netfilter: nf_tables: add set garbage collection helpers

Add helpers for GC batch destruction: since element destruction needs
a RCU grace period for all set implementations, add some helper functions
for asynchronous batch destruction. Elements are collected in a batch
structure, which is asynchronously released using RCU once its full.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 25 insertions, 0 deletions

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 9e032dbc149c..138e47fddab7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3482,6 +3482,31 @@ static int nf_tables_delsetelem(struct sock *nlsk, struct sk_buff *skb,
         return err;
 }
 
+void nft_set_gc_batch_release(struct rcu_head *rcu)
+{
+        struct nft_set_gc_batch *gcb;
+        unsigned int i;
+
+        gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
+        for (i = 0; i < gcb->head.cnt; i++)
+                nft_set_elem_destroy(gcb->head.set, gcb->elems[i]);
+        kfree(gcb);
+}
+EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
+
+struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
+                                                gfp_t gfp)
+{
+        struct nft_set_gc_batch *gcb;
+
+        gcb = kzalloc(sizeof(*gcb), gfp);
+        if (gcb == NULL)
+                return gcb;
+        gcb->head.set = set;
+        return gcb;
+}
+EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
+
 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
                                    u32 portid, u32 seq)
 {