diff --git a/datapath/conntrack.c b/datapath/conntrack.c
index c7a318baf28..50b4d7bd6aa 100644
--- a/datapath/conntrack.c
+++ b/datapath/conntrack.c
@@ -1984,7 +1984,8 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
 		struct hlist_head *head = &info->limits[i];
 		struct ovs_ct_limit *ct_limit;
 
-		hlist_for_each_entry_rcu(ct_limit, head, hlist_node)
+		hlist_for_each_entry_rcu(ct_limit, head, hlist_node,
+					 lockdep_ovsl_is_held())
 			kfree_rcu(ct_limit, rcu);
 	}
 	kfree(ovs_net->ct_limit_info->limits);
diff --git a/datapath/datapath.c b/datapath/datapath.c
index 8e9b9a70619..b88d16107cb 100644
--- a/datapath/datapath.c
+++ b/datapath/datapath.c
@@ -2572,8 +2572,10 @@ static void __net_exit ovs_exit_net(struct net *dnet)
 
 	ovs_netns_frags6_exit(dnet);
 	ovs_netns_frags_exit(dnet);
-	ovs_ct_exit(dnet);
 	ovs_lock();
+
+	ovs_ct_exit(dnet);
+
 	list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
 		__dp_destroy(dp);