netfilter: nf_tables: missing objects with no memcg accounting

[ Upstream commit 69e687cea79fc99a17dfb0116c8644b9391b915e ]

Several ruleset objects are still not using GFP_KERNEL_ACCOUNT for
memory accounting, update them. This includes:

- catchall elements
- compat match large info area
- log prefix
- meta secctx
- numgen counters
- pipapo set backend datastructure
- tunnel private objects

Fixes: 33758c891479 ("memcg: enable accounting for nft objects")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 71df3e5cc46d91bdb6a82fb62eb3933da3bd3f43..465cc43c75e30e7e8b951025b81309ce75eb3e64 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6631,7 +6631,7 @@ static int nft_setelem_catchall_insert(const struct net *net,
                }
        }
 
-       catchall = kmalloc(sizeof(*catchall), GFP_KERNEL);
+       catchall = kmalloc(sizeof(*catchall), GFP_KERNEL_ACCOUNT);
        if (!catchall)
                return -ENOMEM;
 

diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index d3d11dede54507262022725a5e54a12f0def7f89..85450f601142632f2aba453627e5cc2e5885bf93 100644 (file)
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -536,7 +536,7 @@ nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        struct xt_match *m = expr->ops->data;
        int ret;
 
-       priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL);
+       priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL_ACCOUNT);
        if (!priv->info)
                return -ENOMEM;
 
@@ -810,7 +810,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
                goto err;
        }
 
-       ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
+       ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);
        if (!ops) {
                err = -ENOMEM;
                goto err;
@@ -900,7 +900,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
                goto err;
        }
 
-       ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
+       ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);
        if (!ops) {
                err = -ENOMEM;
                goto err;

diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 5defe6e4fd98205643e953e1b1c8ff6e04440897..e355881379957932c29dae968b25a3a4d935d753 100644 (file)
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -163,7 +163,7 @@ static int nft_log_init(const struct nft_ctx *ctx,
 
        nla = tb[NFTA_LOG_PREFIX];
        if (nla != NULL) {
-               priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
+               priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL_ACCOUNT);
                if (priv->prefix == NULL)
                        return -ENOMEM;
                nla_strscpy(priv->prefix, nla, nla_len(nla) + 1);

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 9139ce38ea7b9a7ed2cb626762ef5620e0124b52..f23faf565b6873f352fd68f7136f4269ab5f8084 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -954,7 +954,7 @@ static int nft_secmark_obj_init(const struct nft_ctx *ctx,
        if (tb[NFTA_SECMARK_CTX] == NULL)
                return -EINVAL;
 
-       priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL);
+       priv->ctx = nla_strdup(tb[NFTA_SECMARK_CTX], GFP_KERNEL_ACCOUNT);
        if (!priv->ctx)
                return -ENOMEM;
 

diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
index 7d29db7c2ac0f05dc464e60e7be77061d5a48c63..bd058babfc820c00bf9014114ccddb8481037eaf 100644 (file)
--- a/net/netfilter/nft_numgen.c
+++ b/net/netfilter/nft_numgen.c
@@ -66,7 +66,7 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
        if (priv->offset + priv->modulus - 1 < priv->offset)
                return -EOVERFLOW;
 
-       priv->counter = kmalloc(sizeof(*priv->counter), GFP_KERNEL);
+       priv->counter = kmalloc(sizeof(*priv->counter), GFP_KERNEL_ACCOUNT);
        if (!priv->counter)
                return -ENOMEM;
 

diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index eb4c4a4ac7acea12b213b8db8826930b20a854a6..7be342b495f5f7266b82cc63ed2635d022e7518a 100644 (file)
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -663,7 +663,7 @@ static int pipapo_realloc_mt(struct nft_pipapo_field *f,
            check_add_overflow(rules, extra, &rules_alloc))
                return -EOVERFLOW;
 
-       new_mt = kvmalloc_array(rules_alloc, sizeof(*new_mt), GFP_KERNEL);
+       new_mt = kvmalloc_array(rules_alloc, sizeof(*new_mt), GFP_KERNEL_ACCOUNT);
        if (!new_mt)
                return -ENOMEM;
 
@@ -936,7 +936,7 @@ static void pipapo_lt_bits_adjust(struct nft_pipapo_field *f)
                return;
        }
 
-       new_lt = kvzalloc(lt_size + NFT_PIPAPO_ALIGN_HEADROOM, GFP_KERNEL);
+       new_lt = kvzalloc(lt_size + NFT_PIPAPO_ALIGN_HEADROOM, GFP_KERNEL_ACCOUNT);
        if (!new_lt)
                return;
 
@@ -1212,7 +1212,7 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone,
                scratch = kzalloc_node(struct_size(scratch, map,
                                                   bsize_max * 2) +
                                       NFT_PIPAPO_ALIGN_HEADROOM,
-                                      GFP_KERNEL, cpu_to_node(i));
+                                      GFP_KERNEL_ACCOUNT, cpu_to_node(i));
                if (!scratch) {
                        /* On failure, there's no need to undo previous
                         * allocations: this means that some scratch maps have
@@ -1427,7 +1427,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
        struct nft_pipapo_match *new;
        int i;
 
-       new = kmalloc(struct_size(new, f, old->field_count), GFP_KERNEL);
+       new = kmalloc(struct_size(new, f, old->field_count), GFP_KERNEL_ACCOUNT);
        if (!new)
                return NULL;
 
@@ -1457,7 +1457,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
                new_lt = kvzalloc(src->groups * NFT_PIPAPO_BUCKETS(src->bb) *
                                  src->bsize * sizeof(*dst->lt) +
                                  NFT_PIPAPO_ALIGN_HEADROOM,
-                                 GFP_KERNEL);
+                                 GFP_KERNEL_ACCOUNT);
                if (!new_lt)
                        goto out_lt;
 
@@ -1470,7 +1470,8 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
 
                if (src->rules > 0) {
                        dst->mt = kvmalloc_array(src->rules_alloc,
-                                                sizeof(*src->mt), GFP_KERNEL);
+                                                sizeof(*src->mt),
+                                                GFP_KERNEL_ACCOUNT);
                        if (!dst->mt)
                                goto out_mt;
 

diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
index 60a76e6e348e7be5bc8862d58ec7a59d03ecd288..5c6ed68cc6e058aa29d31ce940ffee58ce4646ff 100644 (file)
--- a/net/netfilter/nft_tunnel.c
+++ b/net/netfilter/nft_tunnel.c
@@ -509,13 +509,14 @@ static int nft_tunnel_obj_init(const struct nft_ctx *ctx,
                        return err;
        }
 
-       md = metadata_dst_alloc(priv->opts.len, METADATA_IP_TUNNEL, GFP_KERNEL);
+       md = metadata_dst_alloc(priv->opts.len, METADATA_IP_TUNNEL,
+                               GFP_KERNEL_ACCOUNT);
        if (!md)
                return -ENOMEM;
 
        memcpy(&md->u.tun_info, &info, sizeof(info));
 #ifdef CONFIG_DST_CACHE
-       err = dst_cache_init(&md->u.tun_info.dst_cache, GFP_KERNEL);
+       err = dst_cache_init(&md->u.tun_info.dst_cache, GFP_KERNEL_ACCOUNT);
        if (err < 0) {
                metadata_dst_free(md);
                return err;