ovs, net/sched: fixes for UAF after conntrack extension realloc

[PATCH net 0/6] ovs, net/sched: fixes for UAF after conntrack extension realloc

Ilya Maximets posted 6 patches 3 days, 3 hours ago

Download series mbox

include/net/netfilter/nf_conntrack.h |  5 ++++
net/openvswitch/conntrack.c          | 37 +++++++++++++++++++-------
net/sched/act_ct.c                   | 39 +++++++++++++++++++++-------
3 files changed, 61 insertions(+), 20 deletions(-)

Expand all Fold all

[PATCH net 0/6] ovs, net/sched: fixes for UAF after conntrack extension realloc

Posted by Ilya Maximets 3 days, 3 hours ago

One clean up change plus two fixes for the UAF on helper extension
realloc x 2.  First half for OVS and the second half for the similar
code in act_ct.  This should cover all the known cases of this problem
in these two modules.


Ilya Maximets (6):
  net: openvswitch: conntrack: avoid modifying shared unconfirmed ct
    entry
  net: openvswitch: conntrack: remove 'add_helper' dead code
  net: openvswitch: conntrack: fix helper UAF due to extensions realloc
  net/sched: act_ct: avoid modifying shared unconfirmed ct entry
  net/sched: act_ct: remove 'add_helper' dead code
  net/sched: act_ct: fix helper UAF due to extensions realloc

 include/net/netfilter/nf_conntrack.h |  5 ++++
 net/openvswitch/conntrack.c          | 37 +++++++++++++++++++-------
 net/sched/act_ct.c                   | 39 +++++++++++++++++++++-------
 3 files changed, 61 insertions(+), 20 deletions(-)

-- 
2.55.0

Re: [PATCH net 0/6] ovs, net/sched: fixes for UAF after conntrack extension realloc

Posted by Jakub Kicinski 17 hours ago

On Mon, 21 Sep 2026 16:55:42 +0200 Ilya Maximets wrote:
> One clean up change plus two fixes for the UAF on helper extension
> realloc x 2.  First half for OVS and the second half for the similar
> code in act_ct.  This should cover all the known cases of this problem
> in these two modules.

Florian, Pablo, did you give up on the TC conntrack integration or can
we still hope for an ack? :)