On 7/22/26 11:19 PM, Ilya Maximets wrote:
On 7/22/26 10:59 PM, Ilya Maximets wrote:
quoted
On 7/22/26 6:40 PM, Ren Wei wrote:
quoted
From: Yuqi Xu <redacted>
Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.
Replace the pointer before freeing the CT limit state. Wait for in-flight
RCU readers before freeing its contents. Serialize CT limit netlink
operations with teardown for the full lifetime of their state accesses.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: <redacted>
Reported-by: Vega <redacted>
Assisted-by: Codex:GPT-5.4
Co-developed-by: Nan Li <redacted>
Signed-off-by: Nan Li <redacted>
Signed-off-by: Yuqi Xu <redacted>
Signed-off-by: Ren Wei <redacted>
---
Hi. It's been silent here for a while. Do you plan to send a new version
of this fix, or should someone else take it over?
Best regards, Ilya Maximets.