Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

criu restore hangs #13

Closed
avagin opened this issue Aug 3, 2015 · 2 comments
Closed

criu restore hangs #13

avagin opened this issue Aug 3, 2015 · 2 comments

Comments

@avagin
Copy link
Member

avagin commented Aug 3, 2015

22075 ?        S      0:00      \_ bash -c ( mount --make-rprivate / && umount -l  /proc && mount -t proc proc /proc/ && bash -x test/jenkins/criu-iter.sh )
22076 ?        S      0:00          \_ bash -c ( mount --make-rprivate / && umount -l  /proc && mount -t proc proc /proc/ && bash -x test/jenkins/criu-iter.sh )
22080 ?        S      0:00              \_ bash -x test/jenkins/criu-iter.sh
26359 ?        S      0:00                  \_ make -C test ZDTM_ARGS=-C -i 3 -x maps04 zdtm
26410 ?        S      0:00                      \_ make -f Makefile.zdtm zdtm_nons
10149 ?        S      0:00                          \_ /bin/sh -c ./zdtm.sh --ct -C -i 3 -x maps04 -r transition/fork2 > transition_fork2.log 2>&1;  \ { ret=$?; fname=transitio
10150 ?        S      0:00                              \_ /bin/bash ./zdtm.sh --ct -C -i 3 -x maps04 -r transition/fork2
10163 ?        S      0:00                                  \_ ./zdtm_ct ./zdtm.sh -C -i 3 -x maps04 -r transition/fork2
10164 ?        Ss     0:00                                      \_ /bin/bash ./zdtm.sh -C -i 3 -x maps04 -r transition/fork2
10414 ?        Ss     0:00                                          \_ /var/lib/jenkins/jobs/CRIU-iter/workspace/criu restore -D /var/lib/jenkins/jobs/CRIU-iter/workspace/test/
10415 ?        Ss     0:00                                              \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10416 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10417 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10418 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10419 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10420 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10421 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10422 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10423 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10424 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10425 ?        S      0:00                                                  \_ ./fork2 --pidfile=fork2.pid --outfile=fork2.out
10426 ?        Z      0:00                                                  \_ [fork2] <defunct>
[root@jenkins workspace]# ./crit show /proc/10414/cwd/core-146.img 
{
    "magic": "CORE", 
    "entries": [
        {
            "mtype": "X86_64", 
            "tc": {
                "task_state": 2, 
                "exit_code": 0, 
                "personality": 0, 
                "flags": 0, 
                "blk_sigset": "0x0", 
                "comm": "fork2"
            }
        }
    ]
}
(gdb) bt
#0  __syscall_common () at arch/x86/syscalls/syscall-common-x86-64.S:15
#1  0x000000000041b596 in futex_wait_while_gt (v=0, f=0x7f905035c00c) at include/lock.h:92
#2  restore_wait_inprogress_tasks () at cr-restore.c:1594
#3  0x000000000041bd63 in restore_switch_stage (next_stage=5) at cr-restore.c:1614
#4  restore_root_task (init=<optimized out>) at cr-restore.c:1876
#5  0x00000000004301d9 in cr_restore_tasks () at cr-restore.c:1990
#6  0x000000000041e7b6 in main (argc=<optimized out>, argv=0x7ffdffe0c468, envp=<optimized out>) at crtools.c:589
(gdb) frame 2
#2  restore_wait_inprogress_tasks () at cr-restore.c:1594
1594        futex_wait_while_gt(np, 0);
(gdb) p *np
$1 = {raw = {counter = 1}}
@avagin
Copy link
Member Author

avagin commented Aug 3, 2015

(gdb) p *task_entries
$2 = {nr_threads = 12, nr_tasks = 12, nr_helpers = 0, nr_in_progress = {raw = {counter = 1}}, start = {raw = {counter = 5}}, cr_err = {counter = 0}, userns_sync_lock = {
    raw = {counter = 0}}}

xemul referenced this issue Aug 3, 2015
Currently each task subtracts number of zombies from
task_entries->nr_threads without locks, so if two tasks will do this
operation concurrently, the result may be unpredictable.

