From 1b9c4f3f9cd2bc485255ec1b3103ed9b11af4737 Mon Sep 17 00:00:00 2001 From: Fernando Fernandez Mancera Date: Wed, 19 Aug 2026 12:24:07 +0200 Subject: [PATCH 1/8] netfilter: seqadj: do not take ct lock if seqadj is NULL This is a small optimization, only take ct lock if seqadj is present. In the unlikely case seqadj isn't present we can return immediately. This is consistent with the behavior of other functions that checks seqadj. Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conntrack_seqadj.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c index 220216a4edc5..d75e8dafb189 100644 --- a/net/netfilter/nf_conntrack_seqadj.c +++ b/net/netfilter/nf_conntrack_seqadj.c @@ -10,20 +10,19 @@ int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo, s32 off) { + struct nf_conn_seqadj *seqadj = nfct_seqadj(ct); enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); - struct nf_conn_seqadj *seqadj; struct nf_ct_seqadj *this_way; if (off == 0) return 0; - spin_lock_bh(&ct->lock); - seqadj = nfct_seqadj(ct); - if (!seqadj) { - spin_unlock_bh(&ct->lock); + if (unlikely(!seqadj)) return 0; - } + set_bit(IPS_SEQ_ADJUST_BIT, &ct->status); + + spin_lock_bh(&ct->lock); this_way = &seqadj->seq[dir]; this_way->offset_before = off; this_way->offset_after = off; From ba100f6f2a0283d546688ef29b25676f77916449 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 3 Sep 2026 13:30:13 +0200 Subject: [PATCH 2/8] netfilter: x_tables: use GFP_KERNEL_ACCOUNT in match/target GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace GFP_KERNEL by GFP_KERNEL_ACCOUNT. Use GFP_KERNEL_ACCOUNT for objects that are allocated in the xtables .check path. This includes template ct object with extensions such as helper and timeout. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conntrack_ovs.c | 2 +- net/netfilter/xt_CT.c | 6 +++--- net/netfilter/xt_IDLETIMER.c | 8 ++++---- net/netfilter/xt_LED.c | 5 +++-- net/netfilter/xt_RATEEST.c | 2 +- net/netfilter/xt_TEE.c | 2 +- net/netfilter/xt_hashlimit.c | 4 ++-- net/netfilter/xt_limit.c | 2 +- net/netfilter/xt_quota.c | 2 +- net/netfilter/xt_recent.c | 3 ++- net/netfilter/xt_statistic.c | 2 +- net/netfilter/xt_string.c | 2 +- 12 files changed, 21 insertions(+), 19 deletions(-) diff --git a/net/netfilter/nf_conntrack_ovs.c b/net/netfilter/nf_conntrack_ovs.c index b4085af3ad1c..fe525b324af4 100644 --- a/net/netfilter/nf_conntrack_ovs.c +++ b/net/netfilter/nf_conntrack_ovs.c @@ -93,7 +93,7 @@ int nf_ct_add_helper(struct nf_conn *ct, const char *name, u8 family, if (!helper) return -EINVAL; - help = nf_ct_helper_ext_add(ct, GFP_KERNEL); + help = nf_ct_helper_ext_add(ct, GFP_KERNEL_ACCOUNT); if (!help) { nf_conntrack_helper_put(helper); return -ENOMEM; diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c index e78660dfdf4b..205bc6dd9812 100644 --- a/net/netfilter/xt_CT.c +++ b/net/netfilter/xt_CT.c @@ -91,7 +91,7 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name, return -ENOENT; } - help = nf_ct_helper_ext_add(ct, GFP_KERNEL); + help = nf_ct_helper_ext_add(ct, GFP_KERNEL_ACCOUNT); if (help == NULL) { nf_conntrack_helper_put(helper); return -ENOMEM; @@ -182,7 +182,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par, if (info->flags & XT_CT_ZONE_MARK) zone.flags |= NF_CT_FLAG_MARK; - ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL); + ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL_ACCOUNT); if (!ct) { ret = -ENOMEM; goto err2; @@ -190,7 +190,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par, if ((info->ct_events || info->exp_events) && !