On Mon, Jul 20, 2026 at 10:14:16AM +0800, Ren Wei wrote: > From: Yuqi Xu <[email protected]> > > Packet processing uses CT limit state under RCU, while netns teardown > frees that state under ovs_mutex. The CT limit pointer was neither removed > from readers nor protected by a grace period, allowing packet processing to > dereference the freed state. > > Replace the pointer before freeing the CT limit state. Wait for in-flight > RCU readers before freeing its contents. Serialize CT limit netlink > operations with teardown for the full lifetime of their state accesses. > > Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") > Cc: [email protected] > Reported-by: Vega <[email protected]>
Is Vega a person? > Assisted-by: Codex:GPT-5.4 > Co-developed-by: Nan Li <[email protected]> > Signed-off-by: Nan Li <[email protected]> > Signed-off-by: Yuqi Xu <[email protected]> > Reviewed-by: Ren Wei <[email protected]> Please take a look at https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin and the sections that follow. What is listed here does not follow the rules. > @@ -932,11 +932,15 @@ static int ovs_ct_check_limit(struct net *net, > const struct sk_buff *skb, > const struct ovs_conntrack_info *info) > { > + const struct ovs_ct_limit_info *ct_limit_info; > struct ovs_net *ovs_net = net_generic(net, ovs_net_id); > - const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; > u32 per_zone_limit, connections; > u32 conncount_key; Reverse Christmas tree. The lines should be sorted longest to shortest. Yes, it was already wrong, but you can actually fix it here. Andrew --- pw-bot: cr _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
