From 776674d4c364e40e6aeadc99861fadd82c19544d Mon Sep 17 00:00:00 2001
From: dongyuzhen <dongyuzhen@h-partners.com>
Date: Tue, 16 Dec 2025 11:45:04 +0800
Subject: [PATCH] backport some patches

(cherry picked from commit fb22691b59a7dbd0b7071ece75702beeb5e3b7c9)
---
 containerd.spec                               |  8 +++-
 git-commit                                    |  2 +-
 ...ible-panic-from-WithMediaTypeKeyPref.patch | 40 +++++++++++++++++++
 series.conf                                   |  1 +
 4 files changed, 49 insertions(+), 2 deletions(-)
 create mode 100644 patch/0050-containerd-fix-possible-panic-from-WithMediaTypeKeyPref.patch

diff --git a/containerd.spec b/containerd.spec
index d53f0ee..d693d00 100644
--- a/containerd.spec
+++ b/containerd.spec
@@ -2,7 +2,7 @@
 %global debug_package %{nil}
 Version:        1.6.22
 Name:           containerd
-Release:        25
+Release:        26
 Summary:        An industry-standard container runtime
 License:        ASL 2.0
 URL:            https://containerd.io
@@ -68,6 +68,12 @@ install -D -p -m 0644 %{S:7} %{buildroot}%{_sysconfdir}/containerd/config.toml
 %exclude %{_bindir}/containerd-stress
 
 %changelog
+* Tue Dec 16 2025 dongyuzhen <dongyuzhen@h-partners.com> - 1.6.22-26
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:backport some patches
+
 * Tue Nov 25 2025 dongyuzhen <dongyuzhen@h-partners.com> - 1.6.22-25
 - Type:CVE
 - ID:NA
diff --git a/git-commit b/git-commit
index bcc75a7..23c71d3 100644
--- a/git-commit
+++ b/git-commit
@@ -1 +1 @@
-0fdeab0487276d925a94c57518ae31d731742462
+cf626d89c4ff0965388f81a964f0ba581ac3edde
diff --git a/patch/0050-containerd-fix-possible-panic-from-WithMediaTypeKeyPref.patch b/patch/0050-containerd-fix-possible-panic-from-WithMediaTypeKeyPref.patch
new file mode 100644
index 0000000..70f71db
--- /dev/null
+++ b/patch/0050-containerd-fix-possible-panic-from-WithMediaTypeKeyPref.patch
@@ -0,0 +1,40 @@
+From c6aa3a443df8f96d87af6de40ca7d29d759cc946 Mon Sep 17 00:00:00 2001
+From: Tonis Tiigi <tonistiigi@gmail.com>
+Date: Tue, 11 Nov 2025 22:15:15 -0800
+Subject: [PATCH] remotes: fix possible panic from WithMediaTypeKeyPrefix
+
+As the same instance of a map is used in context and mutated
+directly, this leads to a  situation where:
+- Calling WithMediaTypeKeyPrefix from parallel goroutines where
+  the context was based on the same base context can trigger a panic.
+- A subcontext calling WithMediaTypeKeyPrefix changes the value for
+  another context when they both originate from the same base context.
+
+Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
+---
+ remotes/handlers.go | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/remotes/handlers.go b/remotes/handlers.go
+index 4d91ed2e5..0f41dae14 100644
+--- a/remotes/handlers.go
++++ b/remotes/handlers.go
+@@ -21,6 +21,7 @@ import (
+ 	"errors"
+ 	"fmt"
+ 	"io"
++	"maps"
+ 	"strings"
+ 	"sync"
+ 
+@@ -44,6 +45,7 @@ func WithMediaTypeKeyPrefix(ctx context.Context, mediaType, prefix string) conte
+ 	var values map[string]string
+ 	if v := ctx.Value(refKeyPrefix{}); v != nil {
+ 		values = v.(map[string]string)
++		values = maps.Clone(values)
+ 	} else {
+ 		values = make(map[string]string)
+ 	}
+-- 
+2.33.0
+
diff --git a/series.conf b/series.conf
index 7d6792b..4329217 100644
--- a/series.conf
+++ b/series.conf
@@ -46,3 +46,4 @@ patch/0046-containerd-Fix-ctr-snapshot-mount-produce-invalid-mount-command.patch
 patch/0047-containerd-cri-Fix-userns-with-Dockerfile-VOLUME-mounts.patch
 patch/0048-containerd-fix-CVE-2024-25621.patch
 patch/0049-containerd-fix-CVE-2025-64329.patch
+patch/0050-containerd-fix-possible-panic-from-WithMediaTypeKeyPref.patch
-- 
Gitee