From 4684ea74f8cede8a044064bab9f179f9d4e4e58e Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 17 Oct 2024 12:43:08 +0200 Subject: [PATCH 01/37] Recommends: iptables Signed-off-by: Adrian Reber --- criu.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 10c8c87..9228159 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -42,6 +42,8 @@ BuildRequires: gnutls-devel BuildRequires: libdrm-devel # Checkpointing containers with a tmpfs requires tar Recommends: tar +# CRIU requires some version of iptables-restore for network locking +Recommends: iptables %if 0%{?fedora} BuildRequires: libbsd-devel BuildRequires: nftables-devel @@ -188,6 +190,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Thu Oct 17 2024 Adrian Reber - 4.0-2 +- Recommends: iptables + * Thu Sep 26 2024 Radostin Stoyanov - 4.0-1 - Update to 4.0 - Add package for cuda-plugin From f6e7edaf73e45ffad6f96708917721a9b2f4f492 Mon Sep 17 00:00:00 2001 From: Radostin Stoyanov Date: Sun, 8 Dec 2024 09:06:12 +0000 Subject: [PATCH 02/37] Apply patch to handle vvar_vclock vma-s in rawhide https://bugzilla.redhat.com/show_bug.cgi?id=2328985 https://github.com/checkpoint-restore/criu/issues/2532 Signed-off-by: Radostin Stoyanov --- criu.spec | 7 +- vdso-handle-vvar_vclock-vma-s.patch | 181 ++++++++++++++++++++++++++++ 2 files changed, 187 insertions(+), 1 deletion(-) create mode 100644 vdso-handle-vvar_vclock-vma-s.patch diff --git a/criu.spec b/criu.spec index 9228159..93d2bff 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -24,6 +24,7 @@ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{v Patch99: criu.pc.patch Patch100: Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch +Patch101: vdso-handle-vvar_vclock-vma-s.patch Source5: criu-tmpfiles.conf @@ -119,6 +120,7 @@ This script can help to workaround the so called "PID mismatch" problem. %patch -P 99 -p1 %patch -P 100 -p1 +%patch -P 101 -p1 %build # This package calls LD directly without specifying the LTO plugins. Until @@ -190,6 +192,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Sun Dec 08 2024 Radostin Stoyanov - 4.0-3 +- Apply patch to handle vvar_vclock vma-s in rawhide + * Thu Oct 17 2024 Adrian Reber - 4.0-2 - Recommends: iptables diff --git a/vdso-handle-vvar_vclock-vma-s.patch b/vdso-handle-vvar_vclock-vma-s.patch new file mode 100644 index 0000000..2dd939b --- /dev/null +++ b/vdso-handle-vvar_vclock-vma-s.patch @@ -0,0 +1,181 @@ +From 058572e91dea1d8ac9c345e69e08a58e8abfacbb Mon Sep 17 00:00:00 2001 +From: Andrei Vagin +Date: Thu, 5 Dec 2024 22:17:38 +0000 +Subject: [PATCH] vdso: handle vvar_vclock vma-s + +The vvar_vclock was introduced by [1]. Basically, the old vvar vma has +been splited on two parts. In term of C/R, these two vma-s can be still +treated as one. + +[1] e93d2521b27f ("x86/vdso: Split virtual clock pages into dedicated mapping") + +Signed-off-by: Andrei Vagin +--- + criu/include/util-vdso.h | 1 + + criu/pie/parasite-vdso.c | 19 ++++++++++++++++++- + criu/proc_parse.c | 23 +++++++++++++++++++---- + criu/vdso.c | 28 +++++++++++++++++++++------- + 4 files changed, 59 insertions(+), 12 deletions(-) + +diff --git a/criu/include/util-vdso.h b/criu/include/util-vdso.h +index c4386cf8e..9fd9a6de4 100644 +--- a/criu/include/util-vdso.h ++++ b/criu/include/util-vdso.h +@@ -30,6 +30,7 @@ struct vdso_symbol { + struct vdso_symtable { + unsigned long vdso_size; + unsigned long vvar_size; ++ unsigned long vvar_vclock_size; + struct vdso_symbol symbols[VDSO_SYMBOL_MAX]; + bool vdso_before_vvar; /* order of vdso/vvar pair */ + }; +diff --git a/criu/pie/parasite-vdso.c b/criu/pie/parasite-vdso.c +index 355007fa9..f3ad3107f 100644 +--- a/criu/pie/parasite-vdso.c ++++ b/criu/pie/parasite-vdso.c +@@ -45,6 +45,7 @@ static int remap_one(char *who, unsigned long *from, unsigned long to, size_t si + static int park_at(struct vdso_maps *rt, unsigned long vdso, unsigned long vvar) + { + unsigned long vvar_size = rt->sym.vvar_size; ++ unsigned long vvar_vclock_size = rt->sym.vvar_vclock_size; + unsigned long vdso_size = rt->sym.vdso_size; + int ret; + +@@ -54,8 +55,24 @@ static int park_at(struct vdso_maps *rt, unsigned long vdso, unsigned long vvar) + + std_log_set_gettimeofday(NULL); /* stop using vdso for timings */ + +- if (vvar) ++ if (vvar) { ++ /* ++ * v6.13-rc1~172^2~9 splits the vvar vma in two parts vvar and ++ * vvar_clock. The last one is mapped right after the first ++ * one. ++ */ ++ if (vvar_vclock_size) { ++ unsigned long from; ++ ++ vvar_size -= vvar_vclock_size; ++ from = rt->vvar_start + vvar_size; ++ ++ ret = remap_one("rt-vvar", &from, vvar + vvar_size, vvar_vclock_size); ++ if (ret) ++ return ret; ++ } + ret = remap_one("rt-vvar", &rt->vvar_start, vvar, vvar_size); ++ } + + if (!ret) + vdso_update_gtod_addr(rt); +diff --git a/criu/proc_parse.c b/criu/proc_parse.c +index 95ebe3a41..6c4303e7d 100644 +--- a/criu/proc_parse.c ++++ b/criu/proc_parse.c +@@ -579,7 +579,8 @@ static int handle_vma(pid_t pid, struct vma_area *vma_area, const char *file_pat + } else if (!strcmp(file_path, "[vdso]")) { + if (handle_vdso_vma(vma_area)) + goto err; +- } else if (!strcmp(file_path, "[vvar]")) { ++ } else if (!strcmp(file_path, "[vvar]") || ++ !strcmp(file_path, "[vvar_vclock]")) { + if (handle_vvar_vma(vma_area)) + goto err; + } else if (!strcmp(file_path, "[heap]")) { +@@ -771,7 +772,7 @@ static int task_size_check(pid_t pid, VmaEntry *entry) + + int parse_smaps(pid_t pid, struct vm_area_list *vma_area_list, dump_filemap_t dump_filemap) + { +- struct vma_area *vma_area = NULL; ++ struct vma_area *vma_area = NULL, *prev_vma_area = NULL; + unsigned long start, end, pgoff, prev_end = 0; + char r, w, x, s; + int ret = -1, vm_file_fd = -1; +@@ -813,8 +814,22 @@ int parse_smaps(pid_t pid, struct vm_area_list *vma_area_list, dump_filemap_t du + continue; + } + +- if (vma_area && vma_list_add(vma_area, vma_area_list, &prev_end, &vfi, &prev_vfi)) +- goto err; ++ if (vma_area && vma_area_is(vma_area, VMA_AREA_VVAR) && ++ prev_vma_area && vma_area_is(prev_vma_area, VMA_AREA_VVAR)) { ++ if (prev_vma_area->e->end != vma_area->e->start) { ++ pr_err("two nonconsecutive vvar vma-s: " ++ "%" PRIx64 "-%" PRIx64 " %" PRIx64 "-%" PRIx64 "\n", ++ prev_vma_area->e->start, prev_vma_area->e->end, ++ vma_area->e->start, vma_area->e->end); ++ goto err; ++ } ++ /* Merge all vvar vma-s into one. */ ++ prev_vma_area->e->end = vma_area->e->end; ++ } else { ++ if (vma_area && vma_list_add(vma_area, vma_area_list, &prev_end, &vfi, &prev_vfi)) ++ goto err; ++ prev_vma_area = vma_area; ++ } + + if (eof) + break; +diff --git a/criu/vdso.c b/criu/vdso.c +index 7de2fae78..d4d351131 100644 +--- a/criu/vdso.c ++++ b/criu/vdso.c +@@ -310,7 +310,7 @@ static int vdso_parse_maps(pid_t pid, struct vdso_maps *s) + + while (1) { + unsigned long start, end; +- char *has_vdso, *has_vvar; ++ char *has_vdso, *has_vvar, *has_vvar_vclock; + + buf = breadline(&f); + if (buf == NULL) +@@ -318,13 +318,19 @@ static int vdso_parse_maps(pid_t pid, struct vdso_maps *s) + if (IS_ERR(buf)) + goto err; + +- has_vdso = strstr(buf, "[vdso]"); +- if (!has_vdso) ++ has_vvar = NULL; ++ has_vvar_vclock = NULL; ++ do { ++ has_vdso = strstr(buf, "[vdso]"); ++ if (has_vdso) ++ break; + has_vvar = strstr(buf, "[vvar]"); +- else +- has_vvar = NULL; ++ if (has_vvar) ++ break; ++ has_vvar_vclock = strstr(buf, "[vvar_vclock]"); ++ } while (0); + +- if (!has_vdso && !has_vvar) ++ if (!has_vdso && !has_vvar && !has_vvar_vclock) + continue; + + if (sscanf(buf, "%lx-%lx", &start, &end) != 2) { +@@ -339,13 +345,21 @@ static int vdso_parse_maps(pid_t pid, struct vdso_maps *s) + } + s->vdso_start = start; + s->sym.vdso_size = end - start; +- } else { ++ } else if (has_vvar) { + if (s->vvar_start != VVAR_BAD_ADDR) { + pr_err("Got second VVAR entry\n"); + goto err; + } + s->vvar_start = start; + s->sym.vvar_size = end - start; ++ } else { ++ if (s->vvar_start == VDSO_BAD_ADDR || ++ s->vvar_start + s->sym.vvar_size != start) { ++ pr_err("VVAR and VVAR_VCLOCK entries are not subsequent\n"); ++ goto err; ++ } ++ s->sym.vvar_vclock_size = end - start; ++ s->sym.vvar_size += s->sym.vvar_vclock_size; + } + } + +-- +2.47.0 + From 5fe5814843c7904ed507db08ede8e3a0e6682c8d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 16 Jan 2025 14:52:14 +0000 Subject: [PATCH 03/37] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 93d2bff..4d19f2a 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -192,6 +192,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Thu Jan 16 2025 Fedora Release Engineering - 4.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sun Dec 08 2024 Radostin Stoyanov - 4.0-3 - Apply patch to handle vvar_vclock vma-s in rawhide From 0c47d09fe9e057f303d56c63b2ffc43cc4d724e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 27 Jan 2025 13:45:55 +0100 Subject: [PATCH 04/37] Fix build when sbindir != /usr/sbin ... (rhbz#2340011) --- criu.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/criu.spec b/criu.spec index 4d19f2a..ba00bdd 100644 --- a/criu.spec +++ b/criu.spec @@ -136,11 +136,11 @@ make docs V=1 %install sed -e "s,--upgrade --ignore-installed,--no-index --no-deps -v --no-build-isolation,g" -i lib/Makefile -i crit/Makefile -make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} +make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} make install-lib DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" make install-amdgpu_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu make install-cuda_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu -make install-crit DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" +make install-crit DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" make install-man DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} rm -f $RPM_BUILD_ROOT%{_mandir}/man1/compel.1 From f2a112e667f55fb1ef6c3b00e13e7d9cda3c4bff Mon Sep 17 00:00:00 2001 From: Radostin Stoyanov Date: Mon, 7 Apr 2025 13:08:31 +0100 Subject: [PATCH 05/37] Update to 4.1 Signed-off-by: Radostin Stoyanov --- .gitignore | 1 + ...onfig-set-CR_PLUGIN_DEFAULT-variable.patch | 49 ----- criu.spec | 18 +- sources | 2 +- vdso-handle-vvar_vclock-vma-s.patch | 181 ------------------ 5 files changed, 9 insertions(+), 242 deletions(-) delete mode 100644 Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch delete mode 100644 vdso-handle-vvar_vclock-vma-s.patch diff --git a/.gitignore b/.gitignore index d704cea..7bd1f04 100644 --- a/.gitignore +++ b/.gitignore @@ -57,3 +57,4 @@ /criu-3.18.tar.gz /criu-3.19.tar.gz /criu-4.0.tar.gz +/criu-4.1.tar.gz diff --git a/Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch b/Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch deleted file mode 100644 index 7f9584d..0000000 --- a/Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch +++ /dev/null @@ -1,49 +0,0 @@ -From bb35901e78216917ce8066fa805ce27f273d76a2 Mon Sep 17 00:00:00 2001 -From: Radostin Stoyanov -Date: Thu, 26 Sep 2024 10:59:32 +0100 -Subject: [PATCH] Makefile.config: set CR_PLUGIN_DEFAULT variable - -By default, CRIU uses the path "/usr/lib/criu" to install and load -plugins at runtime. This path is defined by the `PLUGINDIR` variable -in Makefile.install and `CR_PLUGIN_DEFAULT` in `criu/include/plugin.h`. -However, some distribution packages might install the CRIU plugins at -"/usr/lib64/criu" instead. This patch updates the makefile to align -the path defined by `CR_PLUGIN_DEFAULT` with the value of `PLUGINDIR`. - -Signed-off-by: Radostin Stoyanov ---- - Makefile.config | 4 ++++ - plugins/amdgpu/Makefile | 2 +- - 2 files changed, 5 insertions(+), 1 deletion(-) - -diff --git a/Makefile.config b/Makefile.config -index 52c250b21..5ab689d41 100644 ---- a/Makefile.config -+++ b/Makefile.config -@@ -59,6 +59,10 @@ endif - - export LIBS += $(LIBS_FEATURES) - -+ifneq ($(PLUGINDIR),) -+ FEATURE_DEFINES += -DCR_PLUGIN_DEFAULT="\"$(PLUGINDIR)\"" -+endif -+ - CONFIG_FILE = .config - - $(CONFIG_FILE): -diff --git a/plugins/amdgpu/Makefile b/plugins/amdgpu/Makefile -index 7d3388b80..a20d1d163 100644 ---- a/plugins/amdgpu/Makefile -+++ b/plugins/amdgpu/Makefile -@@ -15,7 +15,7 @@ DEPS_NOK := ; - __nmk_dir ?= ../../scripts/nmk/scripts/ - include $(__nmk_dir)msg.mk - --PLUGIN_CFLAGS := -g -Wall -Werror -D _GNU_SOURCE -shared -nostartfiles -fPIC -DCR_PLUGIN_DEFAULT="$(PLUGINDIR)" -+PLUGIN_CFLAGS := -g -Wall -Werror -D _GNU_SOURCE -shared -nostartfiles -fPIC - PLUGIN_LDFLAGS := -lpthread -lrt -ldrm -ldrm_amdgpu - - ifeq ($(CONFIG_AMDGPU),y) --- -2.46.1 - diff --git a/criu.spec b/criu.spec index ba00bdd..26d8efb 100644 --- a/criu.spec +++ b/criu.spec @@ -11,8 +11,8 @@ %undefine _auto_set_build_flags Name: criu -Version: 4.0 -Release: 4%{?dist} +Version: 4.1 +Release: 1%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -23,9 +23,6 @@ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{v # in RPM and DEB is different. Patch99: criu.pc.patch -Patch100: Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch -Patch101: vdso-handle-vvar_vclock-vma-s.patch - Source5: criu-tmpfiles.conf BuildRequires: gcc @@ -41,10 +38,9 @@ BuildRequires: perl-interpreter BuildRequires: libselinux-devel BuildRequires: gnutls-devel BuildRequires: libdrm-devel +BuildRequires: libuuid-devel # Checkpointing containers with a tmpfs requires tar Recommends: tar -# CRIU requires some version of iptables-restore for network locking -Recommends: iptables %if 0%{?fedora} BuildRequires: libbsd-devel BuildRequires: nftables-devel @@ -119,9 +115,6 @@ This script can help to workaround the so called "PID mismatch" problem. %setup -q %patch -P 99 -p1 -%patch -P 100 -p1 -%patch -P 101 -p1 - %build # This package calls LD directly without specifying the LTO plugins. Until # that is fixed, disable LTO. @@ -129,7 +122,7 @@ This script can help to workaround the so called "PID mismatch" problem. # %{?