From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Subject: [PATCH nf-next,v3 8/8] netfilter: ipset: use GFP_KERNEL_ACCOUNT
Date: Mon, 7 Sep 2026 20:55:52 +0200 [thread overview]
Message-ID: <20260907185552.1422008-8-pablo@netfilter.org> (raw)
In-Reply-To: <20260907185552.1422008-1-pablo@netfilter.org>
GFP_KERNEL_ACCOUNT is preferred these days for memcg, replace
GFP_KERNEL by GFP_KERNEL_ACCOUNT.
Use GFP_KERNEL_ACCOUNT to allocate internal datastructures in
ipset.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v3: no changes
net/netfilter/ipset/ip_set_bitmap_ip.c | 2 +-
net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +-
net/netfilter/ipset/ip_set_bitmap_port.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 7 ++++---
net/netfilter/ipset/ip_set_hash_gen.h | 6 +++---
net/netfilter/ipset/ip_set_list_set.c | 2 +-
6 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index ac7febce074f..e152cf35d859 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -217,7 +217,7 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
u32 first_ip, u32 last_ip,
u32 elements, u32 hosts, u8 netmask)
{
- map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);
+ map->members = bitmap_zalloc(elements, GFP_KERNEL_ACCOUNT | __GFP_NOWARN);
if (!map->members)
return false;
map->first_ip = first_ip;
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 5921fd9d2dca..a1179352220a 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -300,7 +300,7 @@ static bool
init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
u32 first_ip, u32 last_ip, u32 elements)
{
- map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);
+ map->members = bitmap_zalloc(elements, GFP_KERNEL_ACCOUNT | __GFP_NOWARN);
if (!map->members)
return false;
map->first_ip = first_ip;
diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
index ca875c982424..0a0027cdb193 100644
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -231,7 +231,7 @@ static bool
init_map_port(struct ip_set *set, struct bitmap_port *map,
u16 first_port, u16 last_port)
{
- map->members = bitmap_zalloc(map->elements, GFP_KERNEL | __GFP_NOWARN);
+ map->members = bitmap_zalloc(map->elements, GFP_KERNEL_ACCOUNT | __GFP_NOWARN);
if (!map->members)
return false;
map->first_port = first_port;
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 0a86a170ba90..28ac8cba3d68 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1085,7 +1085,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info,
/* First, and without any locks, allocate and initialize
* a normal base set structure.
*/
- set = kzalloc_obj(*set);
+ set = kzalloc_obj(*set, GFP_KERNEL_ACCOUNT);
if (!set)
return -ENOMEM;
spin_lock_init(&set->lock);
@@ -1143,7 +1143,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info,
/* Wraparound */
goto cleanup;
- list = kvzalloc_objs(struct ip_set *, i);
+ list = kvzalloc_objs(struct ip_set *, i, GFP_KERNEL_ACCOUNT);
if (!list)
goto cleanup;
/* nfnl mutex is held, both lists are valid */
@@ -2397,7 +2397,8 @@ ip_set_net_init(struct net *net)
if (inst->ip_set_max >= IPSET_INVALID_ID)
inst->ip_set_max = IPSET_INVALID_ID - 1;
- list = kvzalloc_objs(struct ip_set *, inst->ip_set_max);
+ list = kvzalloc_objs(struct ip_set *, inst->ip_set_max,
+ GFP_KERNEL_ACCOUNT);
if (!list)
return -ENOMEM;
inst->is_deleted = false;
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 80ca523f304b..39dec9285052 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -768,7 +768,7 @@ mtype_resize(struct ip_set *set, bool retried)
int ret;
#ifdef IP_SET_HASH_WITH_NETS
- tmp = kmalloc(dsize, GFP_KERNEL);
+ tmp = kmalloc(dsize, GFP_KERNEL_ACCOUNT);
if (!tmp)
return -ENOMEM;
#endif
@@ -1754,7 +1754,7 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
sizeof(struct IPSET_TOKEN(HTYPE, 6)) :
sizeof(struct IPSET_TOKEN(HTYPE, 4));
#endif
- h = kzalloc(hsize, GFP_KERNEL);
+ h = kzalloc(hsize, GFP_KERNEL_ACCOUNT);
if (!h)
return -ENOMEM;
@@ -1774,7 +1774,7 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
goto free_t;
#ifdef IP_SET_HASH_WITH_NETS
for (i = 0; i < IPSET_NET_COUNT; i++) {
- nets = kzalloc_obj(*nets);
+ nets = kzalloc_obj(*nets, GFP_KERNEL_ACCOUNT);
if (!nets) {
while (i > 0)
kfree(rcu_dereference_raw(h->rnets[--i]));
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index f070088742d6..750fe38261c3 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -600,7 +600,7 @@ init_list_set(struct net *net, struct ip_set *set, u32 size)
{
struct list_set *map;
- map = kzalloc_obj(*map);
+ map = kzalloc_obj(*map, GFP_KERNEL_ACCOUNT);
if (!map)
return false;
--
2.47.3
prev parent reply other threads:[~2026-09-07 18:56 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-07 18:55 [PATCH nf-next,v3 1/8] netfilter: x_tables: use GFP_KERNEL_ACCOUNT in match/target Pablo Neira Ayuso
2026-09-07 18:55 ` [PATCH nf-next,v3 2/8] netfilter: nfnetlink: use GFP_KERNEL_ACCOUNT Pablo Neira Ayuso
2026-09-07 18:55 ` [PATCH nf-next,v3 3/8] netfilter: nf_tables: " Pablo Neira Ayuso
2026-09-07 18:55 ` [PATCH nf-next,v3 4/8] netfilter: synproxy: " Pablo Neira Ayuso
2026-09-07 18:55 ` [PATCH nf-next,v3 5/8] netfilter: sysctl: " Pablo Neira Ayuso
2026-09-07 18:55 ` [PATCH nf-next,v3 6/8] netfilter: nat: " Pablo Neira Ayuso
2026-09-07 18:55 ` [PATCH nf-next,v3 7/8] netfilter: conncount: " Pablo Neira Ayuso
2026-09-07 18:55 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260907185552.1422008-8-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.