[PATCH net] net/sched: account classifier filter allocations to memcg

[PATCH net] net/sched: account classifier filter allocations to memcg

[Jamal Hadi Salim]

Allocations in the tc classifier *_change() paths (filter objects,
per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without
__GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside
memcg charging. The shared tcf_exts_init_ex() action array allocation in
cls_api.c was also uncharged; this patch closes it along with the
per-classifier filter-object/percpu/aux allocations that remain
unaccounted.

Add GFP_KERNEL_ACCOUNT to:
- the shared tcf_exts_init_ex() action array (cls_api.c), common to every
  filter of every classifier (32 pointers, 256 bytes);
- the filter-object, per-CPU-counter, and per-filter aux allocations in
  cls_basic, cls_bpf, cls_cgroup, cls_flow, cls_flower, cls_fw,
  cls_matchall, cls_route and cls_u32;
- the u32_init_knode() replace-path knode allocation (cls_u32.c), which
  allocates the same struct tc_u_knode + sel.keys on every replace of an
  existing knode and was missed by the create-path-only conversion.

Also fix the cls_basic error path: basic_change() inserts fnew into the
IDR before allocating the per-CPU counter. If alloc_percpu() fails the
errout path kfree'd fnew without idr_remove, leaving a dangling pointer
in the IDR. With GFP_KERNEL_ACCOUNT the percpu alloc becomes failable
on demand (memcg at memory.max), making the dead path attacker-reachable
and burning the handle permanently. Add the idr_remove on the percpu
failure path, matching the basic_set_parms failure-path pattern.

Note: vega@nebusec.ai provided a poc for basic_cls, but it was easy to
extend to the other classifiers.

Conditions to recreate the bug:
- CONFIG_NET_SCHED, CONFIG_NET_CLS_* (the classifier being used),
  CONFIG_NET_CLS_ACT, CONFIG_MEMCG, CONFIG_USER_NS, CONFIG_NET_NS.
- Unprivileged user in a fresh user+network namespace (unshare -Urn),
  or root with CAP_NET_ADMIN.
- Create a large number of tc filters (e.g. tc filter add dev lo
  ingress ... <classifier> ...) while watching a memcg-limited cgroup:
  system slab grows far faster than memory.current, pinning kernel
  memory outside memcg charging.

Fixes: 0da974f4f303 ("[NET]: Conversions from kmalloc+memset to k(z|c)alloc.")
Reported-by: vega@nebusec.ai
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---
 net/sched/cls_api.c      |  3 ++-
 net/sched/cls_basic.c    |  6 ++++--
 net/sched/cls_bpf.c      |  6 +++---
 net/sched/cls_cgroup.c   |  2 +-
 net/sched/cls_flow.c     |  2 +-
 net/sched/cls_flower.c   |  4 ++--
 net/sched/cls_fw.c       |  4 ++--
 net/sched/cls_matchall.c |  4 ++--
 net/sched/cls_route.c    |  4 ++--
 net/sched/cls_u32.c      | 11 ++++++-----
 10 files changed, 25 insertions(+), 21 deletions(-)

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 4e6a2812a4f3..be63b347640b 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -3364,7 +3364,8 @@ int tcf_exts_init_ex(struct tcf_exts *exts, struct net *net, int action,
 	 * This reference might be taken later from tcf_exts_get_net().
 	 */
 	exts->net = net;
-	exts->actions = kzalloc_objs(struct tc_action *, TCA_ACT_MAX_PRIO);
+	exts->actions = kzalloc_objs(struct tc_action *, TCA_ACT_MAX_PRIO,
+				     GFP_KERNEL_ACCOUNT);
 	if (!exts->actions)
 		return -ENOMEM;
 #endif
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 492cd9ce8d46..e2a94ba9fba7 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -193,7 +193,7 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
 			return -EINVAL;
 	}
 
-	fnew = kzalloc_obj(*fnew);
+	fnew = kzalloc_obj(*fnew, GFP_KERNEL_ACCOUNT);
 	if (!fnew)
 		return -ENOBUFS;
 
@@ -212,9 +212,11 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
 	if (err)
 		goto errout;
 	fnew->handle = handle;
-	fnew->pf = alloc_percpu(struct tc_basic_pcnt);
+	fnew->pf = alloc_percpu_gfp(struct tc_basic_pcnt, GFP_KERNEL_ACCOUNT);
 	if (!fnew->pf) {
 		err = -ENOMEM;
+		if (!fold)
+			idr_remove(&head->handle_idr, fnew->handle);
 		goto errout;
 	}
 
