Re: "nft reset counters" bug on 32-bit systems

Andreas Fried <[email protected]> Tue, 23 Sep 2025 18:21:05 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
On 9/10/25 20:08, Florian Westphal wrote:
> I'd suggest to turn nft_counter_reset() into a variant of nft_counter_fetch()
> that uses local_xchg() instead of reads.
> 
> Expensive but reset requests should be rare and its much clearer as to
> what is happening vs. this
> fetch-and-then-add-negative-total-to-one-pcpu-counter.

I'm afraid I'm missing something here. Wouldn't this be too expensive?
nft_counter_fetch() can read the stats from other CPUs without issues,
but that won't work for writing, i.e. local_xchg(), right? local64_t is
only atomic with respect to one CPU, so would we need to schedule work
on each CPU to read and reset the counters?

In d84701ecbcd6ad63faa7a9c18ad670d1c4d561c0, Pablo Neira points out that
cmpxchg will not work unless all other functions also use it, and that's
too slow.

What am I missing?

-- 
Andreas Fried
 
emlix GmbH
Headquarters: Berliner Str. 12, 37073 Goettingen, Germany
Phone +49 (0)551 30664-0, e-mail [email protected]
District Court of Goettingen, Registry Number HR B 3160
Managing Directors: Heike Jordan, Dr. Uwe Kracke
VAT ID No. DE 205 198 055
Office Berlin: Panoramastr. 1, 10178 Berlin, Germany
Office Bonn: Bachstr. 6, 53115 Bonn, Germany
http://www.emlix.com

emlix - your embedded Linux partner