https://github.com/xemul/criu/issues/13

Cc: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Andrew Vagin <avagin@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
@avagin
Copy link
Member Author

avagin commented Aug 4, 2015

Fixed by xemul@f13ec96

@avagin avagin closed this as completed Aug 4, 2015
0x7f454c46 added a commit to 0x7f454c46/criu that referenced this issue Dec 7, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
criupatchwork pushed a commit to criupatchwork/criu that referenced this issue Dec 7, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
------------------------ ERROR OVER ------------------------

Cc: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
0x7f454c46 added a commit to 0x7f454c46/criu that referenced this issue Dec 7, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
0x7f454c46 added a commit to 0x7f454c46/criu that referenced this issue Dec 7, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
criupatchwork pushed a commit to criupatchwork/criu that referenced this issue Dec 7, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
xemul pushed a commit that referenced this issue Dec 8, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
xemul pushed a commit that referenced this issue Dec 8, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
xemul pushed a commit that referenced this issue Dec 8, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
xemul pushed a commit that referenced this issue Dec 8, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
xemul pushed a commit that referenced this issue Dec 8, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
0x7f454c46 added a commit to 0x7f454c46/criu that referenced this issue Dec 8, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor checkpoint-restore#14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
xemul pushed a commit that referenced this issue Dec 9, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
xemul pushed a commit that referenced this issue Dec 9, 2016
Before:
=[log]=> dump/zdtm/transition/shmem/142/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
------------------------ ERROR OVER ------------------------

After:
=[log]=> dump/zdtm/transition/shmem/62/1/dump.log
------------------------ grep Error ------------------------
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 1: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 1: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 5: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 5: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #13: -4
pie: 6: Error (/home/travis/build/0x7f454c46/criu/criu/arch/x86/includ>
pie: 6: e/asm/parasite.h:45): Failed to dump TLS descriptor #14: -4
------------------------ ERROR OVER ------------------------

Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
criupatchwork pushed a commit to criupatchwork/criu that referenced this issue Jan 30, 2017
'info' array is off-by-one, nla_parse_nested() requires destination
array (i.e. 'info') to have maxtype+1 (i.e. IFLA_INFO_MAX+1) elements:

	ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef823e3f8
	WRITE of size 48 at 0x7ffef823e3f8 thread T0
	    #0 0x7f9ab7a3915b in __asan_memset (/usr/lib/gcc/x86_64-pc-linux-gnu/5.4.0/libasan.so.2+0x8d15b)
	    #1 0x7f9ab6d4e553 in nla_parse (/usr/lib64/libnl-3.so.200+0xa553)
	    #2 0x4acfb7 in dump_one_netdev criu/net.c:445
	    checkpoint-restore#3 0x4adb60 in dump_one_ethernet criu/net.c:594
	    checkpoint-restore#4 0x4adb60 in dump_one_link criu/net.c:665
	    checkpoint-restore#5 0x48af69 in nlmsg_receive criu/libnetlink.c:45
	    checkpoint-restore#6 0x48af69 in do_rtnl_req criu/libnetlink.c:119
	    checkpoint-restore#7 0x4b0e86 in dump_links criu/net.c:878
	    checkpoint-restore#8 0x4b0e86 in dump_net_ns criu/net.c:1651
	    checkpoint-restore#9 0x4a760d in do_dump_namespaces criu/namespaces.c:985
	    checkpoint-restore#10 0x4a760d in dump_namespaces criu/namespaces.c:1045
	    checkpoint-restore#11 0x451ef7 in cr_dump_tasks criu/cr-dump.c:1799
	    checkpoint-restore#12 0x424588 in main criu/crtools.c:736
	    checkpoint-restore#13 0x7f9ab67b171f in __libc_start_main (/lib64/libc.so.6+0x2071f)
	    checkpoint-restore#14 0x4253d8 in _start (/criu/criu/criu+0x4253d8)

