[PATCH nf-next] netfilter: flowtable: check namespace before iterating flows

[PATCH nf-next] netfilter: flowtable: check namespace before iterating flows

[Qingfang Deng]

nf_flow_table_cleanup() walks every registered flow table, checking the
network namespace for each flow in nf_flow_table_do_cleanup(). As a
result, tables in other namespaces are still iterated and their cleanup
work is flushed.

Compare the flow table's namespace with the device's namespace in
nf_flow_table_cleanup() and skip nonmatching tables. This avoids
unnecessary iteration and work flushing, and leaves the per-flow cleanup
callback to check only the interface index.

Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
 net/netfilter/nf_flow_table_core.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 03241d4bfd5e..52cca7a8f141 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -730,14 +730,9 @@ static void nf_flow_table_do_cleanup(struct nf_flowtable *flow_table,
 {
 	struct net_device *dev = data;
 
-	if (!dev) {
-		flow_offload_teardown(flow);
-		return;
-	}
-
-	if (net_eq(nf_ct_net(flow->ct), dev_net(dev)) &&
-	    (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
-	     flow->tuplehash[1].tuple.iifidx == dev->ifindex))
+	if (!dev ||
+	    flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
+	    flow->tuplehash[1].tuple.iifidx == dev->ifindex)
 		flow_offload_teardown(flow);
 }
 
@@ -754,8 +749,10 @@ void nf_flow_table_cleanup(struct net_device *dev)
 	struct nf_flowtable *flowtable;
 
 	mutex_lock(&flowtable_lock);
-	list_for_each_entry(flowtable, &flowtables, list)
-		nf_flow_table_gc_cleanup(flowtable, dev);
+	list_for_each_entry(flowtable, &flowtables, list) {
+		if (net_eq(read_pnet(&flowtable->net), dev_net(dev)))
+			nf_flow_table_gc_cleanup(flowtable, dev);
+	}
 	mutex_unlock(&flowtable_lock);
 }
 EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
-- 
2.43.0

Re: [PATCH nf-next] netfilter: flowtable: check namespace before iterating flows

[Phil Sutter]

Hi,

On Wed, Sep 09, 2026 at 04:17:04PM +0800, Qingfang Deng wrote:
> nf_flow_table_cleanup() walks every registered flow table, checking the
> network namespace for each flow in nf_flow_table_do_cleanup(). As a
> result, tables in other namespaces are still iterated and their cleanup
> work is flushed.
> 
> Compare the flow table's namespace with the device's namespace in
> nf_flow_table_cleanup() and skip nonmatching tables. This avoids
> unnecessary iteration and work flushing, and leaves the per-flow cleanup
> callback to check only the interface index.
> 
> Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
> ---
>  net/netfilter/nf_flow_table_core.c | 17 +++++++----------
>  1 file changed, 7 insertions(+), 10 deletions(-)
> 
> diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
> index 03241d4bfd5e..52cca7a8f141 100644
> --- a/net/netfilter/nf_flow_table_core.c
> +++ b/net/netfilter/nf_flow_table_core.c
> @@ -730,14 +730,9 @@ static void nf_flow_table_do_cleanup(struct nf_flowtable *flow_table,
>  {
>  	struct net_device *dev = data;
>  
> -	if (!dev) {
> -		flow_offload_teardown(flow);
> -		return;
> -	}
> -
> -	if (net_eq(nf_ct_net(flow->ct), dev_net(dev)) &&
> -	    (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
> -	     flow->tuplehash[1].tuple.iifidx == dev->ifindex))
> +	if (!dev ||
> +	    flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
> +	    flow->tuplehash[1].tuple.iifidx == dev->ifindex)
>  		flow_offload_teardown(flow);
>  }
>  
> @@ -754,8 +749,10 @@ void nf_flow_table_cleanup(struct net_device *dev)
>  	struct nf_flowtable *flowtable;
>  
>  	mutex_lock(&flowtable_lock);
> -	list_for_each_entry(flowtable, &flowtables, list)
> -		nf_flow_table_gc_cleanup(flowtable, dev);
> +	list_for_each_entry(flowtable, &flowtables, list) {
> +		if (net_eq(read_pnet(&flowtable->net), dev_net(dev)))
> +			nf_flow_table_gc_cleanup(flowtable, dev);
> +	}

A second caller of nf_flow_table_gc_cleanup is
nf_flow_table_indr_cleanup in net/netfilter/nf_flow_table_offload.c. Is
the net_eq-check needed there as well? If not, could you please update
the patch description with a statement explaining why?

Thanks, Phil

>  	mutex_unlock(&flowtable_lock);
>  }
>  EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
> -- 
> 2.43.0
> 
> 

Re: [PATCH nf-next] netfilter: flowtable: check namespace before iterating flows

[Qingfang Deng]

Hi,

On 9/9/2026 7:16 PM, Phil Sutter wrote:
> A second caller of nf_flow_table_gc_cleanup is
> nf_flow_table_indr_cleanup in net/netfilter/nf_flow_table_offload.c. Is
> the net_eq-check needed there as well? If not, could you please update
> the patch description with a statement explaining why?

No. Its callback uses the device bound to the flowtable, which belongs 
to the same namespace.

Kind regards,
Qingfang