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 6d19155becc8..188cf0f949dd 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -352,7 +352,7 @@ static int cls_bpf_prog_from_ops(struct nlattr **tb, struct cls_bpf_prog *prog)
 	if (bpf_size != nla_len(tb[TCA_BPF_OPS]))
 		return -EINVAL;
 
-	bpf_ops = kmemdup(nla_data(tb[TCA_BPF_OPS]), bpf_size, GFP_KERNEL);
+	bpf_ops = kmemdup(nla_data(tb[TCA_BPF_OPS]), bpf_size, GFP_KERNEL_ACCOUNT);
 	if (bpf_ops == NULL)
 		return -ENOMEM;
 
@@ -403,7 +403,7 @@ static int cls_bpf_prog_from_efd(struct nlattr **tb, struct cls_bpf_prog *prog,
 	}
 
 	if (tb[TCA_BPF_NAME]) {
-		name = nla_memdup(tb[TCA_BPF_NAME], GFP_KERNEL);
+		name = nla_memdup(tb[TCA_BPF_NAME], GFP_KERNEL_ACCOUNT);
 		if (!name) {
 			bpf_prog_put(fp);
 			return -ENOMEM;
@@ -443,7 +443,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
 	if (ret < 0)
 		return ret;
 
-	prog = kzalloc_obj(*prog);
+	prog = kzalloc_obj(*prog, GFP_KERNEL_ACCOUNT);
 	if (!prog)
 		return -ENOBUFS;
 
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 680a5c308094..210fd9fd26d8 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -95,7 +95,7 @@ static int cls_cgroup_change(struct net *net, struct sk_buff *in_skb,
 	if (head && handle != head->handle)
 		return -ENOENT;
 
-	new = kzalloc_obj(*head);
+	new = kzalloc_obj(*head, GFP_KERNEL_ACCOUNT);
 	if (!new)
 		return -ENOBUFS;
 
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 356c68ebc389..a9ac3acf6eda 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -438,7 +438,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
 			return -EOPNOTSUPP;
 	}
 
-	fnew = kzalloc_obj(*fnew);
+	fnew = kzalloc_obj(*fnew, GFP_KERNEL_ACCOUNT);
 	if (!fnew)
 		return -ENOBUFS;
 
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 88f8a32fab2b..0e275b58151c 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -2233,7 +2233,7 @@ static struct fl_flow_mask *fl_create_new_mask(struct cls_fl_head *head,
 	struct fl_flow_mask *newmask;
 	int err;
 
-	newmask = kzalloc_obj(*newmask);
+	newmask = kzalloc_obj(*newmask, GFP_KERNEL_ACCOUNT);
 	if (!newmask)
 		return ERR_PTR(-ENOMEM);
 
@@ -2394,7 +2394,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 		goto errout_tb;
 	}
 
-	fnew = kzalloc_obj(*fnew);
+	fnew = kzalloc_obj(*fnew, GFP_KERNEL_ACCOUNT);
 	if (!fnew) {
 		err = -ENOBUFS;
 		goto errout_tb;
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 646a730dca93..a462b262719c 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -276,7 +276,7 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
 		if (f->id != handle && handle)
 			return -EINVAL;
 
-		fnew = kzalloc_obj(struct fw_filter);
+		fnew = kzalloc_obj(struct fw_filter, GFP_KERNEL_ACCOUNT);
 		if (!fnew)
 			return -ENOBUFS;
 
@@ -330,7 +330,7 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
 		rcu_assign_pointer(tp->root, head);
 	}
 
-	f = kzalloc_obj(struct fw_filter);
+	f = kzalloc_obj(struct fw_filter, GFP_KERNEL_ACCOUNT);
 	if (f == NULL)
 		return -ENOBUFS;
 
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 6f126872c14a..c14899b935bf 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -189,7 +189,7 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
 			return -EINVAL;
 	}
 
-	new = kzalloc_obj(*new);
+	new = kzalloc_obj(*new, GFP_KERNEL_ACCOUNT);
 	if (!new)
 		return -ENOBUFS;
 
