Re: [Devel] [PATCH vz10 22/32] ve: mark ve0.css with CSS_NO_REF

[Konstantin Khorenko <khorenko@virtuozzo.com>]

Guys, please note the current patch, this is the most important one here.

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 8/21/26 18:37, Konstantin Khorenko wrote:
> From: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
> 
> ve0.css is the root css of the ve cgroup subsystem, and ve_cgrp_subsys is
> not an early_init one, so the css - its percpu_ref included - is only set
> up by cgroup_init().  net_ns_init(), however, runs before cgroup_init()
> in start_kernel() and takes a reference on ve0:
> 
>   start_kernel()
>     net_ns_init()                    /* init/main.c, before cgroup_init() */
>       init_net.owner_ve = get_ve(&ve0)
>         css_get(&ve0.css)            /* flags == 0, refcnt not set up */
>           percpu_ref_get(&ve0.css.refcnt)
> 
> At that point css.refcnt is all zeroes, so __ref_is_percpu() sees no
> __PERCPU_REF_ATOMIC_DEAD bits, decides the counter is in percpu mode and
> increments *(unsigned long __percpu *)NULL - that is, whatever happens to
> live at the start of the percpu area.  On x86 that quietly corrupts a
> percpu variable on every boot; under User Mode Linux it faults outright,
> which is how it was found.
> 
> ve0 is a permanent singleton that is never freed, exactly like the root
> css objects that cgroup_init_subsys() marks CSS_NO_REF, so give it that
> flag from the start.  css_get()/css_put() on ve0 then become no-ops in
> both windows, before and after cgroup_init().
> 
> Fixes: 6087cf234cc5 ("ve/net: thread owning ve through copy_net_ns")
> Feature: ve: ve generic structures
> https://virtuozzo.atlassian.net/browse/VSTOR-134732
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
> ---
>  kernel/ve/ve.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
> index 0f0e1a424953..750a1b2882a7 100644
> --- a/kernel/ve/ve.c
> +++ b/kernel/ve/ve.c
> @@ -53,6 +53,7 @@ static struct kmem_cache *ve_cachep;
>  static DEFINE_PER_CPU(struct kstat_lat_pcpu_snap_struct, ve0_lat_stats);
>  
>  struct ve_struct ve0 = {
> +	.css			= { .flags = CSS_NO_REF },
>  	.ve_name		= "0",
>  	.start_jiffies		= INITIAL_JIFFIES,
>