On 7/22/26 11:19 PM, Ilya Maximets wrote: > On 7/22/26 10:59 PM, Ilya Maximets wrote: >> On 7/22/26 6:40 PM, Ren Wei wrote: >>> From: Yuqi Xu <[email protected]> >>> >>> Packet processing uses CT limit state under RCU, while netns teardown >>> frees that state under ovs_mutex. The CT limit pointer was neither removed >>> from readers nor protected by a grace period, allowing packet processing to >>> dereference the freed state. >>> >>> Replace the pointer before freeing the CT limit state. Wait for in-flight >>> RCU readers before freeing its contents. Serialize CT limit netlink >>> operations with teardown for the full lifetime of their state accesses. >>> >>> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") >>> Cc: [email protected] >>> Reported-by: Vega <[email protected]> >>> Assisted-by: Codex:GPT-5.4 >>> Co-developed-by: Nan Li <[email protected]> >>> Signed-off-by: Nan Li <[email protected]> >>> Signed-off-by: Yuqi Xu <[email protected]> >>> Signed-off-by: Ren Wei <[email protected]> >>> --- Hi. It's been silent here for a while. Do you plan to send a new version of this fix, or should someone else take it over?
Best regards, Ilya Maximets. _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
