Re: [PATCH net 1/1] openvswitch: Fix CT limit teardown use-after-free

On Sun, Jul 19, 2026 at 11:54:31PM -0700, Yuan Tan wrote:

On 7/19/26 19:52, Andrew Lunn wrote:

quoted

On Mon, Jul 20, 2026 at 10:14:16AM +0800, Ren Wei wrote:

quoted

From: Yuqi Xu <redacted>

Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.

Replace the pointer before freeing the CT limit state. Wait for in-flight
RCU readers before freeing its contents. Serialize CT limit netlink
operations with teardown for the full lifetime of their state accesses.

Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>

Is Vega a person?

Hi Andrew,

Thank you very much for your review!
For context, we had previously understood that using the tool name in
the Reported-by tag was acceptable, based on examples such as
Reported-by: AutonomousCodeSecurity@microsoft.com and Reported-by:
Anthropic.

https://lore.kernel.org/all/20260630171016.11c02dec@kernel.org/ (local)

https://docs.kernel.org/process/submitting-patches.html

  The Reported-by tag gives credit to people who find bugs and report
  them and it hopefully inspires them to help us again in the
  future. The tag is intended for bugs; please do not use it to credit
  feature requests. The tag should be followed by a Closes: tag
  pointing to the report, unless the report is not available on the
  web.

If you believe this is out of date, please submit a patch with new
text to this document.

I find it valuable being a person. It indicate somebody is bothered by
the problem you are fixing. We see a lot theoretical bug fixes, which
in practice nobody ever hit. I would prefer to spend my time reviewing
real issues, not theoretical issues, and the Reported-by: is a quick
indicator of this.

quoted

quoted

Assisted-by: Codex:GPT-5.4
Co-developed-by: Nan Li <redacted>
Signed-off-by: Nan Li <redacted>
Signed-off-by: Yuqi Xu <redacted>
Reviewed-by: Ren Wei <redacted>

Please take a look at
https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
and the sections that follow. What is listed here does not follow the
rules.

After reading this document, did you spot the second issues?

      Andrew