linux/include
Fernando Fernandez Mancera 21d033e472 netfilter: nf_conncount: increase the connection clean up limit to 64
After the optimization to only perform one GC per jiffy, a new problem
was introduced. If more than 8 new connections are tracked per jiffy the
list won't be cleaned up fast enough possibly reaching the limit
wrongly.

In order to prevent this issue, only skip the GC if it was already
triggered during the same jiffy and the increment is lower than the
clean up limit. In addition, increase the clean up limit to 64
connections to avoid triggering GC too often and do more effective GCs.

This has been tested using a HTTP server and several
performance tools while having nft_connlimit/xt_connlimit or OVS limit
configured.

Output of slowhttptest + OVS limit at 52000 connections:

 slow HTTP test status on 340th second:
 initializing:        0
 pending:             432
 connected:           51998
 error:               0
 closed:              0
 service available:   YES

Fixes: d265929930 ("netfilter: nf_conncount: reduce unnecessary GC")
Reported-by: Aleksandra Rukomoinikova <ARukomoinikova@k2.cloud>
Closes: https://lore.kernel.org/netfilter/b2064e7b-0776-4e14-adb6-c68080987471@k2.cloud/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
2026-01-20 16:23:37 +01:00
..
acpi ACPI: PCI: IRQ: Fix INTx GSIs signedness 2026-01-05 19:06:40 +01:00
asm-generic hyperv-next for v6.19 2025-12-09 06:10:17 +09:00
clocksource
crypto
cxl
drm drm-misc-fixes for v6.19-rc5: 2026-01-08 07:41:00 +10:00
dt-bindings dt-bindings: phy-common-props: RX and TX lane polarity inversion 2026-01-14 18:16:05 +05:30
hyperv hyperv: Avoid -Wflex-array-member-not-at-end warning 2025-12-18 19:42:01 +00:00
keys
kunit kunit: Enforce task execution in {soft,hard}irq contexts 2025-12-22 12:20:08 -08:00
kvm
linux netkit: Add netkit notifier to check for unregistering devices 2026-01-20 11:58:50 +01:00
math-emu
media
memory
misc
net netfilter: nf_conncount: increase the connection clean up limit to 64 2026-01-20 16:23:37 +01:00
pcmcia
ras Significant patch series in this merge are as follows: 2025-12-05 13:52:43 -08:00
rdma
rv
scsi scsi: core: Fix error handler encryption support 2026-01-04 15:16:20 -05:00
soc This pull request is entirely SoC clk drivers, not for lack of trying to modify 2025-12-08 09:38:52 +09:00
sound ASoC: soc-acpi / SOF: Add best_effort flag to get_function_tplg_files op 2025-12-15 23:08:35 +09:00
target
trace nfsd-6.19 fixes: 2026-01-06 09:12:52 -08:00
uapi netkit: Add single device mode for netkit 2026-01-20 11:58:50 +01:00
ufs
vdso
video
xen
Kbuild