From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 28495802A5 for ; Fri, 9 Oct 2026 14:01:08 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 699Dxt5K008306; Fri, 9 Oct 2026 16:59:55 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 699Dxt5K008306 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="LKrBZT5F" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 699DxanF008270 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Fri, 9 Oct 2026 16:59:36 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 699DxanF008270 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-48c69bdeaacso3258048f8f.0 for ; Fri, 09 Oct 2026 06:59:36 -0700 (PDT) X-Gm-Message-State: AFq9FYL7pqbzYzZLRXJv0+WZLSMXIutNy3k0F+/y7h0ZEXBiu9YBE4yj 61YfkWG1ulF1OfIB0wFIRzjx08Awyd+a78+16cdQUaMoCm+UqzOKcn63x3yI6n7f6rkyB5L9gwo GOzdHGJEzkZci4qZDvd5eVwKu/KIXJu5/IhbUEYeHhfn2+vzlljD+eA== X-Gm-Gg: AYBFou38GWEfXS5DYPJNLUcBY7ZKjrXryWSrBToS+KGGxld2tA3ca63lGPk0v3d+vMr aOxHoecSGOFkQNvvDhdR5A4WQquH4wPVv+EojFj/AIutaoozQrog5XpQmCSvBNHL1WeYttKjTRJ zt98nBwmCa5vZxK7Ki9y9G05qxJoXc0DX6YSdmg3/S7FL03lUL0Qwi+JQ1k+gQ3GWOvhZvV/5rI QjIYDQzaCNwxep5JoAIvjlnRjkF8zHfxbu3fqCCUCTcg81D6AO5reX5PT/Mup71wby/zyGIn3NX aVwn3To0AmOxx1TR4i7vei29defN1kH/Z3exGpXVcuSa07XJkNxevixYFQZxnguIAgpigRMDX9m wxJp0Qr0NGwlKiqiqsGgPVDhxBA== X-Received: by 2002:a5d:5f87:0:b0:487:a3f:1ea6 with SMTP id ffacd0b85a97d-48dbaadd9b7mr4323946f8f.11.1791554376363; Fri, 09 Oct 2026 06:59:36 -0700 (PDT) X-Received: by 2002:a5d:5f87:0:b0:487:a3f:1ea6 with SMTP id ffacd0b85a97d-48dbaadd9b7mr4323866f8f.11.1791554375695; Fri, 09 Oct 2026 06:59:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791554375; cv=none; d=google.com; s=arc-20260327; b=Pwdh2ZG+yKe/veUjq1QzMuYX/xYBP1/wstt3FJno/WUC2gmyTtUKTF/GpdRW2Up8Yd kCuqCfwZfo+4SvqDR28emrSTDyYswz1enSrKykEbFjxVmAlVDClkDpkpuRH27TPFgAr9 YJ76exI5WXFNJoHP7G0Ozk2vG7EcqlMcUkTvNSZqwZUItkdN/X/fyzrofAH7nG0lyMvt qJDF5Z2fbNG++GxI7thjamC3FqxYo9ylB0d7Z0dYKbwphRZCQxnUzJsfIUHyiOVWsoVE Z8fk8Gu7mOH0bacZE7dXcsyvf/Nt3ni5m7TXxjcWPfAtbtLBrWSBFGSaP6+Iyd7BjBmj fDJg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=r2yRbSKECzvU/VnV8/fsF4kQkQCGc+kjl9f3qrpjfOA=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=bMixRO8mX5g5wk4lxWiYeAo9Dw0shKz2vvc5Z1Raqp1w4UkKNBwcRGC0QW5YD1BHkO MWRvMWBOQ53Dnz0KdCCkDfog2qt2Tsk9rwRONwj4MRVUIhomnGWfeS72G2z4mZeCq390 7b48OAE0KTjxfm/uNaLsvc8T2ROl4P4rvt6KAv0/9Je4H/LUi1F+9Ud/Ol1FwLvncaA6 7fZR36HUCnMHr1jMB8h4n0pbT8pJ+b5QVtA/ToTRd1PB67LPGzcR046yDcNoIcEIxMKt UGQ4d8APKhFUgWHKYmM6WX5zU2fjPk6gXw7NEBHiX53wjXg4EBeWn3quubSptBPbzFJs B44A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=LKrBZT5F; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48db9ac4e1csi4357110f8f.200.2026.10.09.06.59.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 09 Oct 2026 06:59:35 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=LKrBZT5F; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=r2yRbSKECzvU/VnV8/fsF4kQkQCGc+kjl9f3qrpjfOA=; b=LKrBZT5FjdeA c/z9/cMHKSgaklFfEyxrNSoXVJNSXUi8TtP7VGXgoXuIZZj/xkk1FfZ/Xcm1rVoD1bJms5GKzRK2n v7KIekSh3jfzK4ev6YedE8lopAodWeyLOcryCBnM9pw98lLoLB/vWXfWsJRae3ekkEFUi/Ng/OfQV z8kcCkGuUAQHnpJiATHGUfdY4xt2pDLi1L72SN8eInPjBSedpVSy/zhizWvIMDtDLrkqBJVrKhfRL kSfkgvKoa3TTlF4+sBisng3CrNVL/M+PelfTdt2h6VA0R2cA9kCFDHZH5AQpFDWM9UOLSYzkL2DI3 NnU4IT4jhJBFjVQMmwXgrQ==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xFB4z-007VMS-3D; Fri, 09 Oct 2026 15:59:31 +0200 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Fri, 9 Oct 2026 16:58:37 +0300 Message-ID: <20261009135929.3274885-5-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261009135929.3274885-1-eva.kurchatova@virtuozzo.com> References: <20261009135929.3274885-1-eva.kurchatova@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 4/4] timens: freeze the offsets on the first join without the vDSO too X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org A time namespace's offsets may be written until the first task joins it; from then on they are read without a lock, so that join freezes them. The freeze sat in the code that fills the namespace's vDSO page, and since 1b6c89285d37 ("timens: Remove dependency on the vDSO") a kernel without a generic vDSO, User Mode Linux now, never froze: the owner could rewrite the offsets under the tasks already running there, and the clocks they read moved with them. Freeze in timens_commit() itself and fill the vDSO page from there, where there is one. Fixes: 1b6c89285d37 ("timens: Remove dependency on the vDSO") https://virtuozzo.atlassian.net/browse/VSTOR-148112 Feature: fix ms/timens Signed-off-by: Eva Kurchatova --- include/linux/time_namespace.h | 11 ++++++----- kernel/time/namespace.c | 28 +++++++++++++++++++++++++++ kernel/time/namespace_internal.h | 10 ++++++++++ kernel/time/namespace_vdso.c | 33 +++++--------------------------- 4 files changed, 49 insertions(+), 33 deletions(-) diff --git a/include/linux/time_namespace.h b/include/linux/time_namespace.h index 6c1872e7bb73..a8b4403e8630 100644 --- a/include/linux/time_namespace.h +++ b/include/linux/time_namespace.h @@ -46,6 +46,7 @@ struct time_namespace *copy_time_ns(unsigned long flags, struct time_namespace *old_ns); void free_time_ns(struct time_namespace *ns); void timens_on_fork(struct nsproxy *nsproxy, struct task_struct *tsk); +void timens_commit(struct task_struct *tsk, struct time_namespace *ns); static inline void put_time_ns(struct time_namespace *ns) { @@ -131,6 +132,11 @@ static inline void timens_on_fork(struct nsproxy *nsproxy, return; } +static inline void timens_commit(struct task_struct *tsk, + struct time_namespace *ns) +{ +} + static inline void timens_add_monotonic(struct timespec64 *ts) { } static inline void timens_add_boottime(struct timespec64 *ts) { } @@ -148,13 +154,8 @@ static inline ktime_t timens_ktime_to_host(clockid_t clockid, ktime_t tim) #endif #ifdef CONFIG_TIME_NS_VDSO -extern void timens_commit(struct task_struct *tsk, struct time_namespace *ns); struct page *find_timens_vvar_page(struct vm_area_struct *vma); #else /* !CONFIG_TIME_NS_VDSO */ -static inline void timens_commit(struct task_struct *tsk, struct time_namespace *ns) -{ -} - static inline struct page *find_timens_vvar_page(struct vm_area_struct *vma) { return NULL; diff --git a/kernel/time/namespace.c b/kernel/time/namespace.c index cf95f9e0ad94..9bd21eb8bf2d 100644 --- a/kernel/time/namespace.c +++ b/kernel/time/namespace.c @@ -192,6 +192,34 @@ static void timens_put(struct ns_common *ns) put_time_ns(to_time_ns(ns)); } +/* + * The offsets are read without a lock once a task runs in the namespace, + * so the first task to join freezes them, and sets up the vDSO page from + * them where there is one. + */ +static void timens_freeze_offsets(struct time_namespace *ns) +{ + if (ns == &init_time_ns) + return; + + /* Fast-path, taken by every task in namespace except the first. */ + if (likely(ns->frozen_offsets)) + return; + + guard(mutex)(&timens_offset_lock); + if (ns->frozen_offsets) + return; + + timens_vdso_setup_vvar_page(ns); + ns->frozen_offsets = true; +} + +void timens_commit(struct task_struct *tsk, struct time_namespace *ns) +{ + timens_freeze_offsets(ns); + timens_vdso_join(tsk, ns); +} + static int timens_install(struct nsset *nsset, struct ns_common *new) { struct nsproxy *nsproxy = nsset->nsproxy; diff --git a/kernel/time/namespace_internal.h b/kernel/time/namespace_internal.h index b37ba179f43b..564c22b639dc 100644 --- a/kernel/time/namespace_internal.h +++ b/kernel/time/namespace_internal.h @@ -4,6 +4,7 @@ #include +struct task_struct; struct time_namespace; /* @@ -15,6 +16,8 @@ extern struct mutex timens_offset_lock; #ifdef CONFIG_TIME_NS_VDSO int timens_vdso_alloc_vvar_page(struct time_namespace *ns); void timens_vdso_free_vvar_page(struct time_namespace *ns); +void timens_vdso_setup_vvar_page(struct time_namespace *ns); +void timens_vdso_join(struct task_struct *task, struct time_namespace *ns); #else /* !CONFIG_TIME_NS_VDSO */ static inline int timens_vdso_alloc_vvar_page(struct time_namespace *ns) { @@ -23,6 +26,13 @@ static inline int timens_vdso_alloc_vvar_page(struct time_namespace *ns) static inline void timens_vdso_free_vvar_page(struct time_namespace *ns) { } +static inline void timens_vdso_setup_vvar_page(struct time_namespace *ns) +{ +} +static inline void timens_vdso_join(struct task_struct *task, + struct time_namespace *ns) +{ +} #endif /* CONFIG_TIME_NS_VDSO */ #endif /* _TIME_NAMESPACE_INTERNAL_H */ diff --git a/kernel/time/namespace_vdso.c b/kernel/time/namespace_vdso.c index 08d69270eb2c..8a2fc9d23687 100644 --- a/kernel/time/namespace_vdso.c +++ b/kernel/time/namespace_vdso.c @@ -86,29 +86,13 @@ struct page *find_timens_vvar_page(struct vm_area_struct *vma) return NULL; } -static void timens_set_vvar_page(struct task_struct *task, - struct time_namespace *ns) +/* Called once per namespace, under timens_offset_lock, before any task reads */ +void timens_vdso_setup_vvar_page(struct time_namespace *ns) { - struct vdso_time_data *vdata; - struct vdso_clock *vc; + struct vdso_time_data *vdata = page_address(ns->vvar_page); + struct vdso_clock *vc = vdata->clock_data; unsigned int i; - if (ns == &init_time_ns) - return; - - /* Fast-path, taken by every task in namespace except the first. */ - if (likely(ns->frozen_offsets)) - return; - - guard(mutex)(&timens_offset_lock); - /* Nothing to-do: vvar_page has been already initialized. */ - if (ns->frozen_offsets) - return; - - ns->frozen_offsets = true; - vdata = page_address(ns->vvar_page); - vc = vdata->clock_data; - for (i = 0; i < CS_BASES; i++) timens_setup_vdso_clock_data(&vc[i], ns); } @@ -120,7 +104,7 @@ static void timens_set_vvar_page(struct task_struct *task, * corresponding layout. * See also the comment near timens_setup_vdso_clock_data() for details. */ -static int vdso_join_timens(struct task_struct *task, struct time_namespace *ns) +void timens_vdso_join(struct task_struct *task, struct time_namespace *ns) { struct mm_struct *mm = task->mm; struct vm_area_struct *vma; @@ -131,13 +115,6 @@ static int vdso_join_timens(struct task_struct *task, struct time_namespace *ns) if (vma_is_special_mapping(vma, &vdso_vvar_mapping)) zap_vma_pages(vma); } - return 0; -} - -void timens_commit(struct task_struct *tsk, struct time_namespace *ns) -{ - timens_set_vvar_page(tsk, ns); - vdso_join_timens(tsk, ns); } int timens_vdso_alloc_vvar_page(struct time_namespace *ns) -- 2.56.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel