Re: [PATCH net v5 1/1] openvswitch: Fix CT limit teardown use-after-free

[Ilya Maximets <i.maximets@ovn.org>]

On 8/11/26 4:02 PM, Ilya Maximets wrote:
> On 8/11/26 11:55 AM, Yuqi Xu wrote:
>> Packet processing uses CT limit state under RCU, while netns teardown
>> frees that state under ovs_mutex. The CT limit pointer was neither removed
>> from readers nor protected by a grace period, allowing packet processing to
>> dereference the freed state.
>>
>> An unprivileged user can trigger this bug from a user and network
>> namespace, causing a slab-use-after-free in ovs_ct_execute() when the
>> netns is torn down.
>>
>> Publish the CT limit pointer through RCU, remove it before teardown, and
>> wait for readers before freeing its contents. Keep ovs_mutex around
>> individual CT limit updates, and use the RCU read-side lock while GET
>> traverses the RCU-protected limit lists.
>>
>> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
>> Cc: stable@vger.kernel.org
>> Reported-by: Vega <vega@nebusec.ai>
>> Link: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@gmail.com
>> Assisted-by: Codex:GPT-5.4
>> Co-developed-by: Nan Li <tonanli66@gmail.com>
>> Signed-off-by: Nan Li <tonanli66@gmail.com>
>> Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
>> Reviewed-by: Ren Wei <enjou1224z@gmail.com>
>> ---
>> Changes in v5:
>>
>> - Remove unreachable command-path NULL handling because netlink sockets
>>   keep their network namespaces alive while requests are processed.
> 
> Please, add a note to the commit message on why the NULL checks are not
> necessary for the code invoked from netlink handlers.  Otherwise, LGTM.

May be also worth explicitly calling out the synchronization while holding
the mutex.  It can be avoided, but should likely be a separate change.

> 
> Best regards, Ilya Maximets.