[Devel] [PATCH RHEL10 COMMIT] ve: fix NULL-deref / use-after-free in ve_create() error unwind

[Konstantin Khorenko]

The commit is pushed to "branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh10-6.12.0-211.39.1.16.2.vz10
------>
commit 7e884677eb9540f3dc2907fd9af753a5ef972a9a
Author: Konstantin Khorenko <khorenko at virtuozzo.com>
Date:   Mon Jul 6 12:59:56 2026 +0200

    ve: fix NULL-deref / use-after-free in ve_create() error unwind
    
    ve_create()'s error path ended with:
    
            err_lat:
                    kmem_cache_free(ve_cachep, ve);
            err_ve:
                    ve_set_state(ve, VE_STATE_STOPPED);
                    return ERR_PTR(err);
    
    ve_set_state() dereferences ve->state, but at err_ve @ve is either NULL
    (the kmem_cache_zalloc() failure jumps straight to err_ve) or already
    freed (the err_lat/err_log/err_vdso legs kmem_cache_free() @ve and then
    fall through to err_ve) - so every error exit of ve_create() is a NULL
    pointer dereference or a use-after-free. It only triggers when an
    allocation in ve_create() fails, which is why it stayed latent.
    
    The state assignment is meaningless on the failure path anyway: the css
    is never returned to cgroup and the ve is being freed. The success path
    already sets ve->state = VE_STATE_STARTING directly. Just drop the bogus
    ve_set_state() from the unwind.
    
    Fixes: 8a21e780ce29a ("ve/cgroups: rework is_running into an explicit VE state")
    Feature: ve: ve generic structures
    https://virtuozzo.atlassian.net/browse/VSTOR-137234
    Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
    Reviewed-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 kernel/ve/ve.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index d8ef28eedabd0..73d1c3b4873e5 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -802,7 +802,6 @@ static struct cgroup_subsys_state *ve_create(struct cgroup_subsys_state *parent_
 err_lat:
 	kmem_cache_free(ve_cachep, ve);
 err_ve:
-	ve_set_state(ve, VE_STATE_STOPPED);
 	return ERR_PTR(err);
 }