Re: [PATCH nf-next] netfilter: flowtable: check namespace before iterating flows

[Phil Sutter]

Hi,

On Wed, Sep 09, 2026 at 04:17:04PM +0800, Qingfang Deng wrote:
> nf_flow_table_cleanup() walks every registered flow table, checking the
> network namespace for each flow in nf_flow_table_do_cleanup(). As a
> result, tables in other namespaces are still iterated and their cleanup
> work is flushed.
> 
> Compare the flow table's namespace with the device's namespace in
> nf_flow_table_cleanup() and skip nonmatching tables. This avoids
> unnecessary iteration and work flushing, and leaves the per-flow cleanup
> callback to check only the interface index.
> 
> Signed-off-by: Qingfang Deng <qingfang.deng@xxxxxxxxx>
> ---
>  net/netfilter/nf_flow_table_core.c | 17 +++++++----------
>  1 file changed, 7 insertions(+), 10 deletions(-)
> 
> diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
> index 03241d4bfd5e..52cca7a8f141 100644
> --- a/net/netfilter/nf_flow_table_core.c
> +++ b/net/netfilter/nf_flow_table_core.c
> @@ -730,14 +730,9 @@ static void nf_flow_table_do_cleanup(struct nf_flowtable *flow_table,
>  {
>  	struct net_device *dev = data;
>  
> -	if (!dev) {
> -		flow_offload_teardown(flow);
> -		return;
> -	}
> -
> -	if (net_eq(nf_ct_net(flow->ct), dev_net(dev)) &&
> -	    (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
> -	     flow->tuplehash[1].tuple.iifidx == dev->ifindex))
> +	if (!dev ||
> +	    flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
> +	    flow->tuplehash[1].tuple.iifidx == dev->ifindex)
>  		flow_offload_teardown(flow);
>  }
>  
> @@ -754,8 +749,10 @@ void nf_flow_table_cleanup(struct net_device *dev)
>  	struct nf_flowtable *flowtable;
>  
>  	mutex_lock(&flowtable_lock);
> -	list_for_each_entry(flowtable, &flowtables, list)
> -		nf_flow_table_gc_cleanup(flowtable, dev);
> +	list_for_each_entry(flowtable, &flowtables, list) {
> +		if (net_eq(read_pnet(&flowtable->net), dev_net(dev)))
> +			nf_flow_table_gc_cleanup(flowtable, dev);
> +	}

A second caller of nf_flow_table_gc_cleanup is
nf_flow_table_indr_cleanup in net/netfilter/nf_flow_table_offload.c. Is
the net_eq-check needed there as well? If not, could you please update
the patch description with a statement explaining why?

Thanks, Phil

>  	mutex_unlock(&flowtable_lock);
>  }
>  EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
> -- 
> 2.43.0
> 
>