Commit 69e687ce authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: missing objects with no memcg accounting 



Several ruleset objects are still not using GFP_KERNEL_ACCOUNT for
memory accounting, update them. This includes:

- catchall elements
- compat match large info area
- log prefix
- meta secctx
- numgen counters
- pipapo set backend datastructure
- tunnel private objects

Fixes: 33758c89 ("memcg: enable accounting for nft objects")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 4ffcf5ca

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -6684,7 +6684,7 @@ static int nft_setelem_catchall_insert(const struct net *net, 
		}

	}



	catchall = kmalloc(sizeof(*catchall), GFP_KERNEL);

	catchall = kmalloc(sizeof(*catchall), GFP_KERNEL_ACCOUNT);

	if (!catchall)

		return -ENOMEM;

net/netfilter/nft_compat.c

+3 −3
Original line number Diff line number Diff line
@@ -535,7 +535,7 @@ nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 
	struct xt_match *m = expr->ops->data;

	int ret;



	priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL);

	priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL_ACCOUNT);

	if (!priv->info)

		return -ENOMEM;
@@ -808,7 +808,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, 
		goto err;

	}



	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);

	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);

	if (!ops) {

		err = -ENOMEM;

		goto err;
@@ -898,7 +898,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, 
		goto err;

	}



	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);

	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);

	if (!ops) {

		err = -ENOMEM;

		goto err;

net/netfilter/nft_log.c

+1 −1
Original line number Diff line number Diff line
@@ -163,7 +163,7 @@ static int nft_log_init(const struct nft_ctx *ctx, 


	nla = tb[NFTA_LOG_PREFIX];

	if (nla != NULL) {

		priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);

		priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL_ACCOUNT);

		if (priv->prefix == NULL)

			return -ENOMEM;

		nla_strscpy(priv->prefix, nla, nla_len(nla) + 1);

net/netfilter/nft_meta.c

+1 −1
Original line number Diff line number Diff line
@@ -952,7 +952,7 @@ static int nft_secmark_obj_init(const struct nft_ctx *ctx, 
	if (tb[NFTA_SECMARK_CTX] == NULL)

		return -EINVAL;



	priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL);

	priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL_ACCOUNT);

	if (!priv->ctx)

		return -ENOMEM;

net/netfilter/nft_numgen.c

+1 −1
Original line number Diff line number Diff line
@@ -66,7 +66,7 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx, 
	if (priv->offset + priv->modulus - 1 < priv->offset)

		return -EOVERFLOW;



	priv->counter = kmalloc(sizeof(*priv->counter), GFP_KERNEL);

	priv->counter = kmalloc(sizeof(*priv->counter), GFP_KERNEL_ACCOUNT);

	if (!priv->counter)

		return -ENOMEM;