Files
Centos-kernel-stream-9/tools
CKI KWF Bot 789b1c9c2d Merge: netfilter: nfnetlink_queue: optimize verdict lookup with hash table
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8357

JIRA: https://redhat.atlassian.net/browse/RHEL-150728

The current implementation uses a linear list to find queued packets by
ID when processing verdicts from userspace. With large queue depths and
out-of-order verdicting, this O(n) lookup becomes a significant
bottleneck, causing userspace verdict processing to dominate CPU time.

Replace the linear search with a hash table for O(1) average-case
packet lookup by ID. A global rhashtable spanning all network
namespaces attributes hash bucket memory to kernel but is subject to
fixed upper bound.

Also includes the relevant selftest changes.
Most changes to the selftests here are dependencies.
SCTP and UDPGRO test not backported, SCTP was very flaky and would need
more followups, UDPGRO test would fail because we lack the relevant nfqueue
fixes.

Omitted-fix: 4e97d521c2be094718c4c5c7c4f785e8972b4af0 ("selftests: netfilter: nft_queue.sh: sctp coverage")
Unrelated to this feature
Omitted-fix: 59ecffa3995e70a675beeb870f0b3a28470428de ("selftests: netfilter: nft_queue.sh: add udp fraglist gro test case")
)
Unrelated to this feature and would need a lot more backporting work.

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Approved-by: Phil Sutter <psutter@redhat.com>
Approved-by: Eric Garver <egarver@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2026-08-17 08:11:10 +00:00
..