netfilter: ebtables: zero chainstack array

[ Upstream commit cbfe53599eebffd188938ab6774cc41794f6f9d5 ]

sashiko reports:
 looking at ebtables table
 translation, could a sparse cpu_possible_mask lead to an uninitialized pointer
 free?

 If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,
 but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at
 CPU 2, the cleanup loop will blindly decrement and call vfree() on
 newinfo->chainstack[1].

Not a real-world bug, such allocation isn't expected to fail
in the first place.

BUG=b/539153463
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2026-64413 in the Linux kernel.

Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Change-Id: I304e5f5c22ed3483186f13ac9e4790f108c4820d
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 9e6c5169db423e51dcc66a73fd15409c0d38e088)
Signed-off-by: Angel Adetula <angeladetula@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/179627
Reviewed-by: Kevin Liu <zhihuil@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Dom Huh <domhuh@google.com>