@@ -201,7 +201,7 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
 		handle = 1;
 	new->handle = handle;
 	new->flags = userflags;
-	new->pf = alloc_percpu(struct tc_matchall_pcnt);
+	new->pf = alloc_percpu_gfp(struct tc_matchall_pcnt, GFP_KERNEL_ACCOUNT);
 	if (!new->pf) {
 		err = -ENOMEM;
 		goto err_alloc_percpu;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index eded7aacd3f7..0d1324c90583 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -455,7 +455,7 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp,
 	h1 = to_hash(nhandle);
 	b = rtnl_dereference(head->table[h1]);
 	if (!b) {
-		b = kzalloc_obj(struct route4_bucket);
+		b = kzalloc_obj(struct route4_bucket, GFP_KERNEL_ACCOUNT);
 		if (b == NULL)
 			return -ENOBUFS;
 
@@ -524,7 +524,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
 			return -EINVAL;
 
 	err = -ENOBUFS;
-	f = kzalloc_obj(struct route4_filter);
+	f = kzalloc_obj(struct route4_filter, GFP_KERNEL_ACCOUNT);
 	if (!f)
 		goto errout;
 
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index c297d7dbcf91..ac6d0fa5a40e 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -825,7 +825,7 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
 	struct tc_u32_sel *s = &n->sel;
 	struct tc_u_knode *new;
 
-	new = kzalloc_flex(*new, sel.keys, s->nkeys);
+	new = kzalloc_flex(*new, sel.keys, s->nkeys, GFP_KERNEL_ACCOUNT);
 	if (!new)
 		return NULL;
 
@@ -1114,15 +1114,16 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
 		goto erridr;
 	}
 
-	n = kzalloc_flex(*n, sel.keys, s->nkeys);
+	n = kzalloc_flex(*n, sel.keys, s->nkeys, GFP_KERNEL_ACCOUNT);
 	if (n == NULL) {
 		err = -ENOBUFS;
 		goto erridr;
 	}
 
 #ifdef CONFIG_CLS_U32_PERF
-	n->pf = __alloc_percpu(struct_size(n->pf, kcnts, s->nkeys),
-			       __alignof__(struct tc_u32_pcnt));
+	n->pf = __alloc_percpu_gfp(struct_size(n->pf, kcnts, s->nkeys),
+				   __alignof__(struct tc_u32_pcnt),
+				   GFP_KERNEL_ACCOUNT);
 	if (!n->pf) {
 		err = -ENOBUFS;
 		goto errfree;
@@ -1144,7 +1145,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
 		goto errout;
 
 #ifdef CONFIG_CLS_U32_MARK
-	n->pcpu_success = alloc_percpu(u32);
+	n->pcpu_success = alloc_percpu_gfp(u32, GFP_KERNEL_ACCOUNT);
 	if (!n->pcpu_success) {
 		err = -ENOMEM;
 		goto errout;
-- 
2.43.0

Re: [PATCH net] net/sched: account classifier filter allocations to memcg

[Breno Leitao]

On Wed, Aug 19, 2026 at 10:37:33AM -0400, Jamal Hadi Salim wrote:
> Allocations in the tc classifier *_change() paths (filter objects,
> per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without
> __GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside
> memcg charging. The shared tcf_exts_init_ex() action array allocation in
> cls_api.c was also uncharged; this patch closes it along with the
> per-classifier filter-object/percpu/aux allocations that remain
> unaccounted.
> 
> Add GFP_KERNEL_ACCOUNT to:
> - the shared tcf_exts_init_ex() action array (cls_api.c), common to every
>   filter of every classifier (32 pointers, 256 bytes);
> - the filter-object, per-CPU-counter, and per-filter aux allocations in
>   cls_basic, cls_bpf, cls_cgroup, cls_flow, cls_flower, cls_fw,
>   cls_matchall, cls_route and cls_u32;
> - the u32_init_knode() replace-path knode allocation (cls_u32.c), which
>   allocates the same struct tc_u_knode + sel.keys on every replace of an
>   existing knode and was missed by the create-path-only conversion.
> 
> Also fix the cls_basic error path: basic_change() inserts fnew into the
> IDR before allocating the per-CPU counter. If alloc_percpu() fails the
> errout path kfree'd fnew without idr_remove, leaving a dangling pointer
> in the IDR. With GFP_KERNEL_ACCOUNT the percpu alloc becomes failable
> on demand (memcg at memory.max), making the dead path attacker-reachable
> and burning the handle permanently. Add the idr_remove on the percpu
> failure path, matching the basic_set_parms failure-path pattern.
> 
> Note: vega@nebusec.ai provided a poc for basic_cls, but it was easy to
> extend to the other classifiers.
> 
> Conditions to recreate the bug:
> - CONFIG_NET_SCHED, CONFIG_NET_CLS_* (the classifier being used),
>   CONFIG_NET_CLS_ACT, CONFIG_MEMCG, CONFIG_USER_NS, CONFIG_NET_NS.
> - Unprivileged user in a fresh user+network namespace (unshare -Urn),
>   or root with CAP_NET_ADMIN.
> - Create a large number of tc filters (e.g. tc filter add dev lo
>   ingress ... <classifier> ...) while watching a memcg-limited cgroup:
>   system slab grows far faster than memory.current, pinning kernel
>   memory outside memcg charging.
> 
> Fixes: 0da974f4f303 ("[NET]: Conversions from kmalloc+memset to k(z|c)alloc.")
> Reported-by: vega@nebusec.ai
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>

Reviewed-by: Breno Leitao <leitao@debian.org>

Re: [PATCH net] net/sched: account classifier filter allocations to memcg

[Jakub Kicinski]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net/sched: account classifier filter allocations to memcg

This adds GFP_KERNEL_ACCOUNT to the filter objects, per-CPU counters and
per-filter aux allocations in the tc classifier *_change() paths, plus the
shared exts->actions array in tcf_exts_init_ex(). It also adds an
idr_remove() to the cls_basic percpu-allocation failure path.

> diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
> index 4e6a2812a4f32..be63b347640ba 100644
> --- a/net/sched/cls_api.c
> +++ b/net/sched/cls_api.c
> @@ -3364,7 +3364,8 @@ int tcf_exts_init_ex(struct tcf_exts *exts, struct net *net, int action,
>  	 * This reference might be taken later from tcf_exts_get_net().
>  	 */
>  	exts->net = net;
> -	exts->actions = kzalloc_objs(struct tc_action *, TCA_ACT_MAX_PRIO);
> +	exts->actions = kzalloc_objs(struct tc_action *, TCA_ACT_MAX_PRIO,
> +				     GFP_KERNEL_ACCOUNT);
>  	if (!exts->actions)
>  		return -ENOMEM;
>  #endif
> diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
> index 492cd9ce8d46f..e2a94ba9fba76 100644
> --- a/net/sched/cls_basic.c
> +++ b/net/sched/cls_basic.c
> @@ -193,7 +193,7 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
>  			return -EINVAL;
>  	}
>  
> -	fnew = kzalloc_obj(*fnew);
> +	fnew = kzalloc_obj(*fnew, GFP_KERNEL_ACCOUNT);
>  	if (!fnew)
>  		return -ENOBUFS;
>  

[Severity: Medium]
The changelog says this "closes" the bypass that lets "unprivileged users
to pin kernel memory outside memcg charging". Is that accurate when the
larger, user-sized allocations on the very same basic_change() request are
still uncharged?

basic_change() charges fnew and fnew->pf here, then reaches the ematch
tree through basic_set_parms():

net/sched/cls_basic.c:basic_set_parms()
    err = tcf_em_tree_validate(tp, tb[TCA_BASIC_EMATCHES], &f->ematches);

net/sched/ematch.c:tcf_em_tree_validate()
    matches_len = tree_hdr->nmatches * sizeof(*em);

    tree->matches = kzalloc(matches_len, GFP_KERNEL);

and per-ematch payloads in tcf_em_validate():

    void *v = kmemdup(data, data_len, GFP_KERNEL);

nmatches and data_len come from the netlink message, so the uncharged part
of a single filter can be much larger than the charged part. The same
tcf_em_tree_validate() path is used by flow_change() and
cls_cgroup_change(), whose filter objects this patch also charges.

Should the u32 hash tables be converted too? u32_change() charges the
knode, but the TCA_U32_DIVISOR branch in the same function still uses the
default gfp for the up-to-257-pointer table that is published in
tp_c->hlist:

net/sched/cls_u32.c:u32_change()
	ht = kzalloc_flex(*ht, ht, divisor + 1);
	if (ht == NULL)
		return -ENOBUFS;

The same object type is allocated as root_ht in u32_init(), also
uncharged.

