Re: [PATCH net 1/1] openvswitch: avoid reallocating confirmed conntrack labels

[Ilya Maximets <i.maximets@ovn.org>]

On 9/12/26 3:22 PM, Zhiling Zou wrote:
> ovs_ct_get_conn_labels() adds the labels extension when a conntrack
> entry does not have one.  Confirmed conntracks can be read locklessly,
> so adding an extension may reallocate and free the extension block
> while another CPU accesses it.
> 
> Only add the extension for unconfirmed conntracks.  A confirmed
> conntrack without labels now fails the caller's label operation instead
> of reallocating its extension storage.
> 
> Fixes: c2ac66735870 ("openvswitch: Allow matching on conntrack label")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
>  net/openvswitch/conntrack.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
> index 27115967e5d93..0f433688e17b9 100644
> --- a/net/openvswitch/conntrack.c
> +++ b/net/openvswitch/conntrack.c
> @@ -366,7 +366,7 @@ static struct nf_conn_labels *ovs_ct_get_conn_labels(struct nf_conn *ct)
>  	struct nf_conn_labels *cl;
>  
>  	cl = nf_ct_labels_find(ct);
> -	if (!cl) {
> +	if (!cl && !nf_ct_is_confirmed(ct)) {
>  		nf_ct_labels_ext_add(ct);
>  		cl = nf_ct_labels_find(ct);
>  	}

Reviewed-by: Ilya Maximets <i.maximets@ovn.org>