# Re: \[PATCH net v4 1/1\] openvswitch: Fix CT limit teardown use-after-free

- From: Yuqi Xu \<hidden\>
- Date: 2026-08-11 04:46:21 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/08/17394693
- Thread: https://ratatoskr.run/netdev/2026/08/17372132/t.md

```text
Hi Jakub,

Thanks for the review. You are right that the CT-limit netlink command
handlers cannot race with netns teardown.

The handlers derive their netns from sock_net(skb->sk), while the
userspace netlink socket holds an active reference to that netns and
delivery to the kernel receiver is synchronous. Therefore
ovs_ct_limit_exit() cannot run concurrently with SET, DEL, or GET for
that socket's netns.

For v5, I will remove the unreachable NULL handling from SET and DEL,
including the uninstalled-allocation free, and remove the GET NULL check
and its new -ENOENT result. This restores the previous command-path
semantics and removes the corresponding teardown-race explanation.

The RCU pointer replacement and grace period remain necessary for packet
processing, which can access ct_limit_info while netns teardown removes
the state. GET will retain its RCU read-side section for traversal of the
RCU-protected limit list.

I will also update the ovs_net::ct_limit_info kernel-doc to document the
RCU protection, ovs_mutex serialization for updates and teardown, and the
transient NULL state during teardown.

Thanks again,
Yuqi
```