	Address 0x7ffef823e3f8 is located in stack of thread T0 at offset 264 in frame
	    #0 0x4ac9ef in dump_one_netdev criu/net.c:364

	  This frame has 5 object(s):
	    [32, 168) 'netdev'
	    [224, 264) 'info' <== Memory access at offset 264 overflows this variable
	    [320, 1040) 'req'
	    [1088, 3368) 'path'
	    [3424, 3625) 'stable_secret'

Increase 'info' size to fix this.

Fixes: b705dcc ("net: pass the struct nlattrs to dump() functions")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
xemul pushed a commit that referenced this issue Jan 31, 2017
'info' array is off-by-one, nla_parse_nested() requires destination
array (i.e. 'info') to have maxtype+1 (i.e. IFLA_INFO_MAX+1) elements:

	ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef823e3f8
	WRITE of size 48 at 0x7ffef823e3f8 thread T0
	    #0 0x7f9ab7a3915b in __asan_memset (/usr/lib/gcc/x86_64-pc-linux-gnu/5.4.0/libasan.so.2+0x8d15b)
	    #1 0x7f9ab6d4e553 in nla_parse (/usr/lib64/libnl-3.so.200+0xa553)
	    #2 0x4acfb7 in dump_one_netdev criu/net.c:445
	    #3 0x4adb60 in dump_one_ethernet criu/net.c:594
	    #4 0x4adb60 in dump_one_link criu/net.c:665
	    #5 0x48af69 in nlmsg_receive criu/libnetlink.c:45
	    #6 0x48af69 in do_rtnl_req criu/libnetlink.c:119
	    #7 0x4b0e86 in dump_links criu/net.c:878
	    #8 0x4b0e86 in dump_net_ns criu/net.c:1651
	    #9 0x4a760d in do_dump_namespaces criu/namespaces.c:985
	    #10 0x4a760d in dump_namespaces criu/namespaces.c:1045
	    #11 0x451ef7 in cr_dump_tasks criu/cr-dump.c:1799
	    #12 0x424588 in main criu/crtools.c:736
	    #13 0x7f9ab67b171f in __libc_start_main (/lib64/libc.so.6+0x2071f)
	    #14 0x4253d8 in _start (/criu/criu/criu+0x4253d8)

	Address 0x7ffef823e3f8 is located in stack of thread T0 at offset 264 in frame
	    #0 0x4ac9ef in dump_one_netdev criu/net.c:364

	  This frame has 5 object(s):
	    [32, 168) 'netdev'
	    [224, 264) 'info' <== Memory access at offset 264 overflows this variable
	    [320, 1040) 'req'
	    [1088, 3368) 'path'
	    [3424, 3625) 'stable_secret'

Increase 'info' size to fix this.

Fixes: b705dcc ("net: pass the struct nlattrs to dump() functions")
travis-ci: success for net: fix stack out-of-bounds access in dump_one_netdev()
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
xemul pushed a commit that referenced this issue Feb 1, 2017
'info' array is off-by-one, nla_parse_nested() requires destination
array (i.e. 'info') to have maxtype+1 (i.e. IFLA_INFO_MAX+1) elements:

	ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef823e3f8
	WRITE of size 48 at 0x7ffef823e3f8 thread T0
	    #0 0x7f9ab7a3915b in __asan_memset (/usr/lib/gcc/x86_64-pc-linux-gnu/5.4.0/libasan.so.2+0x8d15b)
	    #1 0x7f9ab6d4e553 in nla_parse (/usr/lib64/libnl-3.so.200+0xa553)
	    #2 0x4acfb7 in dump_one_netdev criu/net.c:445
	    #3 0x4adb60 in dump_one_ethernet criu/net.c:594
	    #4 0x4adb60 in dump_one_link criu/net.c:665
	    #5 0x48af69 in nlmsg_receive criu/libnetlink.c:45
	    #6 0x48af69 in do_rtnl_req criu/libnetlink.c:119
	    #7 0x4b0e86 in dump_links criu/net.c:878
	    #8 0x4b0e86 in dump_net_ns criu/net.c:1651
	    #9 0x4a760d in do_dump_namespaces criu/namespaces.c:985
	    #10 0x4a760d in dump_namespaces criu/namespaces.c:1045
	    #11 0x451ef7 in cr_dump_tasks criu/cr-dump.c:1799
	    #12 0x424588 in main criu/crtools.c:736
	    #13 0x7f9ab67b171f in __libc_start_main (/lib64/libc.so.6+0x2071f)
	    #14 0x4253d8 in _start (/criu/criu/criu+0x4253d8)

	Address 0x7ffef823e3f8 is located in stack of thread T0 at offset 264 in frame
	    #0 0x4ac9ef in dump_one_netdev criu/net.c:364

	  This frame has 5 object(s):
	    [32, 168) 'netdev'
	    [224, 264) 'info' <== Memory access at offset 264 overflows this variable
	    [320, 1040) 'req'
	    [1088, 3368) 'path'
	    [3424, 3625) 'stable_secret'

Increase 'info' size to fix this.

Fixes: b705dcc ("net: pass the struct nlattrs to dump() functions")
travis-ci: success for net: fix stack out-of-bounds access in dump_one_netdev()
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
xemul pushed a commit that referenced this issue Feb 1, 2017
'info' array is off-by-one, nla_parse_nested() requires destination
array (i.e. 'info') to have maxtype+1 (i.e. IFLA_INFO_MAX+1) elements:

	ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef823e3f8
	WRITE of size 48 at 0x7ffef823e3f8 thread T0
	    #0 0x7f9ab7a3915b in __asan_memset (/usr/lib/gcc/x86_64-pc-linux-gnu/5.4.0/libasan.so.2+0x8d15b)
	    #1 0x7f9ab6d4e553 in nla_parse (/usr/lib64/libnl-3.so.200+0xa553)
	    #2 0x4acfb7 in dump_one_netdev criu/net.c:445
	    #3 0x4adb60 in dump_one_ethernet criu/net.c:594
	    #4 0x4adb60 in dump_one_link criu/net.c:665
	    #5 0x48af69 in nlmsg_receive criu/libnetlink.c:45
	    #6 0x48af69 in do_rtnl_req criu/libnetlink.c:119
	    #7 0x4b0e86 in dump_links criu/net.c:878
	    #8 0x4b0e86 in dump_net_ns criu/net.c:1651
	    #9 0x4a760d in do_dump_namespaces criu/namespaces.c:985
	    #10 0x4a760d in dump_namespaces criu/namespaces.c:1045
	    #11 0x451ef7 in cr_dump_tasks criu/cr-dump.c:1799
	    #12 0x424588 in main criu/crtools.c:736
	    #13 0x7f9ab67b171f in __libc_start_main (/lib64/libc.so.6+0x2071f)
	    #14 0x4253d8 in _start (/criu/criu/criu+0x4253d8)

	Address 0x7ffef823e3f8 is located in stack of thread T0 at offset 264 in frame
	    #0 0x4ac9ef in dump_one_netdev criu/net.c:364

	  This frame has 5 object(s):
	    [32, 168) 'netdev'
	    [224, 264) 'info' <== Memory access at offset 264 overflows this variable
	    [320, 1040) 'req'
	    [1088, 3368) 'path'
	    [3424, 3625) 'stable_secret'

Increase 'info' size to fix this.

