From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konstantin Khorenko Date: Fri, 21 Aug 2026 18:42:23 +0200 Subject: [Devel] [PATCH RHEL10 COMMIT] ve: mark ve0.css with CSS_NO_REF In-Reply-To: <20260821163718.187766-23-khorenko@virtuozzo.com> Message-ID: <202608211642.67LGgNcK667972@f0.sw.ru> List-Id: The commit is pushed to "branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git after rh10-6.12.0-211.39.1.16.6.vz10 ------> commit ea72f3512a97bc7064523e24e5cd4b295db45bdc Author: Eva Kurchatova Date: Fri Aug 21 18:37:08 2026 +0200 ve: mark ve0.css with CSS_NO_REF ve0.css is the root css of the ve cgroup subsystem, and ve_cgrp_subsys is not an early_init one, so the css - its percpu_ref included - is only set up by cgroup_init(). net_ns_init(), however, runs before cgroup_init() in start_kernel() and takes a reference on ve0: start_kernel() net_ns_init() /* init/main.c, before cgroup_init() */ init_net.owner_ve = get_ve(&ve0) css_get(&ve0.css) /* flags == 0, refcnt not set up */ percpu_ref_get(&ve0.css.refcnt) At that point css.refcnt is all zeroes, so __ref_is_percpu() sees no __PERCPU_REF_ATOMIC_DEAD bits, decides the counter is in percpu mode and increments *(unsigned long __percpu *)NULL - that is, whatever happens to live at the start of the percpu area. On x86 that quietly corrupts a percpu variable on every boot; under User Mode Linux it faults outright, which is how it was found. ve0 is a permanent singleton that is never freed, exactly like the root css objects that cgroup_init_subsys() marks CSS_NO_REF, so give it that flag from the start. css_get()/css_put() on ve0 then become no-ops in both windows, before and after cgroup_init(). Fixes: 6087cf234cc5 ("ve/net: thread owning ve through copy_net_ns") Feature: ve: ve generic structures https://virtuozzo.atlassian.net/browse/VSTOR-134732 Signed-off-by: Eva Kurchatova Signed-off-by: Konstantin Khorenko --- kernel/ve/ve.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c index 0f0e1a424953b..750a1b2882a7d 100644 --- a/kernel/ve/ve.c +++ b/kernel/ve/ve.c @@ -53,6 +53,7 @@ static struct kmem_cache *ve_cachep; static DEFINE_PER_CPU(struct kstat_lat_pcpu_snap_struct, ve0_lat_stats); struct ve_struct ve0 = { + .css = { .flags = CSS_NO_REF }, .ve_name = "0", .start_jiffies = INITIAL_JIFFIES,