netfilter: x_tables: do not fail xt_alloc_table_info too easilly
eacd86ca ("net/netfilter/x_tables.c: use kvmalloc() in xt_alloc_table_info()") has unintentionally fortified xt_alloc_table_info allocation when __GFP_RETRY has been dropped from the vmalloc fallback. Later on there was a syzbot report that this can lead to OOM killer invocations when tables are too large and 0537250f ("netfilter: x_tables: make allocation less aggressive") has been merged to restore the original behavior. Georgi Nikolov however noticed that he is not able to install his iptables anymore so this can be seen as a regression. The primary argument for 0537250f was that this allocation path shouldn't really trigger the OOM killer and kill innocent tasks. On the other hand the interface requires root and as such should allow what the admin asks for. Root inside a namespaces makes this more complicated because those might be not trusted in general. If they are not then such namespaces should be restricted anyway. Therefore drop the __GFP_NORETRY and replace it by __GFP_ACCOUNT to enfore memcg constrains on it. Fixes: 0537250f ("netfilter: x_tables: make allocation less aggressive") Reported-by:Georgi Nikolov <gnikolov@icdsoft.com> Suggested-by:
Vlastimil Babka <vbabka@suse.cz> Acked-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
Michal Hocko <mhocko@suse.com> Acked-by:
Vlastimil Babka <vbabka@suse.cz> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org>
parent
1c117d3b
Please register or sign in to comment