From e8609e8d56fb83e407098ffbe21c068fd5e6cbf9 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 7 Sep 2026 20:55:47 +0200 Subject: [PATCH] netfilter: nf_tables: use GFP_KERNEL_ACCOUNT GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace GFP_KERNEL by GFP_KERNEL_ACCOUNT. Just a few leftover in nft_ct and the pipapo set backend, including alloc_percpu() calls. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_ct.c | 5 +++-- net/netfilter/nft_set_pipapo.c | 6 +++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 9dbf127df9c8..3c4c2faa7398 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -848,7 +848,8 @@ nft_ct_timeout_parse_policy(void *timeouts, struct nlattr **tb; int ret = 0; - tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1); + tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1, + GFP_KERNEL_ACCOUNT); if (!tb) return -ENOMEM; @@ -934,7 +935,7 @@ static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx, } timeout = kzalloc(sizeof(struct nf_ct_timeout) + - l4proto->ctnl_timeout.obj_size, GFP_KERNEL); + l4proto->ctnl_timeout.obj_size, GFP_KERNEL_ACCOUNT); if (timeout == NULL) { ret = -ENOMEM; goto err_proto_put; diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 978bb0c01106..a40f9d952184 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1441,7 +1441,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) new->field_count = old->field_count; new->bsize_max = old->bsize_max; - new->scratch = alloc_percpu(*new->scratch); + new->scratch = alloc_percpu_gfp(*new->scratch, GFP_KERNEL_ACCOUNT); if (!new->scratch) goto out_scratch; @@ -2298,14 +2298,14 @@ static int nft_pipapo_init(const struct nft_set *set, if (field_count > NFT_PIPAPO_MAX_FIELDS) return -EINVAL; - m = kmalloc_flex(*m, f, field_count); + m = kmalloc_flex(*m, f, field_count, GFP_KERNEL_ACCOUNT); if (!m) return -ENOMEM; m->field_count = field_count; m->bsize_max = 0; - m->scratch = alloc_percpu(struct nft_pipapo_scratch *); + m->scratch = alloc_percpu_gfp(struct nft_pipapo_scratch *, GFP_KERNEL_ACCOUNT); if (!m->scratch) { err = -ENOMEM; goto out_scratch;