| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAAVpQUBbdsNPkvL7JHrgqen7DM70S2VYTtgHx-kjWq3ZqB6uqA@mail.gmail.com>
Date: Tue, 27 Jan 2026 18:05:36 -0800
From: Kuniyuki Iwashima <kuniyu@...gle.com>
To: Qiliang Yuan <realwujing@...il.com>
Cc: "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Christian Brauner <brauner@...nel.org>, Sabrina Dubroca <sd@...asysnail.net>,
Jeff Layton <jlayton@...nel.org>, Qiliang Yuan <yuanql9@...natelecom.cn>,
Simon Horman <horms@...nel.org>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next v3] netns: optimize netns cleaning by batching
unhash_nsid calls
On Tue, Jan 27, 2026 at 5:22 PM Qiliang Yuan <realwujing@...il.com> wrote:
>
> Currently, unhash_nsid() scans the entire net_namespace_list for each
> netns in a destruction batch during cleanup_net(). This leads to
> O(M_batch * N_system * M_nsids) complexity, where M_batch is the
> destruction batch size, N_system is the total number of namespaces,
> and M_nsids is the number of IDs in each IDR.
>
> Reduce the complexity to O(N_system * M_nsids) by introducing an
> 'is_dying' flag to mark namespaces being destroyed. This allows
> unhash_nsid() to perform a single-pass traversal over the system's
> namespaces. In this pass, for each survivor namespace, iterate
> through its netns_ids and remove any mappings that point to a marked
> namespace, effectively eliminating the M_batch multiplier.
>
> Signed-off-by: Qiliang Yuan <realwujing@...il.com>
> Signed-off-by: Qiliang Yuan <yuanql9@...natelecom.cn>
Why two SOBs with the same person ?
> ---
> v3:
> - Update target tree to net-next.
> - Post as a new thread instead of a reply.
> v2:
> - Move 'is_dying' setting to __put_net() to eliminate the O(M_batch) loop.
> - Remove redundant initializations in preinit_net().
> v1:
> - Initial implementation of batch unhash_nsid().
>
> include/net/net_namespace.h | 1 +
> net/core/net_namespace.c | 46 ++++++++++++++++++++++++++-----------
> 2 files changed, 34 insertions(+), 13 deletions(-)
>
> diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
> index cb664f6e3558..bd1acc6056ac 100644
> --- a/include/net/net_namespace.h
> +++ b/include/net/net_namespace.h
> @@ -69,6 +69,7 @@ struct net {
>
> unsigned int dev_base_seq; /* protected by rtnl_mutex */
> u32 ifindex;
> + bool is_dying;
>
> spinlock_t nsid_lock;
> atomic_t fnhe_genid;
> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> index a6e6a964a287..50fdd4f9bb3b 100644
> --- a/net/core/net_namespace.c
> +++ b/net/core/net_namespace.c
> @@ -624,9 +624,10 @@ void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
> }
> EXPORT_SYMBOL_GPL(net_ns_get_ownership);
>
> -static void unhash_nsid(struct net *net, struct net *last)
> +static void unhash_nsid(struct net *last)
> {
> struct net *tmp;
> +
> /* This function is only called from cleanup_net() work,
> * and this work is the only process, that may delete
> * a net from net_namespace_list. So, when the below
> @@ -636,20 +637,34 @@ static void unhash_nsid(struct net *net, struct net *last)
> for_each_net(tmp) {
> int id;
>
> - spin_lock(&tmp->nsid_lock);
> - id = __peernet2id(tmp, net);
> - if (id >= 0)
> - idr_remove(&tmp->netns_ids, id);
> - spin_unlock(&tmp->nsid_lock);
> - if (id >= 0)
> - rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
> - GFP_KERNEL);
> + for (id = 0; ; id++) {
Doesn't this rather slow down in a common case where
init_net has ids for other netns since it is never dismantled ?
> + struct net *peer;
> + bool dying;
> +
> + rcu_read_lock();
> + peer = idr_get_next(&tmp->netns_ids, &id);
> + dying = peer && peer->is_dying;
> + rcu_read_unlock();
> +
> + if (!peer)
> + break;
> + if (!dying)
> + continue;
> +
> + spin_lock(&tmp->nsid_lock);
> + if (idr_find(&tmp->netns_ids, id) == peer)
> + idr_remove(&tmp->netns_ids, id);
> + else
> + peer = NULL;
> + spin_unlock(&tmp->nsid_lock);
> +
> + if (peer)
> + rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0,
> + NULL, GFP_KERNEL);
> + }
> if (tmp == last)
> break;
> }
> - spin_lock(&net->nsid_lock);
> - idr_destroy(&net->netns_ids);
> - spin_unlock(&net->nsid_lock);
> }
>
> static LLIST_HEAD(cleanup_list);
> @@ -688,8 +703,12 @@ static void cleanup_net(struct work_struct *work)
> last = list_last_entry(&net_namespace_list, struct net, list);
> up_write(&net_rwsem);
>
> + unhash_nsid(last);
> +
> llist_for_each_entry(net, net_kill_list, cleanup_list) {
> - unhash_nsid(net, last);
> + spin_lock(&net->nsid_lock);
This lock can be removed.
> + idr_destroy(&net->netns_ids);
> + spin_unlock(&net->nsid_lock);
> list_add_tail(&net->exit_list, &net_exit_list);
> }
>
> @@ -739,6 +758,7 @@ static DECLARE_WORK(net_cleanup_work, cleanup_net);
> void __put_net(struct net *net)
> {
> ref_tracker_dir_exit(&net->refcnt_tracker);
> + net->is_dying = true;
> /* Cleanup the network namespace in process context */
> if (llist_add(&net->cleanup_list, &cleanup_list))
> queue_work(netns_wq, &net_cleanup_work);
> --
> 2.51.0
>
Powered by blists - more mailing lists