From nobody Mon Sep 28 23:07:07 2026 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E80B2397AEF for ; Sat, 15 Aug 2026 15:17:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786807058; cv=none; b=i5KBkGrQiCbs9PXn2zSuljVSo5+Lp0KwM6XHd2VVNnK5SakE9UeGVeXFoqjCTporToz6HHp3y5OHiuGPVfatQ0u122Ur6v7Wbs1BlJFvis8BFcb5dha/2ZZTuEHQ9jyrO/cu8H2u+qtle9/kXQ/OQ6EIYXVXvYfpukXwxZtPld4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786807058; c=relaxed/simple; bh=Cy7ehUO5QJOp009fJSDqmDrznAwOwERfwSLS7fpTfZY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Urm5NTNV9vhh+2xeEewlfDBqxHlbLFbUOEi+V7VNKNzwhb7QtUxIGfZKHcXwR2LBHA/zR20JAXeTXQAPPWmkKLoSxkzo/zTDnq0C8SjlxMay2Ag1Z/Dpi6oNiRct+XtZ7Zo/rdhtDGhlleLYRMFbCK4KcREQAtIS9QFFy6Eblpc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Q7cI/o5n; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q7cI/o5n" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38f620399a0so1729957a91.2 for ; Sat, 15 Aug 2026 08:17:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786807056; x=1787411856; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=TM5YKUrM+Rjhg2FVhoNuNFP8y5+WDuZJ/t6rMuZQeiI=; b=Q7cI/o5nZQHmrk7aEse5r2N7L5zIfk/8VQ1JDrs9oaP9a0ysdFKtPn1XELnXSNqyRS o+AmlT5hg/tNamQg4PQD0OFvVobaf5emAVX6J6JZpKMmpy8LFslLuSA40HxvcpgQt1gw DO5qA9ntfwUma5nK+vn7XemT0qHD57+/BWceh7x1RcVAj6pAMMjUWMnsR9HhEPS18qbN 0VgW1jEGLr49J6r8toZuNxx1CRo77icovk88ZE3QYr4cCei1Swm2ham7/1ABhm146wj3 KqgNVtTqhWiKNmtH7YXSKzU6NfCChljjZpuG1gYLsaTmzq7N0oDwFHdtFaMezE05/3v9 YNXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786807056; x=1787411856; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TM5YKUrM+Rjhg2FVhoNuNFP8y5+WDuZJ/t6rMuZQeiI=; b=lLwyAY9xgG3YSQCcL2E6HqD3MecB/8b+nUIC69JOoH9/y8HQJiBMdUvCfNWemQBheO 2y7N4q3AKFJaAaz+Y4Q2ErEaBN5VGrGq0fLraZNu0dixiDQybIAskemKmL8hQr4kNJu3 gWHc6mD8Fz0uyDlhJKeLoU78mC5wTGimV5DfmTWJA1J+ryjXKzBemCqlJ2DKCm9NAYbU 7UP91t9LOqr/9oxT0E3UJjIq4id88cfEdnUrzXNiFACGgcW5wdbb6iIQFqXVN1CaIvEa U9wj+LyV8UOlfVJgS90ljF2+G3IGTO3AVE78PlFXXBcvRyBdSJeXKVvpKFDDM8Xywsa1 Nw1Q== X-Forwarded-Encrypted: i=1; AHgh+RqDdJU1IGnnhZ7oXLTkGcgetcFtLwg2VLTPyCHy+1PJCkePj2vqPyr+GCxr5bg5WGEH1JRftPV/nkbOzPY=@vger.kernel.org X-Gm-Message-State: AOJu0YyhgQyA1MAlbiMIllwaokOX2kPb4D2lRZYiL5xS/6dbe65LstlA qGZTPoQ9A2ldvFSMGGMC/GRk+vwAnprhGZ7SdwxM1nyZ49bUVufF+xXz X-Gm-Gg: AR+sD13/CHB7ryp6i/n7F4HdiEVOCmgWmDvrYZiaacnIIEi3iehO60LynIsragyVg48 TVEPfcI9MxhzR1eRrAUCip0XyuzietFcM1bvSj575OrWzFJIYDzwIvugA8ApEDvTqVvjyqCuESC O+29PofZtJhTaUIclVcTow4B6pr158Y4sahdwFo6hDLUBiO+E/3cDInMcceAvsJp99gMWVxTArq ldHZhGT9F5b3SfA8gJlTlCZ/50n2s5Y6EUA4emJXOfCM8NOVaqPc5Tc0QdUiehwoc1tSdQfxN3g MrcFH0sDdz7k9fgGmkzn0AR7eimQkk8boMtWSreZSgGzGt1dr5PJmIYvCxrhHW1OBMDrwbrdNpo t3UnDeNRUL0kR6TJcyiIUO1IfAqOVpn+q1u3UN5IM1e9ZGu2838zSGR6sHN7KNL6PPVCMneMZnq VQ0PaSSlGmy2Z1OVBfBx8FFZqCJNAil8VFGBCCjswzVDGNoRpH60qizUJ+VjxCdoLgnfENBsY7Q Pah7s1g X-Received: by 2002:a17:90b:3c44:b0:380:83fc:4315 with SMTP id 98e67ed59e1d1-3933bf4ac9amr16342589a91.21.1786807056055; Sat, 15 Aug 2026 08:17:36 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:5225:2a2e:8e7c:13a7]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-394ebc32b24sm6424695a91.17.2026.08.15.08.17.