Re: [PATCH nf-next] netfilter: nf_tables: use dedicated mutex for reset operations

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Jan 28, 2026 at 01:09:10AM +0100, Florian Westphal wrote:
> > Brian Witte <brianwitte@mailfence.com> wrote:
> > Maybe its worth investigating if we should instead protect
> > only the reset action itself, i.e. add private reset spinlocks
> > in nft_quota_do_dump() et al?
> 
> Last time we discussed this:
> 
> - There was an attempt to make reset fully atomic (for the whole
>   ruleset), which is not really possible because netlink dumps for a
>   large ruleset might not fit into, not worth trying.
> 
> - Still, there could be two threads resetting the counters at the same
>   time, and someone mentioned underrun is possible.
> 
>   Looking at last for nft_quota, it should be possible to use
>   atomic64_xchg():

Yep, agree, some .dump callbacks can probably be reworked
to use atomic ops for the reset case.

> Then, for nft_counter, it is a bit more complicated, maybe a per-netns
> spinlock for counters is sufficient, to protect this
> nft_counter_do_dump() when the reset flag is true.

Yes, a per-netns spinlock for reset serialization inside the dumper
callbacks is what we discussed, I think its the way to go.