[PATCH 6.1.y 6.6.y v2] netfilter: nf_tables: missing objects with no memcg accounting

[Karl Mehltretter]

From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>

[ Upstream commit 69e687cea79fc99a17dfb0116c8644b9391b915e ]

Several ruleset objects are still not using GFP_KERNEL_ACCOUNT for
memory accounting, update them. This includes:

- catchall elements
- compat match large info area
- log prefix
- meta secctx
- numgen counters
- pipapo set backend datastructure
- tunnel private objects

Fixes: 33758c891479 ("memcg: enable accounting for nft objects")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
[ Karl Mehltretter: The original 6.1.y and 6.6.y backports omitted the
  pipapo_realloc_mt() hunk. In these pre-refactor trees, the corresponding
  mapping-table allocation is still part of pipapo_resize() and uses
  GFP_KERNEL. A/B tests on 6.1.186 and 6.6.155 measured 524,288 additional
  charged bytes for a 32,768-element two-field set. On 6.12.107, the
  corresponding allocation was already accounted. ]
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
---
Changes in v2:
- restore Pablo's authorship, original changelog, Fixes tag and sign-off
- document the older-tree adaptation and exact A/B accounting result

v1: https://lore.kernel.org/stable/20260831043755.29692-1-kmehltretter@xxxxxxxxx/

 net/netfilter/nft_set_pipapo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 7c8d28a031ad..8ba76eea3eb1 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -705,7 +705,7 @@ static int pipapo_resize(struct nft_pipapo_field *f, int old_rules, int rules)
 		return -ENOMEM;
 	}
 
-	new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL);
+	new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL_ACCOUNT);
 	if (!new_mt) {
 		kvfree(new_lt);
 		return -ENOMEM;
-- 
2.39.5 (Apple Git-154)