_smp_mflags} does not work # -fstack-protector breaks build -CFLAGS+=`echo %{optflags} | sed -e 's,-fstack-protector\S*,,g'` make V=1 WERROR=0 PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu +CFLAGS+=`echo %{optflags} | sed -e 's,-fstack-protector\S*,,g'` make V=1 WERROR=0 PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES make V=1 WERROR=0 PREFIX=%{_prefix} PLUGINDIR=%{_libdir}/criu amdgpu_plugin make docs V=1 @@ -192,6 +185,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Mon Apr 07 2025 Radostin Stoyanov - 4.1-1 +- Update to 4.1 + * Thu Jan 16 2025 Fedora Release Engineering - 4.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index 8b4fba8..79397e1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (criu-4.0.tar.gz) = 38a3ae353385b1cc4e63f9b317af67bea88d67322e549cf87501873d59bdcc50e92f9c2ef85c736973c551520a91f579f80a010871d245b1a43a29f9fc69b1ab +SHA512 (criu-4.1.tar.gz) = 769001a7e527c129fe73509fd0c7d3fc3b9b1080dc69929032cb84f60f95256f5d145ed4b7ea11f090a7f468f2bb2a0ecf56475eb292966cad26d643f0e46816 diff --git a/vdso-handle-vvar_vclock-vma-s.patch b/vdso-handle-vvar_vclock-vma-s.patch deleted file mode 100644 index 2dd939b..0000000 --- a/vdso-handle-vvar_vclock-vma-s.patch +++ /dev/null @@ -1,181 +0,0 @@ -From 058572e91dea1d8ac9c345e69e08a58e8abfacbb Mon Sep 17 00:00:00 2001 -From: Andrei Vagin -Date: Thu, 5 Dec 2024 22:17:38 +0000 -Subject: [PATCH] vdso: handle vvar_vclock vma-s - -The vvar_vclock was introduced by [1]. Basically, the old vvar vma has -been splited on two parts. In term of C/R, these two vma-s can be still -treated as one. - -[1] e93d2521b27f ("x86/vdso: Split virtual clock pages into dedicated mapping") - -Signed-off-by: Andrei Vagin ---- - criu/include/util-vdso.h | 1 + - criu/pie/parasite-vdso.c | 19 ++++++++++++++++++- - criu/proc_parse.c | 23 +++++++++++++++++++---- - criu/vdso.c | 28 +++++++++++++++++++++------- - 4 files changed, 59 insertions(+), 12 deletions(-) - -diff --git a/criu/include/util-vdso.h b/criu/include/util-vdso.h -index c4386cf8e..9fd9a6de4 100644 ---- a/criu/include/util-vdso.h -+++ b/criu/include/util-vdso.h -@@ -30,6 +30,7 @@ struct vdso_symbol { - struct vdso_symtable { - unsigned long vdso_size; - unsigned long vvar_size; -+ unsigned long vvar_vclock_size; - struct vdso_symbol symbols[VDSO_SYMBOL_MAX]; - bool vdso_before_vvar; /* order of vdso/vvar pair */ - }; -diff --git a/criu/pie/parasite-vdso.c b/criu/pie/parasite-vdso.c -index 355007fa9..f3ad3107f 100644 ---- a/criu/pie/parasite-vdso.c -+++ b/criu/pie/parasite-vdso.c -@@ -45,6 +45,7 @@ static int remap_one(char *who, unsigned long *from, unsigned long to, size_t si - static int park_at(struct vdso_maps *rt, unsigned long vdso, unsigned long vvar) - { - unsigned long vvar_size = rt->sym.vvar_size; -+ unsigned long vvar_vclock_size = rt->sym.vvar_vclock_size; - unsigned long vdso_size = rt->sym.vdso_size; - int ret; - -@@ -54,8 +55,24 @@ static int park_at(struct vdso_maps *rt, unsigned long vdso, unsigned long vvar) - - std_log_set_gettimeofday(NULL); /* stop using vdso for timings */ - -- if (vvar) -+ if (vvar) { -+ /* -+ * v6.13-rc1~172^2~9 splits the vvar vma in two parts vvar and -+ * vvar_clock. The last one is mapped right after the first -+ * one. -+ */ -+ if (vvar_vclock_size) { -+ unsigned long from; -+ -+ vvar_size -= vvar_vclock_size; -+ from = rt->vvar_start + vvar_size; -+ -+ ret = remap_one("rt-vvar", &from, vvar + vvar_size, vvar_vclock_size); -+ if (ret) -+ return ret; -+ } - ret = remap_one("rt-vvar", &rt->vvar_start, vvar, vvar_size); -+ } - - if (!ret) - vdso_update_gtod_addr(rt); -diff --git a/criu/proc_parse.c b/criu/proc_parse.c -index 95ebe3a41..6c4303e7d 100644 ---- a/criu/proc_parse.c -+++ b/criu/proc_parse.c -@@ -579,7 +579,8 @@ static int handle_vma(pid_t pid, struct vma_area *vma_area, const char *file_pat - } else if (!strcmp(file_path, "[vdso]")) { - if (handle_vdso_vma(vma_area)) - goto err; -- } else if (!strcmp(file_path, "[vvar]")) { -+ } else if (!strcmp(file_path, "[vvar]") || -+ !strcmp(file_path, "[vvar_vclock]")) { - if (handle_vvar_vma(vma_area)) - goto err; - } else if (!strcmp(file_path, "[heap]")) { -@@ -771,7 +772,7 @@ static int task_size_check(pid_t pid, VmaEntry *entry) - - int parse_smaps(pid_t pid, struct vm_area_list *vma_area_list, dump_filemap_t dump_filemap) - { -- struct vma_area *vma_area = NULL; -+ struct vma_area *vma_area = NULL, *prev_vma_area = NULL; - unsigned long start, end, pgoff, prev_end = 0; - char r, w, x, s; - int ret = -1, vm_file_fd = -1; -@@ -813,8 +814,22 @@ int parse_smaps(pid_t pid, struct vm_area_list *vma_area_list, dump_filemap_t du - continue; - } - -- if (vma_area && vma_list_add(vma_area, vma_area_list, &prev_end, &vfi, &prev_vfi)) -- goto err; -+ if (vma_area && vma_area_is(vma_area, VMA_AREA_VVAR) && -+ prev_vma_area && vma_area_is(prev_vma_area, VMA_AREA_VVAR)) { -+ if (prev_vma_area->e->end != vma_area->e->start) { -+ pr_err("two nonconsecutive vvar vma-s: " -+ "%" PRIx64 "-%" PRIx64 " %" PRIx64 "-%" PRIx64 "\n", -+ prev_vma_area->e->start, prev_vma_area->e->end, -+ vma_area->e->start, vma_area->e->end); -+ goto err; -+ } -+ /* Merge all vvar vma-s into one. */ -+ prev_vma_area->e->end = vma_area->e->end; -+ } else { -+ if (vma_area && vma_list_add(vma_area, vma_area_list, &prev_end, &vfi, &prev_vfi)) -+ goto err; -+ prev_vma_area = vma_area; -+ } - - if (eof) - break; -diff --git a/criu/vdso.c b/criu/vdso.c -index 7de2fae78..d4d351131 100644 ---- a/criu/vdso.c -+++ b/criu/vdso.c -@@ -310,7 +310,7 @@ static int vdso_parse_maps(pid_t pid, struct vdso_maps *s) - - while (1) { - unsigned long start, end; -- char *has_vdso, *has_vvar; -+ char *has_vdso, *has_vvar, *has_vvar_vclock; - - buf = breadline(&f); - if (buf == NULL) -@@ -318,13 +318,19 @@ static int vdso_parse_maps(pid_t pid, struct vdso_maps *s) - if (IS_ERR(buf)) - goto err; - -- has_vdso = strstr(buf, "[vdso]"); -- if (!has_vdso) -+ has_vvar = NULL; -+ has_vvar_vclock = NULL; -+ do { -+ has_vdso = strstr(buf, "[vdso]"); -+ if (has_vdso) -+ break; - has_vvar = strstr(buf, "[vvar]"); -- else -- has_vvar = NULL; -+ if (has_vvar) -+ break; -+ has_vvar_vclock = strstr(buf, "[vvar_vclock]"); -+ } while (0); - -- if (!has_vdso && !has_vvar) -+ if (!has_vdso && !has_vvar && !has_vvar_vclock) - continue; - - if (sscanf(buf, "%lx-%lx", &start, &end) != 2) { -@@ -339,13 +345,21 @@ static int vdso_parse_maps(pid_t pid, struct vdso_maps *s) - } - s->vdso_start = start; - s->sym.vdso_size = end - start; -- } else { -+ } else if (has_vvar) { - if (s->vvar_start != VVAR_BAD_ADDR) { - pr_err("Got second VVAR entry\n"); - goto err; - } - s->vvar_start = start; - s->sym.vvar_size = end - start; -+ } else { -+ if (s->vvar_start == VDSO_BAD_ADDR || -+ s->vvar_start + s->sym.vvar_size != start) { -+ pr_err("VVAR and VVAR_VCLOCK entries are not subsequent\n"); -+ goto err; -+ } -+ s->sym.vvar_vclock_size = end - start; -+ s->sym.vvar_size += s->sym.vvar_vclock_size; - } - } - --- -2.47.0 - From 323d01daa05d3d402d05114c21904b645ad755ba Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 21 Apr 2025 20:25:11 +0200 Subject: [PATCH 06/37] Apply upstream patch to fix a runc regression Signed-off-by: Adrian Reber --- 2653.patch | 134 +++++++++++++++++++++++++++++++++++++++++++++++++++++ criu.spec | 8 +++- 2 files changed, 141 insertions(+), 1 deletion(-) create mode 100644 2653.patch diff --git a/2653.patch b/2653.patch new file mode 100644 index 0000000..bcb96fd --- /dev/null +++ b/2653.patch @@ -0,0 +1,134 @@ +From 22fdffbdde9476b27988b3ee0a4013a4453784c9 Mon Sep 17 00:00:00 2001 +From: Andrei Vagin +Date: Mon, 21 Apr 2025 06:33:41 +0000 +Subject: [PATCH] net: nftables: avoid restore failure if the CRIU nft table + already exist + +CRIU locks the network during restore in an "empty" network namespace. +However, "empty" in this context means CRIU isn't restoring the +namespace. This network namespace can be the same namespace where +processes have been dumped and so the network is already locked in it. + +Fixes #2650 + +Signed-off-by: Andrei Vagin +--- + criu/cr-restore.c | 2 +- + criu/include/net.h | 2 +- + criu/net.c | 30 +++++++++++++++++------------- + 3 files changed, 19 insertions(+), 15 deletions(-) + +diff --git a/criu/cr-restore.c b/criu/cr-restore.c +index 583b446e0b..30932f60a2 100644 +--- a/criu/cr-restore.c ++++ b/criu/cr-restore.c +@@ -2119,7 +2119,7 @@ static int restore_root_task(struct pstree_item *init) + * the '--empty-ns net' mode no iptables C/R is done and we + * need to return these rules by hands. + */ +- ret = network_lock_internal(); ++ ret = network_lock_internal(/* restore = */ true); + if (ret) + goto out_kill; + } +diff --git a/criu/include/net.h b/criu/include/net.h +index 5e8a848620..7c5ede21e1 100644 +--- a/criu/include/net.h ++++ b/criu/include/net.h +@@ -31,7 +31,7 @@ extern int collect_net_namespaces(bool for_dump); + + extern int network_lock(void); + extern void network_unlock(void); +-extern int network_lock_internal(void); ++extern int network_lock_internal(bool restore); + + extern struct ns_desc net_ns_desc; + +diff --git a/criu/net.c b/criu/net.c +index ee46f1c495..300df480b0 100644 +--- a/criu/net.c ++++ b/criu/net.c +@@ -3206,12 +3206,12 @@ static inline FILE *redirect_nftables_output(struct nft_ctx *nft) + } + #endif + +-static inline int nftables_lock_network_internal(void) ++static inline int nftables_lock_network_internal(bool restore) + { + #if defined(CONFIG_HAS_NFTABLES_LIB_API_0) || defined(CONFIG_HAS_NFTABLES_LIB_API_1) + cleanup_file FILE *fp = NULL; + struct nft_ctx *nft; +- int ret = 0; ++ int ret = 0, exit_code = -1; + char table[32]; + char buf[128]; + +@@ -3224,11 +3224,16 @@ static inline int nftables_lock_network_internal(void) + + fp = redirect_nftables_output(nft); + if (!fp) +- goto out; ++ goto err2; + + snprintf(buf, sizeof(buf), "create table %s", table); +- if (NFT_RUN_CMD(nft, buf)) ++ ret = NFT_RUN_CMD(nft, buf); ++ if (ret) { ++ /* The network has been locked on dump. */ ++ if (restore && errno == EEXIST) ++ return 0; + goto err2; ++ } + + snprintf(buf, sizeof(buf), "add chain %s output { type filter hook output priority 0; policy drop; }", table); + if (NFT_RUN_CMD(nft, buf)) +@@ -3246,17 +3251,16 @@ static inline int nftables_lock_network_internal(void) + if (NFT_RUN_CMD(nft, buf)) + goto err1; + +- goto out; +- ++ exit_code = 0; ++out: ++ nft_ctx_free(nft); ++ return exit_code; + err1: + snprintf(buf, sizeof(buf), "delete table %s", table); + NFT_RUN_CMD(nft, buf); + err2: +- ret = -1; + pr_err("Locking network failed using nftables\n"); +-out: +- nft_ctx_free(nft); +- return ret; ++ goto out; + #else + pr_err("CRIU was built without libnftables support\n"); + return -1; +@@ -3288,7 +3292,7 @@ static int iptables_network_lock_internal(void) + return ret; + } + +-int network_lock_internal(void) ++int network_lock_internal(bool restore) + { + int ret = 0, nsret; + +@@ -3301,7 +3305,7 @@ int network_lock_internal(void) + if (opts.network_lock_method == NETWORK_LOCK_IPTABLES) + ret = iptables_network_lock_internal(); + else if (opts.network_lock_method == NETWORK_LOCK_NFTABLES) +- ret = nftables_lock_network_internal(); ++ ret = nftables_lock_network_internal(restore); + + if (restore_ns(nsret, &net_ns_desc)) + ret = -1; +@@ -3427,7 +3431,7 @@ int network_lock(void) + if (run_scripts(ACT_NET_LOCK)) + return -1; + +- return network_lock_internal(); ++ return network_lock_internal(false); + } + + void network_unlock(void) diff --git a/criu.spec b/criu.spec index 26d8efb..fb0f551 100644 --- a/criu.spec +++ b/criu.spec @@ -12,12 +12,14 @@ Name: criu Version: 4.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{version}.tar.gz +Patch0: https://github.com/checkpoint-restore/criu/pull/2653.patch + # Add protobuf-c as a dependency. # We use this patch because the protobuf-c package name # in RPM and DEB is different. @@ -113,6 +115,7 @@ This script can help to workaround the so called "PID mismatch" problem. %prep %setup -q +%patch -P 0 -p1 %patch -P 99 -p1 %build @@ -185,6 +188,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Mon Apr 21 2025 Adrian Reber - 4.1-2 +- Apply upstream patch to fix a runc regression + * Mon Apr 07 2025 Radostin Stoyanov - 4.1-1 - Update to 4.1 From 649d2f33e59e9942e049148cce54894693a7c506 Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Sun, 20 Apr 2025 07:01:05 +0300 Subject: [PATCH 07/37] Enable for riscv64 Signed-off-by: David Abdurachmanov --- criu.