Re: [PATCH v4 nf-next 2/2] netfilter: nf_tables: serialize reset with spinlock and atomic

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Feb 04, 2026 at 07:08:05PM +0100, Florian Westphal wrote:
> Brian Witte <brianwitte@mailfence.com> wrote:
> > On Mon, Feb 03, 2026 at 11:19:46PM +0100, Pablo Neira Ayuso wrote:
> > > Maybe this so it covers for get and dump path?
> > >
> > > static struct nftables_pernet *nft_pernet_from_nlskb(const struct sk_buff *skb)
> > > {
> > >         struct sock *sk = skb->sk ? : NETLINK_CB(skb).sk;
> > >
> > >         return nft_pernet(sock_net(sk));
> > > }
> > >
> > > in case it is worth to skip the unique nft_counter_lock below.
> > 
> > I have v5 ready with Florian's global DEFINE_SPINLOCK approach:
> > split into 3 patches (revert, counter spinlock, quota atomic64_xchg),
> > with nft_counter_fetch_and_reset() wrapping fetch+reset under the
> > lock so parallel resets can't both read the same values. Tested and
> > working.
> 
> Thanks.
> 
> > Before I send: should I go with the global spinlock, or would you
> > prefer the per-net lock via nft_pernet_from_nlskb()? Happy to do
> > either.
> 
> I don't think the nft_pernet_from_nlskb() will work as-is, for the
> get requests the target skb is allocated via alloc_skb() and I don't
> think the control block is initialised to hold the origin netlink query
> sk.

This is GET path:

static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
                                  struct sock *ssk)
{
        int ret;
        struct netlink_sock *nlk = nlk_sk(sk);
 
        ret = -ECONNREFUSED;
        if (nlk->netlink_rcv != NULL) {
                ret = skb->len;
                atomic_add(skb->truesize, &sk->sk_rmem_alloc);
                netlink_skb_set_owner_r(skb, sk);
                NETLINK_CB(skb).sk = ssk; <---------------------
                netlink_deliver_tap_kernel(sk, ssk, skb);
                nlk->netlink_rcv(skb);
                consume_skb(skb);