* [PATCH nf-next v3 1/3] net/mlx5e: Ignore FLOW_ACTION_PRIORITY on flowtable offload
2026-10-04 17:16 [PATCH nf-next v3 0/3] netfilter: flowtable: carry a priority into the offload Julius Bairaktaris
@ 2026-10-04 17:16 ` Julius Bairaktaris
2026-10-05 17:16 ` sashiko-bot
2026-10-04 17:16 ` [PATCH nf-next v3 2/3] netfilter: flowtable: carry a priority into the offload Julius Bairaktaris
2026-10-04 17:16 ` [PATCH nf-next v3 3/3] selftests: netfilter: nft_flowtable.sh: check the priority a flow carries Julius Bairaktaris
2 siblings, 1 reply; 7+ messages in thread
From: Julius Bairaktaris @ 2026-10-04 17:16 UTC (permalink / raw)
To: pablo, fw
Cc: phil, netfilter-devel, coreteam, netdev, lorenzo, nbd,
matthias.bgg, angelogioacchino.delregno, andrew+netdev, davem,
edumazet, kuba, pabeni, horms, corbet, rdunlap, skhan, linux-doc,
linux-kselftest, linux-mediatek, linux-arm-kernel, saeedm, leon,
tariqt, mbloch, linux-rdma, linux-kernel
The next patch makes the flowtable emit FLOW_ACTION_PRIORITY for flows
with a non-zero skb->priority, which on IPv4 includes the priority
ip_forward() derives from the TOS by default. mlx5 would reject these
rules and stop offloading flows it offloads today.
The eswitch does not use skb->priority for these flows, so accept the
action on flowtable flows and ignore it. tc flower rules with skbedit
priority are still rejected.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
---
.../net/ethernet/mellanox/mlx5/core/Makefile | 2 +-
.../mellanox/mlx5/core/en/tc/act/act.c | 1 +
.../mellanox/mlx5/core/en/tc/act/act.h | 1 +
.../mellanox/mlx5/core/en/tc/act/prio.c | 22 +++++++++++++++++++
4 files changed, 25 insertions(+), 1 deletion(-)
create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/prio.c
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Makefile b/drivers/net/ethernet/mellanox/mlx5/core/Makefile
index 19e50f0d55af..8bd352e7f20d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Makefile
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Makefile
@@ -54,7 +54,7 @@ mlx5_core-$(CONFIG_MLX5_CLS_ACT) += en/tc/act/act.o en/tc/act/drop.o en/tc/a
en/tc/act/accept.o en/tc/act/mark.o en/tc/act/goto.o \
en/tc/act/tun.o en/tc/act/csum.o en/tc/act/pedit.o \
en/tc/act/vlan.o en/tc/act/vlan_mangle.o en/tc/act/mpls.o \
- en/tc/act/mirred.o en/tc/act/mirred_nic.o \
+ en/tc/act/mirred.o en/tc/act/mirred_nic.o en/tc/act/prio.o \
en/tc/act/ct.o en/tc/act/sample.o en/tc/act/ptype.o \
en/tc/act/redirect_ingress.o en/tc/act/police.o
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
index 0380a04c3691..91a3bab5e498 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
@@ -23,6 +23,7 @@ static struct mlx5e_tc_act *tc_acts_fdb[NUM_FLOW_ACTIONS] = {
[FLOW_ACTION_ADD] = &mlx5e_tc_act_pedit,
[FLOW_ACTION_CSUM] = &mlx5e_tc_act_csum,
[FLOW_ACTION_PTYPE] = &mlx5e_tc_act_ptype,
+ [FLOW_ACTION_PRIORITY] = &mlx5e_tc_act_prio,
[FLOW_ACTION_SAMPLE] = &mlx5e_tc_act_sample,
[FLOW_ACTION_POLICE] = &mlx5e_tc_act_police,
[FLOW_ACTION_CT] = &mlx5e_tc_act_ct,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
index 2e528b2c34d6..bacbc862970e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
@@ -81,6 +81,7 @@ extern struct mlx5e_tc_act mlx5e_tc_act_goto;
extern struct mlx5e_tc_act mlx5e_tc_act_tun_encap;
extern struct mlx5e_tc_act mlx5e_tc_act_tun_decap;
extern struct mlx5e_tc_act mlx5e_tc_act_csum;
+extern struct mlx5e_tc_act mlx5e_tc_act_prio;
extern struct mlx5e_tc_act mlx5e_tc_act_pedit;
extern struct mlx5e_tc_act mlx5e_tc_act_vlan;
