Re: [PATCH net-next 2/9] sit: charge ip_tunnel_prl_entry allocations to memcg
From: Lorenzo Bianconi <hidden>
Date: 2026-09-07 12:35:35
ipip6_tunnel_add_prl() allocates struct ip_tunnel_prl_entry for each
potential router entry added via SIOCADDPRL.
An unprivileged user with CAP_NET_ADMIN in a user namespace can add
an unbounded number of entries, consuming uncharged kernel memory.
Commit 1b51d8271973 ("memcg: ipv6/sit: account and don't WARN on
ip_tunnel_prl structs allocation") added accounting to the temporary
buffer in ipip6_tunnel_get_prl(), but missed the entry allocations
in ipip6_tunnel_add_prl().
Use GFP_KERNEL_ACCOUNT when allocating struct ip_tunnel_prl_entry.
Fixes: 1b51d8271973 ("memcg: ipv6/sit: account and don't WARN on ip_tunnel_prl structs allocation")
Signed-off-by: Eric Dumazet <edumazet@google.com>Acked-by: Lorenzo Bianconi <redacted>
quoted hunk ↗ jump to hunk
--- net/ipv6/sit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 4438b2472b28764f813b9162bdb9f6b6dee5a007..9a2bbd76d3794849cd11c6530ba1303bf53fa388 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c@@ -395,7 +395,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg) goto out; } - p = kzalloc_obj(struct ip_tunnel_prl_entry); + p = kzalloc_obj(struct ip_tunnel_prl_entry, GFP_KERNEL_ACCOUNT); if (!p) { err = -ENOBUFS; goto out;-- 2.55.0.979.g7e5102b832-goog
Attachments
- signature.asc [application/pgp-signature] 228 bytes