> ipip6_tunnel_add_prl() allocates struct ip_tunnel_prl_entry for each
> potential router entry added via SIOCADDPRL.
> An unprivileged user with CAP_NET_ADMIN in a user namespace can add
> an unbounded number of entries, consuming uncharged kernel memory.
> 
> Commit 1b51d8271973 ("memcg: ipv6/sit: account and don't WARN on
> ip_tunnel_prl structs allocation") added accounting to the temporary
> buffer in ipip6_tunnel_get_prl(), but missed the entry allocations
> in ipip6_tunnel_add_prl().
> 
> Use GFP_KERNEL_ACCOUNT when allocating struct ip_tunnel_prl_entry.
> 
> Fixes: 1b51d8271973 ("memcg: ipv6/sit: account and don't WARN on ip_tunnel_prl structs allocation")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Acked-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>

> ---
>  net/ipv6/sit.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
> index 4438b2472b28764f813b9162bdb9f6b6dee5a007..9a2bbd76d3794849cd11c6530ba1303bf53fa388 100644
> --- a/net/ipv6/sit.c
> +++ b/net/ipv6/sit.c
> @@ -395,7 +395,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
>  		goto out;
>  	}
>  
> -	p = kzalloc_obj(struct ip_tunnel_prl_entry);
> +	p = kzalloc_obj(struct ip_tunnel_prl_entry, GFP_KERNEL_ACCOUNT);
>  	if (!p) {
>  		err = -ENOBUFS;
>  		goto out;
> -- 
> 2.55.0.979.g7e5102b832-goog
>