Fixes: b705dcc ("net: pass the struct nlattrs to dump() functions")
travis-ci: success for net: fix stack out-of-bounds access in dump_one_netdev()
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>
adrianreber added a commit to adrianreber/criu that referenced this issue Jan 21, 2025
Running the zdtm/static/unlink_regular00 test on Ubuntu 24.04 on aarch64
results in following error:

    # ./zdtm.py run -t zdtm/static/unlink_regular00 -k always
    userns is supported
    === Run 1/1 ================ zdtm/static/unlink_regular00
    ==================== Run zdtm/static/unlink_regular00 in ns ====================
    Skipping rtc at root
    Start test
    Test is SUID
    ./unlink_regular00 --pidfile=unlink_regular00.pid --outfile=unlink_regular00.out --dirname=unlink_regular00.test
    Run criu dump
    *** buffer overflow detected ***: terminated
    ############# Test zdtm/static/unlink_regular00 FAIL at CRIU dump ##############
    Test output: ================================

     <<< ================================
    Send the 9 signal to  47
    Wait for zdtm/static/unlink_regular00(47) to die for 0.100000
    ##################################### FAIL #####################################

According to the backtrace:

    #0  __pthread_kill_implementation (threadid=281473158467616, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
    #1  0x0000ffff93477690 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
    #2  0x0000ffff9342cb3c in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
    #3  0x0000ffff93417e00 in __GI_abort () at ./stdlib/abort.c:79
    #4  0x0000ffff9346abf0 in __libc_message_impl (fmt=fmt@entry=0xffff93552a78 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:132
    #5  0x0000ffff934e81a8 in __GI___fortify_fail (msg=msg@entry=0xffff93552a28 "buffer overflow detected") at ./debug/fortify_fail.c:24
    #6  0x0000ffff934e79e4 in __GI___chk_fail () at ./debug/chk_fail.c:28
    #7  0x0000ffff934e9070 in ___snprintf_chk (s=s@entry=0xffffc6ed04a3 "testfile", maxlen=maxlen@entry=4056, flag=flag@entry=2, slen=slen@entry=4053,
        format=format@entry=0xaaaacffe3888 "link_remap.%d") at ./debug/snprintf_chk.c:29
    #8  0x0000aaaacff4b8b8 in snprintf (__fmt=0xaaaacffe3888 "link_remap.%d", __n=4056, __s=0xffffc6ed04a3 "testfile")
        at /usr/include/aarch64-linux-gnu/bits/stdio2.h:54
    #9  create_link_remap (path=path@entry=0xffffc6ed2901 "/zdtm/static/unlink_regular00.test/subdir/testfile", len=len@entry=60, lfd=lfd@entry=20,
        idp=idp@entry=0xffffc6ed14ec, nsid=nsid@entry=0xaaaada2bac00, parms=parms@entry=0xffffc6ed2808, fallback=0xaaaacff4c6c0 <dump_linked_remap+96>,
        fallback@entry=0xffffc6ed2797) at criu/files-reg.c:1164
    #10 0x0000aaaacff4c6c0 in dump_linked_remap (path=path@entry=0xffffc6ed2901 "/zdtm/static/unlink_regular00.test/subdir/testfile", len=len@entry=60,
        parms=parms@entry=0xffffc6ed2808, lfd=lfd@entry=20, id=id@entry=12, nsid=nsid@entry=0xaaaada2bac00, fallback=fallback@entry=0xffffc6ed2797)
        at criu/files-reg.c:1198
    #11 0x0000aaaacff4d8b0 in check_path_remap (nsid=0xaaaada2bac00, id=12, lfd=20, parms=0xffffc6ed2808, link=<optimized out>) at criu/files-reg.c:1426
    #12 dump_one_reg_file (lfd=20, id=12, p=0xffffc6ed2808) at criu/files-reg.c:1827
    checkpoint-restore#13 0x0000aaaacff51078 in dump_one_file (pid=<optimized out>, fd=4, lfd=20, opts=opts@entry=0xaaaada2ba2c0, ctl=ctl@entry=0xaaaada2c4d50,
        e=e@entry=0xffffc6ed39c8, dfds=dfds@entry=0xaaaada2c3d40) at criu/files.c:581
    checkpoint-restore#14 0x0000aaaacff5176c in dump_task_files_seized (ctl=ctl@entry=0xaaaada2c4d50, item=item@entry=0xaaaada2b8f80, dfds=dfds@entry=0xaaaada2c3d40)
        at criu/files.c:657
    checkpoint-restore#15 0x0000aaaacff3d3c0 in dump_one_task (parent_ie=0x0, item=0xaaaada2b8f80) at criu/cr-dump.c:1679
    checkpoint-restore#16 cr_dump_tasks (pid=<optimized out>) at criu/cr-dump.c:2224
    checkpoint-restore#17 0x0000aaaacff163a0 in main (argc=<optimized out>, argv=0xffffc6ed40e8, envp=<optimized out>) at criu/crtools.c:293