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 15 Aug 2026 08:17:35 -0700 (PDT) From: Ruoyu Wang To: Aaron Conole , Eelco Chaudron , Ilya Maximets , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Pravin B Shelar , Yi-Hung Wei Cc: netdev@vger.kernel.org, dev@openvswitch.org, linux-kernel@vger.kernel.org, Ruoyu Wang , stable@vger.kernel.org Subject: [PATCH net v2] net: openvswitch: fix nf_connlabels leak in ovs_ct_init Date: Sat, 15 Aug 2026 23:17:29 +0800 Message-ID: <20260815151729.3757984-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ovs_ct_init() acquires a connlabels reference before initializing the conntrack limit state. If ovs_ct_limit_init() fails, its error is returned directly. The pernet core does not invoke the exit callback for the operation whose initialization failed, so ovs_ct_exit() cannot drop the reference. This leaves labels_used elevated when Open vSwitch pernet registration fails for an existing network namespace. Subsequent conntrack entries in that namespace may allocate label extensions even though Open vSwitch failed to register. Drop the connlabels reference before returning a conntrack limit initialization error. ovs_ct_limit_init() already releases its partial state, and the original error remains unchanged. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") Cc: stable@vger.kernel.org Assisted-by: unnamed:gpt-5.5 typestate Signed-off-by: Ruoyu Wang Reviewed-by: Ilya Maximets --- Changes in v2: - Initialize err unconditionally and use one return path. - Add the stable Cc and Assisted-by tag. v1: https://lore.kernel.org/r/20260814134040.1386967-1-ruoyuw560@gmail.com/ --- net/openvswitch/conntrack.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 95697d4e16e64e..38c6f34776c280 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -2001,6 +2001,7 @@ int ovs_ct_init(struct net *net) { unsigned int n_bits =3D sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE; struct ovs_net *ovs_net =3D net_generic(net, ovs_net_id); + int err =3D 0; =20 if (nf_connlabels_get(net, n_bits - 1)) { ovs_net->xt_label =3D false; @@ -2010,10 +2011,11 @@ int ovs_ct_init(struct net *net) } =20 #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) - return ovs_ct_limit_init(net, ovs_net); -#else - return 0; + err =3D ovs_ct_limit_init(net, ovs_net); + if (err && ovs_net->xt_label) + nf_connlabels_put(net); #endif + return err; } =20 void ovs_ct_exit(struct net *net) --=20 2.51.0