[PATCH nf 1/1] netfilter: xt_string: account textsearch configs

From: Zhiling Zou <[email protected]>

string_mt_check() creates a textsearch configuration for every string
match with GFP_KERNEL. Algorithm-private data, including Boyer-Moore
tables, remains allocated for as long as the rule is installed.

The xtables table blob is memcg accounted, but the textsearch
configuration is not. A user with CAP_NET_ADMIN in a user and network
namespace can therefore retain kernel memory outside its memory limit
by installing many string matches.

Use GFP_KERNEL_ACCOUNT for the textsearch configuration so it is
charged with the rest of the rule state.

Fixes: 7567662ba896 ("[NETFILTER]: Add string match")
Cc: [email protected]
Reported-by: Vega <[email protected]>
Signed-off-by: Zhiling Zou <[email protected]>
---
 net/netfilter/xt_string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/xt_string.c b/net/netfilter/xt_string.c
index 8ce25bc9b2775..52c1deb02cdc6 100644
--- a/net/netfilter/xt_string.c
+++ b/net/netfilter/xt_string.c
@@ -54,7 +54,7 @@ static int string_mt_check(const struct xt_mtchk_param *par)
 	if (conf->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
 		flags |= TS_IGNORECASE;
 	ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
-				     GFP_KERNEL, flags);
+				     GFP_KERNEL_ACCOUNT, flags);
 	if (IS_ERR(ts_conf))
 		return PTR_ERR(ts_conf);
 
-- 
2.43.0