ve_create()'s error path ended with:
err_lat:
kmem_cache_free(ve_cachep, ve);
err_ve:
ve_set_state(ve, VE_STATE_STOPPED);
return ERR_PTR(err);
ve_set_state() dereferences ve->state, but at err_ve @ve is either NULL
(the kmem_cache_zalloc() failure jumps straight to err_ve) or already
freed (the err_lat/err_log/err_vdso legs kmem_cache_free() @ve and then
fall through to err_ve) - so every error exit of ve_create() is a NULL
pointer dereference or a use-after-free. It only triggers when an
allocation in ve_create() fails, which is why it stayed latent.
The state assignment is meaningless on the failure path anyway: the css
is never returned to cgroup and the ve is being freed. The success path
already sets ve->state = VE_STATE_STARTING directly. Just drop the bogus
ve_set_state() from the unwind.
Fixes: cf0f518ac706 ("ve/cgroups: rework is_running into an explicit VE state")
Feature: ve: ve generic structures
https://virtuozzo.atlassian.net/browse/VSTOR-137234
Signed-off-by: Konstantin Khorenko <[email protected]>
---
kernel/ve/ve.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 550fac57436b..a726befe71f1 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -798,7 +798,6 @@ static struct cgroup_subsys_state *ve_create(struct
cgroup_subsys_state *parent_
err_lat:
kmem_cache_free(ve_cachep, ve);
err_ve:
- ve_set_state(ve, VE_STATE_STOPPED);
return ERR_PTR(err);
}
--
2.47.1
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
