[PATCH nf-next] netfilter: flowtable: check namespace before iterating flows
From: Qingfang Deng <hidden>
Date: 2026-09-09 08:17:18
Also in:
lkml, netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
nf_flow_table_cleanup() walks every registered flow table, checking the network namespace for each flow in nf_flow_table_do_cleanup(). As a result, tables in other namespaces are still iterated and their cleanup work is flushed. Compare the flow table's namespace with the device's namespace in nf_flow_table_cleanup() and skip nonmatching tables. This avoids unnecessary iteration and work flushing, and leaves the per-flow cleanup callback to check only the interface index. Signed-off-by: Qingfang Deng <redacted> --- net/netfilter/nf_flow_table_core.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 03241d4bfd5e..52cca7a8f141 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c@@ -730,14 +730,9 @@ static void nf_flow_table_do_cleanup(struct nf_flowtable *flow_table, { struct net_device *dev = data; - if (!dev) { - flow_offload_teardown(flow); - return; - } - - if (net_eq(nf_ct_net(flow->ct), dev_net(dev)) && - (flow->tuplehash[0].tuple.iifidx == dev->ifindex || - flow->tuplehash[1].tuple.iifidx == dev->ifindex)) + if (!dev || + flow->tuplehash[0].tuple.iifidx == dev->ifindex || + flow->tuplehash[1].tuple.iifidx == dev->ifindex) flow_offload_teardown(flow); }
@@ -754,8 +749,10 @@ void nf_flow_table_cleanup(struct net_device *dev) struct nf_flowtable *flowtable; mutex_lock(&flowtable_lock); - list_for_each_entry(flowtable, &flowtables, list) - nf_flow_table_gc_cleanup(flowtable, dev); + list_for_each_entry(flowtable, &flowtables, list) { + if (net_eq(read_pnet(&flowtable->net), dev_net(dev))) + nf_flow_table_gc_cleanup(flowtable, dev); + } mutex_unlock(&flowtable_lock); } EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
--
2.43.0