Messages in this thread | | | Date | Mon, 28 Mar 2022 10:15:40 +0200 | From | Pablo Neira Ayuso <> | Subject | Re: [PATCH v2 RESEND] memcg: enable accounting for nft objects |
| |
On Thu, Mar 24, 2022 at 09:05:50PM +0300, Vasily Averin wrote: > nftables replaces iptables, but it lacks memcg accounting. > > This patch account most of the memory allocation associated with nft > and should protect the host from misusing nft inside a memcg restricted > container.
Applied to nf, thanks
I think nft_*.c files whose NFT_EXPR_STATEFUL flag is set on need to use this _ACCOUNT flag variant for objects that are dinamically allocated from the packet path.
| |