[Devel] [PATCH vz10 00/24] 24 kernel bugs found via GCOV-driven kselftest coverage work

[Vasileios Almpanis]

LGTM generally excluding the comments that Andrey already made. Not sure 
about patch 12 because I lack deep
understanding of the subsystem. Also some of the fixes you have sent 
have already been submitted by Mirian in his GPU related series, so 
whoever gets merged first needs to rebase.
Reviewed-by: Vasileios Almpanis <vasileios.almpanis at virtuozzo.com>

On 7/6/26 12:59 PM, Konstantin Khorenko wrote:
> This series collects 24 independent, self-contained kernel fixes found
> while building out a kselftest suite for our VZ-specific kernel code
> (VE containers/cgroups, the dm-ploop/dm-qcow2/dm-tracking/blk-cbt
> block-storage stack, fuse), driven throughout by GCOV line-coverage
> measurement against the VZ commit range (VSTOR-137234). Coverage ended
> up at ~90% for the block-storage group and its node/config ceiling
> (~78%) for the rest; chasing the remaining uncovered lines with real
> and fault-injected error paths is what surfaced all of the bugs below.
>
> Each patch is independently reviewable and bisectable - there are no
> dependencies between them. Every one of them also has a corresponding
> regression kselftest under tools/testing/selftests/ve/ (not included in
> this series; they already live on the selftests branch) that reproduces
> the bug against a pre-fix kernel and passes clean against the fix.
>
> Grouped by kind, for review:
>
> - Unkillable D-state hangs (unbounded retry-forever on I/O error),
>    wedging `dmsetup remove`/`ploop umount` and eventually `reboot` on the
>    stuck task - patches 23, 24. The dm-ploop instance (24) was found by
>    auditing the twin driver immediately after live-reproducing and fixing
>    the dm-qcow2 one (23); both are the same bug shape.
>
> - NULL-deref / use-after-free / invalid free - patches 6, 18, 20, 21.
>
> - A fault-injection annotation bug (a function documented to only ever
>    return -ENOMEM was annotated for NULL-class injection instead of
>    ERRNO-class, so a NULL return read as "not an error" and fell through
>    to a guaranteed NULL-pointer write) - patch 22.
>
> - Locking / RCU / lockdep / uninitialised lock - patches 3, 9, 10, 11,
>    13, 14, 17.
>
> - User-triggerable kernel WARN, a DoS vector wherever panic_on_warn is
>    set - patches 7, 8.
>
> - VE container correctness / availability, including one that could
>    block *all* container starts on a host until reboot - patches 16, 19.
>
> - Bounds / validation / logic - patches 4, 5, 15.
>
> - Data-integrity / filesystem correctness - patches 1, 2, 12.
>
> https://virtuozzo.atlassian.net/browse/VSTOR-137234
>
> Konstantin Khorenko (24):
>    ext4: attach jinode when opening the balloon inode for write
>    fuse: don't wake page_waitq for non-regular inodes in the invalidate
>      worker
>    fuse: also take req_lock when walking open_files in fusectl
>    ve/mm: enforce the 0..100 bound on vfs_cache_min_ratio
>    fence-watchdog: return count from watchdog_log_path store
>    ve/fs/devmnt: fix interior kfree() of strsep cursor in
>      ve_devmnt_check()
>    blk-cbt: don't WARN on a user-supplied ABI version mismatch
>    ve: don't WARN on untrusted exec/mmap attempts from a container
>    kernfs: rcu_read_lock() when walking parents in ve visibility checks
>    dm-ploop: annotate nested md_lock in ploop_check_delta_before_flip()
>    ve/kernfs: hold the iterated tree's rwsem in the perms seq_file
>    oracle/mm: enter COW seqcount/mmu-notifier section in
>      copy_page_range_mt()
>    dm-tracking: initialize dmt->lock with spin_lock_init()
>    sched/ve: read task ve locklessly in update_sched_lat() under rq->lock
>    ve/hooks: fix off-by-one in chain bounds check
>    drivers/base/cpu: fix cpu/offline content inside a ve
>    ve/cgroup: take cgroup_mutex + threadgroup lock around vz.slice attach
>    ve: fix NULL-deref / use-after-free in ve_create() error unwind
>    ve/cgroup: don't block container start on unused cgroup1 hierarchies
>    dm-ploop: fix NULL-derefs on the ctr error / fault-injection paths
>    dm-qcow2: fix NULL deref in merge_backward complete without an active
>      merge
>    dm-qcow2: fix ALLOW_ERROR_INJECTION class on qcow2_alloc_delta (ERRNO
>      not NULL)
>    dm-qcow2: fail waiters instead of retrying forever after metadata I/O
>      error
>    dm-ploop: fail BAT-writeback waiters instead of retrying forever on
>      I/O error
>
>   block/blk-cbt.c              |  4 +--
>   drivers/base/cpu.c           |  2 +-
>   drivers/md/dm-ploop-cmd.c    |  8 ++++-
>   drivers/md/dm-ploop-map.c    | 28 ++++++++++++++---
>   drivers/md/dm-ploop-target.c |  6 ++--
>   drivers/md/dm-qcow2-cmd.c    |  8 ++++-
>   drivers/md/dm-qcow2-map.c    | 17 +++++++++-
>   drivers/md/dm-qcow2-target.c |  2 +-
>   drivers/md/dm-tracking.c     |  1 +
>   fs/ext4/ioctl.c              | 16 ++++++++++
>   fs/fuse/control.c            |  1 +
>   fs/fuse/inode.c              | 11 ++++++-
>   fs/kernfs/ve.c               | 33 +++++++++++++-------
>   fs/namespace.c               | 13 ++++++--
>   fs/sysfs/ve.c                |  2 +-
>   include/linux/kernfs-ve.h    |  2 +-
>   kernel/cgroup/cgroup.c       | 60 +++++++++++++++++++++++++++++++++++-
>   kernel/fence-watchdog.c      |  2 +-
>   kernel/sched/stats.c         | 11 ++++++-
>   kernel/sysctl.c              |  2 +-
>   kernel/ve/hooks.c            |  2 +-
>   kernel/ve/ve.c               |  7 ++---
>   mm/memory.c                  | 35 ++++++++++++++++++++-
>   23 files changed, 234 insertions(+), 39 deletions(-)
>
-- 
Best regards, Vasileios Almpanis
Software Developer, Virtuozzo.