Re: [PATCH nf-next] netfilter: nf_tables: use dedicated mutex for reset operations

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Feb 03, 2026 at 12:06:43AM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Jan 28, 2026 at 01:09:10AM +0100, Florian Westphal wrote:
> > > Brian Witte <brianwitte@mailfence.com> wrote:
> > > Maybe its worth investigating if we should instead protect
> > > only the reset action itself, i.e. add private reset spinlocks
> > > in nft_quota_do_dump() et al?
> > 
> > Last time we discussed this:
> > 
> > - There was an attempt to make reset fully atomic (for the whole
> >   ruleset), which is not really possible because netlink dumps for a
> >   large ruleset might not fit into, not worth trying.
> > 
> > - Still, there could be two threads resetting the counters at the same
> >   time, and someone mentioned underrun is possible.
> > 
> >   Looking at last for nft_quota, it should be possible to use
> >   atomic64_xchg():
> 
> Yep, agree, some .dump callbacks can probably be reworked
> to use atomic ops for the reset case.

Only quota and counter regard the reset flag at this stage.

> > Then, for nft_counter, it is a bit more complicated, maybe a per-netns
> > spinlock for counters is sufficient, to protect this
> > nft_counter_do_dump() when the reset flag is true.
> 
> Yes, a per-netns spinlock for reset serialization inside the dumper
> callbacks is what we discussed, I think its the way to go.

OK.