From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 5785E81377 for ; Mon, 9 Nov 2026 19:54:07 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9Jqr67003471; Mon, 9 Nov 2026 22:52:53 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9Jqr67003471 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="RwlmzmiM" Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9JqoNB003467 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 9 Nov 2026 22:52:51 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9JqoNB003467 Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-8b69d1f2a18so876599b3a.1 for ; Mon, 09 Nov 2026 11:52:51 -0800 (PST) X-Gm-Message-State: APuU4Z/6Cmn0YZCnUSjmAFMfZOnObavwL73DWGflM8wEAf/Sp6HsbVg1 VM8an6nkq5tEZEqTUPEikxtHxGncVGrH+gMgpcaTRUNuXWeYIYcgMSDT8AmRiK7rna/cAXOxwdO srdmZJNNWq3Yi9MFqBHd6VBfhWJqeK75wYl2aF8klGi/mhEd2JIbBEw== X-Gm-Gg: AYBFou2xHmaPvF+cqHaT8ypUgCcOga1JMmx80Z4qrosfu6h++8b8Cx0+8gtnQwC+32X hu6q5+r+EnJMbL4jETLjYmgTH3+mqXlZr7aipENVxEd3zuwMdIxAwdpfmljgdIvU8+2V461xbLN q2ps4yZlhSA/5Ltm67o2KXlRKpPl/f4Tar8qqeFm346DiHA7boNZ3n7aBicWidmdG+hEe/0cXT5 pqWNF/xw3tFMD7WCV7GrXmHph8GykRPeOClPlczVV4v97K8EPSoVKnSoRYy4lpSaKYPRjbYYZes G7GXjQIDu03MlMWEtiKi6ryIygN0sgn8SYZk8tTMG9n4jwPWFa7oQvxFBEbdVIsZketgDnc2CTX rHJ5rjiLZelMKR/pVhyWkLyW+t4La8hIkY5Ej1k52YJgdBDp2TYzPuUUOv0FUcWVKFITU7P9Kxq YgIeHrzcPh/LP8n2M/MVIcc1W+V9nBAPCx X-Received: by 2002:a05:6a00:4649:b0:8b5:a10a:a3e8 with SMTP id d2e1a72fcca58-8ba9930d7a8mr309747b3a.44.1794253969750; Mon, 09 Nov 2026 11:52:49 -0800 (PST) X-Received: by 2002:a05:6a00:4649:b0:8b5:a10a:a3e8 with SMTP id d2e1a72fcca58-8ba9930d7a8mr309728b3a.44.1794253969140; Mon, 09 Nov 2026 11:52:49 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1794253969; cv=pass; d=google.com; s=arc-20260327; b=N4x6rQtnOCpmqe9dcG9Xya0N4QHffcRHJ8GPiOtZ49DoVhku0Ujo+LLjfeYJb00V4i bI7ENdWcyNCvHnI3qphEeGC+Rnfl9eayvKFpL6U2w7c74I18Sipb3v61Pbp/kbpRGwCD +btsn8/O4QIFLJO+3uwfJ+dsef5baQ5aBkBYyd6HZFZ/nBLJuWNV9O30BJD74ZBoGUaR XvTTUwI5TeecFCIwuQF9dkbBd04UzCZKX2VQkLbH2qtzva5eXkrX2j3Xsip/JncKEWzd k9GSTik7+37wHZbPNfzFTbSS2qU8uunN1d5SrvXyd26ay7h/t5zlddecAAU/tG3L93Jo 0uOw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:in-reply-to:from :content-language:references:cc:to:subject:user-agent:date :message-id:dkim-signature; bh=7LQnIgd7oZ0TYu0RNX200rPZZVuC0donjf+nn1KCvCU=; fh=zb8v94HIydbT+fODnrL16oDT0rhznlRsQrQclEqomio=; b=S87wLP2r1ePT6Korhm8CSeAuLIDRqypCj2xK4G9cPu6ldJrmdyqDogRrz0wjibqaSy 6tnGbUMTapfxqWiS2X8d+ttY6YUqca/+MDrvCz4R9V7+jKdN62WBJ6V26EFlcjnhQhjB syv1xBr2MDQGKP9ocOOrz4FVyi5qlkRcLpvyVlmPfPUv3Qp4HuWky89AcQpUlMN7NIo3 N6mJ2Ut6LKbZllJtGHIIZfh6HTcYGTj1sc9ZxGBh9RluuKCH5kb3FSAAC6Gw9F4I7Rym MY+RXgLcOn9HJP7w5q3SyUOL09HEtFFVW8A6Zf55oDdIyhRX9lNbhJz2LMziDZq4Sjlm m7+Q==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=RwlmzmiM; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazlp170100001.outbound.protection.outlook.com. [2a01:111:f403:c201::1]) by mx.google.com with ESMTPS id d2e1a72fcca58-8baad5e433bsi404756b3a.236.2026.11.09.11.52.