On 8/12/26 11:59 AM, Yuqi Xu wrote:
> Packet processing uses CT limit state under RCU, while netns teardown
> frees that state under ovs_mutex. The CT limit pointer was neither removed
> from readers nor protected by a grace period, allowing packet processing to
> dereference the freed state.
>
> An unprivileged user can trigger this bug from a user and network
> namespace, causing a slab-use-after-free in ovs_ct_execute() when the
> netns is torn down.
>
> Publish the CT limit pointer through RCU, remove it before teardown, and
> wait for readers before freeing its contents. Keep ovs_mutex around
> individual CT limit updates, and use the RCU read-side lock while GET
> traverses the RCU-protected limit lists.
>
> The netlink command handlers do not need NULL checks because the userspace
> netlink socket holds an active reference to its network namespace while a
> request is processed. The per-netns exit path therefore cannot run
> concurrently with SET, DEL, or GET for that socket's namespace.
>
> The teardown path currently waits for the RCU grace period while holding
> ovs_mutex. Moving synchronize_rcu() outside the mutex would require
> restructuring the teardown path and is left for a separate change.
>
> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
> Cc: [email protected]
> Reported-by: Vega <[email protected]>
> Link: https://lore.kernel.org/all/[email protected]
> Assisted-by: Codex:GPT-5.4
> Co-developed-by: Nan Li <[email protected]>
> Signed-off-by: Nan Li <[email protected]>
> Signed-off-by: Yuqi Xu <[email protected]>
> Reviewed-by: Ren Wei <[email protected]>
> ---
Reviewed-by: Ilya Maximets <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