extern struct mlx5e_tc_act mlx5e_tc_act_vlan_mangle;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/prio.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/prio.c
new file mode 100644
index 000000000000..2a047059574b
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/prio.c
@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
+
+#include "act.h"
+#include "en/tc_priv.h"
+
+static int
+tc_act_parse_prio(struct mlx5e_tc_act_parse_state *parse_state,
+ const struct flow_action_entry *act,
+ struct mlx5e_priv *priv,
+ struct mlx5_flow_attr *attr)
+{
+ /* The eswitch does not apply skb->priority to flowtable flows. */
+ if (mlx5e_is_ft_flow(parse_state->flow))
+ return 0;
+
+ NL_SET_ERR_MSG_MOD(parse_state->extack, "skbedit priority is not supported");
+ return -EOPNOTSUPP;
+}
+
+struct mlx5e_tc_act mlx5e_tc_act_prio = {
+ .parse_action = tc_act_parse_prio,
+};
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH nf-next v3 2/3] netfilter: flowtable: carry a priority into the offload
2026-10-04 17:16 [PATCH nf-next v3 0/3] netfilter: flowtable: carry a priority into the offload Julius Bairaktaris
2026-10-04 17:16 ` [PATCH nf-next v3 1/3] net/mlx5e: Ignore FLOW_ACTION_PRIORITY on flowtable offload Julius Bairaktaris
@ 2026-10-04 17:16 ` Julius Bairaktaris
2026-10-05 17:16 ` sashiko-bot
2026-10-04 17:16 ` [PATCH nf-next v3 3/3] selftests: netfilter: nft_flowtable.sh: check the priority a flow carries Julius Bairaktaris
2 siblings, 1 reply; 7+ messages in thread
From: Julius Bairaktaris @ 2026-10-04 17:16 UTC (permalink / raw)
To: pablo, fw
Cc: phil, netfilter-devel, coreteam, netdev, lorenzo, nbd,
matthias.bgg, angelogioacchino.delregno, andrew+netdev, davem,
edumazet, kuba, pabeni, horms, corbet, rdunlap, skhan, linux-doc,
linux-kselftest, linux-mediatek, linux-arm-kernel, saeedm, leon,
tariqt, mbloch, linux-rdma, linux-kernel
Packets forwarded by the flowtable skip the ruleset, so a priority set
by "meta priority set" before "flow add" only applies to the first
packets of a connection, and drivers never see it.
Store skb->priority of the packet that creates the flow, apply it in
the software fast path and emit it as FLOW_ACTION_PRIORITY, the action
act_skbedit uses. Flows without a priority are unchanged. On IPv4,
ip_forward() derives a priority from the TOS by default, so a flow can
carry one without a rule. The priority applies to both directions.
airoha uses it as the QoS queue of flows that leave through a GDM port,
as its software path does, mtk ignores it like FLOW_ACTION_CSUM, and
mlx5 ignores it on flowtable flows (previous patch). airoha and mtk
parse tc flower rules in the same function, so they now also accept
skbedit priority there.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
---
Documentation/networking/nf_flowtable.rst | 4 +++-
drivers/net/ethernet/airoha/airoha_ppe.c | 3 +++
drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 1 +
include/net/netfilter/nf_flow_table.h | 1 +
net/netfilter/nf_flow_table_ip.c | 6 ++++++
net/netfilter/nf_flow_table_offload.c | 11 +++++++++++
net/netfilter/nft_flow_offload.c | 2 ++
7 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/Documentation/networking/nf_flowtable.rst b/Documentation/networking/nf_flowtable.rst
index d757c21c10f2..5844ab19aec6 100644
--- a/Documentation/networking/nf_flowtable.rst
+++ b/Documentation/networking/nf_flowtable.rst
@@ -71,7 +71,9 @@ forwarding path including the Netfilter hooks and the flowtable fastpath bypass.