There are a few other siblings on these paths that keep plain GFP_KERNEL:

- fw_change() allocates head = kzalloc_obj(*head) (fw_head with its
  256-entry hash table) a few lines above the fw_filter allocation this
  patch converts.
- route4_init() allocates route4_head, which carries table[256], while
  route4_filter and route4_bucket in the same file are converted.
- fl_init() allocates the cls_fl_head plus the rhashtable that grows with
  each inserted filter, and fl_tmplt_create() allocates the template
  object; both stay uncharged while fnew and newmask are charged.
- tcf_proto_create(), tcf_chain_create() and tcf_block_create() in
  cls_api.c, and the IDR nodes for the handles being charged
  (idr_alloc_u32(..., GFP_KERNEL) in basic_change() and u32_change()).

With the boundary running through the middle of one netlink request, a
memcg-limited task can still see slab grow faster than memory.current,
which is the signal the changelog uses as the reproducer. Was leaving
these out intentional, or is the intent to convert them in a follow-up?

> @@ -212,9 +212,11 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
>  	if (err)
>  		goto errout;
>  	fnew->handle = handle;
> -	fnew->pf = alloc_percpu(struct tc_basic_pcnt);
> +	fnew->pf = alloc_percpu_gfp(struct tc_basic_pcnt, GFP_KERNEL_ACCOUNT);
>  	if (!fnew->pf) {
>  		err = -ENOMEM;
> +		if (!fold)
> +			idr_remove(&head->handle_idr, fnew->handle);
>  		goto errout;
>  	}
>  

[ ... ]

> diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
> index c297d7dbcf916..ac6d0fa5a40e3 100644
> --- a/net/sched/cls_u32.c
> +++ b/net/sched/cls_u32.c
> @@ -1114,15 +1114,16 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
>  		goto erridr;
>  	}
>  
> -	n = kzalloc_flex(*n, sel.keys, s->nkeys);
> +	n = kzalloc_flex(*n, sel.keys, s->nkeys, GFP_KERNEL_ACCOUNT);
>  	if (n == NULL) {
>  		err = -ENOBUFS;
>  		goto erridr;
>  	}
>  

[ ... ]

Re: [PATCH net] net/sched: account classifier filter allocations to memcg

[Jamal Hadi Salim]

On Sat, Aug 22, 2026 at 4:02 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> ---
> net/sched: account classifier filter allocations to memcg
>
> This adds GFP_KERNEL_ACCOUNT to the filter objects, per-CPU counters and
> per-filter aux allocations in the tc classifier *_change() paths, plus the
> shared exts->actions array in tcf_exts_init_ex(). It also adds an
> idr_remove() to the cls_basic percpu-allocation failure path.
>

Thanks for merging.
I have a list of follow-up items for this patch - mostly pre-existing
issues and others pointing to similar patterns identified by the
sashikos.

