From nobody Fri Aug 14 15:49:22 2026 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD54E3D093A for ; Fri, 14 Aug 2026 13:40:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714849; cv=none; b=B3uL7h1guKSexYyCldoC35ka5rmR6QtYPbvmZ2IT+I+BgZylN3DzSyuELS1QsK0Zrn5QikOiWLT5OjrxbSOmG3rhkkonKQNRMT/GlOyNDevXuzkSJPQHQPEUjiUH+BH98h/6C3oRfSga4MfvSbW2nmY3IHLtTt7n9fE0WdtZEDI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714849; c=relaxed/simple; bh=H34gAtKfHIky2hxwYZCZ2UlGNvzJXRmVg786uObepMQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=aj1zKamop9dd/rB/K9Gpmsn+V8H1wgiqaHfQ1YoRpJRYdP8Aj5bpgE04zOO0T0E853HN1PJXa92MyHi+376RrW0aTUppf+xvMXMO4nEcgVEZ7j0fyBzs2akwFM3m459lX8yzt1F0b0hkjh4l5UTvoQCQns1GxavlGow835u+Bi0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kwh78Y7f; arc=none smtp.client-ip=209.85.215.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kwh78Y7f" Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-ca7c1176317so825956a12.1 for ; Fri, 14 Aug 2026 06:40:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786714847; x=1787319647; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=HASRc0ISsvPlOTZ0JP1hWcZCrdy+n3JvmBb9XvUYb54=; b=kwh78Y7f/O59PEY92+lLNG3108yw0tne8GteP3Qa9ndR75lR4LktErpXTofmVt3MsQ LKqK0ZJI9bAC+B5GGA5W3GTU3Juc+K5ROSSo4jTVwnoKX8IYgVWAODgQIVNzLp2g4DS7 5yyXDgqZzJ2dwSZewhIspeBGVH0iz1dT9SQHEWgdYBDzhYsSG1tFxJMHDb887iL1ZFN0 Xek1YfsdoyzzarHP/PfhIYxh6hYDvSG+pwSCznjsqiRuAwMS1L6iRnqOh82Lulicz21z CIpUywe4WEmjJngC6u8hv5BQaDt0OxwAJGJ9HLaQvvLU3wbXdcp9FQk1IPVUTmU9PiUs gZeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786714847; x=1787319647; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HASRc0ISsvPlOTZ0JP1hWcZCrdy+n3JvmBb9XvUYb54=; b=J+3iE1ANfn8kh+vSVxFYgYNk/4y0XBRx22ryf8wKVo5gtQufF1YEKCIfZnhXckMGmF SwHZWJjpZoWcHD4KEzJlB7AiwfjJphIwyT4DOjg8uCfggirxG5OWm7ZRHozJj8f0DQpx VjtZGs+dVAOotQmhGFmZtN0RXSSee8LovI1QY255pu55gMapsetwYZ2tmpkFfvx9kp5L lMUhR+Szig0FEtUYteEFoqJHqqHx6LRTLzwYy4zlZzS9jxHCrS44CGgvThdq7HkjDw0d RPAIBrcP3gd40TVZqNACtnHxUB0xcNM/+Y9CRWuGuOnm2mrAE3C6xsEeUprJ5aOSXOPu 6rbA== X-Forwarded-Encrypted: i=1; AHgh+Rpy51ZPvjkxns+CiYz+3lozGw2g6nYE/jx3PH5m03S/lKVDhFFyJVI3GqJdzEIaTkBOieDauouiQVw+iqY=@vger.kernel.org X-Gm-Message-State: AOJu0YxP2BQ98/7Wg3oPOpNHnQhi7+lHPNPVzzYOefklM5TPaoMW5Nxg APB0W1GbkguHQJIc9chSpGRDUo7sY6wPLPEf59IGVt1zpFZNZ0X5xqBF X-Gm-Gg: AR+sD12+NYqo3cNqZlbb6fuYyIZjyKqwPjVh1fdx9LkNVbzazIRDtimeyLgxGdMedzc D+GqLTRQus2MkY2vOHpCYvcGLqx6Xm9cWqSJQD3ACIA6uF6bmuaZs5VF7/QNDqnQgxKfiKSfBkP SaBsYUdpmgBMPeHCp830TcoEwLGrNuI4kaVgJrdji2oAgAfZQuBk6MdgpYxBQoEndPPjBIagaYX vK6+smfRIX2+Hd3oeadAvO49e+CYrSHvhT2k319Rk1PEbVq/aZc7W+s6tVrHKyCoWiyIkrMn29e vDwGYnCM4HzNInflUsqvZPShDw69q96WvFp20zF+L8S8DMnUPq8B411uWfWLvVWjZ2dG6+XWuIQ XwnL1hvA9C6uE/Mh85lx+FQVIxOvER0wenb2r8AnheTapixmmZHHWi6Ptj6+ifAOOjjz+ePZIcn FgkfKbTFZL7zYzwWI+rijbw4VchrgLyySzDEY0BWzwO1FY4Qn8AtZ7umwgCyHyFNPMIul6gbEcH XdRtHCi X-Received: by 2002:a05:6a21:3281:b0:3bf:5539:f93 with SMTP id adf61e73a8af0-3cc71eb2994mr5859231637.38.1786714846929; Fri, 14 Aug 2026 06:40:46 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:e9af:7c0e:be31:2c3f]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc08f388bf9sm611306a12.5.2026.08.14.06.40.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 06:40:46 -0700 (PDT) From: Ruoyu Wang To: Aaron Conole , Eelco Chaudron , Ilya Maximets , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Yi-Hung Wei , Pravin B Shelar Cc: netdev@vger.kernel.org, dev@openvswitch.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH net] net: openvswitch: fix nf_connlabels leak in ovs_ct_init Date: Fri, 14 Aug 2026 21:40:40 +0800 Message-ID: <20260814134040.1386967-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ovs_ct_init() acquires a connlabels reference before initializing the conntrack limit state. If ovs_ct_limit_init() fails, its error is returned directly. The pernet core does not invoke the exit callback for the operation whose initialization failed, so ovs_ct_exit() cannot drop the reference. This leaves labels_used elevated when Open vSwitch pernet registration fails for an existing network namespace. Subsequent conntrack entries in that namespace may allocate label extensions even though Open vSwitch failed to register. Drop the connlabels reference before returning a conntrack limit initialization error. ovs_ct_limit_init() already releases its partial state, and the original error remains unchanged. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") Signed-off-by: Ruoyu Wang --- net/openvswitch/conntrack.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 95697d4e16e64..fbaa677144143 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -2001,6 +2001,9 @@ int ovs_ct_init(struct net *net) { unsigned int n_bits =3D sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; struct ovs_net *ovs_net =3D net_generic(net, ovs_net_id); +#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) + int err; +#endif =20 if (nf_connlabels_get(net, n_bits - 1)) { ovs_net->xt_label =3D false; @@ -2010,7 +2013,10 @@ int ovs_ct_init(struct net *net) } =20 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) - return ovs_ct_limit_init(net, ovs_net); + err =3D ovs_ct_limit_init(net, ovs_net); + if (err && ovs_net->xt_label) + nf_connlabels_put(net); + return err; #else return 0; #endif --=20 2.51.0