This is a note to let you know that I've just added the patch titled
net/sched: act_ct: additional checks for outdated flows
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-sched-act_ct-additional-checks-for-outdated-flows.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From a63b6622120cd03a304796dbccb80655b3a21798 Mon Sep 17 00:00:00 2001
From: Vlad Buslov <vladbu@xxxxxxxxxx>
Date: Tue, 24 Oct 2023 21:58:57 +0200
Subject: net/sched: act_ct: additional checks for outdated flows
From: Vlad Buslov <vladbu@xxxxxxxxxx>
commit a63b6622120cd03a304796dbccb80655b3a21798 upstream.
Current nf_flow_is_outdated() implementation considers any flow table flow
which state diverged from its underlying CT connection status for teardown
which can be problematic in the following cases:
- Flow has never been offloaded to hardware in the first place either
because flow table has hardware offload disabled (flag
NF_FLOWTABLE_HW_OFFLOAD is not set) or because it is still pending on 'add'
workqueue to be offloaded for the first time. The former is incorrect, the
later generates excessive deletions and additions of flows.
- Flow is already pending to be updated on the workqueue. Tearing down such
flows will also generate excessive removals from the flow table, especially
on highly loaded system where the latency to re-offload a flow via 'add'
workqueue can be quite high.
When considering a flow for teardown as outdated verify that it is both
offloaded to hardware and doesn't have any pending updates.
Fixes: 41f2c7c342d3 ("net/sched: act_ct: Fix promotion of offloaded unreplied tuple")
Reviewed-by: Paul Blakey <paulb@xxxxxxxxxx>
Signed-off-by: Vlad Buslov <vladbu@xxxxxxxxxx>
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/sched/act_ct.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -277,6 +277,8 @@ err_nat:
static bool tcf_ct_flow_is_outdated(const struct flow_offload *flow)
{
return test_bit(IPS_SEEN_REPLY_BIT, &flow->ct->status) &&
+ test_bit(IPS_HW_OFFLOAD_BIT, &flow->ct->status) &&
+ !test_bit(NF_FLOW_HW_PENDING, &flow->flags) &&
!test_bit(NF_FLOW_HW_ESTABLISHED, &flow->flags);
}
Patches currently in stable-queue which might be from vladbu@xxxxxxxxxx are
queue-6.1/net-sched-act_ct-take-per-cb-reference-to-tcf_ct_flo.patch
queue-6.1/netfilter-flowtable-allow-unidirectional-rules.patch
queue-6.1/netfilter-flowtable-cache-info-of-last-offload.patch
queue-6.1/net-sched-act_ct-always-fill-offloading-tuple-iifidx.patch
queue-6.1/net-sched-act_ct-fix-promotion-of-offloaded-unreplie.patch
queue-6.1/net-sched-act_ct-offload-udp-new-connections.patch
queue-6.1/net-sched-act_ct-additional-checks-for-outdated-flows.patch
