Sven Auhagen <Sven.Auhagen@xxxxxxxxxxxx> wrote: > + if (unlikely(!test_bit(IPS_ASSURED_BIT, &flow->ct->status))) { > + spin_lock_bh(&flow->ct->lock); > + flow->ct->proto.tcp.state = TCP_CONNTRACK_ESTABLISHED; > + spin_unlock_bh(&flow->ct->lock); > + set_bit(IPS_ASSURED_BIT, &flow->ct->status); Uh. Whats going on here? ASSURED bit prevents early-eviction, it should not be set at random.