From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id CEB3981377 for ; Mon, 9 Nov 2026 16:01:58 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9G0Pmc001159; Mon, 9 Nov 2026 19:00:26 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9G0Pmc001159 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="YEaicSg0" Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9G0HdP001155 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 9 Nov 2026 19:00:18 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9G0HdP001155 Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2ed276af91dso18168275ad.3 for ; Mon, 09 Nov 2026 08:00:18 -0800 (PST) X-Gm-Message-State: APuU4Z+MYY3fPsbbgiK22GnuTUjbf2V7dJyQ9ofP1UbP/iqmbR3oeJJq mTNeTjuvGty8bO/GymLa3T7Oi7chj7CCs2CLEfl0UaprObswyD/qE1AZpN3bfIm+4F3wAXp2sBH 8dyWGniXOpQIwYJlSjYW01R9Crwsf9AE9eNqRGqZoNezndy3gS/BLOg== X-Gm-Gg: AYBFou1SiYXd9G6WjomDeQP0NKuVstjGrTPupYak/0xnjeYZmCxAG//+k4044jzu9vo 9ADQKnoFXr6NnwfB1y1NPFvUWbl1UcD34NLyQ7K/RgYdbWMnFt0YFm3joJGu7PyewXcWQ+LOTsK R7s1+w41z9aJXTzKRiVVk7A1INn5b3dM2BN8rYqXraZob+vS+61rz/HS2C6MWtVK7AnZ8jQjhpi Dwu63EhNBIMp5W8T7f8VWXeXIIopiaYVBmM3CBI4FO3hoYXRLUrCnufr7YTUQHlccrFIfdluoxt Bot1wL0z+jAKjHZq8+gDkSA1GfO196NPDWt9gS0bNkrN8BvFR+hi/RqcyaL11FPG7vas6kiAAIE QysuVuzoB3v57Pe/+nUsyyzuwVy8ngmKhkK6KVb9imJbEoPFftqoJ6/vtUDEj7A0F6gWFL7Qqac nhfGazHrzr/HRtzX7yAk/wijLcNVfh2bdbb+Y= X-Received: by 2002:a17:903:228a:b0:2ed:d7b:2f5c with SMTP id d9443c01a7336-2ed833eee75mr42592145ad.5.1794240016709; Mon, 09 Nov 2026 08:00:16 -0800 (PST) X-Received: by 2002:a17:903:228a:b0:2ed:d7b:2f5c with SMTP id d9443c01a7336-2ed833eee75mr42591675ad.5.1794240016030; Mon, 09 Nov 2026 08:00:16 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1794240016; cv=pass; d=google.com; s=arc-20260327; b=OAoGxTKUCxXTYfrn+zsuWGTVmGfoHyDw8f9+40C4RGcpMfWnngbgDg4gs+PEi9n4ct 3Wg2EjSZCU2Ni8IF0+2l5hKKpRB3cCNHxTFGStj7gT4nMXt6pkYYOI5zmJFqFZrVoXBK u97Ovumw5qh5FjcteHKVaQq4IPT5WnpqlwSTHnsmE1Xd/awzvngXVnDIBdtAbZpTlclo Qjd/PlUMbWbzxp4oDZNRSuQ/8bcvQIYBrhR+MXBjr/uqTDsi+hhMNcOGn3P+hyz/t4So dmyPdwWIchOMhANV2YD0kVqFeIWIwLhkOL3kWsgsfdvcD5mC0J0jYqIxaiW9pmrACN4O Hx0w== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:in-reply-to:from :content-language:references:cc:to:subject:user-agent:date :message-id:dkim-signature; bh=Ms+30gaOEkB449g7EJnbmS29sm3nssQSySWrHqDGj7Q=; fh=lDcH/AoEq9GlEqGnfAM3WWP3S1pTgZTBlu1eNYhzdGw=; b=oiJ0h966wT98bAMaLScnSHpQwg7kHAWSYIoRJkpD+5ELsHQ9P3HevqiBqqJKHbW2Ex u8Ijp1AuGNJUlcwC1BCbHzrlFcRhz6Jzai9LePiadW1lapncYBlNfwVHj048dnHbasda F2/h54yS2zQ0/z6Y2/xNm/os3LPN9BFsaOUDEz9qLAKcSF+jGhpADuMAM9fwUU6DbHTY NfCVjPlUZ+VuhflfiGh1S6jjw3Cj18Y/QkQZaOmbgKCceQyORWqc6xYZxqMV5XSqXqM2 