On 9/12/26 3:22 PM, Zhiling Zou wrote:
> ovs_ct_get_conn_labels() adds the labels extension when a conntrack
> entry does not have one. Confirmed conntracks can be read locklessly,
> so adding an extension may reallocate and free the extension block
> while another CPU accesses it.
>
> Only add the extension for unconfirmed conntracks. A confirmed
> conntrack without labels now fails the caller's label operation instead
> of reallocating its extension storage.
>
> Fixes: c2ac66735870 ("openvswitch: Allow matching on conntrack label")
> Cc: [email protected]
> Reported-by: Vega <[email protected]>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <[email protected]>
> ---
> net/openvswitch/conntrack.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
> index 27115967e5d93..0f433688e17b9 100644
> --- a/net/openvswitch/conntrack.c
> +++ b/net/openvswitch/conntrack.c
> @@ -366,7 +366,7 @@ static struct nf_conn_labels
> *ovs_ct_get_conn_labels(struct nf_conn *ct)
> struct nf_conn_labels *cl;
>
> cl = nf_ct_labels_find(ct);
> - if (!cl) {
> + if (!cl && !nf_ct_is_confirmed(ct)) {
> nf_ct_labels_ext_add(ct);
> cl = nf_ct_labels_find(ct);
> }
Reviewed-by: Ilya Maximets <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
