From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 068818017D for ; Mon, 9 Nov 2026 19:37:26 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9Ja9rN003160; Mon, 9 Nov 2026 22:36:10 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9Ja9rN003160 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="TxvxVdt2" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9Ja8Ur003148 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 9 Nov 2026 22:36:08 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9Ja8Ur003148 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-4915ba023d4so843908f8f.0 for ; Mon, 09 Nov 2026 11:36:08 -0800 (PST) X-Forwarded-Encrypted: i=2; AL+hErGr9hiDrejLPRM3WY6p0BH5KM3GG7S5rSYBIMSfADsr5Z2+XveIijN6X9ChHlG7Bnwdky2Rxw==@openvz.org X-Gm-Message-State: APuU4Z+MrnV4h0/wrFll+XovkPWZgOnnTxr6u2b5Dufl1MBGXXMJ6m/M MBfEdDFcLZILfJbzW4YyBOh76MohMYPH4lswdY0h+HXJWdmdAbKvqddobbXg+Nds7QIKkImk5XQ XbpzjQ5Tb0MfE+j8qVan8LHDSD19P35rvytR0vF2rSNxGAVzsNyYXVg== X-Gm-Gg: AYBFou1uaZEx57I3rs2F1cYU/MNju3urTHgMIriADG5DOVkKbMPRmVsXicErqr9Tb21 BJBXvShdKIo4mWBkUIoMtCgCu6qO0164xAG1KPBO5ciZUouBh2bOgjYSFqFjXilosaDoktbvmx6 vUE4jGbCJpGXMFfgh6egbLR7hXapYlIbWjEIOz/WVcwXX5WmWNw10ITGbNBIyGqYUxmjZn3isnE O9ufQf+I3tRJm4CxrmVJY0feBFNHb3fJGO35/4hI2Y5ZUvYZxl4Y2811bj4N2xkAehnxK4KiRq5 FLzAYUn1TLpH4VkfZNprNZYK/MsDv8YxPV5PzeVbk2M4hOJkvX9luCugb1qqNjUpYJxPqsNQu/2 EUGHW5bsM0zU4H0oFSjrmKhJvWnM34A== X-Received: by 2002:a05:6000:18a3:b0:493:c0a:5087 with SMTP id ffacd0b85a97d-49830e767fdmr850442f8f.51.1794252968177; Mon, 09 Nov 2026 11:36:08 -0800 (PST) X-Received: by 2002:a05:6000:18a3:b0:493:c0a:5087 with SMTP id ffacd0b85a97d-49830e767fdmr850404f8f.51.1794252967645; Mon, 09 Nov 2026 11:36:07 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794252967; cv=none; d=google.com; s=arc-20260327; b=joYwjqhBMJPusn8dtsQWHEixWEV6eDrPiKTUO9/YOg/Ql8IiUmHmlquwhrhl4fVYfj l3HcaJNmbHAMOO8SCQRtMqH59f6ty0QvjRtBw/viRehpS62LrEFiPmubZUo/Xp4EhBvE p0Qr9bFbo73qzsJtl0/kM9GQYUoABcB+7x9wWNbkRL40FyebGHFyCcKilbum5CAMZXsk Qj2Pc7ByoDjCAgLZw7SL+JGulT4RBOIyfkjhjg+NFx73fxmjEY0Ps4y2lVaUgXu3YU1U KhTSgiCNQ8qNiz+vMaE5P6GHQgLa9GBTTaYnIbLRu9G3wkRVyvM5WvrLxOtNLeuLA5/5 fD9g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:dkim-signature; bh=GOa1goOQcE/kxVmRy7u5E7OAZAwTQxE0SIsFYKYcXr4=; fh=5hQRK+XZF8m8FADH0g5yAiDkSoTAVGTSxnnvVVATGZQ=; b=AaHmmCOuAg1Cmsskew8FVFaPIJwVr2B7xtF4Pz7l+2lXztsTbFCIy/uXWcL7ENABMD A0FT3VnDqG51k9/bUVvEeiiYoLgLxG7R/LQOjbN8WLusgxghbXz8LIOiC8MRNuuBkPQe CRHIge5tjhvrQdV7RraBhVP1iZCvVYZbLzYee/qLwcCnHlakWSXAdSyy2wfGqNKKoR5A YAtYMcN93qGxlu7Gs1DVFq4ejUklAZ7tUPzSxU4ugYgqV6yVQkswIEyPPRqCCOab5rJ7 aBf43hO3ta+P2Gs3yzSyYAHmB+Z+htJcIwXHFOytdKeOz7bV5RvTZ3RG46tKTdRLiWpM nBEg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=TxvxVdt2; spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-49836f62981si548633f8f.316.2026.11.09.11.36.