Re: [PATCH nf 1/1] netfilter: xt_string: account textsearch configs

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Aug 17, 2026 at 08:44:55PM +0800, ZhilingZouzhilinz@nebusec.ai wrote:
> From: Zhiling Zou <zhilinz@nebusec.ai>
> 
> string_mt_check() creates a textsearch configuration for every string
> match with GFP_KERNEL. Algorithm-private data, including Boyer-Moore
> tables,

Why the reference to Boyer-Moore? It looks a bit gratuitous? :-)
How does it relate to this issue at all? Knuth-Pratt-Morris
implementation also performs an internal memory allocation from
->init() path.

> [...] remains allocated for as long as the rule is installed.
> 
> The xtables table blob is memcg accounted, but the textsearch
> configuration is not. A user with CAP_NET_ADMIN in a user and network
> namespace can therefore retain kernel memory outside its memory limit
> by installing many string matches.

This is news to me that you consider this a security issue... but fair
enough. We have taken many patches like this for net-next in the past.

We have more paths that could use GFP_KERNEL_ACCOUNT in x_tables, but
some of them need careful look because they might break existing
setups.

net/netfilter/x_tables.c:       table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL);
net/netfilter/xt_CT.c:  ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
net/netfilter/xt_IDLETIMER.c:   info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
net/netfilter/xt_IDLETIMER.c:   info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
net/netfilter/xt_LED.c: ledinternal->trigger_id = kstrdup(ledinfo->id, GFP_KERNEL);
net/netfilter/xt_dccp.c:        dccp_optbuf = kmalloc(256 * 4, GFP_KERNEL);
net/netfilter/xt_hashlimit.c:   hinfo->name = kstrdup(name, GFP_KERNEL);
net/netfilter/xt_repldata.h:    tbl = kzalloc(term_offset + sizeof(*term), GFP_KERNEL);

I can post a patch to address this, no need for you to post it.

> Use GFP_KERNEL_ACCOUNT for the textsearch configuration so it is
> charged with the rest of the rule state.

textsearch_prepare also in net/sched/em_text.c uses GFP_KERNEL, maybe
you want to "fix" all textsearch_prepare() prepare callers?

Maybe you can just remove the allocation flag for textsearch_prepare()
and use GFP_KERNEL_ACCOUNT inconditionally.

> Fixes: 7567662ba896 ("[NETFILTER]: Add string match")

GFP_KERNEL_ACCOUNT came later than lib/textsearch.c, so this was never
converted to use it.

This Fixes: tag cannot be right.

> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
>  net/netfilter/xt_string.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/xt_string.c b/net/netfilter/xt_string.c
> index 8ce25bc9b2775..52c1deb02cdc6 100644
> --- a/net/netfilter/xt_string.c
> +++ b/net/netfilter/xt_string.c
> @@ -54,7 +54,7 @@ static int string_mt_check(const struct xt_mtchk_param *par)
>  	if (conf->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
>  		flags |= TS_IGNORECASE;
>  	ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
> -				     GFP_KERNEL, flags);
> +				     GFP_KERNEL_ACCOUNT, flags);
>  	if (IS_ERR(ts_conf))
>  		return PTR_ERR(ts_conf);
>  
> -- 
> 2.43.0
>