Re: [PATCH net] net: openvswitch: fix nf_connlabels leak in ovs_ct_init

On 8/14/26 3:40 PM, Ruoyu Wang wrote:
> ovs_ct_init() acquires a connlabels reference before initializing the
> conntrack limit state. If ovs_ct_limit_init() fails, its error is returned
> directly. The pernet core does not invoke the exit callback for the
> operation whose initialization failed, so ovs_ct_exit() cannot drop the
> reference.
> 
> This leaves labels_used elevated when Open vSwitch pernet registration
> fails for an existing network namespace. Subsequent conntrack entries in
> that namespace may allocate label extensions even though Open vSwitch
> failed to register.
> 
> Drop the connlabels reference before returning a conntrack limit
> initialization error. ovs_ct_limit_init() already releases its partial
> state, and the original error remains unchanged.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")

Should add Cc: for the stable here.

> Signed-off-by: Ruoyu Wang <[email protected]>
> ---
>  net/openvswitch/conntrack.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
> index 95697d4e16e64..fbaa677144143 100644
> --- a/net/openvswitch/conntrack.c
> +++ b/net/openvswitch/conntrack.c
> @@ -2001,6 +2001,9 @@ int ovs_ct_init(struct net *net)
>  {
>  	unsigned int n_bits = sizeof(struct ovs_key_ct_labels) * BITS_PER_BYTE;
>  	struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
> +#if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
> +	int err;
> +#endif

No need to guard it with a macro.  It should be cleaner to initialize
as zero and return err in both cases in the end.

>  
>  	if (nf_connlabels_get(net, n_bits - 1)) {
>  		ovs_net->xt_label = false;
> @@ -2010,7 +2013,10 @@ int ovs_ct_init(struct net *net)
>  	}
>  
>  #if	IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
> -	return ovs_ct_limit_init(net, ovs_net);
> +	err = ovs_ct_limit_init(net, ovs_net);
> +	if (err && ovs_net->xt_label)
> +		nf_connlabels_put(net);
> +	return err;
>  #else
>  	return 0;
>  #endif