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events, - GFP_KERNEL)) { + GFP_KERNEL_ACCOUNT)) { ret = -EINVAL; goto err3; } diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c index fe7d8d19629b..71b78b5da698 100644 --- a/net/netfilter/xt_IDLETIMER.c +++ b/net/netfilter/xt_IDLETIMER.c @@ -147,7 +147,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) { int ret; - info->timer = kzalloc_obj(*info->timer); + info->timer = kzalloc_obj(*info->timer, GFP_KERNEL_ACCOUNT); if (!info->timer) { ret = -ENOMEM; goto out; @@ -158,7 +158,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) goto out_free_timer; sysfs_attr_init(&info->timer->attr.attr); - info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL); + info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL_ACCOUNT); if (!info->timer->attr.attr.name) { ret = -ENOMEM; goto out_free_timer; @@ -196,7 +196,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info) { int ret; - info->timer = kmalloc_obj(*info->timer); + info->timer = kmalloc_obj(*info->timer, GFP_KERNEL_ACCOUNT); if (!info->timer) { ret = -ENOMEM; goto out; @@ -207,7 +207,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info) goto out_free_timer; sysfs_attr_init(&info->timer->attr.attr); - info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL); + info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL_ACCOUNT); if (!info->timer->attr.attr.name) { ret = -ENOMEM; goto out_free_timer; diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c index caaaf4d2c584..3cbb8d61d417 100644 --- a/net/netfilter/xt_LED.c +++ b/net/netfilter/xt_LED.c @@ -111,11 +111,12 @@ static int led_tg_check(const struct xt_tgchk_param *par) } err = -ENOMEM; - ledinternal = kzalloc_obj(struct xt_led_info_internal); + ledinternal = kzalloc_obj(struct xt_led_info_internal, + GFP_KERNEL_ACCOUNT); if (!ledinternal) goto exit_mutex_only; - ledinternal->trigger_id = kstrdup(ledinfo->id, GFP_KERNEL); + ledinternal->trigger_id = kstrdup(ledinfo->id, GFP_KERNEL_ACCOUNT); if (!ledinternal->trigger_id) goto exit_internal_alloc; diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c index 91270d467ffd..2f6b512b71e8 100644 --- a/net/netfilter/xt_RATEEST.c +++ b/net/netfilter/xt_RATEEST.c @@ -139,7 +139,7 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) } ret = -ENOMEM; - est = kzalloc_obj(*est); + est = kzalloc_obj(*est, GFP_KERNEL_ACCOUNT); if (!est) goto err1; diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c index 5d34ceb893ed..48b4104f0859 100644 --- a/net/netfilter/xt_TEE.c +++ b/net/netfilter/xt_TEE.c @@ -106,7 +106,7 @@ static int tee_tg_check(const struct xt_tgchk_param *par) if (info->oif[sizeof(info->oif)-1] != '\0') return -EINVAL; - priv = kzalloc_obj(*priv); + priv = kzalloc_obj(*priv, GFP_KERNEL_ACCOUNT); if (priv == NULL) return -ENOMEM; diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c index 9af0fa895f73..57ac455bc331 100644 --- a/net/netfilter/xt_hashlimit.c +++ b/net/netfilter/xt_hashlimit.c @@ -294,7 +294,7 @@ static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg, if (size < 16) size = 16; } - hinfo = kvmalloc_flex(*hinfo, hash, size); + hinfo = kvmalloc_flex(*hinfo, hash, size, GFP_KERNEL_ACCOUNT); if (hinfo == NULL) return -ENOMEM; *out_hinfo = hinfo; @@ -319,7 +319,7 @@ static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg, hinfo->count = 0; hinfo->family = family; hinfo->rnd_initialized = false; - hinfo->name = kstrdup(name, GFP_KERNEL); + hinfo->name = kstrdup(name, GFP_KERNEL_ACCOUNT); if (!hinfo->name) { kvfree(hinfo); return -ENOMEM; diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c index 87d74da14c0b..ad48b6879b13 100644 --- a/net/netfilter/xt_limit.c +++ b/net/netfilter/xt_limit.c @@ -115,7 +115,7 @@ static int limit_mt_check(const struct xt_mtchk_param *par) return -ERANGE; } - priv = kmalloc_obj(*priv); + priv = kmalloc_obj(*priv, GFP_KERNEL_ACCOUNT); if (priv == NULL) return -ENOMEM; diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c index b05c5c8dac78..e21ec152d16a 100644 --- a/net/netfilter/xt_quota.c +++ b/net/netfilter/xt_quota.c @@ -50,7 +50,7 @@ static int quota_mt_check(const struct xt_mtchk_param *par) if (q->flags & ~XT_QUOTA_MASK) return -EINVAL; - q->master = kmalloc_obj(*q->master); + q->master = kmalloc_obj(*q->master, GFP_KERNEL_ACCOUNT); if (q->master == NULL) return -ENOMEM; diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c index d34831ce3adf..55f1f2d89952 100644 --- a/net/netfilter/xt_recent.c +++ b/net/netfilter/xt_recent.c @@ -391,7 +391,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par, goto out; } - t = kvzalloc_flex(*t, iphash, ip_list_hash_size); + t = kvzalloc_flex(*t, iphash, ip_list_hash_size, + GFP_KERNEL_ACCOUNT); if (t == NULL) { ret = -ENOMEM; goto out; diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c index 334e09771abf..1ffc59d90bb0 100644 --- a/net/netfilter/xt_statistic.c +++ b/net/netfilter/xt_statistic.c @@ -58,7 +58,7 @@ static int statistic_mt_check(const struct xt_mtchk_param *par) info->flags & ~XT_STATISTIC_MASK) return -EINVAL; - info->master = kzalloc_obj(*info->master); + info->master = kzalloc_obj(*info->master, GFP_KERNEL_ACCOUNT); if (info->master == NULL) return -ENOMEM; atomic_set(&info->master->count, info->u.nth.count); diff --git a/net/netfilter/xt_string.c b/net/netfilter/xt_string.c index 8ce25bc9b277..52c1deb02cdc 100644 --- a/net/netfilter/xt_string.c +++ b/net/netfilter/xt_string.c @@ -54,7 +54,7 @@ static int string_mt_check(const struct xt_mtchk_param *par) if (conf->u.v1.flags & XT_STRING_FLAG_IGNORECASE) flags |= TS_IGNORECASE; ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen, - GFP_KERNEL, flags); + GFP_KERNEL_ACCOUNT, flags); if (IS_ERR(ts_conf)) return PTR_ERR(ts_conf); From ef2344e67c0cfa4add7edba89881e9ccddad31c0 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 11 Sep 2026 10:00:09 +0200 Subject: [PATCH 3/8] netfilter: nfnetlink: use GFP_KERNEL_ACCOUNT GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace GFP_KERNEL by GFP_KERNEL_ACCOUNT. Use GFP_KERNEL_ACCOUNT for objects that are created from nfnetlink subsystems. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nfnetlink_acct.c | 2 +- net/netfilter/nfnetlink_cthelper.c | 3 ++- net/netfilter/nfnetlink_cttimeout.c | 8 +++++--- net/netfilter/nfnetlink_osf.c | 2 +- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c index 8ff1e0ad5cb0..1a366fbd8133 100644 --- a/net/netfilter/nfnetlink_acct.c +++ b/net/netfilter/nfnetlink_acct.c @@ -112,7 +112,7 @@ static int nfnl_acct_new(struct sk_buff *skb, const struct nfnl_info *info, size += sizeof(u64); } - nfacct = kzalloc(sizeof(struct nf_acct) + size, GFP_KERNEL); + nfacct = kzalloc(sizeof(struct nf_acct) + size, GFP_KERNEL_ACCOUNT); if (nfacct == NULL) return -ENOMEM; diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index 5b6a09f46903..a09b2fdbf9b4 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -335,7 +335,8 @@ static int nfnl_cthelper_update_policy_all(struct nlattr *tb[], struct nf_conntrack_expect_policy *policy; int i, ret = 0; - new_policy = kmalloc_objs(*new_policy, helper->expect_class_max + 1); + new_policy = kmalloc_objs(*new_policy, helper->expect_class_max + 1, + GFP_KERNEL_ACCOUNT); if (!new_policy) return -ENOMEM; diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c index e751f2b9c51d..c667a29d92f1 100644 --- a/net/netfilter/nfnetlink_cttimeout.c +++ b/net/netfilter/nfnetlink_cttimeout.c @@ -71,7 +71,8 @@ ctnl_timeout_parse_policy(void *timeout, struct nlattr **tb; int ret = 0; - tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1); + tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1, + GFP_KERNEL_ACCOUNT); if (!tb) return -ENOMEM; @@ -150,14 +151,15 @@ static int cttimeout_new_timeout(struct sk_buff *skb, goto err_proto_put; } - timeout = kzalloc_obj(*timeout); + timeout = kzalloc_obj(*timeout, GFP_KERNEL_ACCOUNT); if (timeout == NULL) { ret = -ENOMEM; goto err_proto_put; } timeout->timeout = kzalloc(sizeof(*timeout->timeout) + - l4proto->ctnl_timeout.obj_size, GFP_KERNEL); + l4proto->ctnl_timeout.obj_size, + GFP_KERNEL_ACCOUNT); if (!timeout->timeout) { ret = -ENOMEM; goto err; diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c index 92002079f8ea..e4835b0f4bb1 100644 --- a/net/netfilter/nfnetlink_osf.c +++ b/net/netfilter/nfnetlink_osf.c @@ -325,7 +325,7 @@ static int nfnl_osf_add_callback(struct sk_buff *skb, !memchr(f->version, 0, MAXGENRELEN)) return -EINVAL; - kf = kmalloc_obj(struct nf_osf_finger); + kf = kmalloc_obj(struct nf_osf_finger, GFP_KERNEL_ACCOUNT); if (!kf) return -ENOMEM; From e8609e8d56fb83e407098ffbe21c068fd5e6cbf9 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 7 Sep 2026 20:55:47 +0200 Subject: [PATCH 4/8] netfilter: nf_tables: use GFP_KERNEL_ACCOUNT GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace GFP_KERNEL by GFP_KERNEL_ACCOUNT. Just a few leftover in nft_ct and the pipapo set backend, including alloc_percpu() calls. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_ct.c | 5 +++-- net/netfilter/nft_set_pipapo.c | 6 +++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 9dbf127df9c8..3c4c2faa7398 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -848,7 +848,8 @@ nft_ct_timeout_parse_policy(void *timeouts, struct nlattr **tb; int ret = 0; - tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1); + tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1, + GFP_KERNEL_ACCOUNT); if (!tb) return -ENOMEM; @@ -934,7 +935,7 @@ static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx, } timeout = kzalloc(sizeof(struct nf_ct_timeout) + - l4proto->ctnl_timeout.obj_size, GFP_KERNEL); + l4proto->ctnl_timeout.obj_size, GFP_KERNEL_ACCOUNT); if (timeout == NULL) { ret = -ENOMEM; goto err_proto_put; diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 978bb0c01106..a40f9d952184 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1441,7 +1441,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) new->field_count = old->field_count; new->bsize_max = old->bsize_max; - new->scratch = alloc_percpu(*new->scratch); + new->scratch = alloc_percpu_gfp(*new->scratch, GFP_KERNEL_ACCOUNT); if (!new->scratch) goto out_scratch; @@ -2298,14 +2298,14 @@ static int nft_pipapo_init(const struct nft_set *set, if (field_count > NFT_PIPAPO_MAX_FIELDS) return -EINVAL; - m = kmalloc_flex(*m, f, field_count); + m = kmalloc_flex(*m, f, field_count, GFP_KERNEL_ACCOUNT); if (!m) return -ENOMEM; m->field_count = field_count; m->bsize_max = 0; - m->scratch = alloc_percpu(struct nft_pipapo_scratch *); + m->scratch = alloc_percpu_gfp(struct nft_pipapo_scratch *, GFP_KERNEL_ACCOUNT); if (!m->scratch) { err = -ENOMEM; goto out_scratch; From 399a0b7f32589c84e30cb800a51f69a178499a5f Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 7 Sep 2026 20:55:48 +0200 Subject: [PATCH 5/8] netfilter: synproxy: use GFP_KERNEL_ACCOUNT GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace GFP_KERNEL by GFP_KERNEL_ACCOUNT. Allocate template conntrack via GFP_KERNEL_ACCOUNT. