netfilter: nf_tables_offload: incorrect flow offload action array size

netfilter: nf_tables_offload: incorrect flow offload action array size

Origin: https://git.kernel.org/linus/b1a5983f56e371046dcf164f90bfaf704d2b89f6
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-25636

immediate verdict expression needs to allocate one slot in the flow offload
action array, however, immediate data expression does not need to do so.

fwd and dup expression need to allocate one slot, this is missing.

Add a new offload_action interface to report if this expression needs to
allocate one slot in the flow offload action array.

Fixes: be2861dc36d7 ("netfilter: nft_{fwd,dup}_netdev: add offload support")
Reported-and-tested-by: Nick Gregory <Nick.Gregory@Sophos.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name netfilter-nf_tables_offload-incorrect-flow-offload-a.patch