mirror of
https://github.com/checkpoint-restore/criu
synced 2025-08-30 22:05:36 +00:00
1bbc9fbe37
We have a use-after-free in predump code: 1st the free_pstree() is called in pre_dump_tasks(), then we go to irmap_predump_run() which may call the lookup_irmap() which, in turn, dereferences the root_item to get the root mount ns fd. But the problem is bigger than that. After we've released the tasks (done before freeing pstree on predump) we can no longer access them by PIDs, so keeping the root-item after irmap scan is not a fix. Fix is to get the root fd before releasing the tasks and using one in irmap scanner. Caught recently on iterative inotify_irmap test. Signed-off-by: Pavel Emelyanov <xemul@parallels.com> Acked-by: Andrew Vagin <avagin@parallels.com>
13 lines
396 B
C
13 lines
396 B
C
#ifndef __CR_IRMAP__H__
|
|
#define __CR_IRMAP__H__
|
|
char *irmap_lookup(unsigned int s_dev, unsigned long i_ino);
|
|
struct _FhEntry;
|
|
int irmap_queue_cache(unsigned int dev, unsigned long ino,
|
|
struct _FhEntry *fh);
|
|
int irmap_predump_prep(void);
|
|
int irmap_predump_run(void);
|
|
int check_open_handle(unsigned int s_dev, unsigned long i_ino,
|
|
struct _FhEntry *f_handle);
|
|
int irmap_load_cache(void);
|
|
#endif
|