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/criu.spec b/criu.spec index fb0f551..bf0627e 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -52,7 +52,7 @@ BuildRequires: make # user-space and kernel changes are only available for x86_64, arm, # ppc64le, aarch64 and s390x # https://bugzilla.redhat.com/show_bug.cgi?id=902875 -ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x +ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x riscv64 %description criu is the user-space part of Checkpoint/Restore in User-space @@ -188,6 +188,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Apr 23 2025 David Abdurachmanov - 4.1-3 +- Enable for riscv64 + * Mon Apr 21 2025 Adrian Reber - 4.1-2 - Apply upstream patch to fix a runc regression From 54afe54e10d7857efed9ea17f938230600c3aa7b Mon Sep 17 00:00:00 2001 From: Python Maint Date: Tue, 17 Jun 2025 21:09:14 +0200 Subject: [PATCH 08/37] Rebuilt for Python 3.14 --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index bf0627e..6917a4a 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -188,6 +188,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Tue Jun 17 2025 Python Maint - 4.1-4 +- Rebuilt for Python 3.14 + * Wed Apr 23 2025 David Abdurachmanov - 4.1-3 - Enable for riscv64 From dd4a14f00a5b1c38c3e44600c499f3a7dea94f79 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 23 Jul 2025 18:50:01 +0000 Subject: [PATCH 09/37] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 6917a4a..71cacd4 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.1 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -188,6 +188,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Jul 23 2025 Fedora Release Engineering - 4.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Jun 17 2025 Python Maint - 4.1-4 - Rebuilt for Python 3.14 From 88cce10fd3a90853ff054c84043c41e4b16d0216 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Wed, 30 Jul 2025 08:46:06 +0200 Subject: [PATCH 10/37] Update to 4.1.1 Signed-off-by: Adrian Reber --- .gitignore | 1 + criu.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 7bd1f04..5e0f8c8 100644 --- a/.gitignore +++ b/.gitignore @@ -58,3 +58,4 @@ /criu-3.19.tar.gz /criu-4.0.tar.gz /criu-4.1.tar.gz +/criu-4.1.1.tar.gz diff --git a/criu.spec b/criu.spec index 71cacd4..b310da5 100644 --- a/criu.spec +++ b/criu.spec @@ -11,8 +11,8 @@ %undefine _auto_set_build_flags Name: criu -Version: 4.1 -Release: 5%{?dist} +Version: 4.1.1 +Release: 1%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -188,6 +188,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Jul 30 2025 Adrian Reber - 4.1.1-1 +- Update to 4.1.1 + * Wed Jul 23 2025 Fedora Release Engineering - 4.1-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild diff --git a/sources b/sources index 79397e1..f653226 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (criu-4.1.tar.gz) = 769001a7e527c129fe73509fd0c7d3fc3b9b1080dc69929032cb84f60f95256f5d145ed4b7ea11f090a7f468f2bb2a0ecf56475eb292966cad26d643f0e46816 +SHA512 (criu-4.1.1.tar.gz) = a73c35dbd4ec4d2ead0799c6f1af2f467610c538c3ab4a87f5586aa1d29a8268bbc6c222bb3026a32211b6899a4d39730d61fa453ce2adafa561d92f6c87e228 From 6733bdad08f7eef126fbe911bdefc0f6402af8b1 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 15 Aug 2025 12:43:17 +0200 Subject: [PATCH 11/37] Rebuilt for Python 3.14.0rc2 bytecode --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index b310da5..ab468c5 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.1.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -188,6 +188,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Fri Aug 15 2025 Python Maint - 4.1.1-2 +- Rebuilt for Python 3.14.0rc2 bytecode + * Wed Jul 30 2025 Adrian Reber - 4.1.1-1 - Update to 4.1.1 From 678054d8fd9c4280fd093eccd46e2c7c7a7446c0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 29 Jul 2025 23:04:08 +0200 Subject: [PATCH 12/37] Drop unused BuildRequires on python3-wheel See https://github.com/fedora-eln/eln/issues/284 --- criu.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/criu.spec b/criu.spec index ab468c5..98e755c 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.1.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -33,7 +33,7 @@ BuildRequires: libnet-devel BuildRequires: protobuf-devel protobuf-c-devel %{py_prefix}-devel libnl3-devel libcap-devel BuildRequires: %{py_prefix}-pip BuildRequires: %{py_prefix}-setuptools -BuildRequires: %{py_prefix}-wheel +BuildRequires: (%{py_prefix}-wheel if %{py_prefix}-setuptools < 71) BuildRequires: %{py_prefix}-protobuf BuildRequires: asciidoctor BuildRequires: perl-interpreter @@ -188,6 +188,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Aug 27 2025 Miro Hrončok - 4.1.1-3 +- Drop unused BuildRequires on python3-wheel + * Fri Aug 15 2025 Python Maint - 4.1.1-2 - Rebuilt for Python 3.14.0rc2 bytecode From ad9dc1a142fcde0ce8cec66ce2432820c5965f69 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 19 Sep 2025 12:12:32 +0200 Subject: [PATCH 13/37] Rebuilt for Python 3.14.0rc3 bytecode --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 98e755c..a40fa5c 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.1.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -188,6 +188,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Fri Sep 19 2025 Python Maint - 4.1.1-4 +- Rebuilt for Python 3.14.0rc3 bytecode + * Wed Aug 27 2025 Miro Hrončok - 4.1.1-3 - Drop unused BuildRequires on python3-wheel From 5467ca58cd232a1f2cebcc28bd0da60f2386685d Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 02:45:34 +0100 Subject: [PATCH 14/37] Update to 4.2 Signed-off-by: Adrian Reber --- .gitignore | 1 + 2653.patch | 134 ----------------------------------------------------- criu.spec | 10 ++-- sources | 2 +- 4 files changed, 7 insertions(+), 140 deletions(-) delete mode 100644 2653.patch diff --git a/.gitignore b/.gitignore index 5e0f8c8..e5c1b1b 100644 --- a/.gitignore +++ b/.gitignore @@ -59,3 +59,4 @@ /criu-4.0.tar.gz /criu-4.1.tar.gz /criu-4.1.1.tar.gz +/criu-4.2.tar.gz diff --git a/2653.patch b/2653.patch deleted file mode 100644 index bcb96fd..0000000 --- a/2653.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 22fdffbdde9476b27988b3ee0a4013a4453784c9 Mon Sep 17 00:00:00 2001 -From: Andrei Vagin -Date: Mon, 21 Apr 2025 06:33:41 +0000 -Subject: [PATCH] net: nftables: avoid restore failure if the CRIU nft table - already exist - -CRIU locks the network during restore in an "empty" network namespace. -However, "empty" in this context means CRIU isn't restoring the -namespace. This network namespace can be the same namespace where -processes have been dumped and so the network is already locked in it. - -Fixes #2650 - -Signed-off-by: Andrei Vagin ---- - criu/cr-restore.c | 2 +- - criu/include/net.h | 2 +- - criu/net.c | 30 +++++++++++++++++------------- - 3 files changed, 19 insertions(+), 15 deletions(-) - -diff --git a/criu/cr-restore.c b/criu/cr-restore.c -index 583b446e0b..30932f60a2 100644 ---- a/criu/cr-restore.c -+++ b/criu/cr-restore.c -@@ -2119,7 +2119,7 @@ static int restore_root_task(struct pstree_item *init) - * the '--empty-ns net' mode no iptables C/R is done and we - * need to return these rules by hands. - */ -- ret = network_lock_internal(); -+ ret = network_lock_internal(/* restore = */ true); - if (ret) - goto out_kill; - } -diff --git a/criu/include/net.h b/criu/include/net.h -index 5e8a848620..7c5ede21e1 100644 ---- a/criu/include/net.h -+++ b/criu/include/net.h -@@ -31,7 +31,7 @@ extern int collect_net_namespaces(bool for_dump); - - extern int network_lock(void); - extern void network_unlock(void); --extern int network_lock_internal(void); -+extern int network_lock_internal(bool restore); - - extern struct ns_desc net_ns_desc; - -diff --git a/criu/net.c b/criu/net.c -index ee46f1c495..300df480b0 100644 ---- a/criu/net.c -+++ b/criu/net.c -@@ -3206,12 +3206,12 @@ static inline FILE *redirect_nftables_output(struct nft_ctx *nft) - } - #endif - --static inline int nftables_lock_network_internal(void) -+static inline int nftables_lock_network_internal(bool restore) - { - #if defined(CONFIG_HAS_NFTABLES_LIB_API_0) || defined(CONFIG_HAS_NFTABLES_LIB_API_1) - cleanup_file FILE *fp = NULL; - struct nft_ctx *nft; -- int ret = 0; -+ int ret = 0, exit_code = -1; - char table[32]; - char buf[128]; - -@@ -3224,11 +3224,16 @@ static inline int nftables_lock_network_internal(void) - - fp = redirect_nftables_output(nft); - if (!fp) -- goto out; -+ goto err2; - - snprintf(buf, sizeof(buf), "create table %s", table); -- if (NFT_RUN_CMD(nft, buf)) -+ ret = NFT_RUN_CMD(nft, buf); -+ if (ret) { -+ /* The network has been locked on dump. */ -+ if (restore && errno == EEXIST) -+ return 0; - goto err2; -+ } - - snprintf(buf, sizeof(buf), "add chain %s output { type filter hook output priority 0; policy drop; }", table); - if (NFT_RUN_CMD(nft, buf)) -@@ -3246,17 +3251,16 @@ static inline int nftables_lock_network_internal(void) - if (NFT_RUN_CMD(nft, buf)) - goto err1; - -- goto out; -- -+ exit_code = 0; -+out: -+ nft_ctx_free(nft); -+ return exit_code; - err1: - snprintf(buf, sizeof(buf), "delete table %s", table); - NFT_RUN_CMD(nft, buf); - err2: -- ret = -1; - pr_err("Locking network failed using nftables\n"); --out: -- nft_ctx_free(nft); -- return ret; -+ goto out; - #else - pr_err("CRIU was built without libnftables support\n"); - return -1; -@@ -3288,7 +3292,7 @@ static int iptables_network_lock_internal(void) - return ret; - } - --int network_lock_internal(void) -+int network_lock_internal(bool restore) - { - int ret = 0, nsret; - -@@ -3301,7 +3305,7 @@ int network_lock_internal(void) - if (opts.network_lock_method == NETWORK_LOCK_IPTABLES) - ret = iptables_network_lock_internal(); - else if (opts.network_lock_method == NETWORK_LOCK_NFTABLES) -- ret = nftables_lock_network_internal(); -+ ret = nftables_lock_network_internal(restore); - - if (restore_ns(nsret, &net_ns_desc)) - ret = -1; -@@ -3427,7 +3431,7 @@ int network_lock(void) - if (run_scripts(ACT_NET_LOCK)) - return -1; - -- return network_lock_internal(); -+ return network_lock_internal(false); - } - - void network_unlock(void) diff --git a/criu.spec b/criu.spec index a40fa5c..c20cbea 100644 --- a/criu.spec +++ b/criu.spec @@ -11,15 +11,13 @@ %undefine _auto_set_build_flags Name: criu -Version: 4.1.1 -Release: 4%{?dist} +Version: 4.2 +Release: 1%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{version}.tar.gz -Patch0: https://github.com/checkpoint-restore/criu/pull/2653.patch - # Add protobuf-c as a dependency. # We use this patch because the protobuf-c package name # in RPM and DEB is different. @@ -115,7 +113,6 @@ This script can help to workaround the so called "PID mismatch" problem. %prep %setup -q -%patch -P 0 -p1 %patch -P 99 -p1 %build @@ -188,6 +185,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Mon Nov 17 2025 Adrian Reber - 4.2 +- Update to 4.2 + * Fri Sep 19 2025 Python Maint - 4.1.1-4 - Rebuilt for Python 3.14.0rc3 bytecode diff --git a/sources b/sources index f653226..8f69f50 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (criu-4.1.1.tar.gz) = a73c35dbd4ec4d2ead0799c6f1af2f467610c538c3ab4a87f5586aa1d29a8268bbc6c222bb3026a32211b6899a4d39730d61fa453ce2adafa561d92f6c87e228 +SHA512 (criu-4.2.tar.gz) = f7e0ac17d46dd560bb2439f617a0a3b3933eb86f4b8b9b16852d300e4ffc6a4851d72be9342dfd40792a53fca8b65d26fde4e1b1f02bcd04923a8b6f0e5c8a62 From b18123941d500c38b9d94a3e550f33fb67a53f1c Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 10:47:51 +0000 Subject: [PATCH 15/37] Update to 4.2 Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- rpminspect.yaml | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 rpminspect.yaml diff --git a/criu.spec b/criu.spec index c20cbea..d67955f 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 17 2025 Adrian Reber - 4.2 +* Mon Nov 17 2025 Adrian Reber - 4.2-2 - Update to 4.2 * Fri Sep 19 2025 Python Maint - 4.1.1-4 diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..6b8f937 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,4 @@ +--- +annocheck: + jobs: + - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection From c4e321b1d78897969078602af077abbbb8327420 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 14:50:33 +0100 Subject: [PATCH 16/37] Update to 4.2 Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- rpminspect.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/criu.spec b/criu.spec index d67955f..20dbedb 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 17 2025 Adrian Reber - 4.2-2 +* Mon Nov 17 2025 Adrian Reber - 4.2-3 - Update to 4.2 * Fri Sep 19 2025 Python Maint - 4.1.1-4 diff --git a/rpminspect.yaml b/rpminspect.yaml index 6b8f937..56018c6 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,4 @@ --- annocheck: jobs: - - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection + - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes From 0f4173bc94b03dcc3818ebf16308b1be3cf652b6 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 17:37:41 +0100 Subject: [PATCH 17/37] Update to 4.2 Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- rpminspect.