nf_flow_table_init() adds the flowtable to the global flowtables list.
However, tcf_ct_flow_table_get() sets the table's network namespace only
after that call, leaving a window where the published table has a NULL
namespace pointer.

Set the namespace before calling nf_flow_table_init() so that flowtable
list walkers can rely on it being initialized.

Fixes: fc54d9065f90 ("net/sched: act_ct: set 'net' pointer when creating new nf_flow_table")
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
 net/sched/act_ct.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 9080cb386c16..6bd19db68d97 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -349,10 +349,10 @@ static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)
 	ct_ft->nf_ft.type = &flowtable_ct;
 	ct_ft->nf_ft.flags |= NF_FLOWTABLE_HW_OFFLOAD |
 			      NF_FLOWTABLE_COUNTER;
+	write_pnet(&ct_ft->nf_ft.net, net);
 	err = nf_flow_table_init(&ct_ft->nf_ft);
 	if (err)
 		goto err_init;
-	write_pnet(&ct_ft->nf_ft.net, net);
 
 	__module_get(THIS_MODULE);
 out_unlock:
-- 
2.43.0

> nf_flow_table_init() adds the flowtable to the global flowtables list.
> However, tcf_ct_flow_table_get() sets the table's network namespace only
> after that call, leaving a window where the published table has a NULL
> namespace pointer.

The window does exist, but can any existing code path actually read
flowtable->net during this window? Could you also describe that path
in the commit message?

Thanks,
Xuanqiang

Hi,

On 2026/9/10 14:09, Xuanqiang Luo wrote:
>> nf_flow_table_init() adds the flowtable to the global flowtables list.
>> However, tcf_ct_flow_table_get() sets the table's network namespace only
>> after that call, leaving a window where the published table has a NULL
>> namespace pointer.
>
> The window does exist, but can any existing code path actually read
> flowtable->net during this window? Could you also describe that path
> in the commit message? 

There's none. The patch is a preparation for:
https://lore.kernel.org/netfilter-devel/20260909081705.1512600-1-qingfang.deng@linux.dev/

Kind regards,
Qingfang

On 9/10/26 5:03 PM, Qingfang Deng wrote:
> Hi,
>
> On 2026/9/10 14:09, Xuanqiang Luo wrote:
>>> nf_flow_table_init() adds the flowtable to the global flowtables list.
>>> However, tcf_ct_flow_table_get() sets the table's network namespace 
>>> only
>>> after that call, leaving a window where the published table has a NULL
>>> namespace pointer.
>>
>> The window does exist, but can any existing code path actually read
>> flowtable->net during this window? Could you also describe that path
>> in the commit message? 
>
> There's none. The patch is a preparation for:
> https://lore.kernel.org/netfilter-devel/20260909081705.1512600-1-qingfang.deng@linux.dev/ 
>
>
Thanks for clarifying.

Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Thanks,
Xuanqiang