This line is the problem:

    snprintf(tmp + 1, sizeof(link_name) - (size_t)(tmp - link_name - 1), "link_remap.%d", rfe.id);

The problem was that the `-1` was on the inside of the braces and not on
the outside. This way the destination size was increase by 1 instead of
being decreased by 1 which triggered the

Signed-off-by: Adrian Reber <areber@redhat.com>
adrianreber added a commit to adrianreber/criu that referenced this issue Jan 21, 2025
Running the zdtm/static/unlink_regular00 test on Ubuntu 24.04 on aarch64
results in following error:

    # ./zdtm.py run -t zdtm/static/unlink_regular00 -k always
    userns is supported
    === Run 1/1 ================ zdtm/static/unlink_regular00
    ==================== Run zdtm/static/unlink_regular00 in ns ====================
    Skipping rtc at root
    Start test
    Test is SUID
    ./unlink_regular00 --pidfile=unlink_regular00.pid --outfile=unlink_regular00.out --dirname=unlink_regular00.test
    Run criu dump
    *** buffer overflow detected ***: terminated
    ############# Test zdtm/static/unlink_regular00 FAIL at CRIU dump ##############
    Test output: ================================

     <<< ================================
    Send the 9 signal to  47
    Wait for zdtm/static/unlink_regular00(47) to die for 0.100000
    ##################################### FAIL #####################################

According to the backtrace:

