On Thu, Jul 9, 2026 at 11:08 AM Pablo Neira Ayuso [off-list ref] wrote:

On Wed, Jul 08, 2026 at 02:54:04PM -0600, Ahmed Zaki wrote:

quoted

Hardware-offloaded flows bypass the CPU and, unlike the software
datapath, dst_check() does not invalidate them when a route changes.
For ephemeral flows, this is usually not a problem as the flow expire on
its own and the driver clears the entry in the HW. However, for persistent
flows forwarded through the device, the HW is never informed that the
route has expired.

For tables marked with NF_FLOWTABLE_HW_OFFLOAD, listen to the per-net FIB
notifier chain and tear down the affected flows so they are re-evaluated by
the SW forwarding path.

A lockless list is used to reduce the work items overhead in case of a
route change storm allowing many FIB events to be processed by one work
item.

This walks the hashtable anyway in case of fib event, maybe simply
walk over the hashtable and call dst_check() to check if the cached
dst is still current.

Good idea. I will replace the tuple matches and the lockless list with a
dst_check in the hashtable iter func: nf_flow_offload_fib_cb().

quoted

Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")

No, this is an enhancement, not a fix. This must be targeted to nf-next.

Will tag v2 to nf-next.

Thanks.
Ahmed