From nobody Sat Jun 20 00:59:38 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE375C433F5 for ; Thu, 24 Mar 2022 18:05:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352439AbiCXSH2 (ORCPT ); Thu, 24 Mar 2022 14:07:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36082 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236126AbiCXSH0 (ORCPT ); Thu, 24 Mar 2022 14:07:26 -0400 Received: from out2.migadu.com (out2.migadu.com [IPv6:2001:41d0:2:aacc::]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 539B1B6E5D; Thu, 24 Mar 2022 11:05:52 -0700 (PDT) Message-ID: <47f5c00f-86e8-98b5-0cff-3b9fcadb590c@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1648145151; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=65X9ZuCif/yAbUFkhfhi8Kr+zxZCktpmfhwmQ+y1gUw=; b=kh+17ptx+zmwd7Gmjmch6uQHsj61gFdfVAaWXN94zZarcvcAWOjRaj5++JEa8ibl3rH1Ee 7fmRQgPU9yEPmoxE5Vs8iANIbeAOFSzWEdKJNb4hHse532gOkXVZ3pMiw9EVFBicai/ImG 595MmCxkM/1l/lB6TnBnhGCNvErXq78= Date: Thu, 24 Mar 2022 21:05:50 +0300 MIME-Version: 1.0 X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Vasily Averin Subject: [PATCH v2 RESEND] memcg: enable accounting for nft objects Reply-To: vasily.averin@linux.dev To: Florian Westphal , Jozsef Kadlecsik , Pablo Neira Ayuso Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, kernel@openvz.org References: <20220228122429.GC26547@breakpoint.cc> Content-Language: en-US In-Reply-To: <20220228122429.GC26547@breakpoint.cc> Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" nftables replaces iptables, but it lacks memcg accounting. This patch account most of the memory allocation associated with nft and should protect the host from misusing nft inside a memcg restricted container. Signed-off-by: Vasily Averin --- net/netfilter/core.c | 2 +- net/netfilter/nf_tables_api.c | 44 +++++++++++++++++------------------ 2 files changed, 23 insertions(+), 23 deletions(-) diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 8a77a3fd69bc..77ae3e8d344c 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -58,7 +58,7 @@ static struct nf_hook_entries *allocate_hook_entries_size= (u16 num) if (num =3D=3D 0) return NULL; =20 - e =3D kvzalloc(alloc, GFP_KERNEL); + e =3D kvzalloc(alloc, GFP_KERNEL_ACCOUNT); if (e) e->num_hook_entries =3D num; return e; diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d71a33ae39b3..04be94236a34 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1113,16 +1113,16 @@ static int nf_tables_newtable(struct sk_buff *skb, = const struct nfnl_info *info, } =20 err =3D -ENOMEM; - table =3D kzalloc(sizeof(*table), GFP_KERNEL); + table =3D kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT); if (table =3D=3D NULL) goto err_kzalloc; =20 - table->name =3D nla_strdup(attr, GFP_KERNEL); + table->name =3D nla_strdup(attr, GFP_KERNEL_ACCOUNT); if (table->name =3D=3D NULL) goto err_strdup; =20 if (nla[NFTA_TABLE_USERDATA]) { - table->udata =3D nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL); + table->udata =3D nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT= ); if (table->udata =3D=3D NULL) goto err_table_udata; =20 @@ -1803,7 +1803,7 @@ static struct nft_hook *nft_netdev_hook_alloc(struct = net *net, struct nft_hook *hook; int err; =20 - hook =3D kmalloc(sizeof(struct nft_hook), GFP_KERNEL); + hook =3D kmalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT); if (!hook) { err =3D -ENOMEM; goto err_hook_alloc; @@ -2026,7 +2026,7 @@ static struct nft_rule_blob *nf_tables_chain_alloc_ru= les(unsigned int size) if (size > INT_MAX) return NULL; =20 - blob =3D kvmalloc(size, GFP_KERNEL); + blob =3D kvmalloc(size, GFP_KERNEL_ACCOUNT); if (!blob) return NULL; =20 @@ -2126,7 +2126,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8= family, u8 genmask, if (err < 0) return err; =20 - basechain =3D kzalloc(sizeof(*basechain), GFP_KERNEL); + basechain =3D kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT); if (basechain =3D=3D NULL) { nft_chain_release_hook(&hook); return -ENOMEM; @@ -2156,7 +2156,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8= family, u8 genmask, if (flags & NFT_CHAIN_HW_OFFLOAD) return -EOPNOTSUPP; =20 - chain =3D kzalloc(sizeof(*chain), GFP_KERNEL); + chain =3D kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT); if (chain =3D=3D NULL) return -ENOMEM; =20 @@ -2169,7 +2169,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8= family, u8 genmask, chain->table =3D table; =20 if (nla[NFTA_CHAIN_NAME]) { - chain->name =3D nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL); + chain->name =3D nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); } else { if (!(flags & NFT_CHAIN_BINDING)) { err =3D -EINVAL; @@ -2177,7 +2177,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8= family, u8 genmask, } =20 snprintf(name, sizeof(name), "__chain%llu", ++chain_id); - chain->name =3D kstrdup(name, GFP_KERNEL); + chain->name =3D kstrdup(name, GFP_KERNEL_ACCOUNT); } =20 if (!chain->name) { @@ -2186,7 +2186,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8= family, u8 genmask, } =20 if (nla[NFTA_CHAIN_USERDATA]) { - chain->udata =3D nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL); + chain->udata =3D nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT= ); if (chain->udata =3D=3D NULL) { err =3D -ENOMEM; goto err_destroy_chain; @@ -2349,7 +2349,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8= genmask, u8 policy, char *name; =20 err =3D -ENOMEM; - name =3D nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL); + name =3D nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); if (!name) goto err; =20 @@ -2797,7 +2797,7 @@ static struct nft_expr *nft_expr_init(const struct nf= t_ctx *ctx, goto err1; =20 err =3D -ENOMEM; - expr =3D kzalloc(expr_info.ops->size, GFP_KERNEL); + expr =3D kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT); if (expr =3D=3D NULL) goto err2; =20 @@ -3405,7 +3405,7 @@ static int nf_tables_newrule(struct sk_buff *skb, con= st struct nfnl_info *info, } =20 err =3D -ENOMEM; - rule =3D kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL); + rule =3D kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT); if (rule =3D=3D NULL) goto err_release_expr; =20 @@ -3818,7 +3818,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *c= tx, struct nft_set *set, free_page((unsigned long)inuse); } =20 - set->name =3D kasprintf(GFP_KERNEL, name, min + n); + set->name =3D kasprintf(GFP_KERNEL_ACCOUNT, name, min + n); if (!set->name) return -ENOMEM; =20 @@ -4382,11 +4382,11 @@ static int nf_tables_newset(struct sk_buff *skb, co= nst struct nfnl_info *info, alloc_size =3D sizeof(*set) + size + udlen; if (alloc_size < size || alloc_size > INT_MAX) return -ENOMEM; - set =3D kvzalloc(alloc_size, GFP_KERNEL); + set =3D kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT); if (!set) return -ENOMEM; =20 - name =3D nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL); + name =3D nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT); if (!name) { err =3D -ENOMEM; goto err_set_name; @@ -5921,7 +5921,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, stru= ct nft_set *set, err =3D -ENOMEM; elem.priv =3D nft_set_elem_init(set, &tmpl, elem.key.val.data, elem.key_end.val.data, elem.data.val.data, - timeout, expiration, GFP_KERNEL); + timeout, expiration, GFP_KERNEL_ACCOUNT); if (elem.priv =3D=3D NULL) goto err_parse_data; =20 @@ -6165,7 +6165,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struc= t nft_set *set, err =3D -ENOMEM; elem.priv =3D nft_set_elem_init(set, &tmpl, elem.key.val.data, elem.key_end.val.data, NULL, 0, 0, - GFP_KERNEL); + GFP_KERNEL_ACCOUNT); if (elem.priv =3D=3D NULL) goto fail_elem; =20 @@ -6477,7 +6477,7 @@ static struct nft_object *nft_obj_init(const struct n= ft_ctx *ctx, } =20 err =3D -ENOMEM; - obj =3D kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL); + obj =3D kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT); if (!obj) goto err2; =20 @@ -6643,7 +6643,7 @@ static int nf_tables_newobj(struct sk_buff *skb, cons= t struct nfnl_info *info, obj->key.table =3D table; obj->handle =3D nf_tables_alloc_handle(table); =20 - obj->key.name =3D nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL); + obj->key.name =3D nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT); if (!obj->key.name) { err =3D -ENOMEM; goto err_strdup; @@ -7404,7 +7404,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb, =20 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); =20 - flowtable =3D kzalloc(sizeof(*flowtable), GFP_KERNEL); + flowtable =3D kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT); if (!flowtable) return -ENOMEM; =20 @@ -7412,7 +7412,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb, flowtable->handle =3D nf_tables_alloc_handle(table); INIT_LIST_HEAD(&flowtable->hook_list); =20 - flowtable->name =3D nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL); + flowtable->name =3D nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOU= NT); if (!flowtable->name) { err =3D -ENOMEM; goto err1; --=20 2.25.1