Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:
On Sat, 15 Aug 2026 02:58:56 +0200 you wrote:
> The commit in the Fixes tag below made so flow->mask free is scheduled
> via RCU right after it is removed from the flow table. The pointer
> stays in the flow structure and it can be accessible while in the same
> RCU critical section. This is done to avoid requiring ovs_mutex for
> the ovs_flow_free().
>
> However, while removing the flow during processing of CMD_DEL, we do
> not take RCU read lock before the removal, and ovs_flow_cmd_fill_info()
> uses the flow->mask pointer afterwards. The RCU read lock is taken,
> but it's already late at that point. The comment on that line
> acknowledges that the lock is cosmetic and doesn't serve a real purpose.
>
> [...]
Here is the summary with links:
- [net] net: openvswitch: fix flow mask use-after-free on flow deletion
https://git.kernel.org/netdev/net/c/4e30317ff67a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
