Vlad Buslov 2be4e8ac2d net/sched: act_ct: additional checks for outdated flows ... commit a63b6622120cd03a304796dbccb80655b3a21798 upstream. Current nf_flow_is_outdated() implementation considers any flow table flow which state diverged from its underlying CT connection status for teardown which can be problematic in the following cases: - Flow has never been offloaded to hardware in the first place either because flow table has hardware offload disabled (flag NF_FLOWTABLE_HW_OFFLOAD is not set) or because it is still pending on 'add' workqueue to be offloaded for the first time. The former is incorrect, the later generates excessive deletions and additions of flows. - Flow is already pending to be updated on the workqueue. Tearing down such flows will also generate excessive removals from the flow table, especially on highly loaded system where the latency to re-offload a flow via 'add' workqueue can be quite high. When considering a flow for teardown as outdated verify that it is both offloaded to hardware and doesn't have any pending updates. Fixes: 41f2c7c342d3 ("net/sched: act_ct: Fix promotion of offloaded unreplied tuple") Reviewed-by: Paul Blakey <paulb@nvidia.com> Signed-off-by: Vlad Buslov <vladbu@nvidia.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-01-10 17:10:36 +01:00
..
6lowpan
9p	net: 9p: avoid freeing uninit memory in p9pdu_vreadf	2024-01-01 12:39:04 +00:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:33:02 +01:00
8021q	net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()	2024-01-01 12:38:57 +00:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:00:19 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:00:17 +01:00
ax25	ax25: move from strlcpy with unused retval to strscpy	2022-08-22 17:55:50 -07:00
batman-adv	net: vlan: introduce skb_vlan_eth_hdr()	2023-12-20 17:00:16 +01:00
bluetooth	Bluetooth: Add more enc key size check	2024-01-01 12:39:03 +00:00
bpf	Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES"	2023-03-17 08:50:32 +01:00
bpfilter
bridge	netfilter: nf_conntrack_bridge: initialize err to 0	2023-11-28 17:07:05 +00:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:50:24 +01:00
can	net: annotate data-races around sk->sk_tsflags	2024-01-10 17:10:23 +01:00
ceph	libceph: use kernel_connect()	2023-10-19 23:08:56 +02:00
core	bpf, sockmap: af_unix stream sockets need to hold ref for pair sock	2024-01-10 17:10:32 +01:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 12:08:17 +02:00
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 11:52:16 +01:00
devlink	devlink: remove reload failed checks in params get/set callbacks	2023-09-23 11:11:01 +02:00
dns_resolver	keys, dns: Fix missing size check of V1 server-list header	2024-01-10 17:10:20 +01:00
dsa	net: dsa: sja1105: always enable the send_meta options	2023-07-19 16:22:06 +02:00
ethernet	net: gro: skb_gro_header helper function	2022-08-25 10:33:21 +02:00
ethtool	ethtool: don't propagate EOPNOTSUPP from dumps	2024-01-10 17:10:32 +01:00
hsr	hsr: Prevent use after free in prp_create_tagged_frame()	2023-11-20 11:52:15 +01:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-10-07 09:29:17 +02:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:38:56 +00:00
ipv4	udp: annotate data-races around udp->encap_type	2024-01-10 17:10:28 +01:00
ipv6	udp: annotate data-races around udp->encap_type	2024-01-10 17:10:28 +01:00
iucv	net/iucv: Fix size of interrupt data	2023-03-22 13:33:50 +01:00
kcm	kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().	2023-09-19 12:28:10 +02:00
key	net: af_key: fix sadb_x_filter validation	2023-08-23 17:52:32 +02:00
l2tp	udp: annotate data-races around udp->encap_type	2024-01-10 17:10:28 +01:00
l3mdev
lapb
llc	llc: verify mac len before reading mac header	2023-11-20 11:52:15 +01:00
mac80211	wifi: mac80211: mesh_plink: fix matches_local logic	2024-01-01 12:38:54 +00:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-05 09:53:08 +01:00
mctp	mctp: perform route lookups under a RCU read-side lock	2023-10-19 23:08:57 +02:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:59:53 +01:00
mptcp	mptcp: prevent tcp diag from closing listener subflows	2024-01-10 17:10:20 +01:00
ncsi	Revert ncsi: Propagate carrier gain/loss events to the NCSI controller	2023-11-28 17:07:18 +00:00
netfilter	netfilter: flowtable: GC pushes back packets to classic path	2024-01-10 17:10:34 +01:00
netlabel	netlabel: fix shift wrapping bug in netlbl_catmap_setlong()	2023-09-13 09:42:24 +02:00
netlink	drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group	2023-12-13 18:39:12 +01:00
netrom	netrom: Deny concurrent connect().	2023-09-13 09:42:35 +02:00
nfc	nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local	2024-01-10 17:10:22 +01:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-24 17:32:45 +01:00
openvswitch	net: openvswitch: reject negative ifindex	2023-08-23 17:52:35 +02:00
packet	packet: Move reference count in packet_sock to atomic_long_t	2023-12-13 18:39:20 +01:00
phonet
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:39:11 +01:00
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-20 12:35:09 +02:00
rds	net: prevent address rewrite in kernel_bind()	2023-10-19 23:08:50 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:39:04 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:38:57 +00:00
rxrpc	rxrpc: Fix hard call timeout units	2023-05-17 11:53:35 +02:00
sched	net/sched: act_ct: additional checks for outdated flows	2024-01-10 17:10:36 +01:00
sctp	sctp: update hb timer immediately after users change hb_interval	2023-10-10 22:00:44 +02:00
smc	net/smc: fix invalid link access in dumping SMC-R connections	2024-01-10 17:10:25 +01:00
strparser
sunrpc	svcrdma: Drop connection after an RDMA Read error	2023-11-28 17:07:11 +00:00
switchdev
tipc	tipc: Fix kernel-infoleak due to uninitialized TLV value	2023-11-28 17:07:05 +00:00
tls	net: tls, update curr on splice as well	2023-12-20 17:00:28 +01:00
unix	bpf, sockmap: af_unix stream sockets need to hold ref for pair sock	2024-01-10 17:10:32 +01:00
vmw_vsock	vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()	2023-12-20 17:00:19 +01:00
wireless	wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x)	2024-01-01 12:39:09 +00:00
x25	net/x25: Fix to not accept on connected socket	2023-02-09 11:28:13 +01:00
xdp	xsk: Skip polling event check for unbound socket	2023-12-13 18:39:08 +01:00
xfrm	net: xfrm: skip policies marked as dead while reinserting policies	2023-10-25 12:03:12 +02:00
compat.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
devres.c
Kconfig	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
socket.c	splice, net: Add a splice_eof op to file-ops and socket-ops	2024-01-10 17:10:27 +01:00
sysctl_net.c