When testing CRIU with containers with docker images, we found an easily reproducible kernel crash:
[ 2300.870181] BUG: kernel NULL pointer dereference, address: 0000000000000005 [ 2300.871537] #PF: supervisor read access in kernel mode [ 2300.872577] #PF: error_code(0x0000) - not-present page [ 2300.873595] PGD 800000010a18f067 P4D 800000010a18f067 PUD 10730c067 PMD 0 [ 2300.874900] Oops: Oops: 0000 [#1] SMP PTI [ 2300.875742] CPU: 1 UID: 0 PID: 5419 Comm: criu ve: 0 Kdump: loaded Not tainted 6.12.0-211.39.1.16.6.vz10.x86_64 #1 16.6 PREEMPT(voluntary) [ 2300.878057] Hardware name: Acronis OpenStack Compute/Virtuozzo, BIOS 1.16.1-1.vz9.2 04/01/2014 [ 2300.879684] RIP: 0010:ovl_get_index_name_fh+0x18/0x70 [overlay] [ 2300.880859] Code: ... [ 2300.884128] RSP: 0018:ffffd32582e0f7c0 EFLAGS: 00010246 [ 2300.895807] Call Trace: [ 2300.896397] <TASK> [ 2300.904435] ovl_create_index+0x82/0x260 [overlay] [ 2300.905406] ovl_copy_up_workdir+0x30a/0x330 [overlay] [ 2300.906427] ovl_do_copy_up+0x10d/0x2e0 [overlay] [ 2300.907387] ovl_copy_up_one+0x456/0x720 [overlay] [ 2300.910736] ovl_copy_up_flags+0x81/0x110 [overlay] [ 2300.911740] ovl_create_object+0x51/0x130 [overlay] [ 2300.912719] vfs_mkdir+0x194/0x250 [ 2300.913470] do_mkdirat+0x14c/0x180 [ 2300.914223] __x64_sys_mkdir+0x46/0x70 [ 2300.915019] do_syscall_64+0x7d/0x160 [ 2300.922814] entry_SYSCALL_64_after_hwframe+0x76/0x7e The cause is that overlayfs does some feature checks on superblock creation using capable/ve_capable and it stores current credentials. But ve_capable check result depends on both current creds and current VE. Later, overlayfs switches credentials only, leading to unexpected feature disappearance. This was reworked completely after v2, the approach is different now. 1. Patch 1 removes separate STOPPED state - VE goes directly to DEAD. 2. Patch 2 adds helpers for overriding tasks VE. 3. Patch 3 delays ve cred drop until final destruction of VE. 4. Patch 4 adds VE owner to overlay superblock. 5. Patch 5 fixes the bug by switching VE together with creds in overlayfs. v2: http://lore.virtuozzo.com/all/[email protected]/ https://virtuozzo.atlassian.net/browse/VSTOR-143259 - non-CRIU repro https://virtuozzo.atlassian.net/browse/VSTOR-142405 Signed-off-by: Vladimir Riabchun <[email protected]> --- Changes in v5: - Patch 2: report non-host VE changes, also treat VEx -> VE0 and VEx -> VEy differently. VEx -> VE0 might be allowed, VEx -> VEy - never. Replaced most WARN_ON with normal warnings or WARN_ON_ONCE. - Patch 3: updated commit name. - Patch 5: allow VEx -> VE0 case. Now creds are switched without VE. - Link to v4: http://lore.virtuozzo.com/[email protected] Changes in v4: - Patch 2: clean non-NULL overrided_ve in fork and report it, Report revert_ve(ERR_PTR) usages and reject them. - Patch 5: changed ovl_override_creds signature so it returns error. Added checks for it in all places to avoid. - Link to v3: http://lore.virtuozzo.com/[email protected] Changes in v3: - Patch 2: added a separate field for ve_override to fix problems Pasha spotted. - Patch 3: new one, delays init_cred destroy so dead CT can still use it. - Link to v2: http://lore.virtuozzo.com/[email protected] Changes in v2: - Patch 1: updated description as Sashiko suggested.. - Patch 2: moved stubs outside CONFIG_X86 section, added task_lock protection in helpers. Verified via lockdep, no splats after vzctl tests, C/R and crash reproducer. - Patch 4: fixed typo in comment. - Link to v1: http://lore.virtuozzo.com/[email protected] --- Vladimir Riabchun (5): ve: Remove STOPPED state ve: Introduce override_ve/revert_ve helpers ve: Defer ve creds drop until ve is completely destroyed ovl: Keep creator VE in overlayfs superblock ve/overlayfs: Override VE together with creds fs/overlayfs/copy_up.c | 6 ++-- fs/overlayfs/dir.c | 59 ++++++++++++++++++------------ fs/overlayfs/file.c | 65 +++++++++++++++++++-------------- fs/overlayfs/inode.c | 94 +++++++++++++++++++++++++++++++----------------- fs/overlayfs/namei.c | 39 +++++++++++++------- fs/overlayfs/overlayfs.h | 9 ++++- fs/overlayfs/ovl_entry.h | 1 + fs/overlayfs/params.c | 3 ++ fs/overlayfs/readdir.c | 36 ++++++++++++------- fs/overlayfs/super.c | 3 ++ fs/overlayfs/util.c | 49 ++++++++++++++++++++----- fs/overlayfs/xattrs.c | 35 +++++++++++------- include/linux/sched.h | 1 + include/linux/ve.h | 38 ++++++++++++++++++-- kernel/capability.c | 6 ++-- kernel/fork.c | 2 ++ kernel/ve/ve.c | 10 +++--- 17 files changed, 316 insertions(+), 140 deletions(-) --- base-commit: fd34de0d39ec34baee8af703df9c34bc0851e2d3 change-id: 20260918-ovl-use-orig-ve-2dc365976202 Best regards, -- Vladimir Riabchun <[email protected]> _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
