From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konstantin Khorenko Date: Fri, 21 Aug 2026 18:50:40 +0200 Subject: Re: [Devel] [PATCH vz10 22/32] ve: mark ve0.css with CSS_NO_REF In-Reply-To: <20260821163718.187766-23-khorenko@virtuozzo.com> References: <20260821163718.187766-1-khorenko@virtuozzo.com> <20260821163718.187766-23-khorenko@virtuozzo.com> Message-ID: List-Id: Guys, please note the current patch, this is the most important one here. -- Best regards, Konstantin Khorenko, Virtuozzo Linux Kernel Team On 8/21/26 18:37, Konstantin Khorenko wrote: > From: Eva Kurchatova > > ve0.css is the root css of the ve cgroup subsystem, and ve_cgrp_subsys is > not an early_init one, so the css - its percpu_ref included - is only set > up by cgroup_init(). net_ns_init(), however, runs before cgroup_init() > in start_kernel() and takes a reference on ve0: > > start_kernel() > net_ns_init() /* init/main.c, before cgroup_init() */ > init_net.owner_ve = get_ve(&ve0) > css_get(&ve0.css) /* flags == 0, refcnt not set up */ > percpu_ref_get(&ve0.css.refcnt) > > At that point css.refcnt is all zeroes, so __ref_is_percpu() sees no > __PERCPU_REF_ATOMIC_DEAD bits, decides the counter is in percpu mode and > increments *(unsigned long __percpu *)NULL - that is, whatever happens to > live at the start of the percpu area. On x86 that quietly corrupts a > percpu variable on every boot; under User Mode Linux it faults outright, > which is how it was found. > > ve0 is a permanent singleton that is never freed, exactly like the root > css objects that cgroup_init_subsys() marks CSS_NO_REF, so give it that > flag from the start. css_get()/css_put() on ve0 then become no-ops in > both windows, before and after cgroup_init(). > > Fixes: 6087cf234cc5 ("ve/net: thread owning ve through copy_net_ns") > Feature: ve: ve generic structures > https://virtuozzo.atlassian.net/browse/VSTOR-134732 > Signed-off-by: Eva Kurchatova > Signed-off-by: Konstantin Khorenko > --- > kernel/ve/ve.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c > index 0f0e1a424953..750a1b2882a7 100644 > --- a/kernel/ve/ve.c > +++ b/kernel/ve/ve.c > @@ -53,6 +53,7 @@ static struct kmem_cache *ve_cachep; > static DEFINE_PER_CPU(struct kstat_lat_pcpu_snap_struct, ve0_lat_stats); > > struct ve_struct ve0 = { > + .css = { .flags = CSS_NO_REF }, > .ve_name = "0", > .start_jiffies = INITIAL_JIFFIES, >