[Devel] [PATCH RHEL10 COMMIT] ve: mark ve0.css with CSS_NO_REF

[Konstantin Khorenko]

The commit is pushed to "branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh10-6.12.0-211.39.1.16.6.vz10
------>
commit ea72f3512a97bc7064523e24e5cd4b295db45bdc
Author: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
Date:   Fri Aug 21 18:37:08 2026 +0200

    ve: mark ve0.css with CSS_NO_REF
    
    ve0.css is the root css of the ve cgroup subsystem, and ve_cgrp_subsys is
    not an early_init one, so the css - its percpu_ref included - is only set
    up by cgroup_init().  net_ns_init(), however, runs before cgroup_init()
    in start_kernel() and takes a reference on ve0:
    
      start_kernel()
        net_ns_init()                    /* init/main.c, before cgroup_init() */
          init_net.owner_ve = get_ve(&ve0)
            css_get(&ve0.css)            /* flags == 0, refcnt not set up */
              percpu_ref_get(&ve0.css.refcnt)
    
    At that point css.refcnt is all zeroes, so __ref_is_percpu() sees no
    __PERCPU_REF_ATOMIC_DEAD bits, decides the counter is in percpu mode and
    increments *(unsigned long __percpu *)NULL - that is, whatever happens to
    live at the start of the percpu area.  On x86 that quietly corrupts a
    percpu variable on every boot; under User Mode Linux it faults outright,
    which is how it was found.
    
    ve0 is a permanent singleton that is never freed, exactly like the root
    css objects that cgroup_init_subsys() marks CSS_NO_REF, so give it that
    flag from the start.  css_get()/css_put() on ve0 then become no-ops in
    both windows, before and after cgroup_init().
    
    Fixes: 6087cf234cc5 ("ve/net: thread owning ve through copy_net_ns")
    Feature: ve: ve generic structures
    https://virtuozzo.atlassian.net/browse/VSTOR-134732
    Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
    
    Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 kernel/ve/ve.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 0f0e1a424953b..750a1b2882a7d 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -53,6 +53,7 @@ static struct kmem_cache *ve_cachep;
 static DEFINE_PER_CPU(struct kstat_lat_pcpu_snap_struct, ve0_lat_stats);
 
 struct ve_struct ve0 = {
+	.css			= { .flags = CSS_NO_REF },
 	.ve_name		= "0",
 	.start_jiffies		= INITIAL_JIFFIES,