cheers,
jamal

> > diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
> > index 4e6a2812a4f32..be63b347640ba 100644
> > --- a/net/sched/cls_api.c
> > +++ b/net/sched/cls_api.c
> > @@ -3364,7 +3364,8 @@ int tcf_exts_init_ex(struct tcf_exts *exts, struct net *net, int action,
> >        * This reference might be taken later from tcf_exts_get_net().
> >        */
> >       exts->net = net;
> > -     exts->actions = kzalloc_objs(struct tc_action *, TCA_ACT_MAX_PRIO);
> > +     exts->actions = kzalloc_objs(struct tc_action *, TCA_ACT_MAX_PRIO,
> > +                                  GFP_KERNEL_ACCOUNT);
> >       if (!exts->actions)
> >               return -ENOMEM;
> >  #endif
> > diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
> > index 492cd9ce8d46f..e2a94ba9fba76 100644
> > --- a/net/sched/cls_basic.c
> > +++ b/net/sched/cls_basic.c
> > @@ -193,7 +193,7 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
> >                       return -EINVAL;
> >       }
> >
> > -     fnew = kzalloc_obj(*fnew);
> > +     fnew = kzalloc_obj(*fnew, GFP_KERNEL_ACCOUNT);
> >       if (!fnew)
> >               return -ENOBUFS;
> >
>
> [Severity: Medium]
> The changelog says this "closes" the bypass that lets "unprivileged users
> to pin kernel memory outside memcg charging". Is that accurate when the
> larger, user-sized allocations on the very same basic_change() request are
> still uncharged?
>
> basic_change() charges fnew and fnew->pf here, then reaches the ematch
> tree through basic_set_parms():
>
> net/sched/cls_basic.c:basic_set_parms()
>     err = tcf_em_tree_validate(tp, tb[TCA_BASIC_EMATCHES], &f->ematches);
>
> net/sched/ematch.c:tcf_em_tree_validate()
>     matches_len = tree_hdr->nmatches * sizeof(*em);
>
>     tree->matches = kzalloc(matches_len, GFP_KERNEL);
>
> and per-ematch payloads in tcf_em_validate():
>
>     void *v = kmemdup(data, data_len, GFP_KERNEL);
>
> nmatches and data_len come from the netlink message, so the uncharged part
> of a single filter can be much larger than the charged part. The same
> tcf_em_tree_validate() path is used by flow_change() and
> cls_cgroup_change(), whose filter objects this patch also charges.
>
> Should the u32 hash tables be converted too? u32_change() charges the
> knode, but the TCA_U32_DIVISOR branch in the same function still uses the
> default gfp for the up-to-257-pointer table that is published in
> tp_c->hlist:
>
> net/sched/cls_u32.c:u32_change()
>         ht = kzalloc_flex(*ht, ht, divisor + 1);
>         if (ht == NULL)
>                 return -ENOBUFS;
>
> The same object type is allocated as root_ht in u32_init(), also
> uncharged.
>
> There are a few other siblings on these paths that keep plain GFP_KERNEL:
>
> - fw_change() allocates head = kzalloc_obj(*head) (fw_head with its
>   256-entry hash table) a few lines above the fw_filter allocation this
>   patch converts.
> - route4_init() allocates route4_head, which carries table[256], while
>   route4_filter and route4_bucket in the same file are converted.
> - fl_init() allocates the cls_fl_head plus the rhashtable that grows with
>   each inserted filter, and fl_tmplt_create() allocates the template
>   object; both stay uncharged while fnew and newmask are charged.
> - tcf_proto_create(), tcf_chain_create() and tcf_block_create() in
>   cls_api.c, and the IDR nodes for the handles being charged
>   (idr_alloc_u32(..., GFP_KERNEL) in basic_change() and u32_change()).
>
> With the boundary running through the middle of one netlink request, a
> memcg-limited task can still see slab grow faster than memory.current,
> which is the signal the changelog uses as the reproducer. Was leaving
> these out intentional, or is the intent to convert them in a follow-up?
>
> > @@ -212,9 +212,11 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
> >       if (err)
> >               goto errout;
> >       fnew->handle = handle;
> > -     fnew->pf = alloc_percpu(struct tc_basic_pcnt);
> > +     fnew->pf = alloc_percpu_gfp(struct tc_basic_pcnt, GFP_KERNEL_ACCOUNT);
> >       if (!fnew->pf) {
> >               err = -ENOMEM;
> > +             if (!fold)
> > +                     idr_remove(&head->handle_idr, fnew->handle);
> >               goto errout;
> >       }
> >
>
> [ ... ]
>
> > diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
> > index c297d7dbcf916..ac6d0fa5a40e3 100644
> > --- a/net/sched/cls_u32.c
> > +++ b/net/sched/cls_u32.c
> > @@ -1114,15 +1114,16 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
> >               goto erridr;
> >       }
> >
> > -     n = kzalloc_flex(*n, sel.keys, s->nkeys);
> > +     n = kzalloc_flex(*n, sel.keys, s->nkeys, GFP_KERNEL_ACCOUNT);
> >       if (n == NULL) {
> >               err = -ENOBUFS;
> >               goto erridr;
> >       }
> >
>
> [ ... ]

Re: [PATCH net] net/sched: account classifier filter allocations to memcg

[Jakub Kicinski]

On Sat, 22 Aug 2026 16:24:21 -0400 Jamal Hadi Salim wrote:
> I have a list of follow-up items for this patch - mostly pre-existing
> issues and others pointing to similar patterns identified by the
> sashikos.

roger

Re: [PATCH net] net/sched: account classifier filter allocations to memcg

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 19 Aug 2026 10:37:33 -0400 you wrote:
> Allocations in the tc classifier *_change() paths (filter objects,
> per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without
> __GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside
> memcg charging. The shared tcf_exts_init_ex() action array allocation in
> cls_api.c was also uncharged; this patch closes it along with the
> per-classifier filter-object/percpu/aux allocations that remain
> unaccounted.
> 
> [...]

Here is the summary with links:
  - [net] net/sched: account classifier filter allocations to memcg
    https://git.kernel.org/netdev/net/c/1beb81947eb4

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html