VpQMcDoFzojJvGZQY0b3jv8o+0KJgM4r71QyWCte/Zcy4XwVdWAg4/E9yvzd+Fn3Pymm MfrQ==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=YEaicSg0; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c200::1 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from DB3PR0202CU003.outbound.protection.outlook.com (mail-northeuropeazlp170100001.outbound.protection.outlook.com. [2a01:111:f403:c200::1]) by mx.google.com with ESMTPS id d9443c01a7336-2ed81a7ff19si90248795ad.172.2026.11.09.08.00.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2026 08:00:16 -0800 (PST) Received-SPF: pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c200::1 as permitted sender) client-ip=2a01:111:f403:c200::1; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=YEaicSg0; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c200::1 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=u1821ZeZ6w9Q1OMwNTnu/haWW1D3mC8334xXfoRsqtSj7r9elldaFfh0Lej3mwKIO8wr5NnrfrfoywmfNlsazOQpuPwRQx7YbF3MiF/88h39MV55kMLIOrhvJiyk6lTk53V7oT9B/SEn6KygMt6lLS+pmFG/KZE/63vXnl/KeelVFCIMzxM9iCPntVmsidXdPI0OVX8SVqELV0tIvtcNy3JROS0TQr8jAidw6fj2bIvlGCktiKf9+kNlVKfguwS+ZNbOMseWVaDJQeZFTC5XSoyZwKpLidIO2dNGf0RAgHSkHNiGcdXGGdf9EF6zuXZyOqw6ci3fsP8tp1RmQjv/pQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Ms+30gaOEkB449g7EJnbmS29sm3nssQSySWrHqDGj7Q=; b=CjSkQ9OnYcUnlizneUTpldzSvZ+cWS9Q6h4+UaR6pOBqfwv+LY80cCBFANRb2GI7YXLRCDkBYhtebLUQdAb0DfFR4QU8d28yforGdHwRG0OiUIq+/+XDThr8laJ2keYJqQGGJMUUz0m/Kjr5uaZYRJpRmL0cZ2xtsdhcFBzNQBmn38ions4OpFT/4NTBZeW9Sg5Yg5Y+KhJJG0OY7NX+f8BVb0qkzpypQwC0ocC6qlUkqVkbrtHzXbXPyYxlUYdBLEGVFQMr3xqKTcDXQ8G/W3PUrArKlRbi70d8iIYqR04jNNB4MLZJU9gc/Xoh+0JO8D5DYdHIwTdNBe+vqyXp0A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ms+30gaOEkB449g7EJnbmS29sm3nssQSySWrHqDGj7Q=; b=YEaicSg0HCLZsmZ9L0wPT/WbihvezLz51q4kYg1LOL2LqmyMktKi0J7anMchZqQYYqRJHd9CoEpos68x8xH7wNw7A8qPCGM1sFUc4hNzP04HP2jGwiTDPI/jcLSsg04eFojd/XG9h/sHCxs57fCWC6ClSOR5N155WewU4zy9SfpZ4UlgzFrtBpbJmNLMr8NQAQC1VB7HIxyHXc9pn0lsipXcj3LdyK/5s9kxIWalMHMHvTqa0cH97EOzjyY149lPD+bxX/C6f20HRNOHCYSqWDV9Iam2vEwH1kfnAUTLOEmTpco5hvj4NiiuTLAfMuYrQmgJhywJ63MSJ6iYEMLiQQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from MI7PR08MB201474.eurprd08.prod.outlook.com (2603:10a6:290:112::17) by DU0PR08MB8836.eurprd08.prod.outlook.com (2603:10a6:10:47d::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.10; Mon, 9 Nov 2026 16:00:08 +0000 Received: from MI7PR08MB201474.eurprd08.prod.outlook.com ([fe80::f35b:af88:bd82:6dfa]) by MI7PR08MB201474.eurprd08.prod.outlook.com ([fe80::f35b:af88:bd82:6dfa%3]) with mapi id 15.21.0592.010; Mon, 9 Nov 2026 16:00:08 +0000 Message-ID: Date: Mon, 9 Nov 2026 17:00:07 +0100 User-Agent: Mozilla Thunderbird To: no-reply@sashiko.virtuozzo.com, ptikhomirov@virtuozzo.com, Konstantin Khorenko References: <20261103-ovl-use-orig-ve-v3-0-add042cdd087@virtuozzo.com> <20261103-ovl-use-orig-ve-v3-2-add042cdd087@virtuozzo.com> <010701a1a0be8cf9-6aba617e-cae6-4077-b8f7-de83405f3045-000000@eu-central-1.amazonses.com> Content-Language: en-US From: Vladimir Riabchun In-Reply-To: <010701a1a0be8cf9-6aba617e-cae6-4077-b8f7-de83405f3045-000000@eu-central-1.amazonses.com> X-ClientProxiedBy: FR5P281CA0050.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:f0::6) To MI7PR08MB201474.eurprd08.prod.outlook.com (2603:10a6:290:112::17) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MI7PR08MB201474:EE_|DU0PR08MB8836:EE_ X-MS-Office365-Filtering-Correlation-Id: a1f607f7-5236-4823-859d-08df3e7a874a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|23010399003|376014|366016|1800799024|22082099003|18002099003|10067099003|3023799007|4143699003|56012099006|261026140227099003|5023799004|261102130727099003|261102123227099003|261028144727099003|261026121527099003|261022105027099003|261021121427099003|261009223327099003|261022075727099003|261009221727099003|261009223027099003|261009221227099003|261009220027099003; X-Microsoft-Antispam-Message-Info: EK5CUnSqrnuHMAPKQ8W9jIiwpkXgN7xbd8mfswsJP1AzZxagHAIOT8dkW5VVIiyUxcC9s96Lw9lxsDhTLPJqFMhdF0jAMFKoOO5s1Qpe+1OplgWb2Vbj687HTtBW4gB+k9I91AP7P4FUi5ou5nMAtDt8z5xHkoMFTuZLp0xc6nfoJBB0ZJxa0RsPyqIj7sZcmhop8B5UIRthtYWRTHHZWbfsE9ZjTlzJ2bhaQ70z9v2h3K3ErKDqpUmXIGhWpAcI4VKW52RXqaMAegJiSs1jxx3wDfUsISBe3jfqrSeEFiWmwfPdZUV3+YwWTmJgADC5WwkJX6SHhlskZ8GErQReZEktB6ImmigClvZEJrt7qbNz6sVkTzG85TxJGgEdABwjGc6QUXp2cGj96tLYquD4UiMkZjNBhIrN/AkUJcUAs6SLIUJ8hV96nOYKmfDbq03xT3O2AVPrZCCaSamU6VhvtVOL+y/Fg1Hn+sP4PcrBv1Fj1PwwFqQSRBfXp2ap9poMjjywW41ZSVxPYJxD3Rcz4dB1/VK2UKhZZGoKU5cmEk3i0VvAqNcvXeoS4zlrdctskf7hxskTbq5ZE0jvcZXQpSSsLSm/6nRxDyTI8SftCgwyd+hHfsSB0IWHOMVM5MJh X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MI7PR08MB201474.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(23010399003)(376014)(366016)(1800799024)(22082099003)(18002099003)(10067099003)(3023799007)(4143699003)(56012099006)(261026140227099003)(5023799004)(261102130727099003)(261102123227099003)(261028144727099003)(261026121527099003)(261022105027099003)(261021121427099003)(261009223327099003)(261022075727099003)(261009221727099003)(261009223027099003)(261009221227099003)(261009220027099003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?THE1cFJLZ0N1V0NKYXFjS1NzWmlqVHNqWmEvc1B0YkFJaW0zU2R6QlJWQnZS?= =?utf-8?B?NW9BT0g2eWVJd2FRSlp3SzhGSlNsMjZxT1diekRacThkQ0ZWTjdiQ3JNeThu?= =?utf-8?B?NXBYNGJZZUdxOCsvOTIyWDIveGNCcFVqa2NPRG9QU0pNUHVkSnZtRFNZR3VC?= =?utf-8?B?eVJTT2dIWnh0SWJuemphSzN0TVMrQXFJaXQrSFdFQzNqRWVrOWJFYXBLYjY2?= =?utf-8?B?WDk3RkM0eUtWcE9HM1dXbmFzSmEwaTRYWjk2RjA2U3JNU0Z6SjBmNXY5TW92?= =?utf-8?B?bmRyZjlPSmRHR1RJeEYwRTBsU1c4dmtienV3MU8vYWcwWDYwUVYzTXROTjVO?= =?utf-8?B?OEpVNW0rdWxHVTlVU0ExanZVREk2Z1RtMzl6R3kyQXV1YUxuUzExWVE2TkVS?= =?utf-8?B?Ny9rZ01yalc0bHlKSldOR1lGZXVrcTZsN0FkNkVJYURkWUtpZDdiQ0pwM2Nl?= =?utf-8?B?WUo4RzZCbDRrYUdWd1hPMU91RFEyOEdjRmlTUTY4TXpYT2RTRXh5SmI0YkY5?= =?utf-8?B?eGNKMTlzQnR4YyswVlNTVTBRZWRKWThLTDdSTXUvUGNkSXNYVFJjb1hEc2hz?= =?utf-8?B?aFA4TlBONmkrYy9GNlpBM1pNZ2VBZXlhMGkveTRYR09aYjBWOVdkRjlFcWxu?= =?utf-8?B?enVFZlZTbmtUaEZKaDNsVWhHc3ZsSGg1Y1NLTDFlYW03T21Xa1p0a3YyZGZ6?= =?utf-8?B?TUlmQ3dvdFhERkw1RDRORWx2WTB2a1JONnVwOGpuQzB2VUZJa3lDSlcrQkE5?= =?utf-8?B?VEpDcVN3dHRielZQL2llK2RBZEVFU2pCWjc0ZGZyWVFMTlpjejl6bDlrdmFv?= =?utf-8?B?U3FNTVE4T0JSZFBjOGd3QTB0OUFMTHNlTFdpSG1sQ25MMDJucWhDb3lpWDlF?= =?utf-8?B?MXVDTFM0cmFjdXNGOXZVR3FBZElQUVBMVWNOTzFFSUhmK0szUXR6bXJSQS85?= =?utf-8?B?bDhld0hYZTRIY1NoR3d6VVJaYW9ZeXVya0E5MTNGOU9BM3F1VDAzNWtiYXFL?= =?utf-8?B?cFczRVo5bnlnOHRCUkxnN0UwZ1FOenVMNWg3anZQS0hVQzdjTGRDMVExVXFX?= =?utf-8?B?SEh4UVhYSm1raE04WWRIbXd5QlJnbnN2Ny9MV2xsWFhtNkJlRWx4aGhPeGxx?= =?utf-8?B?MHRWL3hBcVRrQTQvcjVtRjRBZDh2SWdXNTNVVElmWFJETDlqWmJFNUovTE5E?= =?utf-8?B?bkh0UmpFSUM2dW1lcUNzcEVVOGtWOFdUVmI0NzhjMVRQUjlLOHJLU3hpNTI2?= =?utf-8?B?UjhXdjRyem4vRE96N1A0SjM4TjdMVmFVN281S0hOUUxNTTd4b3ZpRTZFNng3?= =?utf-8?B?YWFTWnV5VVUwbE5rTmdoalh2RTNPYU5CMXZLZXI5cmpvS2pWajhMY3krbG93?= =?utf-8?B?SUFqdlVsOGk2cHdJWDRFSERyLzhSMndXMWlxM3JxZ3p6bVJDaGpqRDd4VWhK?= =?utf-8?B?alBRNVl5VXg2T2ZTQk5xUU5OdDAzT0ZvQlVoNzJrajN2ZEwxTlUydUNmdmd3?= =?utf-8?B?b2JIVUoxRGVsc2xnd0lEY29hNE95Y3l6cDA2djFaNXZ1MVF6K0psYWlldUpI?= =?utf-8?B?WHg4TnFNSlg5enpHUHJlNmVxbFJ5L09XNTZiek10ZkUzTVcyVndsVUxyOU1j?= =?utf-8?B?TGRwWkhldVFxRGRFVnh5Tnd2cXlwWEQwUDA0QWpPTzQ4RXUvTnBENkxoeFFO?= =?utf-8?B?bUhNUEdKbGZRMUw2clc0eWNWbzlhcVdldFRCWWpvckZaZlRUTWZEejA4R2tL?= =?utf-8?B?UWRmb2cyY3FJQW1RRi9xMEM3Mi9KTU0xZmltbisvTGtpSUJ3QW5GVWF3MEg0?= =?utf-8?B?bU44OFNFMDhzRTltdk1FbUVzTjdnV29TVlRRRVYvRzVqS2JRcVFPYUdFSG03?= =?utf-8?B?alJXKy93eGNmeFh3ZCs2Snlpc0JNK2dCUWdMVHZ5WThCYjM4YzhVajg5bHRV?= =?utf-8?B?SDY5RVU4ZUtSdlNnYmh2Q2Rid2o0RS91RTlkZHFCZnZuZk82T2VEcldKZTNz?= =?utf-8?B?N1RoZmZhcVptcHFvclhraWpnZitTQzBYS0JVOGtmNnh5MGpKQ2taSXFtcXg4?= =?utf-8?B?cDNrei9JSjVBdU85K3lGMjVnMXhzZ0FDckhqQ2JBVFArL2wxemJBQXpoNFRJ?= =?utf-8?B?TGJ6VVZRNWZCNTZLN1FYaTNXREt2Ujkza0ZsaTJmZ0Vhc1pQM1d4eExhL014?= =?utf-8?B?WXppcHkyM0QrTGtMTkJOR24rZGdocmtmTUg0MDhDUlZZR2hmeGI4Qk5VdjBG?= =?utf-8?B?SisvOFZlTkMzVUtEK2VuQnIwY3FHWGZ2OS9ocTRWUVZhdU9wYmprTXVZTmxX?= =?utf-8?B?N01mZ3EvU3E3cHpHU1g1bXVjQ01CNG5nUXR3VnlrRkVmVWlLL0hMTEhWeldV?= =?utf-8?Q?UdkEsxY3y58ZQ4g0=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: a1f607f7-5236-4823-859d-08df3e7a874a X-MS-Exchange-CrossTenant-AuthSource: MI7PR08MB201474.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Nov 2026 16:00:08.7345 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 8PvCfeK1i5+znkeNlX+w2js8tLvyyhMTUssYREK8utlQ6Eguu/8e95MRhO5e9T2FuTBSV4iUWNVFvoNHwoR7hiBDAgBAwt6TFMNI6o7GPj0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR08MB8836 X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1 v3 2/5] ve: Introduce override_ve/revert_ve helpers X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org On 11/3/26 10:30, no-reply@sashiko.virtuozzo.com wrote: > Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider: > - [High] ve: revert_ve() can store ERR_PTR from override_ve() into overrided_ve > - [High] ve: override_ve() ERR_PTR(-EPERM) stored into current->overrided_ve by revert_ve() > - [Medium] ve: task->overrided_ve is inherited across fork and never reset in copy_process() > -- > > commit c3ec088474d81dc93b8377e2345dc81ee6df8365 > Author: Vladimir Riabchun > > ve: Introduce override_ve/revert_ve helpers > > This adds override_ve() and revert_ve(), which mirror > override_creds()/revert_creds(). It also adds a task->overrided_ve field. > ve_capable() and ve_capable_noaudit() now use that field in preference to > get_exec_env(). > > Link: https://virtuozzo.atlassian.net/browse/VSTOR-142405 > >> diff --git a/include/linux/sched.h b/include/linux/sched.h >> --- a/include/linux/sched.h >> +++ b/include/linux/sched.h > > [ ... ] > >> @@ -1065,6 +1065,7 @@ struct task_struct { >> #ifdef CONFIG_VE >> struct ve_struct *task_ve; >> struct ve_namespace *ve_ns; >> + struct ve_struct *overrided_ve; /* NULL when no overrides */ >> #endif > > [Severity: Medium] > Can this pointer be inherited across fork? dup_task_struct() copies the > whole task_struct, so a child created while the parent is between > override_ve() and revert_ve() gets the parent's non-NULL overrided_ve. > > copy_process()->copy_ve_ns() only sets these fields: > > p->ve_ns = new_ve_ns; > p->task_ve = new_ve_ns->ve; override_ve by design is changing current only. It should never happen in fork path. To save us from stupid hiccups in the future, I'll add a WARN and field reset in dup_task_struct. > > It never clears overrided_ve, so the comment "NULL when no overrides" may > not hold for the child. The child never runs revert_ve(), because that > only acts on current. > > ve_capable() and ve_capable_noaudit() in the child would then use the > parent's overriding VE init_cred instead of the child's own > get_exec_env(). > > I did not find a concrete in-tree caller that forks inside the window. > Should overrided_ve be reset to NULL at fork time? > >> diff --git a/include/linux/ve.h b/include/linux/ve.h >> --- a/include/linux/ve.h >> +++ b/include/linux/ve.h > > [ ... ] > >> +static inline struct ve_struct *override_ve(struct ve_struct *new_ve) >> +{ >> + struct ve_struct *old_ve = current->overrided_ve; >> + >> + /* CT tasks are not supposed to switch VE context, this is a breach */ >> + if (WARN_ON(new_ve != get_exec_env() && !ve_is_super(get_exec_env()))) >> + return ERR_PTR(-EPERM); >> + >> + current->overrided_ve = new_ve; >> + return old_ve; >> +} >> + >> +static inline void revert_ve(struct ve_struct *orig_ve) >> +{ >> + current->overrided_ve = orig_ve; >> +} > > [Severity: High] > Can revert_ve() store an ERR_PTR into current->overrided_ve? When the > WARN_ON condition holds, override_ve() returns ERR_PTR(-EPERM) and leaves > overrided_ve unchanged. That return value has the same type as a valid > previous-override cookie. True. I'll add WARN_ON in revert_ve to protect from error values reaching overrided_ve. > > revert_ve() has no IS_ERR() check and stores whatever it is given: > > current->overrided_ve = orig_ve; > > In the final series state, ovl_override_creds() does this: > > fs/overlayfs/util.c:ovl_override_creds() { > ... > desc.ve = override_ve(ofs->creator_ve); > ... > } > > It does not check the result with IS_ERR(). ovl_revert_creds() then calls > revert_ve(old_creds->ve) unconditionally. > > A container task that uses an overlayfs superblock whose creator_ve > differs from its own VE, for example one created by the host, would hit > the WARN_ON and end up with ERR_PTR(-EPERM) in current->overrided_ve. > >> diff --git a/kernel/capability.c b/kernel/capability.c >> --- a/kernel/capability.c >> +++ b/kernel/capability.c >> @@ -389,10 +389,11 @@ EXPORT_SYMBOL(ns_capable); >> bool ve_capable(int cap) >> { >> struct cred *cred; >> + struct ve_struct *ve = current->overrided_ve ?: get_exec_env(); >> bool ret; >> >> rcu_read_lock(); >> - cred = get_exec_env()->init_cred; >> + cred = ve->init_cred; > > [Severity: High] > Can this dereference an ERR_PTR? ERR_PTR(-EPERM) is non-NULL, so the ?: > expression selects it. The next ve_capable() or ve_capable_noaudit() call > by that task then reads ve->init_cred through an invalid pointer. > ve_capable_noaudit() has the same pattern. > > Should override_ve() callers check IS_ERR(), and should revert_ve() skip > error pointers? With updated revert_ve with IS_ERR protection it wouldn't. I'll fix this in v4. > -- Best regards, Riabchun Vladimir Linux Kernel Developer, Virtuozzo _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel