netfilter offload could bloat up memory

[Roi Dayan]

SRU Justification:

* Explain the bug(s)

Memory bloat and aging active ct conns can happen from any stress test as we have a single orkqueue for handling the ct offload conns for add/del/stats actions.

* brief explanation of fixes

The first patch (which is already upstream) splits the add, del, and stats work into separate work queues. The second patch limits the number of entries on the add work queue.

* How to test

Testing was done with just stress traffic with lots of conns different 5-tuple.

* What it could break.

Can take a lot of memory for a long time and also causing active conns to age out when not necessary.

---

ct offload actions like add/del/stats are done in workqueue which can be bloat up in stress tests. can also cause active conns to age out.

one upstream commit to help with this is this
2ed37183abb7 netfilter: flowtable: separate replace, destroy and stats to different workqueues

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-bluefield - 5.4.0-1011.14

---------------
linux-bluefield (5.4.0-1011.14) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1011.14 -proposed tracker (LP: #1923761)

  * kernel crash with stress CT offload traffic (LP: #1922672)
    - netfilter: conntrack: Move nf_ct_offload_timeout to header file
    - netfilter: flowtable: Set offload timeout when adding flow

  * support offloading of ct_state flags invalid and reply (LP: #1922682)
    - net/sched: cls_flower add CT_FLAGS_INVALID flag support
    - net/sched: act_api: fix miss set post_ct for ovs after do conntrack in
      act_ct
    - net/sched: act_ct: clear post_ct if doing ct_clear
    - net/sched: cls_flower: Add match on the ct_state reply flag
    - net: flow_offload: Add original direction flag to ct_metadata

  * netfilter offload could bloat up memory (LP: #1922678)
    - netfilter: flowtable: separate replace, destroy and stats to different
      workqueues
    - SAUCE: netfilter: nf_flow_table_offload: Limit work entries on offload add
      wq

  * TLS fixes (LP: #1916508)
    - net/tls: Add asynchronous resync
    - net/tls: fix sign extension issue when left shifting u16 value
    - net/tls: Fix wrong record sn in async mode of device resync

  * ipmb_host.c: Fix slow transactions (LP: #1922393)
    - SAUCE: ipmb_host.c: Fix slow transactions

  * i2c-mlx.c: sync up with upstream (LP: #1921506)
    - SAUCE: Syncup i2c-mlx driver with upstreamed version

  [ Ubuntu: 5.4.0-73.82 ]

  * focal/linux: 5.4.0-73.82 -proposed tracker (LP: #1923781)
  * Packaging resync (LP: #1786013)
    - update dkms package versions
  * CIFS DFS entries not accessible with 5.4.0-71.74-generic (LP: #1923670)
    - Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting
      cifs_sb->prepath."
  * CVE-2021-29650
    - Revert "netfilter: x_tables: Update remaining dereference to RCU"
    - Revert "netfilter: x_tables: Switch synchronization to RCU"
    - netfilter: x_tables: Use correct memory barriers.
  * LRMv4: switch to signing nvidia modules via the Ubuntu Modules signing key
    (LP: #1918134)
    - [Packaging] dkms-build{,--nvidia-N} sync back from LRMv4
  * 5.4 kernel: when iommu is on crashdump fails (LP: #1922738)
    - iommu/vt-d: Refactor find_domain() helper
    - iommu/vt-d: Add attach_deferred() helper
    - iommu/vt-d: Move deferred device attachment into helper function
    - iommu/vt-d: Do deferred attachment in iommu_need_mapping()
    - iommu/vt-d: Remove deferred_attach_domain()
    - iommu/vt-d: Simplify check in identity_mapping()
  * Backport mlx5e fix for tunnel offload (LP: #1921769)
    - net/mlx5e: Check tunnel offload is required before setting SWP
  * Bcache bypasse writeback on caching device with fragmentation (LP: #1900438)
    - bcache: consider the fragmentation when update the writeback rate
  * Fix implicit declaration warnings for kselftests/memfd test on newer
    releases (LP: #1910323)
    - selftests/memfd: Fix implicit declaration warnings
  * net/mlx5e: Add missing capability check for uplink follow (LP: #1921104)
    - net/mlx5e: Add missing capability check for uplink follow
  * [UBUNUT 21.04] s390/vti...