The flowtable entry also stores the NAT configuration, so all packets are
mangled according to the NAT policy that is specified from the classic IP
-forwarding path. The TTL is decremented before calling neigh_xmit(). Fragmented
+forwarding path. The TTL is decremented before calling neigh_xmit(). The flow
+also stores the priority of the packet that created it, so a priority set before
+``flow add`` applies to the packets that the flowtable forwards. Fragmented
traffic is passed up to follow the classic IP forwarding path given that the
transport header is missing, in this case, flowtable lookups are not possible.
TCP RST and FIN packets are also passed up to the classic IP forwarding path to
diff --git a/drivers/net/ethernet/airoha/airoha_ppe.c b/drivers/net/ethernet/airoha/airoha_ppe.c
index 92611802801e..e790305ea955 100644
--- a/drivers/net/ethernet/airoha/airoha_ppe.c
+++ b/drivers/net/ethernet/airoha/airoha_ppe.c
@@ -1161,6 +1161,9 @@ static int airoha_ppe_flow_offload_replace(struct airoha_eth *eth,
case FLOW_ACTION_REDIRECT:
odev = act->dev;
break;
+ case FLOW_ACTION_PRIORITY:
+ priority = act->priority;
+ break;
case FLOW_ACTION_CSUM:
break;
case FLOW_ACTION_VLAN_PUSH:
diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
index 99b28aaa7cc4..4ee99e8e4a34 100644
--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
@@ -378,6 +378,7 @@ mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f,
case FLOW_ACTION_REDIRECT:
odev = act->dev;
break;
+ case FLOW_ACTION_PRIORITY:
case FLOW_ACTION_CSUM:
break;
case FLOW_ACTION_VLAN_PUSH:
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index f2e2771f188f..23218c8cbc3d 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -202,6 +202,7 @@ struct flow_offload {
unsigned long flags;
u16 type;
u32 timeout;
+ u32 priority;
struct rcu_head rcu_head;
};
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index c8c29a9a1684..c85e2d608c32 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -509,6 +509,9 @@ static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx,
ip_decrease_ttl(iph);
skb_clear_tstamp(skb);
+ if (flow->priority)
+ skb->priority = flow->priority;
+
if (flow_table->flags & NF_FLOWTABLE_COUNTER)
nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
@@ -1104,6 +1107,9 @@ static int nf_flow_offload_ipv6_forward(struct nf_flowtable_ctx *ctx,
ip6h->hop_limit--;
skb_clear_tstamp(skb);
+ if (flow->priority)
+ skb->priority = flow->priority;
+
if (flow_table->flags & NF_FLOWTABLE_COUNTER)
nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len);
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 801a3dd9ceea..caaadffc2563 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -696,6 +696,17 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow,
flow_offload_eth_dst(net, flow, dir, flow_rule) < 0)
return -1;
+ if (flow->priority) {
+ struct flow_action_entry *entry;
+
+ entry = flow_action_entry_next(flow_rule);
+ if (!entry)
+ return -1;
+
+ entry->id = FLOW_ACTION_PRIORITY;
+ entry->priority = flow->priority;
+ }
+
tuple = &flow->tuplehash[dir].tuple;
for (i = 0; i < tuple->encap_num; i++) {
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index 32b4281038dd..c8eaf7bc356d 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -117,6 +117,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
if (tcph)
flow_offload_ct_tcp(ct);
+ flow->priority = pkt->skb->priority;
+
__set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags);
ret = flow_offload_add(flowtable, flow);
if (ret < 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH nf-next v3 2/3] netfilter: flowtable: carry a priority into the offload
2026-10-04 17:16 ` [PATCH nf-next v3 2/3] netfilter: flowtable: carry a priority into the offload Julius Bairaktaris
@ 2026-10-05 17:16 ` sashiko-bot
0 siblings, 0 replies; 7+ messages in thread
From: sashiko-bot @ 2026-10-05 17:16 UTC (permalink / raw)
To: Julius Bairaktaris; +Cc: linux-rdma
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] tc: mtk_ppe: silently ignores FLOW_ACTION_PRIORITY for TC flower offload
--
commit a587674714a18a7d90f4418de25fb5ffa3691fa3
Author: Julius Bairaktaris <julius@bairaktaris.de>
netfilter: flowtable: carry a priority into the offload
This commit updates the flowtable to store the skb->priority of the packet
that creates the flow, and emit it as FLOW_ACTION_PRIORITY during offload.
It also updates the airoha and mtk drivers to parse this action in their
shared flowtable and TC flower offload functions.
> diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
> index 99b28aaa7cc47..4ee99e8e4a34b 100644
> --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
> +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
[ ... ]
> @@ -378,6 +378,7 @@ mtk_flow_offload_replace(struct mtk_eth *eth, struct flow_cls_offload *f,
> case FLOW_ACTION_REDIRECT:
> odev = act->dev;
> break;
> + case FLOW_ACTION_PRIORITY:
> case FLOW_ACTION_CSUM:
> break;
[Severity: Medium]
Does this silently ignore explicit QoS queuing requests from TC flower?
Because mtk_flow_offload_replace() is shared for both netfilter flowtable
and TC flower offloads, accommodating flowtable packets by returning success
here causes the driver to also accept and silently discard "skbedit priority"
actions from TC rules.
Hardware will silently drop the explicit QoS queuing request instead of
returning -EOPNOTSUPP, causing traffic to use default queues instead of
the requested priority queue without warning the user.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261004171636.3545085-1-julius@bairaktaris.de?part=2
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH nf-next v3 3/3] selftests: netfilter: nft_flowtable.sh: check the priority a flow carries
2026-10-04 17:16 [PATCH nf-next v3 0/3] netfilter: flowtable: carry a priority into the offload Julius Bairaktaris
2026-10-04 17:16 ` [PATCH nf-next v3 1/3] net/mlx5e: Ignore FLOW_ACTION_PRIORITY on flowtable offload Julius Bairaktaris
2026-10-04 17:16 ` [PATCH nf-next v3 2/3] netfilter: flowtable: carry a priority into the offload Julius Bairaktaris
@ 2026-10-04 17:16 ` Julius Bairaktaris
2026-10-05 17:16 ` sashiko-bot
2 siblings, 1 reply; 7+ messages in thread
From: Julius Bairaktaris @ 2026-10-04 17:16 UTC (permalink / raw)
To: pablo, fw
Cc: phil, netfilter-devel, coreteam, netdev, lorenzo, nbd,
matthias.bgg, angelogioacchino.delregno, andrew+netdev, davem,
edumazet, kuba, pabeni, horms, corbet, rdunlap, skhan, linux-doc,
linux-kselftest, linux-mediatek, linux-arm-kernel, saeedm, leon,
tariqt, mbloch, linux-rdma, linux-kernel
Count the forwarded TCP packets that leave with priority 0:3 and those
that leave with none, first without a priority and then with "meta
priority set 0:3" ahead of "flow add". With the priority set, every
packet must carry it, including those the flowtable forwards. Runs for
IPv4 and IPv6.
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
---
.../selftests/net/netfilter/nft_flowtable.sh | 110 ++++++++++++++++++
1 file changed, 110 insertions(+)
diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
index 449c518bd947..73c7b1ec2208 100755
--- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
+++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
@@ -458,6 +458,106 @@ fi
check_dscp "dscp_fwd" "$pmtu"
}
+check_priority()
+{
+ local what="$1"
+ local pmtu="$2"
+ local ok=1
+
+ local counter
+ counter=$(ip netns exec "$nsr1" nft reset counter netdev priocheck prio3 | grep packets)
+ local pc3=${counter%*bytes*}
+ pc3=${pc3#*packets}
+
+ counter=$(ip netns exec "$nsr1" nft reset counter netdev priocheck prio0 | grep packets)
+ local pc0=${counter%*bytes*}
+ pc0=${pc0#*packets}
+
+ local failmsg="FAIL: pmtu $pmtu: $what counters do not match, expected"
+
+ case "$what" in
+ "prio_none")
+ if [ "$pc3" -gt 0 ] || [ "$pc0" -eq 0 ]; then
+ echo "$failmsg prio3 == 0, prio0 > 0, but got $pc3,$pc0" 1>&2
+ ret=1
+ ok=0
+ fi
+ ;;
+ "prio_fwd")
+ if [ "$pc3" -eq 0 ] || [ "$pc0" -gt 0 ]; then
+ echo "$failmsg prio3 > 0, prio0 == 0, but got $pc3,$pc0" 1>&2
+ ret=1
+ ok=0
+ fi
+ ;;
+ *)
+ echo "FAIL: pmtu $pmtu: unknown priority check $what" 1>&2
+ ret=1
+ ok=0
+ esac
+
+ if [ "$ok" -eq 1 ] ;then
+ echo "PASS: $what: priority packet counters match"
+ fi
+}
+
+test_tcp_forwarding_set_priority()
+{
+ local pmtu="$3"
+ local proto="$4"
+ local dstip="$5"
+ local dstport="$6"
+ local lret=0
+
+ip netns exec "$nsr1" nft -f - <<EOF
+table netdev priocheck {
+ counter prio0 { }
+ counter prio3 { }
+
+ chain egress0 {
+ type filter hook egress device "veth0" priority 0; policy accept
+ meta l4proto tcp meta priority 0:3 counter name "prio3"
+ meta l4proto tcp meta priority none counter name "prio0"
+ }
+
+ chain egress1 {
+ type filter hook egress device "veth1" priority 0; policy accept
+ meta l4proto tcp meta priority 0:3 counter name "prio3"
+ meta l4proto tcp meta priority none counter name "prio0"
+ }
+}
+EOF
+ if [ $? -ne 0 ]; then
+ echo "SKIP: Could not load netdev:egress for veth0 and veth1"
+ return 0
+ fi
+
+ if ! test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"; then
+ lret=1
+ fi
+ check_priority "prio_none" "$pmtu"
+
+ # The flow stores the priority set before it is added, so the packets
+ # the flowtable forwards leave with it too, in both directions.
+ip netns exec "$nsr1" nft -f - <<EOF
+table inet prioset {
+ chain forward {
+ type filter hook forward priority -1; policy accept
+ meta priority set 0:3
+ }
+}
+EOF
+ if ! test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"; then
+ lret=1
+ fi
+ check_priority "prio_fwd" "$pmtu"
+
+ ip netns exec "$nsr1" nft delete table inet prioset
+ ip netns exec "$nsr1" nft delete table netdev priocheck
+
+ return $lret
+}
+
test_tcp_forwarding_nat()
{
local nsa="$1"
@@ -516,6 +616,11 @@ else
ret=1
fi
+if ! test_tcp_forwarding_set_priority "$ns1" "$ns2" 0 6 "[dead:2::99]" 12345; then
+ echo "FAIL: IPv6 flow offload for ns1/ns2 with priority update" 1>&2
+ ret=1
+fi
+
# delete default route, i.e. ns2 won't be able to reach ns1 and
# will depend on ns1 being masqueraded in nsr1.
# expect ns1 has nsr1 address.
@@ -572,6 +677,11 @@ if ! test_tcp_forwarding_set_dscp "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
exit 0
fi
+if ! test_tcp_forwarding_set_priority "$ns1" "$ns2" 1 4 10.0.2.99 12345; then
+ echo "FAIL: flow offload for ns1/ns2 with priority update and pmtu discovery" 1>&2
+ ret=1
+fi
+
ip netns exec "$nsr1" nft reset counters table inet filter >/dev/null
if ! test_tcp_forwarding_nat "$ns1" "$ns2" 1 ""; then
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH nf-next v3 3/3] selftests: netfilter: nft_flowtable.sh: check the priority a flow carries
2026-10-04 17:16 ` [PATCH nf-next v3 3/3] selftests: netfilter: nft_flowtable.sh: check the priority a flow carries Julius Bairaktaris
@ 2026-10-05 17:16 ` sashiko-bot
0 siblings, 0 replies; 7+ messages in thread
From: sashiko-bot @ 2026-10-05 17:16 UTC (permalink / raw)
To: Julius Bairaktaris; +Cc: linux-rdma
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] selftests: netfilter: flaky priority test due to race in counter reset
--
commit fb5120bafad5d9a740fa81fe7c9587aaad2d26eb
Author: Julius Bairaktaris <julius@bairaktaris.de>
selftests: netfilter: nft_flowtable.sh: check the priority a flow carries
Count the forwarded TCP packets that leave with priority 0:3 and those
that leave with none, first without a priority and then with "meta
priority set 0:3" ahead of "flow add". With the priority set, every
packet must carry it, including those the flowtable forwards. Runs for
IPv4 and IPv6.
> diff --git a/tools/testing/selftests/net/netfilter/nft_flowtable.sh b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> index 449c518bd947d..73c7b1ec2208b 100755
> --- a/tools/testing/selftests/net/netfilter/nft_flowtable.sh
> +++ b/tools/testing/selftests/net/netfilter/nft_flowtable.sh
[ ... ]
> @@ -458,6 +458,106 @@ fi
> check_dscp "dscp_fwd" "$pmtu"
> }
>
> +check_priority()
> +{
[ ... ]
> +test_tcp_forwarding_set_priority()
> +{
> + local pmtu="$3"
> + local proto="$4"
> + local dstip="$5"
> + local dstport="$6"
> + local lret=0
> +
> +ip netns exec "$nsr1" nft -f - <<EOF
> +table netdev priocheck {
> + counter prio0 { }
> + counter prio3 { }
> +
> + chain egress0 {
> + type filter hook egress device "veth0" priority 0; policy accept
> + meta l4proto tcp meta priority 0:3 counter name "prio3"
> + meta l4proto tcp meta priority none counter name "prio0"
> + }
> +
> + chain egress1 {
> + type filter hook egress device "veth1" priority 0; policy accept
> + meta l4proto tcp meta priority 0:3 counter name "prio3"
> + meta l4proto tcp meta priority none counter name "prio0"
> + }
> +}
> +EOF
> + if [ $? -ne 0 ]; then
> + echo "SKIP: Could not load netdev:egress for veth0 and veth1"
> + return 0
> + fi
> +
> + if ! test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"; then
> + lret=1
> + fi
> + check_priority "prio_none" "$pmtu"
[Severity: Medium]
Could this introduce test flakiness due to a race condition?
The test_tcp_forwarding_ip() function runs a socat TCP transfer and returns
as soon as the socat processes exit. However, final TCP packets (like FIN or
ACK) may still be in flight in the network namespaces.
When check_priority "prio_none" reads and resets the netfilter counters
immediately after the transfer completes, any delayed packet from this first
unprioritized run that arrives after the reset will increment the prio0
counter.
> +
> + # The flow stores the priority set before it is added, so the packets
> + # the flowtable forwards leave with it too, in both directions.
> +ip netns exec "$nsr1" nft -f - <<EOF
> +table inet prioset {
> + chain forward {
> + type filter hook forward priority -1; policy accept
> + meta priority set 0:3
> + }
> +}
> +EOF
> + if ! test_tcp_forwarding_ip "$1" "$2" "$pmtu" "$proto" "$dstip" "$dstport"; then
> + lret=1
> + fi
> + check_priority "prio_fwd" "$pmtu"
[Severity: Medium]
If a delayed packet from the first run incremented prio0 after the reset,
will it cause this check to fail spuriously?
The prio_fwd check expects prio0 to remain exactly 0. If delayed packets
from the previous run are still trickling through, this might lead to
random test failures in kselftests.
> +
> + ip netns exec "$nsr1" nft delete table inet prioset
> + ip netns exec "$nsr1" nft delete table netdev priocheck
> +
> + return $lret
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261004171636.3545085-1-julius@bairaktaris.de?part=3
^ permalink raw reply [flat|nested] 7+ messages in thread