From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konstantin Khorenko Date: Wed, 5 Aug 2026 22:09:41 +0200 Subject: [Devel] [PATCH RHEL10 COMMIT] ve: fix NULL-deref / use-after-free in ve_create() error unwind In-Reply-To: <20260706110002.1024515-19-khorenko@virtuozzo.com> Message-ID: <202608052009.675K9fxR541227@f0.sw.ru> List-Id: The commit is pushed to "branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git after rh10-6.12.0-211.39.1.16.2.vz10 ------> commit 7e884677eb9540f3dc2907fd9af753a5ef972a9a Author: Konstantin Khorenko Date: Mon Jul 6 12:59:56 2026 +0200 ve: fix NULL-deref / use-after-free in ve_create() error unwind ve_create()'s error path ended with: err_lat: kmem_cache_free(ve_cachep, ve); err_ve: ve_set_state(ve, VE_STATE_STOPPED); return ERR_PTR(err); ve_set_state() dereferences ve->state, but at err_ve @ve is either NULL (the kmem_cache_zalloc() failure jumps straight to err_ve) or already freed (the err_lat/err_log/err_vdso legs kmem_cache_free() @ve and then fall through to err_ve) - so every error exit of ve_create() is a NULL pointer dereference or a use-after-free. It only triggers when an allocation in ve_create() fails, which is why it stayed latent. The state assignment is meaningless on the failure path anyway: the css is never returned to cgroup and the ve is being freed. The success path already sets ve->state = VE_STATE_STARTING directly. Just drop the bogus ve_set_state() from the unwind. Fixes: 8a21e780ce29a ("ve/cgroups: rework is_running into an explicit VE state") Feature: ve: ve generic structures https://virtuozzo.atlassian.net/browse/VSTOR-137234 Signed-off-by: Konstantin Khorenko Reviewed-by: Pavel Tikhomirov --- kernel/ve/ve.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c index d8ef28eedabd0..73d1c3b4873e5 100644 --- a/kernel/ve/ve.c +++ b/kernel/ve/ve.c @@ -802,7 +802,6 @@ static struct cgroup_subsys_state *ve_create(struct cgroup_subsys_state *parent_ err_lat: kmem_cache_free(ve_cachep, ve); err_ve: - ve_set_state(ve, VE_STATE_STOPPED); return ERR_PTR(err); }