Re: [PATCH v3] netfilter: nfnetlink_queue: optimize verdict lookup with hash table

[Scott Mitchell]

On Thu, Nov 13, 2025 at 7:55 AM Florian Westphal <fw@xxxxxxxxx> wrote:
>
> Scott Mitchell <scott.k.mitch1@xxxxxxxxx> wrote:
> > +static int
> > +nfqnl_hash_resize(struct nfqnl_instance *inst, u32 hash_size)
> > +{
> > +     struct hlist_head *new_hash, *old_hash;
> > +     struct nf_queue_entry *entry;
> > +     unsigned int h, hash_mask;
> > +
> > +     hash_size = nfqnl_normalize_hash_size(hash_size);
> > +     if (hash_size == inst->queue_hash_size)
> > +             return 0;
> > +
> > +     new_hash = kvcalloc(hash_size, sizeof(*new_hash), GFP_KERNEL_ACCOUNT);
>
> This doesn't work, please re-test with LOCKDEP enabled before sending
> next version.
>
> > +     inst->queue_hash = kvcalloc(hash_size, sizeof(*inst->queue_hash),
> > +                                 GFP_KERNEL_ACCOUNT);
>
> .. and this doesn't work either, we are holding rcu read lock and
> the queue instance spinlock, so we cannot do a sleeping allocation.
>
> That said, I don't see a compelling reason why rcu read lock is held
> here, but resolving that needs prep work :-/
>
> So there are only two choices:
> 1. add a prep patch that pushes the locks to where they are needed,
>    the rebase this patch on top
> 2. use GFP_ATOMIC like in v1 and update comment to say that
>    GFP_KERNEL_ACCOUNT would need more work to place allocations
>    outside of the locks.

I will go with option 2 to make incremental progress.