diff --git a/SOURCES/openvswitch-3.1.0.patch b/SOURCES/openvswitch-3.1.0.patch
index e50b34d..081bd36 100644
--- a/SOURCES/openvswitch-3.1.0.patch
+++ b/SOURCES/openvswitch-3.1.0.patch
@@ -566,7 +566,7 @@ index 134496ef3..5d2635946 100644
      invalidate_cache(ctx);
  }
 diff --git a/lib/dpctl.c b/lib/dpctl.c
-index d12d9b8a5..970373389 100644
+index d12d9b8a5..bfc397329 100644
 --- a/lib/dpctl.c
 +++ b/lib/dpctl.c
 @@ -1713,10 +1713,16 @@ dpctl_flush_conntrack(int argc, const char *argv[],
@@ -597,6 +597,25 @@ index d12d9b8a5..970373389 100644
          ds_put_cstr(&ds, "invalid arguments");
          error = EINVAL;
          goto error;
+@@ -2196,7 +2202,7 @@ parse_ct_limit_zones(const char *argv, struct ovs_list *zone_limits,
+     argcopy = xstrdup(argv + 5);
+     next_zone = strtok_r(argcopy, ",", &save_ptr);
+ 
+-    do {
++    while (next_zone != NULL) {
+         if (ovs_scan(next_zone, "%"SCNu16, &zone)) {
+             ct_dpif_push_zone_limit(zone_limits, zone, 0, 0);
+         } else {
+@@ -2204,7 +2210,8 @@ parse_ct_limit_zones(const char *argv, struct ovs_list *zone_limits,
+             free(argcopy);
+             return EINVAL;
+         }
+-    } while ((next_zone = strtok_r(NULL, ",", &save_ptr)) != NULL);
++        next_zone = strtok_r(NULL, ",", &save_ptr);
++    }
+ 
+     free(argcopy);
+     return 0;
 diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c
 index c9f7179c3..aed2c8fbb 100644
 --- a/lib/dpif-netdev.c
@@ -2473,6 +2492,31 @@ index f652b5983..de2705653 100644
  AT_BANNER([flow classifier prefix lookup])
  AT_SETUP([flow classifier - prefix lookup])
  OVS_VSWITCHD_START
+diff --git a/tests/dpctl.at b/tests/dpctl.at
+index 7454a51ec..d2f1046f8 100644
+--- a/tests/dpctl.at
++++ b/tests/dpctl.at
+@@ -135,3 +135,19 @@ AT_CHECK([ovs-appctl dpctl/dump-flows dummy@br0 | sort], [0], [dnl
+ AT_CHECK([ovs-appctl dpctl/del-dp dummy@br0])
+ OVS_VSWITCHD_STOP
+ AT_CLEANUP
++
++AT_SETUP([dpctl - ct-get-limits ct-del-limits])
++OVS_VSWITCHD_START
++AT_CHECK([ovs-appctl dpctl/ct-get-limits], [0], [default limit=0
++])
++AT_CHECK([ovs-appctl dpctl/ct-get-limits zone=], [0], [default limit=0
++])
++AT_CHECK([ovs-appctl dpctl/ct-get-limits zone=,], [0], [default limit=0
++])
++AT_CHECK([ovs-appctl dpctl/ct-get-limits zone=x], [2], [],
++  [ovs-vswitchd: invalid zone (Invalid argument)
++ovs-appctl: ovs-vswitchd: server returned an error
++])
++AT_CHECK([ovs-appctl dpctl/ct-del-limits zone=])
++OVS_VSWITCHD_STOP
++AT_CLEANUP
+\ No newline at end of file
 diff --git a/tests/learning-switch.at b/tests/learning-switch.at
 new file mode 100644
 index 000000000..ac2fc1b80
diff --git a/SPECS/openvswitch3.1.spec b/SPECS/openvswitch3.1.spec
index 1d32fd2..6fefa4f 100644
--- a/SPECS/openvswitch3.1.spec
+++ b/SPECS/openvswitch3.1.spec
@@ -63,7 +63,7 @@ Summary: Open vSwitch
 Group: System Environment/Daemons daemon/database/utilities
 URL: http://www.openvswitch.org/
 Version: 3.1.0
-Release: 28%{?dist}
+Release: 29%{?dist}
 
 # Nearly all of openvswitch is ASL 2.0.  The bugtool is LGPLv2+, and the
 # lib/sflow*.[ch] files are SISSL
@@ -757,6 +757,12 @@ exit 0
 %endif
 
 %changelog
+* Thu May 11 2023 Open vSwitch CI <ovs-ci@redhat.com> - 3.1.0-29
+- Merging upstream branch-3.1 [RH git: 21d461f54c]
+    Commit list:
+    f4cc9ca824 dpctl: Fix dereferencing null pointer in parse_ct_limit_zones().
+
+
 * Wed May 10 2023 Open vSwitch CI <ovs-ci@redhat.com> - 3.1.0-28
 - Merging upstream branch-3.1 [RH git: d7b0d724f2]
     Commit list: