Re: [PATCH net 1/1] openvswitch: Fix CT limit teardown use-after-free

On Mon, Jul 20, 2026 at 12:30 PM Aaron Conole [off-list ref] wrote:

Andrew Lunn [off-list ref] writes:

quoted

On Sun, Jul 19, 2026 at 11:54:31PM -0700, Yuan Tan wrote:

quoted

On 7/19/26 19:52, Andrew Lunn wrote:

quoted

On Mon, Jul 20, 2026 at 10:14:16AM +0800, Ren Wei wrote:

quoted

From: Yuqi Xu <redacted>

Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.

Replace the pointer before freeing the CT limit state. Wait for in-flight
RCU readers before freeing its contents. Serialize CT limit netlink
operations with teardown for the full lifetime of their state accesses.

Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>

Is Vega a person?

Hi Andrew,

Thank you very much for your review!
For context, we had previously understood that using the tool name in
the Reported-by tag was acceptable, based on examples such as
Reported-by: AutonomousCodeSecurity@microsoft.com and Reported-by:
Anthropic.

https://lore.kernel.org/all/20260630171016.11c02dec@kernel.org/ (local)

https://docs.kernel.org/process/submitting-patches.html

  The Reported-by tag gives credit to people who find bugs and report
  them and it hopefully inspires them to help us again in the
  future. The tag is intended for bugs; please do not use it to credit
  feature requests. The tag should be followed by a Closes: tag
  pointing to the report, unless the report is not available on the
  web.

If you believe this is out of date, please submit a patch with new
text to this document.

It is common practice to accept syzbot reports as well, which look like:

    Reported-by: syzbot+36256deb69a588e9290e@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=36256deb69a588e9290e

(see commit 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 for example).

quoted

I find it valuable being a person. It indicate somebody is bothered by
the problem you are fixing. We see a lot theoretical bug fixes, which
in practice nobody ever hit. I would prefer to spend my time reviewing
real issues, not theoretical issues, and the Reported-by: is a quick
indicator of this.

+1

In the case of syzbot reports, they are real actionable reports that we
can look at and address (and I agree with your sentiment of wanting to
focus on real issues).  They include the 'Closes:' tag as well, and a
reviewer can just visit the link and see the splat.  If there is a
report link that this Vega tool pushes, maybe that would be acceptable
since it's the way syzbot works as well.  It also makes sense to update
the documentation to reflect how it is used currently.

As for the v2, it would help my review to include some kind of
reproducer description - I usually try to experience OVS splats for
myself.

Hi Andrew and Aaron,

Thank you very much for your feedback!

In fact, all of the bugs for which we have submitted patches have been
reproduced with working PoCs. We also include detailed information
about the bug, the PoC, and the QEMU crash log in the cover letter.
Previously, however, we did not send the cover letters to the public
mailing list due to security concerns.

For example, this particular bug is a use-after-free write that can be
triggered from a user namespace. Based on our analysis, we believe it
is likely exploitable for local privilege escalation.

Going forward, we will send all cover letters to the public mailing
list. We apologize for any inconvenience caused by our previous
approach.

In addition, we plan to launch a website (in approximately one week)
containing the bug detail, PoCs and crash logs for all the bugs we
have found, making them easier for maintainer to view, browse and
search. We also plan to include bugs found by other tools, such as
Sashiko.

Besides, I will send a patch to update the document.

quoted

quoted

quoted

Assisted-by: Codex:GPT-5.4
Co-developed-by: Nan Li <redacted>
Signed-off-by: Nan Li <redacted>
Signed-off-by: Yuqi Xu <redacted>
Reviewed-by: Ren Wei <redacted>

Please take a look at
https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
and the sections that follow. What is listed here does not follow the
rules.

After reading this document, did you spot the second issues?

      Andrew

Hi Andrew,

I have read through the document several times, but I am still not
sure what you mean by the second issue. Could you please clarify which
specific issue you are referring to?

At the moment, all of our patches are reviewed by Ren Wei before they
are sent out. Are you referring to that Ren Wei is not included with a
Signed-off-by tag? We did consider adding one, although I was
concerned that including too many tags might make the commit message
unnecessarily cluttered.

Thank you for the clarification.

Best,
Yuan