# Re: \[PATCH net v2 1/1\] openvswitch: Fix CT limit teardown use-after-free

- From: Ilya Maximets \<i.maximets@ovn.org\>
- Date: 2026-08-03 12:25:11 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/08/17357626
- Thread: https://ratatoskr.run/netdev/2026/07/17305352/t.md

```text
On 7/22/26 11:19 PM, Ilya Maximets wrote:
> On 7/22/26 10:59 PM, Ilya Maximets wrote:
>> On 7/22/26 6:40 PM, Ren Wei wrote:
>>> From: Yuqi Xu <redacted>
>>>
>>> Packet processing uses CT limit state under RCU, while netns teardown
>>> frees that state under ovs_mutex. The CT limit pointer was neither removed
>>> from readers nor protected by a grace period, allowing packet processing to
>>> dereference the freed state.
>>>
>>> Replace the pointer before freeing the CT limit state. Wait for in-flight
>>> RCU readers before freeing its contents. Serialize CT limit netlink
>>> operations with teardown for the full lifetime of their state accesses.
>>>
>>> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
>>> Cc: <redacted>
>>> Reported-by: Vega <redacted>
>>> Assisted-by: Codex:GPT-5.4
>>> Co-developed-by: Nan Li <redacted>
>>> Signed-off-by: Nan Li <redacted>
>>> Signed-off-by: Yuqi Xu <redacted>
>>> Signed-off-by: Ren Wei <redacted>
>>> ---
Hi.  It's been silent here for a while.  Do you plan to send a new version
of this fix, or should someone else take it over?

Best regards, Ilya Maximets.
```