Re: [PATCH net v2 1/1] openvswitch: Fix CT limit teardown use-after-free

[Ilya Maximets <i.maximets@ovn.org>]

On 7/22/26 11:19 PM, Ilya Maximets wrote:
> On 7/22/26 10:59 PM, Ilya Maximets wrote:
>> On 7/22/26 6:40 PM, Ren Wei wrote:
>>> From: Yuqi Xu <xuyuqiabc@gmail.com>
>>>
>>> Packet processing uses CT limit state under RCU, while netns teardown
>>> frees that state under ovs_mutex. The CT limit pointer was neither removed
>>> from readers nor protected by a grace period, allowing packet processing to
>>> dereference the freed state.
>>>
>>> Replace the pointer before freeing the CT limit state. Wait for in-flight
>>> RCU readers before freeing its contents. Serialize CT limit netlink
>>> operations with teardown for the full lifetime of their state accesses.
>>>
>>> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
>>> Cc: stable@vger.kernel.org
>>> Reported-by: Vega <vega@nebusec.ai>
>>> Assisted-by: Codex:GPT-5.4
>>> Co-developed-by: Nan Li <tonanli66@gmail.com>
>>> Signed-off-by: Nan Li <tonanli66@gmail.com>
>>> Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
>>> Signed-off-by: Ren Wei <enjou1224z@gmail.com>
>>> ---
Hi.  It's been silent here for a while.  Do you plan to send a new version
of this fix, or should someone else take it over?

Best regards, Ilya Maximets.