Re: [PATCH net v5 1/1] openvswitch: Fix CT limit teardown use-after-free

[Ilya Maximets]

On 8/11/26 11:55 AM, Yuqi Xu wrote:
> Packet processing uses CT limit state under RCU, while netns teardown
> frees that state under ovs_mutex. The CT limit pointer was neither removed
> from readers nor protected by a grace period, allowing packet processing to
> dereference the freed state.
> 
> An unprivileged user can trigger this bug from a user and network
> namespace, causing a slab-use-after-free in ovs_ct_execute() when the
> netns is torn down.
> 
> Publish the CT limit pointer through RCU, remove it before teardown, and
> wait for readers before freeing its contents. Keep ovs_mutex around
> individual CT limit updates, and use the RCU read-side lock while GET
> traverses the RCU-protected limit lists.
> 
> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Vega <vega@xxxxxxxxxx>
> Link: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@xxxxxxxxx
> Assisted-by: Codex:GPT-5.4
> Co-developed-by: Nan Li <tonanli66@xxxxxxxxx>
> Signed-off-by: Nan Li <tonanli66@xxxxxxxxx>
> Signed-off-by: Yuqi Xu <xuyuqiabc@xxxxxxxxx>
> Reviewed-by: Ren Wei <enjou1224z@xxxxxxxxx>
> ---
> Changes in v5:
> 
> - Remove unreachable command-path NULL handling because netlink sockets
>   keep their network namespaces alive while requests are processed.

Please, add a note to the commit message on why the NULL checks are not
necessary for the code invoked from netlink handlers.  Otherwise, LGTM.

Best regards, Ilya Maximets.