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2026 11:52:48 -0800 (PST) Received-SPF: pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) client-ip=2a01:111:f403:c201::1; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=RwlmzmiM; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NLIp+v9iQzF0bVPaXqkkEI3ae4xeZTO18ksZbb6dN1hDHiXLE5tjbdz7dtxr+9gUKYegxyxpI1DPuxZHwzGDCRY5myg5XQTwHG+Amje51csyiOiipZ3MPzljmI08bUFhs8D0/GrMK2zgqTmF0TSPowv4zAXNPRCM7wI95spXyK7D2b24hG+bB1L0qb72nunOoaV7+QqKRuGsc3x9ZZt56Ei4pY7ZNkeShPmHUUMI3v2gkOqeASRzXNT+GgFnnjDE2HS9pM+8Ta6Qw4/r/7dN1PSdGCpW+ssV4HTXM/lYV3bgRAzcybuFRlZA0Lwt7MgDIyCkPwjpa0Irw4zd5X8y0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=7LQnIgd7oZ0TYu0RNX200rPZZVuC0donjf+nn1KCvCU=; b=LlL56Fsi1sMkrqVdQ43ouYHwkOnq6RO+w0OAoHb/yJLIoqe+d7FrRNzYgm9JxpUax9dMmjYARDHLBraRnPXjAHLr/oT+0twIlHStx+Q2R/bj1jYpnxmOxjxTz+M5ZzQflnQLAoMEQSRft4VU4Rh8trBshmXQ8R299+MIdVXDaYaT8w1oU/wocaPTK69f1zBwNekFVwecd3k6Ec/MBtqah6yaDQN/4QqpKwTYtqfpbnw8Y+NreVQDpiXzB+ThTmqzP/Q78J0fz12scTkYQ5+34LxlURgcjrQwD9Vyol8Rg+AEogA4NxOMfGGslERlcdDTXKkr/9VJxiuZvWLZhmvMig== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7LQnIgd7oZ0TYu0RNX200rPZZVuC0donjf+nn1KCvCU=; b=RwlmzmiMA10oljpmdVG2rhrkpehA6dk8GwP/vZvQTbWQQyLkWr2Q3p4mY5UeaNKThUzmrTKIGXvqOGd/sG6jvw9MRo9lz0HKvbZawcAYlyz/65eeyKHnD+bLoJ/8A+GMhPy2rh69CJY8lmZw+FjXrKpucRxN+h2vNTJvfbxuWPoVv0Jm47vFccDEzD21giOrlppI1yu3SUxFP26lwm7z2jtMPWnr97Y2y32gFmWvbfxKSYo9leewsask3d/xFOqeQ2XUGiqO4MSk/EmL70aU8kIuGRo3Re6je1fEoCJiFYvFGugZ1HLZ/Pb+MZCkyZuMv3KDEd/VJLqJ3/VUcmVrCw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from MI7PR08MB201474.eurprd08.prod.outlook.com (2603:10a6:290:112::17) by DU4PR08MB11103.eurprd08.prod.outlook.com (2603:10a6:10:574::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.12; Mon, 9 Nov 2026 19:52:45 +0000 Received: from MI7PR08MB201474.eurprd08.prod.outlook.com ([fe80::f35b:af88:bd82:6dfa]) by MI7PR08MB201474.eurprd08.prod.outlook.com ([fe80::f35b:af88:bd82:6dfa%3]) with mapi id 15.21.0592.010; Mon, 9 Nov 2026 19:52:45 +0000 Message-ID: Date: Mon, 9 Nov 2026 20:52:44 +0100 User-Agent: Mozilla Thunderbird To: ptikhomirov@virtuozzo.com, Konstantin Khorenko References: <20261109-ovl-use-orig-ve-v4-0-88e65484dc5b@virtuozzo.com> <20261109-ovl-use-orig-ve-v4-2-88e65484dc5b@virtuozzo.com> <010701a1c1d68b6b-d2b45261-2206-45c7-b6f4-a5200bbce44c-000000@eu-central-1.amazonses.com> Content-Language: en-US From: Vladimir Riabchun In-Reply-To: <010701a1c1d68b6b-d2b45261-2206-45c7-b6f4-a5200bbce44c-000000@eu-central-1.amazonses.com> X-ClientProxiedBy: FR0P281CA0071.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:49::10) To MI7PR08MB201474.eurprd08.prod.outlook.com (2603:10a6:290:112::17) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MI7PR08MB201474:EE_|DU4PR08MB11103:EE_ X-MS-Office365-Filtering-Correlation-Id: 8d73c576-6f6d-4fb9-a60b-08df3e9b0640 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|376014|23010399003|366016|1800799024|261009223027099003|5023799004|4143699003|261021121427099003|56012099006|261022105027099003|261022075727099003|261022113327099003|261021135927099003|261022115727099003|261026140227099003|261028144727099003|261102123227099003|261026121527099003|10067099003|22082099003|18002099003|6133799003|3023799007; X-Microsoft-Antispam-Message-Info: wxce5yCX3rhOqPlOrREg3lvVB5Vo6piEsQMxGHQxAH3OBKIGptpRskkansiliCMkRge+pnjPbkQRRMcCb9KTI8cfhKhsazVan3S9mzW2WXdWQIOkA5Tnnl/44f0PDYkIWRldkwkVxLd1phH8LEVOU3ixoC7o5a9LSIpevuNA1xe0ClvG1dPCG7bo7NHc9Qeywd+nFLvR62ENjljX3N8+MgChi7I2wlUENd0YOH70+7+PS4BMxvKzx4OW4IOguN5m/xQa25wdt8tmG2277EjIuH2CRihpwjnlj8ICjv9GApM1OseSXfoxM0pnMEbVMkYavwUZ80hUBY3u5e64iSiTH8zRt5P7cuoZmr6m1z9DFBnhvrFDir4E33ghvtTmi7uVk2/13Unr1NauA3K6Pw58CR/fEtezkPSzVVUPTpweEi88FS16nJAfLi/xK5vVJkS1DWJwnMwmUGRFM3ussuEog/T3A8uFHqL7CI25mFSo89vZpSl8JX+joidukJO3MRMWhbDg4FTk7lVEhEGL5sJWhEljzdRK0C8m9634E3ceheK7ZUWM8Q6migCCt7WvvfaEOry9VlgeQS/of7zmRokKOxGDulo9vvtZovwzfD2ZTUx9iqzWa1YN7EA4vCFWBgck X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MI7PR08MB201474.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(261009223027099003)(5023799004)(4143699003)(261021121427099003)(56012099006)(261022105027099003)(261022075727099003)(261022113327099003)(261021135927099003)(261022115727099003)(261026140227099003)(261028144727099003)(261102123227099003)(261026121527099003)(10067099003)(22082099003)(18002099003)(6133799003)(3023799007); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?a1JVNnhaanN5d2V6ejdMak5MOHB0bDlaalRJZlVQUDNaTmJNM1N2ZDhOalRP?= =?utf-8?B?a0IrQUxEQ3F6YmxtNnlyZXpQT0w4TzJTTjYzaXBzUEt3MVRkbVRDQzJDYVR4?= =?utf-8?B?cXFjbDJtUFU4WWwzR1EvUXZNNXdLNHA0T0NySkRGMjRETm9FSWlzZlRFeUs1?= =?utf-8?B?ellmWFRXejNFUE5ZMWg5QXVBR0VRa2JrQmhiQjNSYWhiME1oaVEvYjNQdGNH?= =?utf-8?B?dlFMS2sxbm9TZ0l3NXQ3aFUrYTBGbXRxM21PQjlkN2xnd2dyLzVHU1h6UzA2?= =?utf-8?B?OVFxNCtJTnhGaVo3OTFudlJMckYrbjFmNnhhNU5iOFRoZ2YyVjdjTzgwcUtt?= =?utf-8?B?cU5ycnlMQXBDRHhaeWRMWEs0UmxSZ01DdU54SENDZlZoS04xWkNrU29XT2NK?= =?utf-8?B?N01pL3JBTE9mVFZZejRzL2dNL1IySDJzRmNveXFnbFErWWU1bzIwQi9GYnY1?= =?utf-8?B?L2pFOWcvYTF3YnJIc3hxWG9CSURKV2hKK2thWGtUU2dsWStFc0lXWnpuRjJI?= =?utf-8?B?Yzl1MUhaRFJZVEVTVTNRYmNZaGIyYnh4M1YzbHNKT0JINm9nZkNqY1pmME5r?= =?utf-8?B?RUM3S0lsaHZkaTlZVW9SV0JmZFRqQ0pZaFJlOHdHSXJTNncwYmlRai9acGZK?= =?utf-8?B?YlRtQklMbWFHdnljOUJWcGhGVDQxaExMQjYyWWdlbGlrRnRuTW8yTm84c3Qx?= =?utf-8?B?YjNvVVh3cHlJcEg2YXp5ME9YNy9ZZGU3bENUMUlrVGN5UEJHcWRlWTFCYW9p?= =?utf-8?B?TDVLYkd2cjkvL1V3V0NEd0FSMWwwOGtjWW8rYTJERnd2RGN2ajV1RlhETUlI?= =?utf-8?B?ZGp5clFtaytVSW54QUpXMTA3eXBuVVA3aE80bU15N3MxLzhZMCs3ZlpsYVRz?= =?utf-8?B?aldOck40Rm9CV3FQTUkrWjdpS2I4ZVBJUytYcmpxVGJUWXV5TTZNSHVQN2h2?= =?utf-8?B?SzZLOEcwL0gvRVp6bTdHcXlkNkl1eUtTdDZ5SWY4QmgrdC84WDZWWmpCejRQ?= =?utf-8?B?Q2hUZFNsNTUyRVN0UXFLWHpMM1htU1RodlZ2aWh3azZuOHJmZDRYWHlBMGtO?= =?utf-8?B?RXlUOXA2dXJ0cWNsUHJjaXhGM0NLVFlYRHRMNTkwSkg0bTg1enlIa2hCQTBm?= =?utf-8?B?ZEY0N1VPeGVHa280VkJGOHU1RU1oOUpSUitkSG9LUVlYeldZSGRjYlUwTlRw?= =?utf-8?B?M0cwSUs1OXdERk5HdTVNNVBJaENWbDRzUnUzNExPVVJGQXk2VVlUZG1wa0xv?= =?utf-8?B?aThkSmlvbkppR0JXNU5xM2NLbkQyMDVHaktURWRlb1hBdnJzaE9VdnJJYUlU?= =?utf-8?B?bklBZnlTMFU1UjFkbWhqelVURFhUck1lbHVTS1ZrRWc2YldjVEJkSkJNVkJ1?= =?utf-8?B?amQ5SW9hdGx1blFhZ0x2aGE1Nm81VnEvMnU1Y0FPbURPT2dyM2Q1d05yTzU3?= =?utf-8?B?UGlDK3FOMFkzd21iNlpBT2g3b1FJcW9oQW5Zd3RORUZQMFR0eXgyaWw5eFM3?= =?utf-8?B?aWhaeEVmSjBzZG9uYVIyZE9GVjFYS0RlaFlGNEtBY2UvNWhzeFVQaGtVWC9F?= =?utf-8?B?clVobDBkb1FsVkEzTWlTQ3N6RlJ1TVRyQktXTG43UURMYWVLQ0JSZUxUQUs1?= =?utf-8?B?Z1hZL2xpNVZ1QzhxOU9Oc0dsVjQ3WTVMSE9yZjZ3N3JUTVpXVkY5T1piYUs0?= =?utf-8?B?WDZVVEJtVEpHWVA3SnpkOHR0SWNnc1lFRFMzakcvRmF6NFpRVCtsYk1kL2Nw?= =?utf-8?B?ZEJaUDZJcU0xR3MyOGdiWmRUcXR3TWx5WWxKN2ZtOFBLN0UzeHk3S2Q0TFJ2?= =?utf-8?B?bkFxbkEyUWlaTWFiVGp2cTRlTWFoUlVIR2thMUNPVTMzTkFFbER5L0UzWlp2?= =?utf-8?B?WUFLU2xnNk1DNHJyQnRiZVNpNjI3MExWWW1qdHlJbFpmUEd5VVg0ZU9yYURl?= =?utf-8?B?bGlFMDh4TUJFbkY5WUNFemVPeGh0UzRSR2pSd3B0RTZKUXdtQmsvbXprditz?= =?utf-8?B?OFB5aDhWYmYyYXQ2S1ZockxYWGwxbWhZMFFsbnZmMVFrdkxNVk16bmV4cDNp?= =?utf-8?B?bWdGOUxtZ0ZUc1JkNjlOa0N5bVNncjkyd0JDYVdXcHRUenNWTC8rNEFzT2Yy?= =?utf-8?B?Z1BtNWZ4cFhKUHZmOGorK3dqd2tXZUtQRDYzWUp0S2kwa1Z0NHZZbXNGTjdh?= =?utf-8?B?b0I3RTFlUCsxZ09hZkhJSlBaNHFKNzhqN3NPN2w1V1FrbG9NNTIrL3E1T2JU?= =?utf-8?B?d093OVc5YWN1SlhodkVDeko2ZVBHSWVrZHp5YVlheTY3clNaWVQzT1J5dWlj?= =?utf-8?B?c3h2a1lMbWNEeGFiRFNQejRrQVhZak9WTzVsZy9JTzc2REJrMWdGQSs5cmpa?= =?utf-8?Q?46/l8+PV3DRQIiGg=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8d73c576-6f6d-4fb9-a60b-08df3e9b0640 X-MS-Exchange-CrossTenant-AuthSource: MI7PR08MB201474.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Nov 2026 19:52:45.6385 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 780aqLB9oTs2HPT+8B/hJvdUSFZW2QVCaiZl02h7PfDB1NJ6zYkmBwaft/mpqv6NP5xUog1Tg+l4LCmN/x1M3uyx0tXL0bEpOSYmmS2KtAU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4PR08MB11103 X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1 v4 2/5] ve: Introduce override_ve/revert_ve helpers X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org On 11/9/26 20:43, no-reply@sashiko.virtuozzo.com wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: > - [Low] ve: override_ve() uses a non-ratelimited WARN_ON as its permission check > -- > > Commit dab91ee458061d579a92288ba48a09c48c12df09 > Author: Vladimir Riabchun > > ve: Introduce override_ve/revert_ve helpers > > This adds override_ve() and revert_ve() helpers that mirror > override_creds() and revert_creds(). It also adds a task->overrided_ve > field, which ve_capable() and ve_capable_noaudit() now consult, and a > check in dup_task_struct() that the field is not inherited on fork. > > Link: https://virtuozzo.atlassian.net/browse/VSTOR-142405 > >> diff --git a/include/linux/ve.h b/include/linux/ve.h >> --- a/include/linux/ve.h >> +++ b/include/linux/ve.h > > [ ... ] > >> @@ -295,6 +295,26 @@ static inline struct vdso_image *ve_get_vdso_64(struct ve_struct *ve) >> return ve->vdso_64; >> } >> >> +static inline struct ve_struct *override_ve(struct ve_struct *new_ve) >> +{ >> + struct ve_struct *old_ve = current->overrided_ve; >> + >> + /* CT tasks are not supposed to switch VE context, this is a breach */ >> + if (WARN_ON(new_ve != get_exec_env() && !ve_is_super(get_exec_env()))) >> + return ERR_PTR(-EPERM); > > [Severity: Low] > Can this WARN_ON fire on a legitimate path? override_ve() is called from > ovl_override_creds() with ofs->creator_ve, which is fixed at mount time > in ovl_fill_super() as get_ve(get_exec_env()). This is a security issue and we really don't want to allow this. Just don't make an overlayfs in a CT over an overlayfs from another, this is weird. > > If a container task reaches an overlay whose creator VE is not its own VE > (for example an overlay mounted by the host and exposed to the container, > perhaps through a bind mount), the condition > new_ve != get_exec_env() && !ve_is_super(get_exec_env()) > is true on every lookup, permission check, getattr, readdir and so on. > > Each of those operations would then log a warning splat and fail with > -EPERM, where they previously succeeded. I could not confirm from the > repository that such exposure actually occurs, so this depends on whether > it is reachable. > > The WARN_ON is neither _ONCE nor ratelimited, so repeated failures can > flood the log, and with panic_on_warn set the system would panic. Would > a ratelimited or one-time warning, or no warning and just the -EPERM > return, be more appropriate for a permission check that callers already > handle? We want to see a call trace for debugging purposes in such case. I think WARN_ON is fine. User should see a bunch of warnings that something is going terribly wrong and run to us and report it. > >> + >> + current->overrided_ve = new_ve; >> + return old_ve; >> +} > > [ ... ] > -- Best regards, Riabchun Vladimir Linux Kernel Developer, Virtuozzo _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel