Files
twx-linux/include/net
Florian Westphal e2642d1e42 netfilter: nf_tables: allow clone callbacks to sleep
commit fa23e0d4b7 upstream.

Sven Auhagen reports transaction failures with following error:
  ./main.nft:13:1-26: Error: Could not process rule: Cannot allocate memory
  percpu: allocation failed, size=16 align=8 atomic=1, atomic alloc failed, no space left

This points to failing pcpu allocation with GFP_ATOMIC flag.
However, transactions happen from user context and are allowed to sleep.

One case where we can call into percpu allocator with GFP_ATOMIC is
nft_counter expression.

Normally this happens from control plane, so this could use GFP_KERNEL
instead.  But one use case, element insertion from packet path,
needs to use GFP_ATOMIC allocations (nft_dynset expression).

At this time, .clone callbacks always use GFP_ATOMIC for this reason.

Add gfp_t argument to the .clone function and pass GFP_KERNEL or
GFP_ATOMIC flag depending on context, this allows all clone memory
allocations to sleep for the normal (transaction) case.

Cc: Sven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-08-14 13:53:03 +02:00
..
2024-07-25 09:49:20 +02:00
2022-08-23 10:43:11 +02:00
2022-08-09 22:14:02 -07:00
2023-11-20 11:52:15 +01:00
2024-01-31 16:17:04 -08:00
2023-10-10 22:00:46 +02:00
2023-04-13 16:55:23 +02:00
2023-06-14 11:15:20 +02:00
2024-06-16 13:41:40 +02:00
2024-08-03 08:49:04 +02:00
2024-01-10 17:10:27 +01:00
2023-08-11 12:08:17 +02:00