Message-ID: <fb6e4953-a706-49e5-9026-3cc190414984@suse.de>
Date: Thu, 27 Nov 2025 22:31:27 +0100
From: Fernando Fernandez Mancera <fmancera@...e.de>
To: Paolo Abeni <pabeni@...hat.com>, Pablo Neira Ayuso <pablo@...filter.org>,
 netfilter-devel@...r.kernel.org
Cc: davem@...emloft.net, netdev@...r.kernel.org, kuba@...nel.org,
 edumazet@...gle.com, fw@...len.de, horms@...nel.org
Subject: Re: [PATCH net-next,v2 00/16] Netfilter updates for net-next

On 11/27/25 4:08 PM, Paolo Abeni wrote:
> On 11/26/25 9:55 PM, Pablo Neira Ayuso wrote:
>> v2: - Move ifidx to avoid adding a hole, per Eric Dumazet.
>>      - Update pppoe xmit inline patch description, per Qingfang Deng.
>>
>> -o-
>>
>> Hi,
>>
>> The following batch contains Netfilter updates for net-next:
>>   
>> 1) Move the flowtable path discovery code to its own file, the
>>     nft_flow_offload.c mixes the nf_tables evaluation with the path
>>     discovery logic, just split this in two for clarity.
>>   
>> 2) Consolidate flowtable xmit path by using dev_queue_xmit() and the
>>     real device behind the layer 2 vlan/pppoe device. This allows to
>>     inline encapsulation. After this update, hw_ifidx can be removed
>>     since both ifidx and hw_ifidx now point to the same device.
>>   
>> 3) Support for IPIP encapsulation in the flowtable, extend selftest
>>     to cover for this new layer 3 offload, from Lorenzo Bianconi.
>>   
>> 4) Push down the skb into the conncount API to fix duplicates in the
>>     conncount list for packets with non-confirmed conntrack entries,
>>     this is due to an optimization introduced in d265929930e2
>>     ("netfilter: nf_conncount: reduce unnecessary GC").
>>     From Fernando Fernandez Mancera.
>>   
>> 5) In conncount, disable BH when performing garbage collection
>>     to consolidate existing behaviour in the conncount API, also
>>     from Fernando.
>>   
>> 6) A matching packet with a confirmed conntrack invokes GC if
>>     conncount reaches the limit in an attempt to release slots.
>>     This allows the existing extensions to be used for real conntrack
>>     counting, not just limiting new connections, from Fernando.
>>   
>> 7) Support for updating ct count objects in nf_tables, from Fernando.
>>   
>> 8) Extend nft_flowtables.sh selftest to send IPv6 TCP traffic,
>>     from Lorenzo Bianconi.
>>   
>> 9) Fixes for UAPI kernel-doc documentation, from Randy Dunlap.
>>
>> Please, pull these changes from:
>>
>>    git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-25-11-26
>>
>> Thanks.
> 
> The AI review tool found a few possible issue on this PR:
> 
> https://netdev-ai.bots.linux.dev/ai-review.html?id=fd5a6706-c2f8-4cf2-a220-0c01492fdb90
> 
> I'm still digging the report, but I think that at least first item
> reported (possibly wrong ifidx used in nf_flow_offload_ipv6_hook() by
> patch "netfilter: flowtable: consolidate xmit path") makes sense.
> 

Hi Paolo,

I took a look to the reports related to my patches.

Patch 10 - yes, that report is correct. I can follow up with a fix on nf 
tree if that is fine.

Patch 12 - I think that should be fine, nf_conncount_tree_skb() which 
calls count_tree() should called with RCU read lock. This patch didn't 
modify that behavior.

Patch 13 - as we are holding the commit mutex I thought that it wasn't 
needed. Anyway, if that is needed, there are other places where we have 
similar issues that would require a fix too. I can follow up on nf tree.

> I *think* that at least for that specific point it would be better to
> follow-up on net (as opposed to a v3 and possibly miss the cycle), but
> could you please have a look at that report, too?
> 
> Thanks,
> 
> Paolo
> 
> 

Powered by blists - more mailing lists