[Devel] [PATCH vz10 22/32] ve: mark ve0.css with CSS_NO_REF

[Konstantin Khorenko]

From: Eva Kurchatova <eva.kurchatova at virtuozzo.com>

ve0.css is the root css of the ve cgroup subsystem, and ve_cgrp_subsys is
not an early_init one, so the css - its percpu_ref included - is only set
up by cgroup_init().  net_ns_init(), however, runs before cgroup_init()
in start_kernel() and takes a reference on ve0:

  start_kernel()
    net_ns_init()                    /* init/main.c, before cgroup_init() */
      init_net.owner_ve = get_ve(&ve0)
        css_get(&ve0.css)            /* flags == 0, refcnt not set up */
          percpu_ref_get(&ve0.css.refcnt)

At that point css.refcnt is all zeroes, so __ref_is_percpu() sees no
__PERCPU_REF_ATOMIC_DEAD bits, decides the counter is in percpu mode and
increments *(unsigned long __percpu *)NULL - that is, whatever happens to
live at the start of the percpu area.  On x86 that quietly corrupts a
percpu variable on every boot; under User Mode Linux it faults outright,
which is how it was found.

ve0 is a permanent singleton that is never freed, exactly like the root
css objects that cgroup_init_subsys() marks CSS_NO_REF, so give it that
flag from the start.  css_get()/css_put() on ve0 then become no-ops in
both windows, before and after cgroup_init().

Fixes: 6087cf234cc5 ("ve/net: thread owning ve through copy_net_ns")
Feature: ve: ve generic structures
https://virtuozzo.atlassian.net/browse/VSTOR-134732
Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 kernel/ve/ve.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 0f0e1a424953..750a1b2882a7 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -53,6 +53,7 @@ static struct kmem_cache *ve_cachep;
 static DEFINE_PER_CPU(struct kstat_lat_pcpu_snap_struct, ve0_lat_stats);
 
 struct ve_struct ve0 = {
+	.css			= { .flags = CSS_NO_REF },
 	.ve_name		= "0",
 	.start_jiffies		= INITIAL_JIFFIES,
 
-- 
2.47.1