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/criu.spec b/criu.spec index 20dbedb..9b80e5c 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 17 2025 Adrian Reber - 4.2-3 +* Mon Nov 17 2025 Adrian Reber - 4.2-4 - Update to 4.2 * Fri Sep 19 2025 Python Maint - 4.1.1-4 diff --git a/rpminspect.yaml b/rpminspect.yaml index 56018c6..3430463 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,4 @@ --- annocheck: jobs: - - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes + - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes --skip-gaps From 368f367e6924e842f6d426eaefdc274b463b15a5 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 18:29:29 +0100 Subject: [PATCH 18/37] Update to 4.2 Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- rpminspect.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/criu.spec b/criu.spec index 9b80e5c..ba4379c 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 17 2025 Adrian Reber - 4.2-4 +* Mon Nov 17 2025 Adrian Reber - 4.2-5 - Update to 4.2 * Fri Sep 19 2025 Python Maint - 4.1.1-4 diff --git a/rpminspect.yaml b/rpminspect.yaml index 3430463..93f2777 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,4 @@ --- annocheck: jobs: - - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes --skip-gaps + - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes --skip-gaps --skip-optimization --skip-stack-clash --skip-stack-prot From 13061f0076c966f6893e2bb283ffd68b9d3b8d78 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 21:14:44 +0100 Subject: [PATCH 19/37] Convert STI tests to TMT (rhbz#2382879) Signed-off-by: Adrian Reber --- .fmf/version | 1 + criu.spec | 5 ++++- plans.fmf | 24 ++++++++++++++++++++++++ tests/{tests.yml => main.fmf} | 33 +++++++++++++-------------------- tests/run-zdtm.sh | 2 +- 5 files changed, 43 insertions(+), 22 deletions(-) create mode 100644 .fmf/version create mode 100644 plans.fmf rename tests/{tests.yml => main.fmf} (54%) diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/criu.spec b/criu.spec index ba4379c..ed21c01 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,6 +185,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Mon Nov 15 2025 Cristian Le - 4.2-6 +- Convert STI tests to TMT (rhbz#2382879) + * Mon Nov 17 2025 Adrian Reber - 4.2-5 - Update to 4.2 diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..52b1751 --- /dev/null +++ b/plans.fmf @@ -0,0 +1,24 @@ +summary: Run all tests +discover: + how: fmf +prepare: + - name: Disable installing everything from srpm + how: install + exclude: ".*" + - name: Install the main package + how: install + package: + - criu +execute: + how: tmt + +/zdtm: + # Use the srpm sources + discover+: + dist-git-source: true + dist-git-merge: true + test: /tests/zdtm + +/podman: + discover+: + test: /tests/podman diff --git a/tests/tests.yml b/tests/main.fmf similarity index 54% rename from tests/tests.yml rename to tests/main.fmf index 995fd2d..2062bee 100644 --- a/tests/tests.yml +++ b/tests/main.fmf @@ -1,16 +1,7 @@ ---- -- hosts: localhost - roles: - - role: standard-test-source - tags: - - classic - - role: standard-test-basic - tags: - - classic - required_packages: - - podman - - curl - - jq +/zdtm: + summary: Test zdtm + test: ./run-zdtm.sh + require: - checkpolicy - policycoreutils - make @@ -28,10 +19,12 @@ - python3-pyyaml - python3-protobuf - python-unversioned-command - tests: - - zdtm: - dir: . - run: ./run-zdtm.sh - - podman: - dir: . - run: ./run-podman-checkpoint-restore.sh + - crit + - python3-criu +/podman: + summary: Test podman + test: ./run-podman-checkpoint-restore.sh + require: + - podman + - curl + - jq diff --git a/tests/run-zdtm.sh b/tests/run-zdtm.sh index 460d090..f825928 100755 --- a/tests/run-zdtm.sh +++ b/tests/run-zdtm.sh @@ -36,7 +36,7 @@ RESULT=42 # this socket brakes CRIU's test cases rm -f /var/lib/sss/pipes/nss -cd "source/criu-$(crit --version)/" +cd ../criu-$(crit --version) echo "Build CRIU" make -j"$(nproc)" From ac36de486b2b2514e6fe69a1a0981fdd408590e5 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 20:33:12 +0000 Subject: [PATCH 20/37] Test debugging Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- tests/main.fmf | 1 + tests/run-podman-checkpoint-restore.sh | 4 +++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/criu.spec b/criu.spec index ed21c01..6e042fb 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 15 2025 Cristian Le - 4.2-6 +* Mon Nov 15 2025 Cristian Le - 4.2-7 - Convert STI tests to TMT (rhbz#2382879) * Mon Nov 17 2025 Adrian Reber - 4.2-5 diff --git a/tests/main.fmf b/tests/main.fmf index 2062bee..221ef70 100644 --- a/tests/main.fmf +++ b/tests/main.fmf @@ -15,6 +15,7 @@ - libnl3-devel - libcap-devel - libaio-devel + - libuuid-devel - nftables-devel - python3-pyyaml - python3-protobuf diff --git a/tests/run-podman-checkpoint-restore.sh b/tests/run-podman-checkpoint-restore.sh index 845d0b4..0d846ae 100755 --- a/tests/run-podman-checkpoint-restore.sh +++ b/tests/run-podman-checkpoint-restore.sh @@ -1,6 +1,6 @@ #!/bin/bash -set -eux +set -ux ls -la @@ -16,6 +16,8 @@ curl `podman inspect -l | jq -r '.[0].NetworkSettings.IPAddress'`:8088 echo "Checkpoint container" podman --log-level debug container checkpoint -l +cat /var/lib/containers/storage/overlay-containers/*/userdata/dump.log + podman ps -a echo "Restore container" podman --log-level debug container restore -l From 841fd2c85a9af34e6c80b03ae6de322ea6474d62 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 21:35:38 +0100 Subject: [PATCH 21/37] Fix changelog date Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/criu.spec b/criu.spec index 6e042fb..34e04d6 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 15 2025 Cristian Le - 4.2-7 +* Mon Nov 17 2025 Cristian Le - 4.2-8 - Convert STI tests to TMT (rhbz#2382879) * Mon Nov 17 2025 Adrian Reber - 4.2-5 From 1b9075566654f51a6e920af7a66bee2df519dbdc Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 22:23:34 +0100 Subject: [PATCH 22/37] Increase test duration to 30 minutes From the default 5 minutes Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- tests/main.fmf | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/criu.spec b/criu.spec index 34e04d6..fd4208f 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 17 2025 Cristian Le - 4.2-8 +* Mon Nov 17 2025 Cristian Le - 4.2-9 - Convert STI tests to TMT (rhbz#2382879) * Mon Nov 17 2025 Adrian Reber - 4.2-5 diff --git a/tests/main.fmf b/tests/main.fmf index 221ef70..a743210 100644 --- a/tests/main.fmf +++ b/tests/main.fmf @@ -1,6 +1,7 @@ /zdtm: summary: Test zdtm test: ./run-zdtm.sh + duration: 30m require: - checkpolicy - policycoreutils From 737146110baffdc47cc4b5202119d078d3e6ec5d Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 22:56:10 +0100 Subject: [PATCH 23/37] Drop "Disable installing everything from srpm" This should fix that the newly build criu RPM is not installed in the test environment. Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- plans.fmf | 3 --- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/criu.spec b/criu.spec index fd4208f..32bf7a8 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 17 2025 Cristian Le - 4.2-9 +* Mon Nov 17 2025 Cristian Le - 4.2-10 - Convert STI tests to TMT (rhbz#2382879) * Mon Nov 17 2025 Adrian Reber - 4.2-5 diff --git a/plans.fmf b/plans.fmf index 52b1751..946731e 100644 --- a/plans.fmf +++ b/plans.fmf @@ -2,9 +2,6 @@ summary: Run all tests discover: how: fmf prepare: - - name: Disable installing everything from srpm - how: install - exclude: ".*" - name: Install the main package how: install package: From a0a8f6a514976e539722aeb20d6c263686bebfed Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 17 Nov 2025 23:41:29 +0100 Subject: [PATCH 24/37] Hopefully finally changes to make the tests work Signed-off-by: Adrian Reber --- criu.spec | 4 ++-- tests/run-podman-checkpoint-restore.sh | 7 ++++--- tests/run-zdtm.sh | 17 ++++++++++++++++- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/criu.spec b/criu.spec index 32bf7a8..ec8bb31 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 10%{?dist} +Release: 11%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,7 +185,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Mon Nov 17 2025 Cristian Le - 4.2-10 +* Mon Nov 17 2025 Cristian Le - 4.2-11 - Convert STI tests to TMT (rhbz#2382879) * Mon Nov 17 2025 Adrian Reber - 4.2-5 diff --git a/tests/run-podman-checkpoint-restore.sh b/tests/run-podman-checkpoint-restore.sh index 0d846ae..6ed7ad6 100755 --- a/tests/run-podman-checkpoint-restore.sh +++ b/tests/run-podman-checkpoint-restore.sh @@ -1,8 +1,11 @@ #!/bin/bash -set -ux +set -eux ls -la +uname -a +rpm -qi criu || true +criu --version echo "Start container" podman --log-level debug run -d quay.io/adrianreber/counter @@ -16,8 +19,6 @@ curl `podman inspect -l | jq -r '.[0].NetworkSettings.IPAddress'`:8088 echo "Checkpoint container" podman --log-level debug container checkpoint -l -cat /var/lib/containers/storage/overlay-containers/*/userdata/dump.log - podman ps -a echo "Restore container" podman --log-level debug container restore -l diff --git a/tests/run-zdtm.sh b/tests/run-zdtm.sh index f825928..ab046e1 100755 --- a/tests/run-zdtm.sh +++ b/tests/run-zdtm.sh @@ -3,6 +3,8 @@ set -xe uname -a +rpm -qi criu || true +criu --version # These zdtm tests are skipped because they fail only in CI system EXCLUDES=" \ @@ -13,6 +15,19 @@ EXCLUDES=" \ -x zdtm/static/socket-tcp4v6-closed \ -x zdtm/static/maps01 \ -x zdtm/static/maps04 \ + -x zdtm/static/del_standalone_un \ + -x zdtm/static/del_standalone_un_seqpacket \ + -x zdtm/static/deleted_unix_sock \ + -x zdtm/static/fifo_upon_unix_socket00 \ + -x zdtm/static/sk-unix-dgram-ghost \ + -x zdtm/static/sk-unix01 \ + -x zdtm/static/sk-unix01-seqpacket \ + -x zdtm/static/socket-tcpbuf \ + -x zdtm/static/socket-tcpbuf6 \ + -x zdtm/static/sockets00 \ + -x zdtm/static/sockets00-seqpacket \ + -x zdtm/static/sockets03 \ + -x zdtm/static/sockets03-seqpacket \ -x zdtm/static/cgroup04 \ -x zdtm/static/cgroup_ifpriomap \ -x zdtm/static/netns_sub \ @@ -33,7 +48,7 @@ run_test() { RESULT=42 -# this socket brakes CRIU's test cases +# this socket breaks CRIU's test cases rm -f /var/lib/sss/pipes/nss cd ../criu-$(crit --version) From 4b2c2d2e601d03a25e2155303061b222997662d5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 05:32:07 +0000 Subject: [PATCH 25/37] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index ec8bb31..b81742c 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 11%{?dist} +Release: 12%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,6 +185,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Fri Jan 16 2026 Fedora Release Engineering - 4.2-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Mon Nov 17 2025 Cristian Le - 4.2-11 - Convert STI tests to TMT (rhbz#2382879) From d5d689011c1a3b23c913e180cba64197bdc55391 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 09:31:30 +0000 Subject: [PATCH 26/37] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index b81742c..7ca32e5 100644 --- a/criu.spec +++ b/criu.spec @@ -12,7 +12,7 @@ Name: criu Version: 4.2 -Release: 12%{?dist} +Release: 13%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -185,6 +185,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Fri Jan 16 2026 Fedora Release Engineering - 4.2-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jan 16 2026 Fedora Release Engineering - 4.2-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 12ddfeab47d329eb37e8d7f31f97cde574930c00 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Tue, 3 Mar 2026 08:17:41 +0000 Subject: [PATCH 27/37] Fix rseq build failure with latest glibc in rawhide Add patch to use kernel rseq.h when glibc detects it. Recent glibc conditionally includes linux/rseq.h when __GLIBC_HAVE_KERNEL_RSEQ is defined, conflicting with CRIU's own copy. The patch checks for this define and includes the kernel header directly when available. Also re-enable binary hardening flags for the main criu binary via an ld wrapper that strips gcc-only -specs= options for direct ld calls, based on: https://gitlab.com/redhat/centos-stream/rpms/criu/-/commit/4c6f4911a0497400a170c371614963dc80001689 Generated with Claude Code (https://claude.ai/code) Signed-off-by: Adrian Reber --- ...-kernel-rseq.h-when-glibc-detects-it.patch | 56 ++++++++++++++++++ criu.spec | 57 +++++++++++++------ 2 files changed, 97 insertions(+), 16 deletions(-) create mode 100644 0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch diff --git a/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch b/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch new file mode 100644 index 0000000..0bed5af --- /dev/null +++ b/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch @@ -0,0 +1,56 @@ +From 95531dcc36c2453b9242e0de17b8fedb20ce48ca Mon Sep 17 00:00:00 2001 +From: Adrian Reber +Date: Tue, 3 Mar 2026 06:29:53 +0000 +Subject: [PATCH] rseq: use kernel rseq.h when glibc detects it + +Compilation fails with the latest glibc-devel in Fedora rawhide. +Recent glibc conditionally includes the kernel's linux/rseq.h +when __GLIBC_HAVE_KERNEL_RSEQ is defined, but CRIU's own copy +of the rseq definitions does not account for this and conflicts +with the kernel header which has additional information. + +Check if __GLIBC_HAVE_KERNEL_RSEQ is defined and if so include +the kernel header directly using angle brackets (which bypasses +-iquote and finds the real kernel header instead of CRIU's +copy). Otherwise fall back to CRIU's own definitions. + +Generated with Claude Code (https://claude.ai/code) + +Signed-off-by: Adrian Reber +--- + criu/include/linux/rseq.h | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/criu/include/linux/rseq.h b/criu/include/linux/rseq.h +index 5ceefbf8e..d7f81e9a2 100644 +--- a/criu/include/linux/rseq.h ++++ b/criu/include/linux/rseq.h +@@ -14,6 +14,16 @@ + + #include "common/config.h" + ++/* ++ * If glibc detected that the kernel rseq.h header exists, include ++ * it directly using angle brackets (which bypasses -iquote and finds ++ * the real kernel header). Otherwise fall back to our own copy of ++ * the definitions. ++ */ ++#ifdef __GLIBC_HAVE_KERNEL_RSEQ ++#include ++#else /* !__GLIBC_HAVE_KERNEL_RSEQ */ ++ + #ifdef CONFIG_HAS_NO_LIBC_RSEQ_DEFS + /* + * linux/rseq.h +@@ -45,6 +55,8 @@ enum rseq_cs_flags { + }; + #endif /* CONFIG_HAS_NO_LIBC_RSEQ_DEFS */ + ++#endif /* !__GLIBC_HAVE_KERNEL_RSEQ */ ++ + /* + * Let's use our own definition of struct rseq_cs because some distros + * (for example Mariner GNU/Linux) declares this structure their-own way. +-- +2.51.1 + diff --git a/criu.spec b/criu.spec index 7ca32e5..e37ceb3 100644 --- a/criu.spec +++ b/criu.spec @@ -1,22 +1,24 @@ %global py_prefix python3 %global py_binary %{py_prefix} -# With annobin enabled, CRIU does not work anymore. It seems CRIU's -# parasite code breaks if annobin is enabled. +# CRIU's parasite/restorer code (criu/pie/) is compiled with its own CFLAGS +# that already disable hardening (-fno-stack-protector, -U_FORTIFY_SOURCE, +# -D_FORTIFY_SOURCE=0, -nostdlib). Standard RHEL hardening flags (PIE, RELRO, +# FORTIFY_SOURCE, stack protector) only affect the main criu binary and libs. +# +# Annobin remains disabled because its instrumentation gets injected into +# every compilation unit including parasite code, and there is no per-target +# way to exclude it through the Makefile. %undefine _annotated_build -# Disable automatic call to the set_build_flags macro -# at the beginning of the build, check, and install. -# This change was introduced in Fedora 36. -%undefine _auto_set_build_flags - Name: criu Version: 4.2 -Release: 13%{?dist} +Release: 15%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{version}.tar.gz +Patch0: 0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch # Add protobuf-c as a dependency. # We use this patch because the protobuf-c package name @@ -113,6 +115,7 @@ This script can help to workaround the so called "PID mismatch" problem. %prep %setup -q +%patch -P 0 -p1 %patch -P 99 -p1 %build @@ -120,21 +123,37 @@ This script can help to workaround the so called "PID mismatch" problem. # that is fixed, disable LTO. %define _lto_cflags %{nil} +# CRIU's nmk build system calls ld directly for intermediate partial linking +# (ld -r). RHEL LDFLAGS contain -specs= options that only gcc understands; +# raw ld rejects them. Create a wrapper that strips -specs= for direct ld +# calls. The final criu binary link uses gcc (CC), not ld, so it still gets +# full hardening (-pie, -z relro, -z now) from the spec files. +mkdir -p %{_builddir}/bin +cat > %{_builddir}/bin/ld << 'LDWRAPPER' +#!/bin/sh +for arg do + shift + case "$arg" in -specs=*) continue ;; esac + set -- "$@" "$arg" +done +exec /usr/bin/ld "$@" +LDWRAPPER +chmod +x %{_builddir}/bin/ld + # %{?_smp_mflags} does not work -# -fstack-protector breaks build -CFLAGS+=`echo %{optflags} | sed -e 's,-fstack-protector\S*,,g'` make V=1 WERROR=0 PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES +CFLAGS+="%{optflags}" make V=1 WERROR=0 LD=%{_builddir}/bin/ld PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES make V=1 WERROR=0 PREFIX=%{_prefix} PLUGINDIR=%{_libdir}/criu amdgpu_plugin make docs V=1 %install sed -e "s,--upgrade --ignore-installed,--no-index --no-deps -v --no-build-isolation,g" -i lib/Makefile -i crit/Makefile -make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} -make install-lib DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" -make install-amdgpu_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu -make install-cuda_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu -make install-crit DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" -make install-man DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} +make install-criu LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} +make install-lib LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" +make install-amdgpu_plugin LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu +make install-cuda_plugin LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu +make install-crit LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed" +make install-man LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} rm -f $RPM_BUILD_ROOT%{_mandir}/man1/compel.1 mkdir -p %{buildroot}%{_tmpfilesdir} @@ -185,6 +204,12 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Tue Mar 03 2026 Adrian Reber - 4.2-15 +- Fix rseq build failure with latest glibc in rawhide + +* Mon Mar 02 2026 Christopher Lusk - 4.2-14 +- Re-enable binary hardening flags for main binary + * Fri Jan 16 2026 Fedora Release Engineering - 4.2-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From f6264d32e15b8a00c5ed14b8f8e4bb3ff819a30a Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Tue, 3 Mar 2026 10:09:21 +0000 Subject: [PATCH 28/37] Fix tty compiler error (const qualifier warning) Apply upstream patch 90300748effc to fix -Werror=discarded-qualifiers in pts_fd_get_index(). Generated with Claude Code (https://claude.ai/code) Signed-off-by: Adrian Reber --- 0001-tty-fix-compiler-error.patch | 35 +++++++++++++++++++++++++++++++ criu.spec | 7 ++++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 0001-tty-fix-compiler-error.patch diff --git a/0001-tty-fix-compiler-error.patch b/0001-tty-fix-compiler-error.patch new file mode 100644 index 0000000..9b84c02 --- /dev/null +++ b/0001-tty-fix-compiler-error.patch @@ -0,0 +1,35 @@ +From 90300748effc1cf0fe56e35d3d1cc2ddfedab246 Mon Sep 17 00:00:00 2001 +From: Adrian Reber +Date: Wed, 26 Nov 2025 13:21:07 +0000 +Subject: [PATCH] tty: fix compiler error + +At least on tests running on Fedora rawhide following error could be +seen: + +``` + criu/tty.c: In function 'pts_fd_get_index': + criu/tty.c:262:21: error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] + 262 | char *pos = strrchr(link->name, '/'); + | +``` + +This fixes it. + +Signed-off-by: Adrian Reber +--- + criu/tty.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/criu/tty.c b/criu/tty.c +index ae23094b7b..9a4520d535 100644 +--- a/criu/tty.c ++++ b/criu/tty.c +@@ -259,7 +259,7 @@ static int pts_fd_get_index(int fd, const struct fd_parms *p) + { + int index; + const struct fd_link *link = p->link; +- char *pos = strrchr(link->name, '/'); ++ const char *pos = strrchr(link->name, '/'); + + if (!pos || pos == (link->name + link->len - 1)) { + pr_err("Unexpected format on path %s\n", link->name + 1); diff --git a/criu.spec b/criu.spec index e37ceb3..ab8647c 100644 --- a/criu.spec +++ b/criu.spec @@ -13,12 +13,13 @@ Name: criu Version: 4.2 -Release: 15%{?dist} +Release: 16%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{version}.tar.gz Patch0: 0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch +Patch1: 0001-tty-fix-compiler-error.patch # Add protobuf-c as a dependency. # We use this patch because the protobuf-c package name @@ -116,6 +117,7 @@ This script can help to workaround the so called "PID mismatch" problem. %prep %setup -q %patch -P 0 -p1 +%patch -P 1 -p1 %patch -P 99 -p1 %build @@ -204,6 +206,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Tue Mar 03 2026 Adrian Reber - 4.2-16 +- Fix tty compiler error (const qualifier warning) + * Tue Mar 03 2026 Adrian Reber - 4.2-15 - Fix rseq build failure with latest glibc in rawhide From 259ac6c8e7e4f4862eaeeb1d768078b1b3b23adf Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 26 Mar 2026 09:55:07 +0100 Subject: [PATCH 29/37] Always use nftables network locking backend --- criu.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/criu.spec b/criu.spec index ab8647c..7b770b1 100644 --- a/criu.spec +++ b/criu.spec @@ -13,7 +13,7 @@ Name: criu Version: 4.2 -Release: 16%{?dist} +Release: 17%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -42,11 +42,11 @@ BuildRequires: libselinux-devel BuildRequires: gnutls-devel BuildRequires: libdrm-devel BuildRequires: libuuid-devel +BuildRequires: nftables-devel # Checkpointing containers with a tmpfs requires tar Recommends: tar %if 0%{?fedora} BuildRequires: libbsd-devel -BuildRequires: nftables-devel %endif BuildRequires: make @@ -206,6 +206,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Thu Mar 26 2026 Adrian Reber - 4.2-17 +- Always use nftables network locking backend + * Tue Mar 03 2026 Adrian Reber - 4.2-16 - Fix tty compiler error (const qualifier warning) From 0b4e09fe633e98966b7afe0333633c2d1f2a92eb Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 26 Mar 2026 09:56:11 +0100 Subject: [PATCH 30/37] Fix email address Signed-off-by: Adrian Reber --- criu.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 7b770b1..af083a2 100644 --- a/criu.spec +++ b/criu.spec @@ -206,7 +206,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog -* Thu Mar 26 2026 Adrian Reber - 4.2-17 +* Thu Mar 26 2026 Adrian Reber - 4.2-17 - Always use nftables network locking backend * Tue Mar 03 2026 Adrian Reber - 4.2-16 From 7ca58ef6a75fdd015dccfcdda9c4e29d22f3c485 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Wed, 22 Apr 2026 07:18:00 +0000 Subject: [PATCH 31/37] Route veth restore through usernsd for userns mode (upstream PR#3006) Fix rseq01 test for kernel 7.0 rseq changes (upstream PR#3007) Handle UDPLITE removal in kernel 7.1 (upstream PR#3003) Signed-off-by: Adrian Reber --- ...tore-through-usernsd-for-userns-mode.patch | 178 ++++++++++++++++++ ...q01-test-for-kernel-7.0-rseq-changes.patch | 163 ++++++++++++++++ ...t-UDPLITE-as-optional-in-collect_err.patch | 52 +++++ ...plite-test-when-kernel-lacks-UDPLITE.patch | 37 ++++ criu.spec | 15 +- 5 files changed, 444 insertions(+), 1 deletion(-) create mode 100644 0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch create mode 100644 0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch create mode 100644 0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch create mode 100644 0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch diff --git a/0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch b/0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch new file mode 100644 index 0000000..cbedd55 --- /dev/null +++ b/0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch @@ -0,0 +1,178 @@ +From 7ad6bb97b4e3951fc79cbda51b05e649aea2854a Mon Sep 17 00:00:00 2001 +From: Adrian Reber +Date: Tue, 21 Apr 2026 09:04:51 +0000 +Subject: [PATCH] net: Route veth restore through usernsd for userns mode + +Starting with Linux kernel commit 7b735ef81286 ("rtnetlink: add +missing netlink_ns_capable() check for peer netns"), creating a +veth pair with a peer in a different network namespace requires +CAP_NET_ADMIN in the peer namespace as well: + + rtnetlink: add missing netlink_ns_capable() check for peer netns + + rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer + network namespace when creating paired devices (veth, vxcan, + netkit). This allows an unprivileged user with a user namespace + to create interfaces in arbitrary network namespaces, including + init_net. + + Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer + namespace before allowing device creation to proceed. + +Link: https://github.com/torvalds/linux/commit/7b735ef81286007794a227ce2539419479c02a5f + +When CRIU restores a veth in user namespace mode, it sends the +RTM_NEWLINK request from a netlink socket inside the child user +namespace. The veth peer is placed into the root network namespace +via IFLA_NET_NS_FD, but the child user namespace does not have +CAP_NET_ADMIN in the root namespace, so the new kernel check +rejects the request with EPERM. + +Fix this by routing the veth creation through usernsd when the +peer lives in an external (host) namespace specified via the +--external veth[name] restore option. usernsd runs with real +root privileges in the init user namespace, so it passes the +capability check in both namespaces. + +The usernsd path is only used for external veth mappings, not for +child-to-child namespace veths (has_peer_nsid), because in that +case both namespaces share the same user namespace and already +have