Re: [PATCH net v2 1/1] openvswitch: Fix CT limit teardown use-after-free

On 7/22/26 11:19 PM, Ilya Maximets wrote:

On 7/22/26 10:59 PM, Ilya Maximets wrote:

quoted

On 7/22/26 6:40 PM, Ren Wei wrote:

quoted

From: Yuqi Xu <redacted>

Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.

Replace the pointer before freeing the CT limit state. Wait for in-flight
RCU readers before freeing its contents. Serialize CT limit netlink
operations with teardown for the full lifetime of their state accesses.

Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Assisted-by: Codex:GPT-5.4
Co-developed-by: Nan Li <redacted>
Signed-off-by: Nan Li <redacted>
Signed-off-by: Yuqi Xu <redacted>
Signed-off-by: Ren Wei <redacted>
---

Hi.  It's been silent here for a while.  Do you plan to send a new version
of this fix, or should someone else take it over?

Best regards, Ilya Maximets.