Re: [PATCH net] net: openvswitch: fix nf_connlabels leak in ovs_ct_init
From: Ilya Maximets <i.maximets@ovn.org>
Date: 2026-08-15 01:05:41
Also in:
lkml
On 8/14/26 3:40 PM, Ruoyu Wang wrote:
ovs_ct_init() acquires a connlabels reference before initializing the
conntrack limit state. If ovs_ct_limit_init() fails, its error is returned
directly. The pernet core does not invoke the exit callback for the
operation whose initialization failed, so ovs_ct_exit() cannot drop the
reference.
This leaves labels_used elevated when Open vSwitch pernet registration
fails for an existing network namespace. Subsequent conntrack entries in
that namespace may allocate label extensions even though Open vSwitch
failed to register.
Drop the connlabels reference before returning a conntrack limit
initialization error. ovs_ct_limit_init() already releases its partial
state, and the original error remains unchanged.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")Should add Cc: for the stable here.
quoted hunk ↗ jump to hunk
Signed-off-by: Ruoyu Wang <redacted> --- net/openvswitch/conntrack.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 95697d4e16e64..fbaa677144143 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c@@ -2001,6 +2001,9 @@ int ovs_ct_init(struct net *net) { unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; struct ovs_net *ovs_net = net_generic(net, ovs_net_id); +#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) + int err; +#endif
No need to guard it with a macro. It should be cleaner to initialize as zero and return err in both cases in the end.
quoted hunk ↗ jump to hunk
if (nf_connlabels_get(net, n_bits - 1)) { ovs_net->xt_label = false;@@ -2010,7 +2013,10 @@ int ovs_ct_init(struct net *net) } #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) - return ovs_ct_limit_init(net, ovs_net); + err = ovs_ct_limit_init(net, ovs_net); + if (err && ovs_net->xt_label) + nf_connlabels_put(net); + return err; #else return 0; #endif