netfilter: nf_tables: memcg accounting for dynamically allocated objects

nft_*.c files whose NFT_EXPR_STATEFUL flag is set on need to
use __GFP_ACCOUNT flag for objects that are dynamically
allocated from the packet path.

Such objects are allocated inside nft_expr_ops->init() callbacks
executed in task context while processing netlink messages.

In addition, this patch adds accounting to nft_set_elem_expr_clone()
used for the same purposes.

Signed-off-by: Vasily Averin <vvs@openvz.org>
Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5ddfdb2adaf1ebe68d56c8ccc2e5d14bffef8b59..128ee3b300d610d0993886b69f2b1971ddd4a92a 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5526,7 +5526,7 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
        int err, i, k;
 
        for (i = 0; i < set->num_exprs; i++) {
-               expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL);
+               expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT);
                if (!expr)
                        goto err_expr;
 

diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
index 9de1462e4ac4fd803f925ace0f45a3a52ce7997a..d657f999a11b6fd68d07a790259b3b4e8f92d9d1 100644 (file)
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -77,7 +77,7 @@ static int nft_connlimit_do_init(const struct nft_ctx *ctx,
                        invert = true;
        }
 
-       priv->list = kmalloc(sizeof(*priv->list), GFP_KERNEL);
+       priv->list = kmalloc(sizeof(*priv->list), GFP_KERNEL_ACCOUNT);
        if (!priv->list)
                return -ENOMEM;
 

diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c
index da9083605a61ad1107612e05f5c528cc3f945177..f4d3573e8782d2a69a63cc9438bfb1a39c105432 100644 (file)
--- a/net/netfilter/nft_counter.c
+++ b/net/netfilter/nft_counter.c
@@ -62,7 +62,7 @@ static int nft_counter_do_init(const struct nlattr * const tb[],
        struct nft_counter __percpu *cpu_stats;
        struct nft_counter *this_cpu;
 
-       cpu_stats = alloc_percpu(struct nft_counter);
+       cpu_stats = alloc_percpu_gfp(struct nft_counter, GFP_KERNEL_ACCOUNT);
        if (cpu_stats == NULL)
                return -ENOMEM;
 

diff --git a/net/netfilter/nft_last.c b/net/netfilter/nft_last.c
index 43d0d4aadb1f65fd908dc38b16aae256a8a86778..bb15a55dad5c018a0b18876e72c11d1d12b9e80c 100644 (file)
--- a/net/netfilter/nft_last.c
+++ b/net/netfilter/nft_last.c
@@ -30,7 +30,7 @@ static int nft_last_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        u64 last_jiffies;
        int err;
 
-       last = kzalloc(sizeof(*last), GFP_KERNEL);
+       last = kzalloc(sizeof(*last), GFP_KERNEL_ACCOUNT);
        if (!last)
                return -ENOMEM;
 

diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index d4a6cf3cd697895ce82f6aaf89de8095782bfdd8..04ea8b9bf202855159b01e17c7033ed49047d8d1 100644 (file)
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -90,7 +90,7 @@ static int nft_limit_init(struct nft_limit_priv *priv,
                                 priv->rate);
        }
 
-       priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL);
+       priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL_ACCOUNT);
        if (!priv->limit)
                return -ENOMEM;
 

diff --git a/net/netfilter/nft_quota.c b/net/netfilter/nft_quota.c
index d7db57ed3bc10f2b4388d6399458e9e09a5494db..e6b0df68feeaf85640969c64cf8d80d84082a4ef 100644 (file)
--- a/net/netfilter/nft_quota.c
+++ b/net/netfilter/nft_quota.c
@@ -90,7 +90,7 @@ static int nft_quota_do_init(const struct nlattr * const tb[],
                        return -EOPNOTSUPP;
        }
 
-       priv->consumed = kmalloc(sizeof(*priv->consumed), GFP_KERNEL);
+       priv->consumed = kmalloc(sizeof(*priv->consumed), GFP_KERNEL_ACCOUNT);
        if (!priv->consumed)
                return -ENOMEM;