Re: [PATCH net] net/packet: charge fanout groups to the memory cgroup

[Ahmad AG <ahmadag1001@gmail.com>]

Thanks. I will scan all allocations in net/packet/ and send a v2
covering them in one patch, using a mail setup that keeps the patch
intact.

On Thu, Oct 29, 2026 at 7:10 PM Willem de Bruijn
<willemdebruijn.kernel@gmail.com> wrote:
>
> Ahmad AG wrote:
> > fanout_add() allocates a new group with room for max_num_members
> > socket pointers. Since commit 9c661b0b8544 ("net/packet: make
> > packet_fanout.arr size configurable up to 64K") that is up to 64K
> > pointers, 512 KB per group, from a single PACKET_FANOUT setsockopt().
> > The allocation uses GFP_KERNEL, so it is not charged to the caller's
> > memory cgroup.
> >
> > Each packet socket can create its own group, so a process with
> > CAP_NET_RAW in its own user and network namespace holds about 512 KB
> > of kernel memory per open socket that its memory cgroup never sees.
> > In a cgroup with memory.max set to 16M, 256 sockets each creating a
> > group with max_num_members = 65536 took 264 MB of system memory while
> > memory.current grew by 380 KB.
> >
> > Allocate the group with GFP_KERNEL_ACCOUNT, as other allocations a
>
> This is not the only such allocation in packet sockets that does not
> account. If addressing that, probably scan all such allocations and
> update them in one go.
>
> > user can make on demand in the networking stack already do. With the
> > change the same test in the 16M cgroup is stopped by the cgroup's OOM
> > killer, and with memory.max at 512M the 256 groups charge 262656 KB
> > for 264640 KB of system memory used.
> >
> > The missing charge was found by code inspection of net/packet/ with
> > the help of an LLM and then triggered with a small test program that
> > creates the sockets and groups and reads memory.current; the numbers
> > above are from that run. Tested in a QEMU/KVM guest on this tree
> > (x86_64_defconfig plus kvm_guest.config, KASAN, MEMCG, PACKET),
> > running the test as uid 1000 in a cgroup v2 memory cgroup.
> > tools/testing/selftests/net/psock_fanout passes before and after.
> >
> > Fixes: 9c661b0b8544 ("net/packet: make packet_fanout.arr size
> > configurable up to 64K")
>
> Your email client corrupted the patch.
>
> > Cc: stable@vger.kernel.org
> > Assisted-by: Claude Code
> > Signed-off-by: Ahmad AG <ahmadag1001@gmail.com>
> > ---
> >  net/packet/af_packet.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> > index 823e0911c91..406397acc5c 100644
> > --- a/net/packet/af_packet.c
> > +++ b/net/packet/af_packet.c
> > @@ -1778,7 +1778,8 @@ static int fanout_add(struct sock *sk, struct
> > fanout_args *args)
> >   /* legacy PACKET_FANOUT_MAX */
> >   args->max_num_members = 256;
> >   err = -ENOMEM;
> > - match = kvzalloc_flex(*match, arr, args->max_num_members);
> > + match = kvzalloc_flex(*match, arr, args->max_num_members,
> > +      GFP_KERNEL_ACCOUNT);
> >   if (!match)
> >   goto out;
> >   write_pnet(&match->net, sock_net(sk));
> >
> > base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
> > --
> > 2.43.0
>
>