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2026 11:36:07 -0800 (PST) Received-SPF: pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=TxvxVdt2; spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Content-Type:MIME-Version:Message-Id:Date:Subject :From; bh=GOa1goOQcE/kxVmRy7u5E7OAZAwTQxE0SIsFYKYcXr4=; b=TxvxVdt2uDS721G58M0 d6ixUBQ40ejqfrJ2Tx6pfPXdsoKmrMqEHQJkPpvEttgItYzs47uVHo6IPaUJoba6gS6Wyt3p7APok WtRPSRS0JEPFQMFPEM2elrKTF9oCrqM5u3noMRLeNZUYg4SplddR1G1dAMw5KlqP51INHYx60I95I C5VMcbdqEQccyfkc9sQbbTBrVHEFyx5CsqUjYv0uSgoU4U6w5Wqro2F0CMhaBjglx7snR/btJ+Sbo c4oOsefvGra1/sEEviM4Tjyjkgu7LcBgTPUDbel6wrB0T+3Xz9psscOygttxza5XLsAD+gI5yrOoZ ZxQd8Qv9LPgsLVw==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=192.168.1.87) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xQV5u-00CGp3-1P; Mon, 09 Nov 2026 20:35:58 +0100 From: Vladimir Riabchun Date: Mon, 09 Nov 2026 20:35:58 +0100 Message-Id: <20261109-ovl-use-orig-ve-v4-0-88e65484dc5b@virtuozzo.com> MIME-Version: 1.0 X-B4-Tracking: v=1; b=H4sIAJ4g8moC/23NwW7CMAwG4FdBOS8ocduQctp7IA6pY6injUxJG 22gvjtpOWyiXCxZ/v39N5EoMiWx39xEpMyJw6Us9dtGYO8uZ5Lsyy5AgVGttjLkTzkmkiHyWWa S4LEyTbszJSHK13ekE/8s4kH0yNJutTg+DmnsPgiH2ZujPachxN+lO+vlYa7RCmBVk7VU0jtbo 1JolWneM8dhDNdr2GL4Whoy/DfM2oBikOsa250QWnSvjOrP0KpaG1UxnPeqBizT7p6NaZrunUV 4DlUBAAA= X-Change-ID: 20260918-ovl-use-orig-ve-2dc365976202 To: ptikhomirov@virtuozzo.com, Konstantin Khorenko X-Mailer: b4 0.16.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v4 0/5] Fix kernel crash in overlayfs X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org When testing CRIU with containers with docker images, we found an easily reproducible kernel crash: [ 2300.870181] BUG: kernel NULL pointer dereference, address: 0000000000000005 [ 2300.871537] #PF: supervisor read access in kernel mode [ 2300.872577] #PF: error_code(0x0000) - not-present page [ 2300.873595] PGD 800000010a18f067 P4D 800000010a18f067 PUD 10730c067 PMD 0 [ 2300.874900] Oops: Oops: 0000 [#1] SMP PTI [ 2300.875742] CPU: 1 UID: 0 PID: 5419 Comm: criu ve: 0 Kdump: loaded Not tainted 6.12.0-211.39.1.16.6.vz10.x86_64 #1 16.6 PREEMPT(voluntary) [ 2300.878057] Hardware name: Acronis OpenStack Compute/Virtuozzo, BIOS 1.16.1-1.vz9.2 04/01/2014 [ 2300.879684] RIP: 0010:ovl_get_index_name_fh+0x18/0x70 [overlay] [ 2300.880859] Code: ... [ 2300.884128] RSP: 0018:ffffd32582e0f7c0 EFLAGS: 00010246 [ 2300.895807] Call Trace: [ 2300.896397] [ 2300.904435] ovl_create_index+0x82/0x260 [overlay] [ 2300.905406] ovl_copy_up_workdir+0x30a/0x330 [overlay] [ 2300.906427] ovl_do_copy_up+0x10d/0x2e0 [overlay] [ 2300.907387] ovl_copy_up_one+0x456/0x720 [overlay] [ 2300.910736] ovl_copy_up_flags+0x81/0x110 [overlay] [ 2300.911740] ovl_create_object+0x51/0x130 [overlay] [ 2300.912719] vfs_mkdir+0x194/0x250 [ 2300.913470] do_mkdirat+0x14c/0x180 [ 2300.914223] __x64_sys_mkdir+0x46/0x70 [ 2300.915019] do_syscall_64+0x7d/0x160 [ 2300.922814] entry_SYSCALL_64_after_hwframe+0x76/0x7e The cause is that overlayfs does some feature checks on superblock creation using capable/ve_capable and it stores current credentials. But ve_capable check result depends on both current creds and current VE. Later, overlayfs switches credentials only, leading to unexpected feature disappearance. This was reworked completely after v2, the approach is different now. 1. Patch 1 removes separate STOPPED state - VE goes directly to DEAD. 2. Patch 2 adds helpers for overriding tasks VE. 3. Patch 3 adds VE owner to overlay superblock. 4. Patch 4 fixes the bug by switching VE together with creds in overlayfs. v2: http://lore.virtuozzo.com/all/20260920-ovl-use-orig-ve-v1-0-b3e63f6ff80d@virtuozzo.com/ https://virtuozzo.atlassian.net/browse/VSTOR-143259 - non-CRIU repro https://virtuozzo.atlassian.net/browse/VSTOR-142405 Signed-off-by: Vladimir Riabchun --- Changes in v4: - Patch 2: clean non-NULL overrided_ve in fork and report it, Report revert_ve(ERR_PTR) usages and reject them. - Patch 5: changed ovl_override_creds signature so it returns error. Added checks for it in all places to avoid. - Link to v3: http://lore.virtuozzo.com/20261103-ovl-use-orig-ve-v3-0-add042cdd087@virtuozzo.com Changes in v3: - Patch 2: added a separate field for ve_override to fix problems Pasha spotted. - Patch 3: new one, delays init_cred destroy so dead CT can still use it. - Link to v2: http://lore.virtuozzo.com/20261026-ovl-use-orig-ve-v2-0-eab58bfc29ca@virtuozzo.com Changes in v2: - Patch 1: updated description as Sashiko suggested.. - Patch 2: moved stubs outside CONFIG_X86 section, added task_lock protection in helpers. Verified via lockdep, no splats after vzctl tests, C/R and crash reproducer. - Patch 4: fixed typo in comment. - Link to v1: http://lore.virtuozzo.com/20261022-ovl-use-orig-ve-v1-0-da84c00c8065@virtuozzo.com --- Vladimir Riabchun (5): ve: Remove STOPPED state ve: Introduce override_ve/revert_ve helpers ve: Defer ve context drop until ve is completely destroyed ovl: Keep creator VE in overlayfs superblock ve/overlayfs: Override VE together with creds fs/overlayfs/copy_up.c | 6 ++-- fs/overlayfs/dir.c | 59 ++++++++++++++++++------------ fs/overlayfs/file.c | 65 +++++++++++++++++++-------------- fs/overlayfs/inode.c | 94 +++++++++++++++++++++++++++++++----------------- fs/overlayfs/namei.c | 39 +++++++++++++------- fs/overlayfs/overlayfs.h | 9 ++++- fs/overlayfs/ovl_entry.h | 1 + fs/overlayfs/params.c | 3 ++ fs/overlayfs/readdir.c | 36 ++++++++++++------- fs/overlayfs/super.c | 3 ++ fs/overlayfs/util.c | 41 ++++++++++++++++----- fs/overlayfs/xattrs.c | 35 +++++++++++------- include/linux/sched.h | 1 + include/linux/ve.h | 30 ++++++++++++++-- kernel/capability.c | 6 ++-- kernel/fork.c | 2 ++ kernel/ve/ve.c | 10 +++--- 17 files changed, 300 insertions(+), 140 deletions(-) --- base-commit: fd34de0d39ec34baee8af703df9c34bc0851e2d3 change-id: 20260918-ovl-use-orig-ve-2dc365976202 Best regards, -- Vladimir Riabchun _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel