diff --git a/git-commit b/git-commit index e1d35a76c906e441b669c2ceb32280bcc9b8f2b7..3b1e070d6fbef169e2fa8918b606b2c5bd4780de 100644 --- a/git-commit +++ b/git-commit @@ -1 +1 @@ -6a36602a91e2bf0275f28cb7710838922daa7b0f +32ed6f4eebcde9458c54092c578c7b852b7f79dd diff --git a/patch/0044-runc-delete-do-not-ignore-error-from-destroy.patch b/patch/0044-runc-delete-do-not-ignore-error-from-destroy.patch new file mode 100644 index 0000000000000000000000000000000000000000..6548bbe654b7a7d0ec1958ead5e310a4a826a658 --- /dev/null +++ b/patch/0044-runc-delete-do-not-ignore-error-from-destroy.patch @@ -0,0 +1,116 @@ +From 489e5bfbed5faff99d1fa48c146bd5a4f17b9c67 Mon Sep 17 00:00:00 2001 +From: Kir Kolyshkin +Date: Mon, 6 Nov 2023 15:38:11 -0800 +Subject: [PATCH] runc delete: do not ignore error from destroy + +If container.Destroy() has failed, runc destroy still return 0, which is +wrong and can result in other issues down the line. + +Let's always return error from destroy in runc delete. + +For runc checkpoint and runc run, we still treat it as a warning. + +Co-authored-by: Zhang Tianyang +Signed-off-by: Kir Kolyshkin +--- + checkpoint.go | 6 +++++- + delete.go | 7 ++----- + libcontainer/container_linux.go | 5 ++++- + utils_linux.go | 10 +++------- + 4 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/checkpoint.go b/checkpoint.go +index 32a62a8b..897564c1 100644 +--- a/checkpoint.go ++++ b/checkpoint.go +@@ -65,7 +65,11 @@ checkpointed.`, + options := criuOptions(context) + if !(options.LeaveRunning || options.PreDump) { + // destroy container unless we tell CRIU to keep it +- defer destroy(container) ++ defer func() { ++ if err := container.Destroy(); err != nil { ++ logrus.Warn(err) ++ } ++ }() + } + // these are the mandatory criu options for a container + setPageServer(context, options) +diff --git a/delete.go b/delete.go +index 799c2a77..6fe776d0 100644 +--- a/delete.go ++++ b/delete.go +@@ -18,8 +18,7 @@ func killContainer(container libcontainer.Container) error { + for i := 0; i < 10; i++ { + time.Sleep(100 * time.Millisecond) + if err := container.Signal(unix.Signal(0), false); err != nil { +- destroy(container) +- return nil ++ return container.Destroy() + } + } + return errors.New("container init still running") +@@ -72,7 +71,7 @@ status of "ubuntu01" as "stopped" the following will delete resources held for + } + switch s { + case libcontainer.Stopped: +- destroy(container) ++ return container.Destroy() + case libcontainer.Created: + return killContainer(container) + default: +@@ -81,7 +80,5 @@ status of "ubuntu01" as "stopped" the following will delete resources held for + } + return fmt.Errorf("cannot delete container %s that is not stopped: %s", id, s) + } +- +- return nil + }, + } +diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go +index f56d73e6..4f9433b8 100644 +--- a/libcontainer/container_linux.go ++++ b/libcontainer/container_linux.go +@@ -708,7 +708,10 @@ func (c *linuxContainer) newInitConfig(process *Process) *initConfig { + func (c *linuxContainer) Destroy() error { + c.m.Lock() + defer c.m.Unlock() +- return c.state.destroy() ++ if err := c.state.destroy(); err != nil { ++ return fmt.Errorf("unable to destroy container: %w", err) ++ } ++ return nil + } + + func (c *linuxContainer) Pause() error { +diff --git a/utils_linux.go b/utils_linux.go +index a9badf20..20a949a1 100644 +--- a/utils_linux.go ++++ b/utils_linux.go +@@ -114,12 +114,6 @@ func newProcess(p specs.Process) (*libcontainer.Process, error) { + return lp, nil + } + +-func destroy(container libcontainer.Container) { +- if err := container.Destroy(); err != nil { +- logrus.Error(err) +- } +-} +- + // setupIO modifies the given process config according to the options. + func setupIO(process *libcontainer.Process, rootuid, rootgid int, createTTY, detach bool, sockpath string) (*tty, error) { + if createTTY { +@@ -323,7 +317,9 @@ func (r *runner) run(config *specs.Process) (int, error) { + + func (r *runner) destroy() { + if r.shouldDestroy { +- destroy(r.container) ++ if err := r.container.Destroy(); err != nil { ++ logrus.Warn(err) ++ } + } + } + +-- +2.33.0 + diff --git a/runc.spec b/runc.spec index df0ed2d09eb1dc0b241be817707588fb77223462..d153f9c9f705ba930f0c435a4976dbd6a5073870 100644 --- a/runc.spec +++ b/runc.spec @@ -3,7 +3,7 @@ Name: docker-runc Version: 1.1.3 -Release: 19 +Release: 20 Summary: runc is a CLI tool for spawning and running containers according to the OCI specification. License: ASL 2.0 @@ -54,6 +54,12 @@ install -p -m 755 runc $RPM_BUILD_ROOT/%{_bindir}/runc %{_bindir}/runc %changelog +* Mon Dec 4 2023 zhongjiawei - 1.1.3-20 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:runc delete do not ignore error from destroy + * Thu Oct 26 2023 zhongjiawei - 1.1.3-19 - Type:bugfix - CVE:NA diff --git a/series.conf b/series.conf index 9e37c314ff3f2df364d1765b0fa99cd7f0de7de7..98d84983b5d174d514256b65351c00d3e60e5450 100644 --- a/series.conf +++ b/series.conf @@ -41,3 +41,4 @@ patch/0040-runc-run-refuse-a-non-empty-cgroup.patch patch/0041-runc-libct-init-unify-init-fix-its-error-logic.patch patch/0042-runc-Handle-kmem.limit_in_bytes-removal.patch patch/0043-runc-fix-update-rt-runtime-us-and-rt-period-us-faile.patch +patch/0044-runc-delete-do-not-ignore-error-from-destroy.patch