[PATCH v3 6.6.y 0/8] netfilter: nft_set_pipapo: move clone allocation to insert/removal path

[Natarajan KV <natarajankv91@gmail.com>]

This is a backport of the following mainline series to 6.6.122:

  a590f4760922 ("netfilter: nft_set_pipapo: move prove_locking helper around")
  80efd2997fb9 ("netfilter: nft_set_pipapo: make pipapo_clone helper return NULL")
  8b8a2417558c ("netfilter: nft_set_pipapo: prepare destroy function for on-demand clone")
  6c108d9bee44 ("netfilter: nft_set_pipapo: prepare walk function for on-demand clone")
  c5444786d0ea ("netfilter: nft_set_pipapo: merge deactivate helper into caller")
  a238106703ab ("netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone")
  3f1d886cc7c3 ("netfilter: nft_set_pipapo: move cloning of match info to insert/removal path")
  532aec7e878b ("netfilter: nft_set_pipapo: remove dirty flag")

The pipapo set backend currently calls pipapo_clone() from the commit
and abort callbacks. These callbacks must not fail, but pipapo_clone()
can fail with ENOMEM. When this happens, the working copy ends up in a
corrupt state: freed elements remain accessible, and the dirty flag stays
set, causing the next commit to promote a stale clone.

This series moves pipapo_clone() to the insert and removal paths via a
new pipapo_maybe_clone() helper that creates the working copy on demand
and can propagate -ENOMEM to the caller.

Patches 1-4 cherry-pick cleanly from mainline.
Patches 5-8 are adapted for 6.6.122's different API:
 - nft_pipapo_flush() still uses the pipapo_deactivate() helper
   (mainline removed it via the elem_priv refactor)
 - pipapo_get() has no GFP parameter (always GFP_ATOMIC)
 - nft_pipapo_commit() is non-const in 6.6.x

Build-tested with both nft_set_pipapo.o and nft_set_pipapo_avx2.o.

Florian Westphal (8):
  netfilter: nft_set_pipapo: move prove_locking helper around
  netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
  netfilter: nft_set_pipapo: prepare destroy function for on-demand clone
  netfilter: nft_set_pipapo: prepare walk function for on-demand clone
  netfilter: nft_set_pipapo: merge deactivate helper into caller
  netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
  netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
  netfilter: nft_set_pipapo: remove dirty flag

 net/netfilter/nft_set_pipapo.c | 196 +++++++++++++++++---------------
 net/netfilter/nft_set_pipapo.h |   6 --
 2 files changed, 107 insertions(+), 95 deletions(-)

-- 
2.39.5