netfilter: nftables: add helper function to flush set elements

jira LE-3201
cve CVE-2024-27017
Rebuild_History Non-Buildable kernel-rt-4.18.0-553.27.1.rt7.368.el8_10
commit-author Pablo Neira Ayuso <[email protected]>
commit e6ba7cb
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-rt-4.18.0-553.27.1.rt7.368.el8_10/e6ba7cb6.failed

This patch adds nft_set_flush() which prepares for the catch-all
element support.

	Signed-off-by: Pablo Neira Ayuso <[email protected]>
(cherry picked from commit e6ba7cb)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	net/netfilter/nf_tables_api.c

Author: PlaidCat

ciq/ciq_backports/kernel-rt-4.18.0-553.27.1.rt7.368.el8_10/e6ba7cb6.failed

@@ -0,0 +1,112 @@
+netfilter: nftables: add helper function to flush set elements
+
+jira LE-3201
+cve CVE-2024-27017
+Rebuild_History Non-Buildable kernel-rt-4.18.0-553.27.1.rt7.368.el8_10
+commit-author Pablo Neira Ayuso <[email protected]>
+commit e6ba7cb63b8ae0e13e6c2acc4067097c1181f6bf
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-rt-4.18.0-553.27.1.rt7.368.el8_10/e6ba7cb6.failed
+
+This patch adds nft_set_flush() which prepares for the catch-all
+element support.
+
+	Signed-off-by: Pablo Neira Ayuso <[email protected]>
+(cherry picked from commit e6ba7cb63b8ae0e13e6c2acc4067097c1181f6bf)
+	Signed-off-by: Jonathan Maple <[email protected]>
+
+# Conflicts:
+#	net/netfilter/nf_tables_api.c
+diff --cc net/netfilter/nf_tables_api.c
+index a8d03cec29c3,3342f260d534..000000000000
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@@ -5955,12 -5839,13 +5955,12 @@@ fail_elem
+  	return err;
+  }
+  
+- static int nft_flush_set(const struct nft_ctx *ctx,
+- 			 struct nft_set *set,
+- 			 const struct nft_set_iter *iter,
+- 			 struct nft_set_elem *elem)
++ static int nft_setelem_flush(const struct nft_ctx *ctx,
++ 			     struct nft_set *set,
++ 			     const struct nft_set_iter *iter,
++ 			     struct nft_set_elem *elem)
+  {
+  	struct nft_trans *trans;
+ -	int err;
+  
+  	trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
+  				    sizeof(struct nft_trans_elem), GFP_ATOMIC);
+@@@ -5973,17 -5861,33 +5973,35 @@@
+  	nft_setelem_data_deactivate(ctx->net, set, elem);
+  	nft_trans_elem_set(trans) = set;
+  	nft_trans_elem(trans) = *elem;
+ -	nft_trans_commit_list_add_tail(ctx->net, trans);
+ +	list_add_tail(&trans->list, &ctx->net->nft.commit_list);
+  
+  	return 0;
+ -err1:
+ -	kfree(trans);
+ -	return err;
+  }
+  
+++<<<<<<< HEAD
+ +static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
+ +				struct sk_buff *skb, const struct nlmsghdr *nlh,
+ +				const struct nlattr * const nla[],
+ +				struct netlink_ext_ack *extack)
+++=======
++ static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask)
++ {
++ 	struct nft_set_iter iter = {
++ 		.genmask	= genmask,
++ 		.fn		= nft_setelem_flush,
++ 	};
++ 
++ 	set->ops->walk(ctx, set, &iter);
++ 
++ 	return iter.err;
++ }
++ 
++ static int nf_tables_delsetelem(struct sk_buff *skb,
++ 				const struct nfnl_info *info,
++ 				const struct nlattr * const nla[])
+++>>>>>>> e6ba7cb63b8a (netfilter: nftables: add helper function to flush set elements)
+  {
+ -	struct netlink_ext_ack *extack = info->extack;
+ -	u8 genmask = nft_genmask_next(info->net);
+ -	struct net *net = info->net;
+ +	u8 genmask = nft_genmask_next(net);
+  	const struct nlattr *attr;
+  	struct nft_set *set;
+  	struct nft_ctx ctx;
+@@@ -5997,22 -5901,11 +6015,15 @@@
+  	set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
+  	if (IS_ERR(set))
+  		return PTR_ERR(set);
+ -	if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
+ +
+ +	if (nft_set_is_anonymous(set))
+ +		return -EOPNOTSUPP;
+ +
+ +	if (!list_empty(&set->bindings) && (set->flags & NFT_SET_CONSTANT))
+  		return -EBUSY;
+  
+- 	if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
+- 		struct nft_set_iter iter = {
+- 			.genmask	= genmask,
+- 			.fn		= nft_flush_set,
+- 		};
+- 		set->ops->walk(&ctx, set, &iter);
+- 
+- 		return iter.err;
+- 	}
++ 	if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
++ 		return nft_set_flush(&ctx, set, genmask);
+  
+  	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
+  		err = nft_del_setelem(&ctx, set, attr);
+* Unmerged path net/netfilter/nf_tables_api.c