[Devel] [PATCH vz10 00/24] 24 kernel bugs found via GCOV-driven kselftest coverage work

[Konstantin Khorenko]

This series collects 24 independent, self-contained kernel fixes found
while building out a kselftest suite for our VZ-specific kernel code
(VE containers/cgroups, the dm-ploop/dm-qcow2/dm-tracking/blk-cbt
block-storage stack, fuse), driven throughout by GCOV line-coverage
measurement against the VZ commit range (VSTOR-137234). Coverage ended
up at ~90% for the block-storage group and its node/config ceiling
(~78%) for the rest; chasing the remaining uncovered lines with real
and fault-injected error paths is what surfaced all of the bugs below.

Each patch is independently reviewable and bisectable - there are no
dependencies between them. Every one of them also has a corresponding
regression kselftest under tools/testing/selftests/ve/ (not included in
this series; they already live on the selftests branch) that reproduces
the bug against a pre-fix kernel and passes clean against the fix.

Grouped by kind, for review:

- Unkillable D-state hangs (unbounded retry-forever on I/O error),
  wedging `dmsetup remove`/`ploop umount` and eventually `reboot` on the
  stuck task - patches 23, 24. The dm-ploop instance (24) was found by
  auditing the twin driver immediately after live-reproducing and fixing
  the dm-qcow2 one (23); both are the same bug shape.

- NULL-deref / use-after-free / invalid free - patches 6, 18, 20, 21.

- A fault-injection annotation bug (a function documented to only ever
  return -ENOMEM was annotated for NULL-class injection instead of
  ERRNO-class, so a NULL return read as "not an error" and fell through
  to a guaranteed NULL-pointer write) - patch 22.

- Locking / RCU / lockdep / uninitialised lock - patches 3, 9, 10, 11,
  13, 14, 17.

- User-triggerable kernel WARN, a DoS vector wherever panic_on_warn is
  set - patches 7, 8.

- VE container correctness / availability, including one that could
  block *all* container starts on a host until reboot - patches 16, 19.

- Bounds / validation / logic - patches 4, 5, 15.

- Data-integrity / filesystem correctness - patches 1, 2, 12.

https://virtuozzo.atlassian.net/browse/VSTOR-137234

Konstantin Khorenko (24):
  ext4: attach jinode when opening the balloon inode for write
  fuse: don't wake page_waitq for non-regular inodes in the invalidate
    worker
  fuse: also take req_lock when walking open_files in fusectl
  ve/mm: enforce the 0..100 bound on vfs_cache_min_ratio
  fence-watchdog: return count from watchdog_log_path store
  ve/fs/devmnt: fix interior kfree() of strsep cursor in
    ve_devmnt_check()
  blk-cbt: don't WARN on a user-supplied ABI version mismatch
  ve: don't WARN on untrusted exec/mmap attempts from a container
  kernfs: rcu_read_lock() when walking parents in ve visibility checks
  dm-ploop: annotate nested md_lock in ploop_check_delta_before_flip()
  ve/kernfs: hold the iterated tree's rwsem in the perms seq_file
  oracle/mm: enter COW seqcount/mmu-notifier section in
    copy_page_range_mt()
  dm-tracking: initialize dmt->lock with spin_lock_init()
  sched/ve: read task ve locklessly in update_sched_lat() under rq->lock
  ve/hooks: fix off-by-one in chain bounds check
  drivers/base/cpu: fix cpu/offline content inside a ve
  ve/cgroup: take cgroup_mutex + threadgroup lock around vz.slice attach
  ve: fix NULL-deref / use-after-free in ve_create() error unwind
  ve/cgroup: don't block container start on unused cgroup1 hierarchies
  dm-ploop: fix NULL-derefs on the ctr error / fault-injection paths
  dm-qcow2: fix NULL deref in merge_backward complete without an active
    merge
  dm-qcow2: fix ALLOW_ERROR_INJECTION class on qcow2_alloc_delta (ERRNO
    not NULL)
  dm-qcow2: fail waiters instead of retrying forever after metadata I/O
    error
  dm-ploop: fail BAT-writeback waiters instead of retrying forever on
    I/O error

 block/blk-cbt.c              |  4 +--
 drivers/base/cpu.c           |  2 +-
 drivers/md/dm-ploop-cmd.c    |  8 ++++-
 drivers/md/dm-ploop-map.c    | 28 ++++++++++++++---
 drivers/md/dm-ploop-target.c |  6 ++--
 drivers/md/dm-qcow2-cmd.c    |  8 ++++-
 drivers/md/dm-qcow2-map.c    | 17 +++++++++-
 drivers/md/dm-qcow2-target.c |  2 +-
 drivers/md/dm-tracking.c     |  1 +
 fs/ext4/ioctl.c              | 16 ++++++++++
 fs/fuse/control.c            |  1 +
 fs/fuse/inode.c              | 11 ++++++-
 fs/kernfs/ve.c               | 33 +++++++++++++-------
 fs/namespace.c               | 13 ++++++--
 fs/sysfs/ve.c                |  2 +-
 include/linux/kernfs-ve.h    |  2 +-
 kernel/cgroup/cgroup.c       | 60 +++++++++++++++++++++++++++++++++++-
 kernel/fence-watchdog.c      |  2 +-
 kernel/sched/stats.c         | 11 ++++++-
 kernel/sysctl.c              |  2 +-
 kernel/ve/hooks.c            |  2 +-
 kernel/ve/ve.c               |  7 ++---
 mm/memory.c                  | 35 ++++++++++++++++++++-
 23 files changed, 234 insertions(+), 39 deletions(-)

-- 
2.47.1