On 8/12/26 11:59 AM, Yuqi Xu wrote:
Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.
An unprivileged user can trigger this bug from a user and network
namespace, causing a slab-use-after-free in ovs_ct_execute() when the
netns is torn down.
Publish the CT limit pointer through RCU, remove it before teardown, and
wait for readers before freeing its contents. Keep ovs_mutex around
individual CT limit updates, and use the RCU read-side lock while GET
traverses the RCU-protected limit lists.
The netlink command handlers do not need NULL checks because the userspace
netlink socket holds an active reference to its network namespace while a
request is processed. The per-netns exit path therefore cannot run
concurrently with SET, DEL, or GET for that socket's namespace.
The teardown path currently waits for the RCU grace period while holding
ovs_mutex. Moving synchronize_rcu() outside the mutex would require
restructuring the teardown path and is left for a separate change.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: <redacted>
Reported-by: Vega <redacted>
Link: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@gmail.com (local)
Assisted-by: Codex:GPT-5.4
Co-developed-by: Nan Li <redacted>
Signed-off-by: Nan Li <redacted>
Signed-off-by: Yuqi Xu <redacted>
Reviewed-by: Ren Wei <redacted>
---
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>