From 40a2b90f5190fcc7b083809fa93f2799abefeeb1 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Mon, 7 Sep 2026 07:58:39 +0000 Subject: [PATCH] sit: charge ip_tunnel_prl_entry allocations to memcg ipip6_tunnel_add_prl() allocates struct ip_tunnel_prl_entry for each potential router entry added via SIOCADDPRL. An unprivileged user with CAP_NET_ADMIN in a user namespace can add an unbounded number of entries, consuming uncharged kernel memory. Commit 1b51d8271973 ("memcg: ipv6/sit: account and don't WARN on ip_tunnel_prl structs allocation") added accounting to the temporary buffer in ipip6_tunnel_get_prl(), but missed the entry allocations in ipip6_tunnel_add_prl(). Use GFP_KERNEL_ACCOUNT when allocating struct ip_tunnel_prl_entry. Fixes: 1b51d8271973 ("memcg: ipv6/sit: account and don't WARN on ip_tunnel_prl structs allocation") Signed-off-by: Eric Dumazet Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260907075846.2913645-3-edumazet@google.com Signed-off-by: Jakub Kicinski --- net/ipv6/sit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 4438b2472b28..9a2bbd76d379 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -395,7 +395,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg) goto out; } - p = kzalloc_obj(struct ip_tunnel_prl_entry); + p = kzalloc_obj(struct ip_tunnel_prl_entry, GFP_KERNEL_ACCOUNT); if (!p) { err = -ENOBUFS; goto out;