<div dir="ltr"><div>Acked-by: Zachary Tahenakos <<a href="mailto:zachary.tahenakos@canonical.com">zachary.tahenakos@canonical.com</a>></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 7, 2022 at 10:58 AM Bodong Wang <<a href="mailto:bodong@nvidia.com">bodong@nvidia.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">From: Paul Blakey <<a href="mailto:paulb@nvidia.com" target="_blank">paulb@nvidia.com</a>> BugLink: <a href="https://bugs.launchpad.net/bugs/1963948" rel="noreferrer" target="_blank">https://bugs.launchpad.net/bugs/1963948</a> Flow table lookup is skipped if packet either went through ct clear action (which set the IP_CT_UNTRACKED flag on the packet), or while switching zones and there is already a connection associated with the packet. This will result in no SW offload of the connection, and the and connection not being removed from flow table with TCP teardown (fin/rst packet). To fix the above, remove these unneccary checks in flow table lookup. Fixes: 46475bb20f4b ("net/sched: act_ct: Software offload of established flows") Signed-off-by: Paul Blakey <<a href="mailto:paulb@nvidia.com" target="_blank">paulb@nvidia.com</a>> Acked-by: Marcelo Ricardo Leitner <<a href="mailto:marcelo.leitner@gmail.com" target="_blank">marcelo.leitner@gmail.com</a>> Signed-off-by: David S. Miller <<a href="mailto:davem@davemloft.net" target="_blank">davem@davemloft.net</a>> (cherry picked from commit 2f131de361f6d0eaff17db26efdb844c178432f8) Signed-off-by: Bodong Wang <<a href="mailto:bodong@nvidia.com" target="_blank">bodong@nvidia.com</a>> --- net/sched/act_ct.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 8a78cbd..1c3d0b2 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -511,11 +511,6 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, struct nf_conn *ct; u8 dir; - /* Previously seen or loopback */ - ct = nf_ct_get(skb, &ctinfo); - if ((ct && !nf_ct_is_template(ct)) || ctinfo == IP_CT_UNTRACKED) - return false; - switch (family) { case NFPROTO_IPV4: if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple, &tcph)) -- 1.8.3.1 -- kernel-team mailing list <a href="mailto:kernel-team@lists.ubuntu.com" target="_blank">kernel-team@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/kernel-team" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/kernel-team</a> </blockquote></div></div>