    #0  __pthread_kill_implementation (threadid=281473158467616, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
    #1  0x0000ffff93477690 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
    #2  0x0000ffff9342cb3c in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
    #3  0x0000ffff93417e00 in __GI_abort () at ./stdlib/abort.c:79
    #4  0x0000ffff9346abf0 in __libc_message_impl (fmt=fmt@entry=0xffff93552a78 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:132
    #5  0x0000ffff934e81a8 in __GI___fortify_fail (msg=msg@entry=0xffff93552a28 "buffer overflow detected") at ./debug/fortify_fail.c:24
    #6  0x0000ffff934e79e4 in __GI___chk_fail () at ./debug/chk_fail.c:28
    #7  0x0000ffff934e9070 in ___snprintf_chk (s=s@entry=0xffffc6ed04a3 "testfile", maxlen=maxlen@entry=4056, flag=flag@entry=2, slen=slen@entry=4053,
        format=format@entry=0xaaaacffe3888 "link_remap.%d") at ./debug/snprintf_chk.c:29
    #8  0x0000aaaacff4b8b8 in snprintf (__fmt=0xaaaacffe3888 "link_remap.%d", __n=4056, __s=0xffffc6ed04a3 "testfile")
        at /usr/include/aarch64-linux-gnu/bits/stdio2.h:54
    #9  create_link_remap (path=path@entry=0xffffc6ed2901 "/zdtm/static/unlink_regular00.test/subdir/testfile", len=len@entry=60, lfd=lfd@entry=20,
        idp=idp@entry=0xffffc6ed14ec, nsid=nsid@entry=0xaaaada2bac00, parms=parms@entry=0xffffc6ed2808, fallback=0xaaaacff4c6c0 <dump_linked_remap+96>,
        fallback@entry=0xffffc6ed2797) at criu/files-reg.c:1164
    #10 0x0000aaaacff4c6c0 in dump_linked_remap (path=path@entry=0xffffc6ed2901 "/zdtm/static/unlink_regular00.test/subdir/testfile", len=len@entry=60,
        parms=parms@entry=0xffffc6ed2808, lfd=lfd@entry=20, id=id@entry=12, nsid=nsid@entry=0xaaaada2bac00, fallback=fallback@entry=0xffffc6ed2797)
        at criu/files-reg.c:1198
    #11 0x0000aaaacff4d8b0 in check_path_remap (nsid=0xaaaada2bac00, id=12, lfd=20, parms=0xffffc6ed2808, link=<optimized out>) at criu/files-reg.c:1426
    #12 dump_one_reg_file (lfd=20, id=12, p=0xffffc6ed2808) at criu/files-reg.c:1827
    checkpoint-restore#13 0x0000aaaacff51078 in dump_one_file (pid=<optimized out>, fd=4, lfd=20, opts=opts@entry=0xaaaada2ba2c0, ctl=ctl@entry=0xaaaada2c4d50,
        e=e@entry=0xffffc6ed39c8, dfds=dfds@entry=0xaaaada2c3d40) at criu/files.c:581
    checkpoint-restore#14 0x0000aaaacff5176c in dump_task_files_seized (ctl=ctl@entry=0xaaaada2c4d50, item=item@entry=0xaaaada2b8f80, dfds=dfds@entry=0xaaaada2c3d40)
        at criu/files.c:657
    checkpoint-restore#15 0x0000aaaacff3d3c0 in dump_one_task (parent_ie=0x0, item=0xaaaada2b8f80) at criu/cr-dump.c:1679
    checkpoint-restore#16 cr_dump_tasks (pid=<optimized out>) at criu/cr-dump.c:2224
    checkpoint-restore#17 0x0000aaaacff163a0 in main (argc=<optimized out>, argv=0xffffc6ed40e8, envp=<optimized out>) at criu/crtools.c:293

This line is the problem:

    snprintf(tmp + 1, sizeof(link_name) - (size_t)(tmp - link_name - 1), "link_remap.%d", rfe.id);

The problem was that the `-1` was on the inside of the braces and not on
the outside. This way the destination size was increase by 1 instead of
being decreased by 1 which triggered the buffer overflow detection.

Signed-off-by: Adrian Reber <areber@redhat.com>
avagin pushed a commit that referenced this issue Jan 21, 2025
Running the zdtm/static/unlink_regular00 test on Ubuntu 24.04 on aarch64
results in following error:

    # ./zdtm.py run -t zdtm/static/unlink_regular00 -k always
    userns is supported
    === Run 1/1 ================ zdtm/static/unlink_regular00
    ==================== Run zdtm/static/unlink_regular00 in ns ====================
    Skipping rtc at root
    Start test
    Test is SUID
    ./unlink_regular00 --pidfile=unlink_regular00.pid --outfile=unlink_regular00.out --dirname=unlink_regular00.test
    Run criu dump
    *** buffer overflow detected ***: terminated
    ############# Test zdtm/static/unlink_regular00 FAIL at CRIU dump ##############
    Test output: ================================

     <<< ================================
    Send the 9 signal to  47
    Wait for zdtm/static/unlink_regular00(47) to die for 0.100000
    ##################################### FAIL #####################################

According to the backtrace:

    #0  __pthread_kill_implementation (threadid=281473158467616, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
    #1  0x0000ffff93477690 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
    #2  0x0000ffff9342cb3c in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
    #3  0x0000ffff93417e00 in __GI_abort () at ./stdlib/abort.c:79
    #4  0x0000ffff9346abf0 in __libc_message_impl (fmt=fmt@entry=0xffff93552a78 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:132
    #5  0x0000ffff934e81a8 in __GI___fortify_fail (msg=msg@entry=0xffff93552a28 "buffer overflow detected") at ./debug/fortify_fail.c:24
    #6  0x0000ffff934e79e4 in __GI___chk_fail () at ./debug/chk_fail.c:28
    #7  0x0000ffff934e9070 in ___snprintf_chk (s=s@entry=0xffffc6ed04a3 "testfile", maxlen=maxlen@entry=4056, flag=flag@entry=2, slen=slen@entry=4053,
        format=format@entry=0xaaaacffe3888 "link_remap.%d") at ./debug/snprintf_chk.c:29
    #8  0x0000aaaacff4b8b8 in snprintf (__fmt=0xaaaacffe3888 "link_remap.%d", __n=4056, __s=0xffffc6ed04a3 "testfile")
        at /usr/include/aarch64-linux-gnu/bits/stdio2.h:54
    #9  create_link_remap (path=path@entry=0xffffc6ed2901 "/zdtm/static/unlink_regular00.test/subdir/testfile", len=len@entry=60, lfd=lfd@entry=20,
        idp=idp@entry=0xffffc6ed14ec, nsid=nsid@entry=0xaaaada2bac00, parms=parms@entry=0xffffc6ed2808, fallback=0xaaaacff4c6c0 <dump_linked_remap+96>,
        fallback@entry=0xffffc6ed2797) at criu/files-reg.c:1164
    #10 0x0000aaaacff4c6c0 in dump_linked_remap (path=path@entry=0xffffc6ed2901 "/zdtm/static/unlink_regular00.test/subdir/testfile", len=len@entry=60,
        parms=parms@entry=0xffffc6ed2808, lfd=lfd@entry=20, id=id@entry=12, nsid=nsid@entry=0xaaaada2bac00, fallback=fallback@entry=0xffffc6ed2797)
        at criu/files-reg.c:1198
    #11 0x0000aaaacff4d8b0 in check_path_remap (nsid=0xaaaada2bac00, id=12, lfd=20, parms=0xffffc6ed2808, link=<optimized out>) at criu/files-reg.c:1426
    #12 dump_one_reg_file (lfd=20, id=12, p=0xffffc6ed2808) at criu/files-reg.c:1827
    #13 0x0000aaaacff51078 in dump_one_file (pid=<optimized out>, fd=4, lfd=20, opts=opts@entry=0xaaaada2ba2c0, ctl=ctl@entry=0xaaaada2c4d50,
        e=e@entry=0xffffc6ed39c8, dfds=dfds@entry=0xaaaada2c3d40) at criu/files.c:581
    #14 0x0000aaaacff5176c in dump_task_files_seized (ctl=ctl@entry=0xaaaada2c4d50, item=item@entry=0xaaaada2b8f80, dfds=dfds@entry=0xaaaada2c3d40)
        at criu/files.c:657
    #15 0x0000aaaacff3d3c0 in dump_one_task (parent_ie=0x0, item=0xaaaada2b8f80) at criu/cr-dump.c:1679
    #16 cr_dump_tasks (pid=<optimized out>) at criu/cr-dump.c:2224
    #17 0x0000aaaacff163a0 in main (argc=<optimized out>, argv=0xffffc6ed40e8, envp=<optimized out>) at criu/crtools.c:293

This line is the problem:

    snprintf(tmp + 1, sizeof(link_name) - (size_t)(tmp - link_name - 1), "link_remap.%d", rfe.id);

The problem was that the `-1` was on the inside of the braces and not on
the outside. This way the destination size was increase by 1 instead of
being decreased by 1 which triggered the buffer overflow detection.

Signed-off-by: Adrian Reber <areber@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant