[Devel] [PATCH vz10 22/32] ve: mark ve0.css with CSS_NO_REF

[Pavel Tikhomirov]

Reviewed-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>

Sounds good, I somehow was under impression that we always had 
CSS_NO_REF there...

On 8/21/26 18:50, Konstantin Khorenko wrote:
> Guys, please note the current patch, this is the most important one here.
> 
> --
> Best regards,
> 
> Konstantin Khorenko,
> Virtuozzo Linux Kernel Team
> 
> On 8/21/26 18:37, Konstantin Khorenko wrote:
>> From: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
>>
>> ve0.css is the root css of the ve cgroup subsystem, and ve_cgrp_subsys is
>> not an early_init one, so the css - its percpu_ref included - is only set
>> up by cgroup_init().  net_ns_init(), however, runs before cgroup_init()
>> in start_kernel() and takes a reference on ve0:
>>
>>   start_kernel()
>>     net_ns_init()                    /* init/main.c, before cgroup_init() */
>>       init_net.owner_ve = get_ve(&ve0)
>>         css_get(&ve0.css)            /* flags == 0, refcnt not set up */
>>           percpu_ref_get(&ve0.css.refcnt)
>>
>> At that point css.refcnt is all zeroes, so __ref_is_percpu() sees no
>> __PERCPU_REF_ATOMIC_DEAD bits, decides the counter is in percpu mode and
>> increments *(unsigned long __percpu *)NULL - that is, whatever happens to
>> live at the start of the percpu area.  On x86 that quietly corrupts a
>> percpu variable on every boot; under User Mode Linux it faults outright,
>> which is how it was found.
>>
>> ve0 is a permanent singleton that is never freed, exactly like the root
>> css objects that cgroup_init_subsys() marks CSS_NO_REF, so give it that
>> flag from the start.  css_get()/css_put() on ve0 then become no-ops in
>> both windows, before and after cgroup_init().
>>
>> Fixes: 6087cf234cc5 ("ve/net: thread owning ve through copy_net_ns")
>> Feature: ve: ve generic structures
>> https://virtuozzo.atlassian.net/browse/VSTOR-134732
>> Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
>> Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
>> ---
>>  kernel/ve/ve.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
>> index 0f0e1a424953..750a1b2882a7 100644
>> --- a/kernel/ve/ve.c
>> +++ b/kernel/ve/ve.c
>> @@ -53,6 +53,7 @@ static struct kmem_cache *ve_cachep;
>>  static DEFINE_PER_CPU(struct kstat_lat_pcpu_snap_struct, ve0_lat_stats);
>>  
>>  struct ve_struct ve0 = {
>> +	.css			= { .flags = CSS_NO_REF },
>>  	.ve_name		= "0",
>>  	.start_jiffies		= INITIAL_JIFFIES,
>>  
> 

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.