raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 18:09:56 +00:00
Code Issues Projects Releases Wiki Activity

netfilter: nf_tables: missing objects with no memcg accounting

Browse Source 
[ Upstream commit 69e687cea7 ]

Several ruleset objects are still not using GFP_KERNEL_ACCOUNT for
memory accounting, update them. This includes:

- catchall elements
- compat match large info area
- log prefix
- meta secctx
- numgen counters
- pipapo set backend datastructure
- tunnel private objects

Fixes: 33758c8914 ("memcg: enable accounting for nft objects")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pablo Neira Ayuso
2024-09-18 14:19:45 +02:00
committed by Greg Kroah-Hartman
parent 2223aa83c7
commit a8c12f6903
7 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
net/netfilter/nf_tables_api.c
View File

@@ -6679,7 +6679,7 @@ static int nft_setelem_catchall_insert(const struct net *net,
} }
} }
catchall = kmalloc(sizeof(*catchall), GFP_KERNEL); catchall = kmalloc(sizeof(*catchall), GFP_KERNEL_ACCOUNT);
if (!catchall) if (!catchall)
return -ENOMEM; return -ENOMEM;

6
net/netfilter/nft_compat.c
View File

@@ -536,7 +536,7 @@ nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
struct xt_match *m = expr->ops->data; struct xt_match *m = expr->ops->data;
int ret; int ret;
priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL); priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL_ACCOUNT);
if (!priv->info) if (!priv->info)
return -ENOMEM; return -ENOMEM;
@@ -810,7 +810,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
goto err; goto err;
} }
ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);
if (!ops) { if (!ops) {
err = -ENOMEM; err = -ENOMEM;
goto err; goto err;
@@ -900,7 +900,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
goto err; goto err;
} }
ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);
if (!ops) { if (!ops) {
err = -ENOMEM; err = -ENOMEM;
goto err; goto err;

2
net/netfilter/nft_log.c
View File

@@ -163,7 +163,7 @@ static int nft_log_init(const struct nft_ctx *ctx,
nla = tb[NFTA_LOG_PREFIX]; nla = tb[NFTA_LOG_PREFIX];
if (nla != NULL) { if (nla != NULL) {
priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL); priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL_ACCOUNT);
if (priv->prefix == NULL) if (priv->prefix == NULL)
return -ENOMEM; return -ENOMEM;
nla_strscpy(priv->prefix, nla, nla_len(nla) + 1); nla_strscpy(priv->prefix, nla, nla_len(nla) + 1);

2
net/netfilter/nft_meta.c
View File

@@ -954,7 +954,7 @@ static int nft_secmark_obj_init(const struct nft_ctx *ctx,
if (tb[NFTA_SECMARK_CTX] == NULL) if (tb[NFTA_SECMARK_CTX] == NULL)
return -EINVAL; return -EINVAL;
priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL); priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL_ACCOUNT);
if (!priv->ctx) if (!priv->ctx)
return -ENOMEM; return -ENOMEM;

2
net/netfilter/nft_numgen.c
View File

@@ -66,7 +66,7 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
if (priv->offset + priv->modulus - 1 < priv->offset) if (priv->offset + priv->modulus - 1 < priv->offset)
return -EOVERFLOW; return -EOVERFLOW;
priv->counter = kmalloc(sizeof(*priv->counter), GFP_KERNEL); priv->counter = kmalloc(sizeof(*priv->counter), GFP_KERNEL_ACCOUNT);
if (!priv->counter) if (!priv->counter)
return -ENOMEM; return -ENOMEM;

13
net/netfilter/nft_set_pipapo.c
View File

@@ -663,7 +663,7 @@ static int pipapo_realloc_mt(struct nft_pipapo_field *f,
check_add_overflow(rules, extra, &rules_alloc)) check_add_overflow(rules, extra, &rules_alloc))
return -EOVERFLOW; return -EOVERFLOW;
new_mt = kvmalloc_array(rules_alloc, sizeof(*new_mt), GFP_KERNEL); new_mt = kvmalloc_array(rules_alloc, sizeof(*new_mt), GFP_KERNEL_ACCOUNT);
if (!new_mt) if (!new_mt)
return -ENOMEM; return -ENOMEM;
@@ -936,7 +936,7 @@ static void pipapo_lt_bits_adjust(struct nft_pipapo_field *f)
return; return;
} }
new_lt = kvzalloc(lt_size + NFT_PIPAPO_ALIGN_HEADROOM, GFP_KERNEL); new_lt = kvzalloc(lt_size + NFT_PIPAPO_ALIGN_HEADROOM, GFP_KERNEL_ACCOUNT);
if (!new_lt) if (!new_lt)
return; return;
@@ -1212,7 +1212,7 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone,
scratch = kzalloc_node(struct_size(scratch, map, scratch = kzalloc_node(struct_size(scratch, map,
bsize_max * 2) + bsize_max * 2) +
NFT_PIPAPO_ALIGN_HEADROOM, NFT_PIPAPO_ALIGN_HEADROOM,
GFP_KERNEL, cpu_to_node(i)); GFP_KERNEL_ACCOUNT, cpu_to_node(i));
if (!scratch) { if (!scratch) {
/* On failure, there's no need to undo previous /* On failure, there's no need to undo previous
* allocations: this means that some scratch maps have * allocations: this means that some scratch maps have
@@ -1427,7 +1427,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
struct nft_pipapo_match *new; struct nft_pipapo_match *new;
int i; int i;
new = kmalloc(struct_size(new, f, old->field_count), GFP_KERNEL); new = kmalloc(struct_size(new, f, old->field_count), GFP_KERNEL_ACCOUNT);
if (!new) if (!new)
return NULL; return NULL;
@@ -1457,7 +1457,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
new_lt = kvzalloc(src->groups * NFT_PIPAPO_BUCKETS(src->bb) * new_lt = kvzalloc(src->groups * NFT_PIPAPO_BUCKETS(src->bb) *
src->bsize * sizeof(*dst->lt) + src->bsize * sizeof(*dst->lt) +
NFT_PIPAPO_ALIGN_HEADROOM, NFT_PIPAPO_ALIGN_HEADROOM,
GFP_KERNEL); GFP_KERNEL_ACCOUNT);
if (!new_lt) if (!new_lt)
goto out_lt; goto out_lt;
@@ -1470,7 +1470,8 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
if (src->rules > 0) { if (src->rules > 0) {
dst->mt = kvmalloc_array(src->rules_alloc, dst->mt = kvmalloc_array(src->rules_alloc,
sizeof(*src->mt), GFP_KERNEL); sizeof(*src->mt),
GFP_KERNEL_ACCOUNT);
if (!dst->mt) if (!dst->mt)
goto out_mt; goto out_mt;

5
net/netfilter/nft_tunnel.c
View File

@@ -509,13 +509,14 @@ static int nft_tunnel_obj_init(const struct nft_ctx *ctx,
return err; return err;
} }
md = metadata_dst_alloc(priv->opts.len, METADATA_IP_TUNNEL, GFP_KERNEL); md = metadata_dst_alloc(priv->opts.len, METADATA_IP_TUNNEL,
GFP_KERNEL_ACCOUNT);
if (!md) if (!md)
return -ENOMEM; return -ENOMEM;
memcpy(&md->u.tun_info, &info, sizeof(info)); memcpy(&md->u.tun_info, &info, sizeof(info));
#ifdef CONFIG_DST_CACHE #ifdef CONFIG_DST_CACHE
err = dst_cache_init(&md->u.tun_info.dst_cache, GFP_KERNEL); err = dst_cache_init(&md->u.tun_info.dst_cache, GFP_KERNEL_ACCOUNT);
if (err < 0) { if (err < 0) {
metadata_dst_free(md); metadata_dst_free(md);
return err; return err;