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_synproxy_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c index acd360515972..9fc959ba2030 100644 --- a/net/netfilter/nf_synproxy_core.c +++ b/net/netfilter/nf_synproxy_core.c @@ -336,7 +336,7 @@ static int __net_init synproxy_net_init(struct net *net) struct nf_conn *ct; int err = -ENOMEM; - ct = nf_ct_tmpl_alloc(net, &nf_ct_zone_dflt, GFP_KERNEL); + ct = nf_ct_tmpl_alloc(net, &nf_ct_zone_dflt, GFP_KERNEL_ACCOUNT); if (!ct) goto err1; From 324ca7a2b6feb50f8a561abb6d189d3b2d604b8f Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 7 Sep 2026 20:55:49 +0200 Subject: [PATCH 6/8] netfilter: sysctl: use GFP_KERNEL_ACCOUNT GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace GFP_KERNEL by GFP_KERNEL_ACCOUNT. Allocate per-netns sysctl via GFP_KERNEL_ACCOUNT. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_hooks_lwtunnel.c | 2 +- net/netfilter/nf_log.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index f4f2d82192d5..d88a10230862 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -1009,7 +1009,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net) BUILD_BUG_ON(ARRAY_SIZE(nf_ct_sysctl_table) != NF_SYSCTL_CT_LAST_SYSCTL); table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table), - GFP_KERNEL); + GFP_KERNEL_ACCOUNT); if (!table) return -ENOMEM; diff --git a/net/netfilter/nf_hooks_lwtunnel.c b/net/netfilter/nf_hooks_lwtunnel.c index 4e1eef1ba0f1..40c6fce14a63 100644 --- a/net/netfilter/nf_hooks_lwtunnel.c +++ b/net/netfilter/nf_hooks_lwtunnel.c @@ -73,7 +73,7 @@ static int __net_init nf_lwtunnel_net_init(struct net *net) if (!net_eq(net, &init_net)) { table = kmemdup(nf_lwtunnel_sysctl_table, sizeof(nf_lwtunnel_sysctl_table), - GFP_KERNEL); + GFP_KERNEL_ACCOUNT); if (!table) goto err_alloc; } diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c index f4d80654dfe6..f1d3649e3fc6 100644 --- a/net/netfilter/nf_log.c +++ b/net/netfilter/nf_log.c @@ -493,7 +493,7 @@ static int netfilter_log_sysctl_init(struct net *net) if (!net_eq(net, &init_net)) { table = kmemdup(nf_log_sysctl_table, sizeof(nf_log_sysctl_table), - GFP_KERNEL); + GFP_KERNEL_ACCOUNT); if (!table) goto err_alloc; } else { From 70deb8ec08cf945af7b110b32d0fa898da5aa852 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 7 Sep 2026 20:55:50 +0200 Subject: [PATCH 7/8] netfilter: nat: use GFP_KERNEL_ACCOUNT GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace GFP_KERNEL by GFP_KERNEL_ACCOUNT. Allocate the internal nat hook via GFP_KERNEL_ACCOUNT. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_nat_core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index 8ac326e1eb5b..09cc5b8fd6af 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -1204,14 +1204,15 @@ int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops, if (!nat_proto_net->nat_hook_ops) { WARN_ON(nat_proto_net->users != 0); - nat_ops = kmemdup_array(orig_nat_ops, ops_count, sizeof(*orig_nat_ops), GFP_KERNEL); + nat_ops = kmemdup_array(orig_nat_ops, ops_count, sizeof(*orig_nat_ops), + GFP_KERNEL_ACCOUNT); if (!nat_ops) { mutex_unlock(&nf_nat_proto_mutex); return -ENOMEM; } for (i = 0; i < ops_count; i++) { - priv = kzalloc_obj(*priv); + priv = kzalloc_obj(*priv, GFP_KERNEL_ACCOUNT); if (priv) { nat_ops[i].priv = priv; continue; From 0e28586ee444ae85513c09a7a211483c540df9f5 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 7 Sep 2026 20:55:51 +0200 Subject: [PATCH 8/8] netfilter: conncount: use GFP_KERNEL_ACCOUNT GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace GFP_KERNEL by GFP_KERNEL_ACCOUNT. Allocate the internal nf_conncount datastructure via GFP_KERNEL_ACCOUNT. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conncount.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c index 4292c3d9addd..eca7a8d330ce 100644 --- a/net/netfilter/nf_conncount.c +++ b/net/netfilter/nf_conncount.c @@ -692,7 +692,7 @@ struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int keylen keylen == 0) return ERR_PTR(-EINVAL); - data = kvzalloc_obj(*data); + data = kvzalloc_obj(*data, GFP_KERNEL_ACCOUNT); if (!data) return ERR_PTR(-ENOMEM);