CT: check offload bit on table dump

[Dan Jurgens]

SRU Justification:

possible race cleaning ct conns too early.

* Explain the bug(s)

There is a possible race between updating established conn timeout
and initial timeout expiring.

* brief explanation of fixes

in normal flow, established conns gets thier timeout extended to a day and
the GC keeps extending them if timeout is below half a day.
but it looks like there is a possible race that the intial timeout expired
before that timeout was extended.
this is a temporary fix and still being investigated how to avoid this
potential race on the timeout.

* How to test

huge amount of traffic, we used ixia traffic generator. during traffic can dump conntrack
using "conntrack -L" or "cat /proc/net/nf_conntrack" this sometimes helps reproduce faster.
after conns offloaded stop the traffic and wait few seconds. now check if all conntrack conns
still offloaded. we noticed sometimes few conns are missing.

* What it could break.

ct conns expiring too soon. so sometimes idle sessions starting traffic again would have some
first packets not offloaded and conntrack would reoffload the ct conn.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-bluefield - 5.4.0-1013.16

---------------
linux-bluefield (5.4.0-1013.16) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1013.16 -proposed tracker (LP: #1930009)

  * Automate soft reset of BlueField ARM via GPIO7 (LP: #1929736)
    - SAUCE: Automate soft reset of BlueField ARM via GPIO7

  * Remove dependency between module and driver (LP: #1927246)
    - net/sched: act_ct: Make tcf_ct_flow_table_restore_skb inline
    - netfilter: flowtable: Make nf_flow_table_offload_add/del_cb inline

  * Increase flow insertion rate by using rw lock instead of mutex on the flow
    block. (LP: #1927251)
    - netfilter: flowtable: Use rw sem as flow block lock
    - netfilter: flowtable: Free block_cb when being deleted

  * oob_net0 file transfers can crash kernel (LP: #1928852)
    - SAUCE: mlxbf_gige: syncup with v1.23 content

  * CT: Fix CT template allocation for zone 0 (LP: #1929460)
    - SAUCE: net/sched: act_ct: Fix ct template allocation for zone 0

  * CT: Offload connections with commit action (LP: #1929459)
    - SAUCE: net/sched: act_ct: Offload connections with commit action

  * CT: check offload bit on table dump (LP: #1929458)
    - SAUCE: netfilter: conntrack: Check offload bit on table dump

  * Memleak on restore flow when offloading conntrack. (LP: #1929844)
    - SAUCE: skbuff: Release nfct refcount on napi stolen or re-used skbs

  [ Ubuntu: 5.4.0-75.84 ]

  * focal/linux: 5.4.0-75.84 -proposed tracker (LP: #1930032)
  * Packaging resync (LP: #1786013)
    - update dkms package versions
  * CVE-2021-33200
    - bpf: Wrap aux data inside bpf_sanitize_info container
    - bpf: Fix mask direction swap upon off reg sign change
    - bpf: No need to simulate speculative domain for immediates
  * Realtek USB hubs in Dell WD19SC/DC/TB fail to work after exiting s2idle
    (LP: #1928242)
    - USB: Verify the port status when timeout happens during port suspend
  * CVE-2020-26145
    - ath10k: drop fragments with multicast DA for SDIO
    - ath10k: add CCMP PN replay protection for fragmented frames for PCIe
    - ath10k: drop fragments with multicast DA for PCIe
  * CVE-2020-26141
    - ath10k: Fix TKIP Michael MIC verification for PCIe
  * CVE-2020-24588
    - mac80211: properly handle A-MSDUs that start with an RFC 1042 header
    - cfg80211: mitigate A-MSDU aggregation attacks
    - mac80211: drop A-MSDUs on old ciphers
    - ath10k: drop MPDU which has discard flag set by firmware for SDIO
  * CVE-2020-26139
    - mac80211: do not accept/forward invalid EAPOL frames
  * CVE-2020-24586 // CVE-2020-24587 // CVE-2020-24587 for such cases.
    - mac80211: extend protection against mixed key and fragment cache attacks
  * CVE-2020-24586 // CVE-2020-24587
    - mac80211: prevent mixed key and fragment cache attacks
    - mac80211: add fragment cache to sta_info
    - mac80211: check defrag PN against current frame
    - mac80211: prevent attacks on TKIP/WEP as well
  * CVE-2020-26147
    - mac80211: assure all fragments are encrypted
  * raid10: Block discard is very slow, causing severe delays for mkfs and
    fstrim operations (LP: #1896578)
    - md: add md_submit_discard_bio() for subm...