diff mbox series

[6.1.y,6.6.y,v2] netfilter: nf_tables: missing objects with no memcg accounting

Message ID a223903ab9e3b19f9b28ee39b338a49e3e8e6f5f.1788192676.git.kmehltretter@gmail.com
State Handled Elsewhere, archived
Headers show
Series [6.1.y,6.6.y,v2] netfilter: nf_tables: missing objects with no memcg accounting | expand

Commit Message

Karl Mehltretter Aug. 31, 2026, 6:07 p.m. UTC 
From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 69e687cea79fc99a17dfb0116c8644b9391b915e ]

Several ruleset objects are still not using GFP_KERNEL_ACCOUNT for
memory accounting, update them. This includes:

- catchall elements
- compat match large info area
- log prefix
- meta secctx
- numgen counters
- pipapo set backend datastructure
- tunnel private objects

Fixes: 33758c891479 ("memcg: enable accounting for nft objects")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[ Karl Mehltretter: The original 6.1.y and 6.6.y backports omitted the
  pipapo_realloc_mt() hunk. In these pre-refactor trees, the corresponding
  mapping-table allocation is still part of pipapo_resize() and uses
  GFP_KERNEL. A/B tests on 6.1.186 and 6.6.155 measured 524,288 additional
  charged bytes for a 32,768-element two-field set. On 6.12.107, the
  corresponding allocation was already accounted. ]
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Changes in v2:
- restore Pablo's authorship, original changelog, Fixes tag and sign-off
- document the older-tree adaptation and exact A/B accounting result

v1: https://lore.kernel.org/stable/20260831043755.29692-1-kmehltretter@gmail.com/

 net/netfilter/nft_set_pipapo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 7c8d28a031ad..8ba76eea3eb1 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -705,7 +705,7 @@  static int pipapo_resize(struct nft_pipapo_field *f, int old_rules, int rules)
 		return -ENOMEM;
 	}
 
-	new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL);
+	new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL_ACCOUNT);
 	if (!new_mt) {
 		kvfree(new_lt);
 		return -ENOMEM;