Florian Westphal fa23e0d4b7 netfilter: nf_tables: allow clone callbacks to sleep
Sven Auhagen reports transaction failures with following error:
  ./main.nft:13:1-26: Error: Could not process rule: Cannot allocate memory
  percpu: allocation failed, size=16 align=8 atomic=1, atomic alloc failed, no space left

This points to failing pcpu allocation with GFP_ATOMIC flag.
However, transactions happen from user context and are allowed to sleep.

One case where we can call into percpu allocator with GFP_ATOMIC is
nft_counter expression.

Normally this happens from control plane, so this could use GFP_KERNEL
instead.  But one use case, element insertion from packet path,
needs to use GFP_ATOMIC allocations (nft_dynset expression).

At this time, .clone callbacks always use GFP_ATOMIC for this reason.

Add gfp_t argument to the .clone function and pass GFP_KERNEL or
GFP_ATOMIC flag depending on context, this allows all clone memory
allocations to sleep for the normal (transaction) case.

Cc: Sven Auhagen <sven.auhagen@voleatech.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2024-05-10 11:13:45 +02:00
..
2024-04-24 11:06:25 -07:00
2024-03-05 11:21:18 -08:00
2024-01-02 12:41:16 +00:00
2022-08-09 22:14:02 -07:00
2024-02-09 10:01:09 -08:00
2024-05-01 19:06:32 -07:00
2024-03-05 19:21:17 -08:00
2023-11-02 09:31:02 +01:00
2021-10-15 11:33:08 +01:00
2024-02-28 11:19:41 +00:00
2023-04-22 01:39:41 +02:00
2024-04-30 18:32:38 -07:00
2023-10-30 14:36:57 -07:00
2021-10-13 09:40:46 -07:00
2023-08-22 17:31:18 -07:00
2022-05-11 12:43:10 +01:00
2024-05-05 14:35:33 +01:00
2024-04-25 15:24:23 -07:00
2024-04-01 10:49:28 +01:00
2023-07-14 20:39:30 -07:00
2024-04-30 18:32:38 -07:00
2024-04-30 18:46:52 -07:00
2023-10-04 11:49:20 -07:00
2023-10-23 15:01:53 -07:00
2023-07-28 14:07:59 -07:00
2022-12-12 15:04:39 -08:00
2023-09-14 16:16:36 +02:00
2023-12-14 16:38:59 +01:00