leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: ipset: enable memory accounting for ipset allocations

Browse Source 
Currently netadmin inside non-trusted container can quickly allocate
whole node's memory via request of huge ipset hashtable.
Other ipset-related memory allocations should be restricted too.

v2: fixed typo ALLOC -> ACCOUNT

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Vasily Averin 2020-09-25 11:56:02 +03:00 committed by Pablo Neira Ayuso
parent 82ec6630f9
commit 9446ab34ac
1 changed files with 1 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
net/netfilter/ipset/ip_set_core.c
View File

@ -250,22 +250,7 @@ EXPORT_SYMBOL_GPL(ip_set_type_unregister);
void * void *
ip_set_alloc(size_t size) ip_set_alloc(size_t size)
{ {
void *members = NULL; return kvzalloc(size, GFP_KERNEL_ACCOUNT);
if (size < KMALLOC_MAX_SIZE)
members = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
if (members) {
pr_debug("%p: allocated with kmalloc\n", members);
return members;
}
members = vzalloc(size);
if (!members)
return NULL;
pr_debug("%p: allocated with vmalloc\n", members);
return members;
} }
EXPORT_SYMBOL_GPL(ip_set_alloc); EXPORT_SYMBOL_GPL(ip_set_alloc);