From: Pablo Neira Ayuso <pablo@netfilter.org>
To: gregkh@linuxfoundation.org, sashal@kernel.org
Cc: jianqi.ren.cn@windriver.com, stable@vger.kernel.org,
patches@lists.linux.dev, linux-kernel@vger.kernel.org,
kadlec@netfilter.org, fw@strlen.de, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
kaber@trash.net, netfilter-devel@vger.kernel.org,
coreteam@netfilter.org, netdev@vger.kernel.org
Subject: Re: [PATCH 6.6.y] netfilter: nf_tables: use timestamp to check for set element timeout
Date: Tue, 18 Mar 2025 23:18:57 +0100 [thread overview]
Message-ID: <Z9nxUdl9OcOlEl8L@calendula> (raw)
In-Reply-To: <20250317081632.2997440-1-jianqi.ren.cn@windriver.com>
Hi Greg, Sasha,
This backport is correct, please apply to -stable 6.6
On Mon, Mar 17, 2025 at 04:16:32PM +0800, jianqi.ren.cn@windriver.com wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
>
> [ Upstream commit 7395dfacfff65e9938ac0889dafa1ab01e987d15 ]
>
> Add a timestamp field at the beginning of the transaction, store it
> in the nftables per-netns area.
>
> Update set backend .insert, .deactivate and sync gc path to use the
> timestamp, this avoids that an element expires while control plane
> transaction is still unfinished.
>
> .lookup and .update, which are used from packet path, still use the
> current time to check if the element has expired. And .get path and dump
> also since this runs lockless under rcu read size lock. Then, there is
> async gc which also needs to check the current time since it runs
> asynchronously from a workqueue.
>
> Fixes: c3e1b005ed1c ("netfilter: nf_tables: add set element timeout support")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
> Signed-off-by: He Zhe <zhe.he@windriver.com>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Pablo Neira Ayuso <pablo@netfilter.org>
prev parent reply other threads:[~2025-03-18 22:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-17 8:16 [PATCH 6.6.y] netfilter: nf_tables: use timestamp to check for set element timeout jianqi.ren.cn
2025-03-17 16:40 ` Sasha Levin
2025-03-18 22:18 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z9nxUdl9OcOlEl8L@calendula \
--to=pablo@netfilter.org \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=gregkh@linuxfoundation.org \
--cc=jianqi.ren.cn@windriver.com \
--cc=kaber@trash.net \
--cc=kadlec@netfilter.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.