[Devel] [PATCH RHEL10 COMMIT] ve/cgroup-v2: Allow nested ve cgroup directories

[Konstantin Khorenko]

The commit is pushed to "branch-rh10-6.12.0-55.13.1.3.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh10-6.12.0-55.13.1.2.24.vz10
------>
commit 1565d4b060b4d84793bce265ebf053fb79e809ad
Author: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
Date:   Wed Dec 10 18:34:29 2025 +0800

    ve/cgroup-v2: Allow nested ve cgroup directories
    
    In cgroup-v2 we have no other way except allowing to enable ve
    controller on intermidiate cgroups (e.g. machine.slice).
    That means we have at least 3 levels.
    
    https://virtuozzo.atlassian.net/browse/VSTOR-104639
    Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
    
    Feature: ve: ve generic structures
---
 kernel/ve/ve.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 321c35f4d2bfc..df0b96e7f64a5 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -945,8 +945,9 @@ static struct cgroup_subsys_state *ve_create(struct cgroup_subsys_state *parent_
 	if (!parent_css)
 		goto do_init;
 
-	/* forbid nested containers */
-	if (css_to_ve(parent_css) != &ve0)
+	/* Forbid nested containers in cgroup v1 hierarchy */
+	if (!cgroup_subsys_on_dfl(ve_cgrp_subsys) &&
+	    css_to_ve(parent_css) != &ve0)
 		return ERR_PTR(-ENOTDIR);
 
 	err = -ENOMEM;