From nobody Sat Feb 7 17:56:00 2026 Received: from mail-dy1-f175.google.com (mail-dy1-f175.google.com [74.125.82.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE3527E0E8 for ; Fri, 30 Jan 2026 02:29:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769740201; cv=none; b=l6uApho4ev1taEVoDtWLHeQioTod0gscRX8GUZk6eduN3iUtmhwdvBqt2cFAyrbkcq5T+58SGXvMy5tHy9zwVFKxyiCummCF/xdRmj4AKfsRY5hpSLUpKGfcA6q58/akPSO94rFwIzR/9ZaLgp7dPmDpIxjoRvUJnw7+DTWgO7w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769740201; c=relaxed/simple; bh=Hpy7Ihf3i1gURmCZqvZpH2haL+/JX9vw1L+0TwSCoM0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=WMxwGxU+G8iYta+mXvAyKZyYq6t1QydZU8vsZTFjhc5c7pBg4F0MO22ozQC1BLgfeBkNby/92ukytKi1eeCaOxlk+v+S/w9amf7T3SwTzh3HQfWJY3GWhgUfJlhk+h+BqJkbn5M1ppbk7PNXSZY0lUE4N3SK9mwU9dDoK0Y11oM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=V+4iYFGU; arc=none smtp.client-ip=74.125.82.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="V+4iYFGU" Received: by mail-dy1-f175.google.com with SMTP id 5a478bee46e88-2b720bb90d0so1730272eec.0 for ; Thu, 29 Jan 2026 18:29:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1769740199; x=1770344999; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=L8pSvMXbcScI7VOTlnNV6K7+YBBPc5KlELWYhGa9o+w=; b=V+4iYFGUv7jH0E4F8vzKRU0xCWlWxyoRVrU3BW/XxiBQvzbT0dukr3ix/cpPqpE4pI bpVTnswXmQVpBqn/2YgzZJ0xVtPQVmloo0dbX/AXhGOmNCFY/B52AdIa6KF0ivvElHt7 U2HHD6DbhgLZkRjzuCwZ+oWIpgudntcz1AfGhhE8z1ZNbm6mnWW49PGZ9auciBRqSJT2 ebsyE4z1bxbkeOLcKeP/neGffJi9biAo5J+9pBbwGJqtKFVT75WB8d5Kob7pkh2xslbl KBhQzvLQ3g/2Y96ROMCtfUG7o7a7M2URmZtZYIqEadw62/ejoQbUZ7mz6+MJqfKGK06/ plow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769740199; x=1770344999; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=L8pSvMXbcScI7VOTlnNV6K7+YBBPc5KlELWYhGa9o+w=; b=ZYufYIy/GJJHvOx8TJj5PSg6NSf4mndLiN100xh6qFKIDn2V8VWPH56lEJ6Vc/pa89 BI1TcEeJs9nPaWVYJdZxVXpfKZu/9tXyGtLpcI8TJcObsfMKB56QHm4Yr12PnZ0XU/gy xVaKrpdS5cvU4GtKMmIUTHgBjIyA0mFjGThs8MBy+p5WusLOiwIwUXq/77aeWL3azRFb zx/eT46ueDSEyyHjFYORihdgghgjg7AJJfeYABc3LdLicl4gxkQoDGneBKvV6IHHESgj TNzUPeBDBbTXKutdM6QZj9siNvMsQho+Ub0G1CZaantC3poAKn74gJxsHIvLeHEUIyBA pAUg== X-Forwarded-Encrypted: i=1; AJvYcCXqk+t2HcUH5ORe0RNFc8j1/XaQMjUL8x2Ak1DRbCh+ho08esbaHI5fHcP8OSqNnwH7DWorJXHJjJEyOQs=@vger.kernel.org X-Gm-Message-State: AOJu0YyxZDrrnNT/GqUmSoMwn/IEv4FznPP/rv0FoDCI3hYJdN0pgJiG 3pCOdjz/GAYF2vJRbAvMMUcKGSa4LZXVCTIMsCHCDTLGg6fOl3vu9zqR X-Gm-Gg: AZuq6aLE9I41SoUm4PUbJnbyl+dGUcWkfyHkgt2VCJS2SlcO7ejww5eZPjJpcBgvyGo LaIAkFT+hu4kQWyYYvuauu4dQE0Wh/VdqKJifjwLs4vh+EVOxltug6jLaz6oP71yD9bbvr8RaoL v3GUMP0IXA5hizGS9b7bfJunFFKqX509gPVBrWT3Ndy3h/tBR7v3MwVDLz6eVR/pyypx7kvw8j1 VR9oBSzZ04531ZqHquHdkd1x90+xXvSU3xDLcffyazCARV1XxOkVLL49BlGDhiFiXbfSMSjiV/x +i5d0drVNRLqevnRrJSNoo32kkrRz6Gxo6NYWBky+wenCX6M7lqOWD6r2QtnkaY8CNa8DZq2au7 Q2SSsh4b0u2CRSj4CmjH0agwGUMFmMG9wuZGY50o9/QTey4eroUCEnHZSsUNPt4zMC5rg/vAEQs LRxuI= X-Received: by 2002:a05:7300:6da1:b0:2b4:80f0:3bf3 with SMTP id 5a478bee46e88-2b7c8632b58mr626406eec.1.1769740198655; Thu, 29 Jan 2026 18:29:58 -0800 (PST) Received: from debian ([74.48.213.230]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2b7b9e2774asm4331618eec.24.2026.01.29.18.29.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Jan 2026 18:29:58 -0800 (PST) From: Qiliang Yuan To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Christian Brauner , Kuniyuki Iwashima , Jan Kara , Jeff Layton , Qiliang Yuan Cc: Qiliang Yuan , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v4] netns: optimize netns cleaning by batching unhash_nsid calls Date: Thu, 29 Jan 2026 21:29:37 -0500 Message-ID: <20260130022951.2489133-1-realwujing@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Currently, unhash_nsid() scans the entire system for each netns being killed, leading to O(M_batch * N_system * log(N_ids)) complexity. Optimize this to O(N_system * N_ids) by batching unhash operations. Move unhash_nsid() out of the per-netns loop in cleanup_net() to perform a single-pass traversal over survivor namespaces using idr_for_each(). Identify dying peers by an 'is_dying' flag, which is set under net_rwsem write lock after the netns is removed from the global list. This batches the unhashing work and eliminates the O(M_batch) multiplier. Clean up redundant nsid_lock and simplify the destruction loop now that unhashing is centralized. Signed-off-by: Qiliang Yuan --- v4: - Move unhash_nsid() out of the batch loop to reduce complexity from O(M*N= ) to O(N). - Use idr_for_each() for efficient, single-pass IDR traversal. - Mark 'is_dying' under net_rwsem to safely identify and batch unhashing. - Simplify destruction loop by removing redundant locking and per-netns un= hash logic. v3: - Update target tree to net-next. - Post as a new thread instead of a reply. v2: - Move 'is_dying' setting to __put_net() to eliminate the O(M_batch) loop. - Remove redundant initializations in preinit_net(). v1: - Initial implementation of batch unhash_nsid(). include/net/net_namespace.h | 1 + net/core/net_namespace.c | 41 +++++++++++++++++++++++-------------- 2 files changed, 27 insertions(+), 15 deletions(-) diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h index cb664f6e3558..bd1acc6056ac 100644 --- a/include/net/net_namespace.h +++ b/include/net/net_namespace.h @@ -69,6 +69,7 @@ struct net { =20 unsigned int dev_base_seq; /* protected by rtnl_mutex */ u32 ifindex; + bool is_dying; =20 spinlock_t nsid_lock; atomic_t fnhe_genid; diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index a6e6a964a287..9ea05fb9df5b 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -624,9 +624,29 @@ void net_ns_get_ownership(const struct net *net, kuid_= t *uid, kgid_t *gid) } EXPORT_SYMBOL_GPL(net_ns_get_ownership); =20 -static void unhash_nsid(struct net *net, struct net *last) +static int unhash_nsid_callback(int id, void *p, void *data) +{ + struct net *tmp =3D data; + struct net *peer =3D p; + + if (peer->is_dying) { + spin_lock(&tmp->nsid_lock); + if (idr_find(&tmp->netns_ids, id) =3D=3D peer) + idr_remove(&tmp->netns_ids, id); + else + peer =3D NULL; + spin_unlock(&tmp->nsid_lock); + + if (peer) + rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL, GFP_KERNEL); + } + return 0; +} + +static void unhash_nsid(struct net *last) { struct net *tmp; + /* This function is only called from cleanup_net() work, * and this work is the only process, that may delete * a net from net_namespace_list. So, when the below @@ -634,22 +654,10 @@ static void unhash_nsid(struct net *net, struct net *= last) * use for_each_net_rcu() or net_rwsem. */ for_each_net(tmp) { - int id; - - spin_lock(&tmp->nsid_lock); - id =3D __peernet2id(tmp, net); - if (id >=3D 0) - idr_remove(&tmp->netns_ids, id); - spin_unlock(&tmp->nsid_lock); - if (id >=3D 0) - rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL, - GFP_KERNEL); + idr_for_each(&tmp->netns_ids, unhash_nsid_callback, tmp); if (tmp =3D=3D last) break; } - spin_lock(&net->nsid_lock); - idr_destroy(&net->netns_ids); - spin_unlock(&net->nsid_lock); } =20 static LLIST_HEAD(cleanup_list); @@ -674,6 +682,7 @@ static void cleanup_net(struct work_struct *work) llist_for_each_entry(net, net_kill_list, cleanup_list) { ns_tree_remove(net); list_del_rcu(&net->list); + net->is_dying =3D true; } /* Cache last net. After we unlock rtnl, no one new net * added to net_namespace_list can assign nsid pointer @@ -688,8 +697,10 @@ static void cleanup_net(struct work_struct *work) last =3D list_last_entry(&net_namespace_list, struct net, list); up_write(&net_rwsem); =20 + unhash_nsid(last); + llist_for_each_entry(net, net_kill_list, cleanup_list) { - unhash_nsid(net, last); + idr_destroy(&net->netns_ids); list_add_tail(&net->exit_list, &net_exit_list); } =20 --=20 2.51.0