netns: optimize netns cleaning by batching unhash_nsid calls

Currently, unhash_nsid() scans the entire system for each netns being
killed, leading to O(L_dying_net * M_alive_net * N_id) complexity, as
__peernet2id() also performs a linear search in the IDR.

Optimize this to O(M_alive_net * N_id) by batching unhash operations. Move
unhash_nsid() out of the per-netns loop in cleanup_net() to perform a
single-pass traversal over survivor namespaces.

Identify dying peers by an 'is_dying' flag, which is set under net_rwsem
write lock after the netns is removed from the global list. This batches
the unhashing work and eliminates the O(L_dying_net) multiplier.

To minimize the impact on struct net size, 'is_dying' is placed in an
existing hole after 'hash_mix' in struct net.

Use a restartable idr_get_next() loop for iteration. This avoids the
unsafe modification issue inherent to idr_for_each() callbacks and allows
dropping the nsid_lock to safely call sleepy rtnl_net_notifyid().

Clean up redundant nsid_lock and simplify the destruction loop now that
unhashing is centralized.

Signed-off-by: Qiliang Yuan <yuanql9@chinatelecom.cn>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260204074854.3506916-1-realwujing@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Qiliang Yuan and committed by

Jakub Kicinski 4 months ago 7acee67a 24cf78c7

+22 -13

2 changed files

expand all

include

net

net_namespace.h

net

core

net_namespace.c

include/net/net_namespace.h

··· 121 121 * it is critical that it is on a read_mostly cache line. 122 122 */ 123 123 u32 hash_mix; 124 + bool is_dying; 124 125 125 126 struct net_device *loopback_dev; /* The loopback */ 126 127

+21 -13

net/core/net_namespace.c

··· 624 624 } 625 625 EXPORT_SYMBOL_GPL(net_ns_get_ownership); 626 626 627 - static void unhash_nsid(struct net *net, struct net *last) 627 + static void unhash_nsid(struct net *last) 628 628 { 629 - struct net *tmp; 629 + struct net *tmp, *peer; 630 + 630 631 /* This function is only called from cleanup_net() work, 631 632 * and this work is the only process, that may delete 632 633 * a net from net_namespace_list. So, when the below ··· 635 634 * use for_each_net_rcu() or net_rwsem. 636 635 */ 637 636 for_each_net(tmp) { 638 - int id; 637 + int id = 0; 639 638 640 639 spin_lock(&tmp->nsid_lock); 641 - id = __peernet2id(tmp, net); 642 - if (id >= 0) 643 - idr_remove(&tmp->netns_ids, id); 644 - spin_unlock(&tmp->nsid_lock); 645 - if (id >= 0) 646 - rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL, 640 + while ((peer = idr_get_next(&tmp->netns_ids, &id))) { 641 + int curr_id = id; 642 + 643 + id++; 644 + if (!peer->is_dying) 645 + continue; 646 + 647 + idr_remove(&tmp->netns_ids, curr_id); 648 + spin_unlock(&tmp->nsid_lock); 649 + rtnl_net_notifyid(tmp, RTM_DELNSID, curr_id, 0, NULL, 647 650 GFP_KERNEL); 651 + spin_lock(&tmp->nsid_lock); 652 + } 653 + spin_unlock(&tmp->nsid_lock); 648 654 if (tmp == last) 649 655 break; 650 656 } 651 - spin_lock(&net->nsid_lock); 652 - idr_destroy(&net->netns_ids); 653 - spin_unlock(&net->nsid_lock); 654 657 } 655 658 656 659 static LLIST_HEAD(cleanup_list); ··· 679 674 llist_for_each_entry(net, net_kill_list, cleanup_list) { 680 675 ns_tree_remove(net); 681 676 list_del_rcu(&net->list); 677 + net->is_dying = true; 682 678 } 683 679 /* Cache last net. After we unlock rtnl, no one new net 684 680 * added to net_namespace_list can assign nsid pointer ··· 694 688 last = list_last_entry(&net_namespace_list, struct net, list); 695 689 up_write(&net_rwsem); 696 690 691 + unhash_nsid(last); 692 + 697 693 llist_for_each_entry(net, net_kill_list, cleanup_list) { 698 - unhash_nsid(net, last); 694 + idr_destroy(&net->netns_ids); 699 695 list_add_tail(&net->exit_list, &net_exit_list); 700 696 } 701 697

Configure Feed

Configure Feed