[Devel] [PATCH vz10 18/24] ve: fix NULL-deref / use-after-free in ve_create() error unwind

[Pavel Tikhomirov]

Reviewed-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>

On 7/6/26 12:59, Konstantin Khorenko wrote:
> ve_create()'s error path ended with:
> 
> 	err_lat:
> 		kmem_cache_free(ve_cachep, ve);
> 	err_ve:
> 		ve_set_state(ve, VE_STATE_STOPPED);
> 		return ERR_PTR(err);
> 
> ve_set_state() dereferences ve->state, but at err_ve @ve is either NULL
> (the kmem_cache_zalloc() failure jumps straight to err_ve) or already
> freed (the err_lat/err_log/err_vdso legs kmem_cache_free() @ve and then
> fall through to err_ve) - so every error exit of ve_create() is a NULL
> pointer dereference or a use-after-free. It only triggers when an
> allocation in ve_create() fails, which is why it stayed latent.
> 
> The state assignment is meaningless on the failure path anyway: the css
> is never returned to cgroup and the ve is being freed. The success path
> already sets ve->state = VE_STATE_STARTING directly. Just drop the bogus
> ve_set_state() from the unwind.
> 
> Fixes: cf0f518ac706 ("ve/cgroups: rework is_running into an explicit VE state")
> Feature: ve: ve generic structures
> https://virtuozzo.atlassian.net/browse/VSTOR-137234
> Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
> ---
>  kernel/ve/ve.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
> index 550fac57436b..a726befe71f1 100644
> --- a/kernel/ve/ve.c
> +++ b/kernel/ve/ve.c
> @@ -798,7 +798,6 @@ static struct cgroup_subsys_state *ve_create(struct cgroup_subsys_state *parent_
>  err_lat:
>  	kmem_cache_free(ve_cachep, ve);
>  err_ve:
> -	ve_set_state(ve, VE_STATE_STOPPED);
>  	return ERR_PTR(err);
>  }
>  

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.