CAP_NET_ADMIN in each other. + +The approach mirrors restore_one_macvlan(), which already solves +the same CAP_NET_ADMIN-in-both-namespaces problem for macvlan +devices. A new veth_link_info_userns() builds the RTM_NEWLINK +request without IFLA_NET_NS_FD for the peer -- since usernsd +sends the request from the root network namespace, the peer +naturally stays there. userns_restore_one_link() then adds a +top-level IFLA_NET_NS_FD to move the main device into the child +namespace. + +Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default +Signed-off-by: Adrian Reber +--- + criu/net.c | 104 +++++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 104 insertions(+) + +diff --git a/criu/net.c b/criu/net.c +index e5775a3287..e1dc5973fd 100644 +--- a/criu/net.c ++++ b/criu/net.c +@@ -1653,6 +1653,94 @@ static int restore_one_macvlan(struct ns_id *ns, struct net_link *link, int nlsk + return ret; + } + ++/* ++ * Simplified veth_link_info for the usernsd path: builds the veth peer ++ * info without adding IFLA_NET_NS_FD for the peer, since the netlink ++ * request will be sent from usernsd's namespace (the root/peer namespace) ++ * and the peer should remain there. ++ */ ++static int veth_link_info_userns(struct ns_id *ns, struct net_link *link, struct newlink_req *req) ++{ ++ NetDeviceEntry *nde = link->nde; ++ struct rtattr *veth_data, *peer_data; ++ struct ifinfomsg ifm; ++ char key[100], *val; ++ ++ addattr_l(&req->h, sizeof(*req), IFLA_INFO_KIND, "veth", 4); ++ ++ veth_data = NLMSG_TAIL(&req->h); ++ addattr_l(&req->h, sizeof(*req), IFLA_INFO_DATA, NULL, 0); ++ peer_data = NLMSG_TAIL(&req->h); ++ memset(&ifm, 0, sizeof(ifm)); ++ ++ if (nde->has_peer_nsid) ++ ifm.ifi_index = nde->peer_ifindex; ++ addattr_l(&req->h, sizeof(*req), VETH_INFO_PEER, &ifm, sizeof(ifm)); ++ ++ /* Set peer name from external mapping if available */ ++ snprintf(key, sizeof(key), "veth[%s]", nde->name); ++ val = external_lookup_by_key(key); ++ if (!IS_ERR_OR_NULL(val)) { ++ char *aux = strchrnul(val, '@'); ++ ++ addattr_l(&req->h, sizeof(*req), IFLA_IFNAME, val, aux - val); ++ } ++ ++ /* ++ * No IFLA_NET_NS_FD for the peer -- the request is sent from ++ * usernsd's namespace (the root network namespace) and the ++ * peer stays there. userns_restore_one_link() adds a top-level ++ * IFLA_NET_NS_FD to move the main device into the child netns. ++ */ ++ ++ peer_data->rta_len = (char *)NLMSG_TAIL(&req->h) - (char *)peer_data; ++ veth_data->rta_len = (char *)NLMSG_TAIL(&req->h) - (char *)veth_data; ++ ++ link->created = true; ++ ++ return 0; ++} ++ ++/* ++ * When running in user namespaces with a cross-namespace veth peer, ++ * CAP_NET_ADMIN is required in both namespaces for veth creation ++ * (kernel >= 7.0, commit 7b735ef81286). Route the request through ++ * usernsd which runs with real root privileges, similar to ++ * restore_one_macvlan(). ++ * ++ * The netlink request is sent from usernsd's namespace (the root ++ * network namespace), so the veth peer stays there. The main device ++ * is moved to the child namespace via a top-level IFLA_NET_NS_FD ++ * added by userns_restore_one_link(). ++ */ ++static int restore_one_veth_userns(struct ns_id *ns, struct net_link *link) ++{ ++ struct newlink_req req; ++ int my_netns, ret; ++ ++ my_netns = open_proc(PROC_SELF, "ns/net"); ++ if (my_netns < 0) ++ return -1; ++ ++ if (populate_newlink_req(ns, &req, RTM_NEWLINK, link, ++ veth_link_info_userns, NULL) < 0) { ++ close(my_netns); ++ return -1; ++ } ++ ++ pr_info("Restoring netdev %s idx %d via usernsd\n", ++ link->nde->name, link->nde->ifindex); ++ ++ ret = userns_call(userns_restore_one_link, 0, ++ &req, sizeof(req), my_netns); ++ if (ret < 0) ++ pr_err("couldn't restore veth interface %s via usernsd\n", ++ link->nde->name); ++ ++ close(my_netns); ++ return ret; ++} ++ + static int sit_link_info(struct ns_id *ns, struct net_link *link, struct newlink_req *req) + { + NetDeviceEntry *nde = link->nde; +@@ -1762,6 +1850,22 @@ static int __restore_link(struct ns_id *ns, struct net_link *link, int nlsk) + if (!IS_ERR_OR_NULL(val)) + return move_veth(val, ns, link, nlsk); + ++ /* ++ * Creating a veth with a cross-namespace peer requires ++ * CAP_NET_ADMIN in both namespaces (kernel >= 7.0). ++ * In user namespace mode, route through usernsd which ++ * has real root when the peer lives in an external ++ * (host) namespace specified via --external veth[name]. ++ */ ++ if (root_ns_mask & CLONE_NEWUSER) { ++ char vkey[100]; ++ ++ snprintf(vkey, sizeof(vkey), "veth[%s]", nde->name); ++ val = external_lookup_by_key(vkey); ++ if (!IS_ERR_OR_NULL(val)) ++ return restore_one_veth_userns(ns, link); ++ } ++ + return restore_one_link(ns, link, nlsk, veth_link_info, NULL); + case ND_TYPE__TUN: + return restore_one_tun(ns, link, nlsk); diff --git a/0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch b/0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch new file mode 100644 index 0000000..e0ead93 --- /dev/null +++ b/0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch @@ -0,0 +1,163 @@ +From 14574afd322113630b897f5f7d08a292fb06ce5a Mon Sep 17 00:00:00 2001 +From: Adrian Reber +Date: Tue, 21 Apr 2026 09:30:17 +0000 +Subject: [PATCH] zdtm: Fix rseq01 test for kernel 7.0 rseq changes + +Starting with Linux 7.0, the rseq feature size has grown to 33 bytes +and AT_RSEQ_ALIGN has increased to 64. This causes sizeof(struct rseq) +from the uapi header to be 64 (33 bytes padded to aligned(32)), while +the actual registration size used by glibc (__rseq_size) is 33. + +The rseq01 test was using sizeof(struct rseq) as the registration +size and a test-local __rseq_abi variable (with only 32-byte +alignment from the uapi header) as the rseq area. Both are +wrong on kernel 7.0: + + - The kernel now checks alignment against __alignof__(struct rseq) + which is 64 internally; the 32-byte-aligned test variable may + not satisfy this. + + - sizeof(struct rseq) = 64 does not match the feature size of 33 + that glibc registered with, so re-registration with a different + size fails. + +Fix by: + + - Using __rseq_size (the feature size reported by glibc) as the + registration size instead of sizeof(struct rseq). + + - Using the glibc-provided rseq area (at thread_pointer() + + __rseq_offset) which is allocated with proper AT_RSEQ_ALIGN + alignment, instead of a test-local variable. + +Both fall back to the previous behavior when glibc rseq support +is not available. + +This mirrors the glibc fix: + + https://sourceware.org/cgit/glibc/commit/?id=67f303b47dc584f204e3f2441b9832082415eebc + +Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default +Signed-off-by: Adrian Reber +--- + test/zdtm/transition/rseq01.c | 59 +++++++++++++++++++++++++++++------ + 1 file changed, 50 insertions(+), 9 deletions(-) + +diff --git a/test/zdtm/transition/rseq01.c b/test/zdtm/transition/rseq01.c +index 08a7a8e1a6..9c5925bc45 100644 +--- a/test/zdtm/transition/rseq01.c ++++ b/test/zdtm/transition/rseq01.c +@@ -20,9 +20,19 @@ + #endif + #endif + ++/* ++ * HAVE_GLIBC_RSEQ is set when the C library provides rseq support ++ * (__rseq_size, __rseq_offset). glibc >= 2.35 defines RSEQ_SIG in ++ * ; musl does not, so the test falls back to its own ++ * definitions below. ++ */ ++#if defined(RSEQ_SIG) ++#define HAVE_GLIBC_RSEQ 1 ++#endif ++ + #if defined(__x86_64__) + +-#if defined(__x86_64__) && defined(RSEQ_SIG) ++#ifdef HAVE_GLIBC_RSEQ + static inline void *thread_pointer(void) + { + void *result; +@@ -38,11 +48,11 @@ static inline void unregister_old_rseq(void) + size = 32; + syscall(__NR_rseq, (void *)((char *)thread_pointer() + __rseq_offset), size, 1, RSEQ_SIG); + } +-#else ++#else /* !HAVE_GLIBC_RSEQ */ + static inline void unregister_old_rseq(void) + { + } +-#endif ++#endif /* HAVE_GLIBC_RSEQ */ + + const char *test_doc = "rseq() transition test"; + const char *test_author = "Alexander Mikhalitsyn "; +@@ -97,11 +107,27 @@ static int sys_rseq(volatile struct rseq *rseq_abi, uint32_t rseq_len, int flags + return syscall(__NR_rseq, rseq_abi, rseq_len, flags, sig); + } + ++/* ++ * Return the rseq registration size. Starting with Linux 7.0, ++ * AT_RSEQ_ALIGN is 64 but the feature size is 33, so sizeof(struct rseq) ++ * (padded to alignment) no longer matches the registration size the kernel ++ * expects. Use __rseq_size when available, clamped to a minimum of 32 ++ * for older kernels (mirroring glibc's rseq-internal.h). ++ */ ++static uint32_t rseq_reg_size(void) ++{ ++#ifdef HAVE_GLIBC_RSEQ ++ if (__rseq_size) ++ return (__rseq_size < 32) ? 32 : __rseq_size; ++#endif ++ return sizeof(struct rseq); ++} ++ + static void register_thread(void) + { + int rc; + unregister_old_rseq(); +- rc = sys_rseq(rseq_ptr, sizeof(struct rseq), 0, RSEQ_SIG); ++ rc = sys_rseq(rseq_ptr, rseq_reg_size(), 0, RSEQ_SIG); + if (rc) { + fail("Failed to register rseq"); + exit(1); +@@ -111,7 +137,7 @@ static void register_thread(void) + static void check_thread(void) + { + int rc; +- rc = sys_rseq(rseq_ptr, sizeof(struct rseq), 0, RSEQ_SIG); ++ rc = sys_rseq(rseq_ptr, rseq_reg_size(), 0, RSEQ_SIG); + if (!(rc && errno == EBUSY)) { + fail("Failed to check rseq %d", rc); + exit(1); +@@ -206,12 +232,27 @@ static intptr_t *cpu_data; + bool ignore_abort = true; + int thread_ret; + ++static volatile struct rseq *rseq_area(void) ++{ ++#ifdef HAVE_GLIBC_RSEQ ++ /* ++ * Use the glibc-provided rseq area which is allocated with the ++ * correct alignment (AT_RSEQ_ALIGN, 64 on kernel >= 7.0). ++ * The test-local __rseq_abi only has the uapi header alignment ++ * (32 bytes) which may not satisfy the kernel's requirement. ++ */ ++ if (__rseq_size) ++ return (volatile struct rseq *)((char *)thread_pointer() + __rseq_offset); ++#endif ++ return &__rseq_abi; ++} ++ + void *thread_routine(void *args) + { + int cpu; + +- rseq_ptr = &__rseq_abi; +- memset((void *)rseq_ptr, 0, sizeof(struct rseq)); ++ rseq_ptr = rseq_area(); ++ memset((void *)rseq_ptr, 0, rseq_reg_size()); + register_thread(); + task_waiter_complete(&waiter, 1); + task_waiter_wait4(&waiter, 2); +@@ -235,8 +276,8 @@ int main(int argc, char *argv[]) + long nr_cpus; + pthread_t thread; + +- rseq_ptr = &__rseq_abi; +- memset((void *)rseq_ptr, 0, sizeof(struct rseq)); ++ rseq_ptr = rseq_area(); ++ memset((void *)rseq_ptr, 0, rseq_reg_size()); + + test_init(argc, argv); + nr_cpus = sysconf(_SC_NPROCESSORS_ONLN); diff --git a/0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch b/0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch new file mode 100644 index 0000000..1cd8f12 --- /dev/null +++ b/0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch @@ -0,0 +1,52 @@ +From 1cf8d3b21c64f0ef3310301019136433fc9f6392 Mon Sep 17 00:00:00 2001 +From: Adrian Reber +Date: Mon, 20 Apr 2026 19:19:42 +0000 +Subject: [PATCH] sockets: Treat UDPLITE as optional in collect_err() + +Kernel 7.1 removed IPPROTO_UDPLITE support. When the UDPLITE diag +module is absent, the netlink request returns -ENOENT, which CRIU +was treating as a fatal error causing the entire dump to fail. + +Apply the same treatment as IPPROTO_RAW: return success from the +error callback so the dump can proceed. If a UDPLITE socket is +actually encountered, it will fail at lookup time with a clear +error rather than failing the entire dump preemptively. + +Fixes: https://github.com/checkpoint-restore/criu/issues/3002 + +Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default +Signed-off-by: Adrian Reber +--- + criu/sockets.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/criu/sockets.c b/criu/sockets.c +index e4adae03cd..7778b46881 100644 +--- a/criu/sockets.c ++++ b/criu/sockets.c +@@ -827,16 +827,20 @@ static int collect_err(int err, struct ns_id *ns, void *arg) + if (err == -ENOENT) { + pr_debug("%s: %d\n", msg, err); + /* +- * Unlike other modules RAW sockets are +- * always optional and not commonly used. ++ * Unlike other modules RAW and UDPLITE sockets ++ * are always optional and not commonly used. + * Currently we warn user about lack of + * a particular module support in "check" + * procedure. Thus don't fail on lack of +- * RAW diags in a regular dump. If we meet +- * a raw socket we will simply fail on dump ++ * these diags in a regular dump. If we meet ++ * such a socket we will simply fail on dump + * procedure because it won't be resolved. ++ * ++ * Note: IPPROTO_UDPLITE support was removed ++ * from the kernel starting with v7.1. + */ +- if (gr->protocol == IPPROTO_RAW) ++ if (gr->protocol == IPPROTO_RAW || ++ gr->protocol == IPPROTO_UDPLITE) + return 0; + return -ENOENT; + } diff --git a/0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch b/0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch new file mode 100644 index 0000000..5d9d5d5 --- /dev/null +++ b/0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch @@ -0,0 +1,37 @@ +From 23905c26b86afdc01bcfa85ae0a3aab015fc81f1 Mon Sep 17 00:00:00 2001 +From: Adrian Reber +Date: Tue, 21 Apr 2026 07:58:00 +0000 +Subject: [PATCH] zdtm: Skip socket_udplite test when kernel lacks UDPLITE + +Kernel 7.1 removed IPPROTO_UDPLITE support. Add a checkskip +script that probes for a UDPLITE socket and skips the test +with EPROTONOSUPPORT instead of failing. + +Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default +Signed-off-by: Adrian Reber +--- + test/zdtm/static/socket_udplite.checkskip | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + create mode 100755 test/zdtm/static/socket_udplite.checkskip + +diff --git a/test/zdtm/static/socket_udplite.checkskip b/test/zdtm/static/socket_udplite.checkskip +new file mode 100755 +index 0000000000..a562550843 +--- /dev/null ++++ b/test/zdtm/static/socket_udplite.checkskip +@@ -0,0 +1,15 @@ ++#!/usr/bin/env python3 ++# IPPROTO_UDPLITE was removed in kernel 7.1, skip the test if the ++# protocol is not available. ++import socket ++import errno ++ ++try: ++ socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDPLITE).close() ++except OSError as e: ++ if e.errno == errno.EPROTONOSUPPORT: ++ print("UDPLITE is not supported by this kernel.") ++ exit(1) ++ raise ++ ++exit(0) diff --git a/criu.spec b/criu.spec index af083a2..383213a 100644 --- a/criu.spec +++ b/criu.spec @@ -13,13 +13,17 @@ Name: criu Version: 4.2 -Release: 17%{?dist} +Release: 18%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{version}.tar.gz Patch0: 0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch Patch1: 0001-tty-fix-compiler-error.patch +Patch2: 0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch +Patch3: 0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch +Patch4: 0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch +Patch5: 0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch # Add protobuf-c as a dependency. # We use this patch because the protobuf-c package name @@ -118,6 +122,10 @@ This script can help to workaround the so called "PID mismatch" problem. %setup -q %patch -P 0 -p1 %patch -P 1 -p1 +%patch -P 2 -p1 +%patch -P 3 -p1 +%patch -P 4 -p1 +%patch -P 5 -p1 %patch -P 99 -p1 %build @@ -206,6 +214,11 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Apr 22 2026 Adrian Reber - 4.2-18 +- Route veth restore through usernsd for userns mode (upstream PR#3006) +- Fix rseq01 test for kernel 7.0 rseq changes (upstream PR#3007) +- Handle UDPLITE removal in kernel 7.1 (upstream PR#3003) + * Thu Mar 26 2026 Adrian Reber - 4.2-17 - Always use nftables network locking backend From 3b916046e8c7ada9533cf7f402d8ce19a28336ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Thu, 28 May 2026 18:59:55 +0200 Subject: [PATCH 32/37] rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 383213a..34d16e1 100644 --- a/criu.spec +++ b/criu.spec @@ -13,7 +13,7 @@ Name: criu Version: 4.2 -Release: 18%{?dist} +Release: 19%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -214,6 +214,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Thu May 28 2026 Miroslav Suchy - 4.2-19 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + * Wed Apr 22 2026 Adrian Reber - 4.2-18 - Route veth restore through usernsd for userns mode (upstream PR#3006) - Fix rseq01 test for kernel 7.0 rseq changes (upstream PR#3007) From 609b0c4ac5acadd428b3afc7a7a57204ea632e09 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 3 Jun 2026 23:01:44 +0200 Subject: [PATCH 33/37] Rebuilt for Python 3.15 --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 34d16e1..8660187 100644 --- a/criu.spec +++ b/criu.spec @@ -13,7 +13,7 @@ Name: criu Version: 4.2 -Release: 19%{?dist} +Release: 20%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -214,6 +214,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Jun 03 2026 Python Maint - 4.2-20 +- Rebuilt for Python 3.15 + * Thu May 28 2026 Miroslav Suchy - 4.2-19 - rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x From 77b92b38c1f878a0ad8c5147667b1de69bd5e6fa Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 6 Jul 2026 10:03:00 +0200 Subject: [PATCH 34/37] One more test only patch for linux 7.1 Signed-off-by: Adrian Reber --- 3023.patch | 50 +++++++++++++++++++++++++++++++++++++++++++++++++ criu.spec | 7 ++++++- rpminspect.yaml | 2 +- 3 files changed, 57 insertions(+), 2 deletions(-) create mode 100644 3023.patch diff --git a/3023.patch b/3023.patch new file mode 100644 index 0000000..8b7c0bc --- /dev/null +++ b/3023.patch @@ -0,0 +1,50 @@ +From 51660aba34b41c08d892bda6528abe992a5687e7 Mon Sep 17 00:00:00 2001 +From: Adrian Reber +Date: Tue, 19 May 2026 17:11:35 +0000 +Subject: [PATCH] zdtm: unregister rseq before zeroing the rseq area + +Starting with Linux 7.1, the kernel enforces strict read-only field +protection for the rseq V2 ABI. Userspace is no longer allowed to +modify kernel-managed fields (cpu_id_start, cpu_id, node_id, mm_cid) +while rseq is registered. Violations are detected on the next context +switch and the offending process is killed with SIGSEGV. + +The rseq01 test was zeroing the entire glibc-registered rseq area +with memset() before calling test_init(), which internally calls +fork(). This corrupted the read-only fields while the glibc rseq +registration was still active, causing the kernel to send SIGSEGV +during the fork. + +Fix this by calling unregister_old_rseq() before the memset in both +main() and thread_routine(), so the kernel is no longer monitoring +those fields when they are zeroed. The subsequent register_thread() +call re-registers rseq with the clean area. + +Link: https://github.com/torvalds/linux/commit/7f0023215262221ca08d56be2203e8a4770be033 + +Assisted-by: Claude Code (https://claude.ai/code):claude-opus-4-6 +Signed-off-by: Adrian Reber +--- + test/zdtm/transition/rseq01.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/test/zdtm/transition/rseq01.c b/test/zdtm/transition/rseq01.c +index 9c5925bc45..0d5485e162 100644 +--- a/test/zdtm/transition/rseq01.c ++++ b/test/zdtm/transition/rseq01.c +@@ -252,6 +252,7 @@ void *thread_routine(void *args) + int cpu; + + rseq_ptr = rseq_area(); ++ unregister_old_rseq(); + memset((void *)rseq_ptr, 0, rseq_reg_size()); + register_thread(); + task_waiter_complete(&waiter, 1); +@@ -277,6 +278,7 @@ int main(int argc, char *argv[]) + pthread_t thread; + + rseq_ptr = rseq_area(); ++ unregister_old_rseq(); + memset((void *)rseq_ptr, 0, rseq_reg_size()); + + test_init(argc, argv); diff --git a/criu.spec b/criu.spec index 8660187..689ebbf 100644 --- a/criu.spec +++ b/criu.spec @@ -13,7 +13,7 @@ Name: criu Version: 4.2 -Release: 20%{?dist} +Release: 21%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -24,6 +24,7 @@ Patch2: 0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch Patch3: 0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch Patch4: 0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch Patch5: 0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch +Patch6: https://patch-diff.githubusercontent.com/raw/checkpoint-restore/criu/pull/3023.patch # Add protobuf-c as a dependency. # We use this patch because the protobuf-c package name @@ -126,6 +127,7 @@ This script can help to workaround the so called "PID mismatch" problem. %patch -P 3 -p1 %patch -P 4 -p1 %patch -P 5 -p1 +%patch -P 6 -p1 %patch -P 99 -p1 %build @@ -214,6 +216,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Mon Jul 06 2026 Adrian Reber - 4.2-21 +- One more test only patch for linux 7.1 + * Wed Jun 03 2026 Python Maint - 4.2-20 - Rebuilt for Python 3.15 diff --git a/rpminspect.yaml b/rpminspect.yaml index 93f2777..70daeea 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,4 @@ --- annocheck: jobs: - - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes --skip-gaps --skip-optimization --skip-stack-clash --skip-stack-prot + - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes --skip-gaps --skip-optimization --skip-stack-clash --skip-stack-prot --skip-branch-protection From fb5ccdffadd069db801638fee1b77aa3c42eafac Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 15 Jul 2026 21:21:16 +0000 Subject: [PATCH 35/37] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 689ebbf..897e63b 100644 --- a/criu.spec +++ b/criu.spec @@ -13,7 +13,7 @@ Name: criu Version: 4.2 -Release: 21%{?dist} +Release: 22%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -216,6 +216,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Jul 15 2026 Fedora Release Engineering - 4.2-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Mon Jul 06 2026 Adrian Reber - 4.2-21 - One more test only patch for linux 7.1 From e38e664a70aa03725aaab4fe3f8219135a287607 Mon Sep 17 00:00:00 2001 From: Radostin Stoyanov Date: Tue, 21 Jul 2026 09:47:12 +0100 Subject: [PATCH 36/37] Update to 4.2.1 Signed-off-by: Radostin Stoyanov --- .gitignore | 1 + ...-kernel-rseq.h-when-glibc-detects-it.patch | 56 ------ 0001-tty-fix-compiler-error.patch | 35 ---- ...tore-through-usernsd-for-userns-mode.patch | 178 ------------------ ...q01-test-for-kernel-7.0-rseq-changes.patch | 163 ---------------- ...t-UDPLITE-as-optional-in-collect_err.patch | 52 ----- ...plite-test-when-kernel-lacks-UDPLITE.patch | 37 ---- 3023.patch | 50 ----- criu.spec | 22 +-- sources | 2 +- 10 files changed, 8 insertions(+), 588 deletions(-) delete mode 100644 0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch delete mode 100644 0001-tty-fix-compiler-error.patch delete mode 100644 0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch delete mode 100644 0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch delete mode 100644 0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch delete mode 100644 0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch delete mode 100644 3023.patch diff --git a/.gitignore b/.gitignore index e5c1b1b..fab44b7 100644 --- a/.gitignore +++ b/.gitignore @@ -60,3 +60,4 @@ /criu-4.1.tar.gz /criu-4.1.1.tar.gz /criu-4.2.tar.gz +/criu-4.2.1.tar.gz diff --git a/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch b/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch deleted file mode 100644 index 0bed5af..0000000 --- a/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 95531dcc36c2453b9242e0de17b8fedb20ce48ca Mon Sep 17 00:00:00 2001 -From: Adrian Reber -Date: Tue, 3 Mar 2026 06:29:53 +0000 -Subject: [PATCH] rseq: use kernel rseq.h when glibc detects it - -Compilation fails with the latest glibc-devel in Fedora rawhide. -Recent glibc conditionally includes the kernel's linux/rseq.h -when __GLIBC_HAVE_KERNEL_RSEQ is defined, but CRIU's own copy -of the rseq definitions does not account for this and conflicts -with the kernel header which has additional information. - -Check if __GLIBC_HAVE_KERNEL_RSEQ is defined and if so include -the kernel header directly using angle brackets (which bypasses --iquote and finds the real kernel header instead of CRIU's -copy). Otherwise fall back to CRIU's own definitions. - -Generated with Claude Code (https://claude.ai/code) - -Signed-off-by: Adrian Reber ---- - criu/include/linux/rseq.h | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/criu/include/linux/rseq.h b/criu/include/linux/rseq.h -index 5ceefbf8e..d7f81e9a2 100644 ---- a/criu/include/linux/rseq.h -+++ b/criu/include/linux/rseq.h -@@ -14,6 +14,16 @@ - - #include "common/config.h" - -+/* -+ * If glibc detected that the kernel rseq.h header exists, include -+ * it directly using angle brackets (which bypasses -iquote and finds -+ * the real kernel header). Otherwise fall back to our own copy of -+ * the definitions. -+ */ -+#ifdef __GLIBC_HAVE_KERNEL_RSEQ -+#include -+#else /* !__GLIBC_HAVE_KERNEL_RSEQ */ -+ - #ifdef CONFIG_HAS_NO_LIBC_RSEQ_DEFS - /* - * linux/rseq.h -@@ -45,6 +55,8 @@ enum rseq_cs_flags { - }; - #endif /* CONFIG_HAS_NO_LIBC_RSEQ_DEFS */ - -+#endif /* !__GLIBC_HAVE_KERNEL_RSEQ */ -+ - /* - * Let's use our own definition of struct rseq_cs because some distros - * (for example Mariner GNU/Linux) declares this structure their-own way. --- -2.51.1 - diff --git a/0001-tty-fix-compiler-error.patch b/0001-tty-fix-compiler-error.patch deleted file mode 100644 index 9b84c02..0000000 --- a/0001-tty-fix-compiler-error.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 90300748effc1cf0fe56e35d3d1cc2ddfedab246 Mon Sep 17 00:00:00 2001 -From: Adrian Reber -Date: Wed, 26 Nov 2025 13:21:07 +0000 -Subject: [PATCH] tty: fix compiler error - -At least on tests running on Fedora rawhide following error could be -seen: - -``` - criu/tty.c: In function 'pts_fd_get_index': - criu/tty.c:262:21: error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] - 262 | char *pos = strrchr(link->name, '/'); - | -``` - -This fixes it. - -Signed-off-by: Adrian Reber ---- - criu/tty.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/criu/tty.c b/criu/tty.c -index ae23094b7b..9a4520d535 100644 ---- a/criu/tty.c -+++ b/criu/tty.c -@@ -259,7 +259,7 @@ static int pts_fd_get_index(int fd, const struct fd_parms *p) - { - int index; - const struct fd_link *link = p->link; -- char *pos = strrchr(link->name, '/'); -+ const char *pos = strrchr(link->name, '/'); - - if (!pos || pos == (link->name + link->len - 1)) { - pr_err("Unexpected format on path %s\n", link->name + 1); diff --git a/0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch b/0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch deleted file mode 100644 index cbedd55..0000000 --- a/0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch +++ /dev/null @@ -1,178 +0,0 @@ -From 7ad6bb97b4e3951fc79cbda51b05e649aea2854a Mon Sep 17 00:00:00 2001 -From: Adrian Reber -Date: Tue, 21 Apr 2026 09:04:51 +0000 -Subject: [PATCH] net: Route veth restore through usernsd for userns mode - -Starting with Linux kernel commit 7b735ef81286 ("rtnetlink: add -missing netlink_ns_capable() check for peer netns"), creating a -veth pair with a peer in a different network namespace requires -CAP_NET_ADMIN in the peer namespace as well: - - rtnetlink: add missing netlink_ns_capable() check for peer netns - - rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer - network namespace when creating paired devices (veth, vxcan, - netkit). This allows an unprivileged user with a user namespace - to create interfaces in arbitrary network namespaces, including - init_net. - - Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer - namespace before allowing device creation to proceed. - -Link: https://github.com/torvalds/linux/commit/7b735ef81286007794a227ce2539419479c02a5f - -When CRIU restores a veth in user namespace mode, it sends the -RTM_NEWLINK request from a netlink socket inside the child user -namespace. The veth peer is placed into the root network namespace -via IFLA_NET_NS_FD, but the child user namespace does not have -CAP_NET_ADMIN in the root namespace, so the new kernel check -rejects the request with EPERM. - -Fix this by routing the veth creation through usernsd when the -peer lives in an external (host) namespace specified via the ---external veth[name] restore option. usernsd runs with real -root privileges in the init user namespace, so it passes the -capability check in both namespaces. - -The usernsd path is only used for external veth mappings, not for -child-to-child namespace veths (has_peer_nsid), because in that -case both namespaces share the same user namespace and already -have CAP_NET_ADMIN in each other. - -The approach mirrors restore_one_macvlan(), which already solves -the same CAP_NET_ADMIN-in-both-namespaces problem for macvlan -devices. A new veth_link_info_userns() builds the RTM_NEWLINK -request without IFLA_NET_NS_FD for the peer -- since usernsd -sends the request from the root network namespace, the peer -naturally stays there. userns_restore_one_link() then adds a -top-level IFLA_NET_NS_FD to move the main device into the child -namespace. - -Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default -Signed-off-by: Adrian Reber ---- - criu/net.c | 104 +++++++++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 104 insertions(+) - -diff --git a/criu/net.c b/criu/net.c -index e5775a3287..e1dc5973fd 100644 ---- a/criu/net.c -+++ b/criu/net.c -@@ -1653,6 +1653,94 @@ static int restore_one_macvlan(struct ns_id *ns, struct net_link *link, int nlsk - return ret; - } - -+/* -+ * Simplified veth_link_info for the usernsd path: builds the veth peer -+ * info without adding IFLA_NET_NS_FD for the peer, since the netlink -+ * request will be sent from usernsd's namespace (the root/peer namespace) -+ * and the peer should remain there. -+ */ -+static int veth_link_info_userns(struct ns_id *ns, struct net_link *link, struct newlink_req *req) -+{ -+ NetDeviceEntry *nde = link->nde; -+ struct rtattr *veth_data, *peer_data; -+ struct ifinfomsg ifm; -+ char key[100], *val; -+ -+ addattr_l(&req->h, sizeof(*req), IFLA_INFO_KIND, "veth", 4); -+ -+ veth_data = NLMSG_TAIL(&req->h); -+ addattr_l(&req->h, sizeof(*req), IFLA_INFO_DATA, NULL, 0); -+ peer_data = NLMSG_TAIL(&req->h); -+ memset(&ifm, 0, sizeof(ifm)); -+ -+ if (nde->has_peer_nsid) -+ ifm.ifi_index = nde->peer_ifindex; -+ addattr_l(&req->h, sizeof(*req), VETH_INFO_PEER, &ifm, sizeof(ifm)); -+ -+ /* Set peer name from external mapping if available */ -+ snprintf(key, sizeof(key), "veth[%s]", nde->name); -+ val = external_lookup_by_key(key); -+ if (!IS_ERR_OR_NULL(val)) { -+ char *aux = strchrnul(val, '@'); -+ -+ addattr_l(&req->h, sizeof(*req), IFLA_IFNAME, val, aux - val); -+ } -+ -+ /* -+ * No IFLA_NET_NS_FD for the peer -- the request is sent from -+ * usernsd's namespace (the root network namespace) and the -+ * peer stays there. userns_restore_one_link() adds a top-level -+ * IFLA_NET_NS_FD to move the main device into the child netns. -+ */ -+ -+ peer_data->rta_len = (char *)NLMSG_TAIL(&req->h) - (char *)peer_data; -+ veth_data->rta_len = (char *)NLMSG_TAIL(&req->h) - (char *)veth_data; -+ -+ link->created = true; -+ -+ return 0; -+} -+ -+/* -+ * When running in user namespaces with a cross-namespace veth peer, -+ * CAP_NET_ADMIN is required in both namespaces for veth creation -+ * (kernel >= 7.0, commit 7b735ef81286). Route the request through -+ * usernsd which runs with real root privileges, similar to -+ * restore_one_macvlan(). -+ * -+ * The netlink request is sent from usernsd's namespace (the root -+ * network namespace), so the veth peer stays there. The main device -+ * is moved to the child namespace via a top-level IFLA_NET_NS_FD -+ * added by userns_restore_one_link(). -+ */ -+static int restore_one_veth_userns(struct ns_id *ns, struct net_link *link) -+{ -+ struct newlink_req req; -+ int my_netns, ret; -+ -+ my_netns = open_proc(PROC_SELF, "ns/net"); -+ if (my_netns < 0) -+ return -1; -+ -+ if (populate_newlink_req(ns, &req, RTM_NEWLINK, link, -+ veth_link_info_userns, NULL) < 0) { -+ close(my_netns); -+ return -1; -+ } -+ -+ pr_info("Restoring netdev %s idx %d via usernsd\n", -+ link->nde->name, link->nde->ifindex); -+ -+ ret = userns_call(userns_restore_one_link, 0, -+ &req, sizeof(req), my_netns); -+ if (ret < 0) -+ pr_err("couldn't restore veth interface %s via usernsd\n", -+ link->nde->name); -+ -+ close(my_netns); -+ return ret; -+} -+ - static int sit_link_info(struct ns_id *ns, struct net_link *link, struct newlink_req *req) - { - NetDeviceEntry *nde = link->nde; -@@ -1762,6 +1850,22 @@ static int __restore_link(struct ns_id *ns, struct net_link *link, int nlsk) - if (!IS_ERR_OR_NULL(val)) - return move_veth(val, ns, link, nlsk); - -+ /* -+ * Creating a veth with a cross-namespace peer requires -+ * CAP_NET_ADMIN in both namespaces (kernel >= 7.0). -+ * In user namespace mode, route through usernsd which -+ * has real root when the peer lives in an external -+ * (host) namespace specified via --external veth[name]. -+ */ -+ if (root_ns_mask & CLONE_NEWUSER) { -+ char vkey[100]; -+ -+ snprintf(vkey, sizeof(vkey), "veth[%s]", nde->name); -+ val = external_lookup_by_key(vkey); -+ if (!IS_ERR_OR_NULL(val)) -+ return restore_one_veth_userns(ns, link); -+ } -+ - return restore_one_link(ns, link, nlsk, veth_link_info, NULL); - case ND_TYPE__TUN: - return restore_one_tun(ns, link, nlsk); diff --git a/0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch b/0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch deleted file mode 100644 index e0ead93..0000000 --- a/0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch +++ /dev/null @@ -1,163 +0,0 @@ -From 14574afd322113630b897f5f7d08a292fb06ce5a Mon Sep 17 00:00:00 2001 -From: Adrian Reber -Date: Tue, 21 Apr 2026 09:30:17 +0000 -Subject: [PATCH] zdtm: Fix rseq01 test for kernel 7.0 rseq changes - -Starting with Linux 7.0, the rseq feature size has grown to 33 bytes -and AT_RSEQ_ALIGN has increased to 64. This causes sizeof(struct rseq) -from the uapi header to be 64 (33 bytes padded to aligned(32)), while -the actual registration size used by glibc (__rseq_size) is 33. - -The rseq01 test was using sizeof(struct rseq) as the registration -size and a test-local __rseq_abi variable (with only 32-byte -alignment from the uapi header) as the rseq area. Both are -wrong on kernel 7.0: - - - The kernel now checks alignment against __alignof__(struct rseq) - which is 64 internally; the 32-byte-aligned test variable may - not satisfy this. - - - sizeof(struct rseq) = 64 does not match the feature size of 33 - that glibc registered with, so re-registration with a different - size fails. - -Fix by: - - - Using __rseq_size (the feature size reported by glibc) as the - registration size instead of sizeof(struct rseq). - - - Using the glibc-provided rseq area (at thread_pointer() + - __rseq_offset) which is allocated with proper AT_RSEQ_ALIGN - alignment, instead of a test-local variable. - -Both fall back to the previous behavior when glibc rseq support -is not available. - -This mirrors the glibc fix: - - https://sourceware.org/cgit/glibc/commit/?id=67f303b47dc584f204e3f2441b9832082415eebc - -Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default -Signed-off-by: Adrian Reber ---- - test/zdtm/transition/rseq01.c | 59 +++++++++++++++++++++++++++++------ - 1 file changed, 50 insertions(+), 9 deletions(-) - -diff --git a/test/zdtm/transition/rseq01.c b/test/zdtm/transition/rseq01.c -index 08a7a8e1a6..9c5925bc45 100644 ---- a/test/zdtm/transition/rseq01.c -+++ b/test/zdtm/transition/rseq01.c -@@ -20,9 +20,19 @@ - #endif - #endif - -+/* -+ * HAVE_GLIBC_RSEQ is set when the C library provides rseq support -+ * (__rseq_size, __rseq_offset). glibc >= 2.35 defines RSEQ_SIG in -+ * ; musl does not, so the test falls back to its own -+ * definitions below. -+ */ -+#if defined(RSEQ_SIG) -+#define HAVE_GLIBC_RSEQ 1 -+#endif -+ - #if defined(__x86_64__) - --#if defined(__x86_64__) && defined(RSEQ_SIG) -+#ifdef HAVE_GLIBC_RSEQ - static inline void *thread_pointer(void) - { - void *result; -@@ -38,11 +48,11 @@ static inline void unregister_old_rseq(void) - size = 32; - syscall(__NR_rseq, (void *)((char *)thread_pointer() + __rseq_offset), size, 1, RSEQ_SIG); - } --#else -+#else /* !HAVE_GLIBC_RSEQ */ - static inline void unregister_old_rseq(void) - { - } --#endif -+#endif /* HAVE_GLIBC_RSEQ */ - - const char *test_doc = "rseq() transition test"; - const char *test_author = "Alexander Mikhalitsyn "; -@@ -97,11 +107,27 @@ static int sys_rseq(volatile struct rseq *rseq_abi, uint32_t rseq_len, int flags - return syscall(__NR_rseq, rseq_abi, rseq_len, flags, sig); - } - -+/* -+ * Return the rseq registration size. Starting with Linux 7.0, -+ * AT_RSEQ_ALIGN is 64 but the feature size is 33, so sizeof(struct rseq) -+ * (padded to alignment) no longer matches the registration size the kernel -+ * expects. Use __rseq_size when available, clamped to a minimum of 32 -+ * for older kernels (mirroring glibc's rseq-internal.h). -+ */ -+static uint32_t rseq_reg_size(void) -+{ -+#ifdef HAVE_GLIBC_RSEQ -+ if (__rseq_size) -+ return (__rseq_size < 32) ? 32 : __rseq_size; -+#endif -+ return sizeof(struct rseq); -+} -+ - static void register_thread(void) - { - int rc; - unregister_old_rseq(); -- rc = sys_rseq(rseq_ptr, sizeof(struct rseq), 0, RSEQ_SIG); -+ rc = sys_rseq(rseq_ptr, rseq_reg_size(), 0, RSEQ_SIG); - if (rc) { - fail("Failed to register rseq"); - exit(1); -@@ -111,7 +137,7 @@ static void register_thread(void) - static void check_thread(void) - { - int rc; -- rc = sys_rseq(rseq_ptr, sizeof(struct rseq), 0, RSEQ_SIG); -+ rc = sys_rseq(rseq_ptr, rseq_reg_size(), 0, RSEQ_SIG); - if (!(rc && errno == EBUSY)) { - fail("Failed to check rseq %d", rc); - exit(1); -@@ -206,12 +232,27 @@ static intptr_t *cpu_data; - bool ignore_abort = true; - int thread_ret; - -+static volatile struct rseq *rseq_area(void) -+{ -+#ifdef HAVE_GLIBC_RSEQ -+ /* -+ * Use the glibc-provided rseq area which is allocated with the -+ * correct alignment (AT_RSEQ_ALIGN, 64 on kernel >= 7.0). -+ * The test-local __rseq_abi only has the uapi header alignment -+ * (32 bytes) which may not satisfy the kernel's requirement. -+ */ -+ if (__rseq_size) -+ return (volatile struct rseq *)((char *)thread_pointer() + __rseq_offset); -+#endif -+ return &__rseq_abi; -+} -+ - void *thread_routine(void *args) - { - int cpu; - -- rseq_ptr = &__rseq_abi; -- memset((void *)rseq_ptr, 0, sizeof(struct rseq)); -+ rseq_ptr = rseq_area(); -+ memset((void *)rseq_ptr, 0, rseq_reg_size()); - register_thread(); - task_waiter_complete(&waiter, 1); - task_waiter_wait4(&waiter, 2); -@@ -235,8 +276,8 @@ int main(int argc, char *argv[]) - long nr_cpus; - pthread_t thread; - -- rseq_ptr = &__rseq_abi; -- memset((void *)rseq_ptr, 0, sizeof(struct rseq)); -+ rseq_ptr = rseq_area(); -+ memset((void *)rseq_ptr, 0, rseq_reg_size()); - - test_init(argc, argv); - nr_cpus = sysconf(_SC_NPROCESSORS_ONLN); diff --git a/0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch b/0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch deleted file mode 100644 index 1cd8f12..0000000 --- a/0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 1cf8d3b21c64f0ef3310301019136433fc9f6392 Mon Sep 17 00:00:00 2001 -From: Adrian Reber -Date: Mon, 20 Apr 2026 19:19:42 +0000 -Subject: [PATCH] sockets: Treat UDPLITE as optional in collect_err() - -Kernel 7.1 removed IPPROTO_UDPLITE support. When the UDPLITE diag -module is absent, the netlink request returns -ENOENT, which CRIU -was treating as a fatal error causing the entire dump to fail. - -Apply the same treatment as IPPROTO_RAW: return success from the -error callback so the dump can proceed. If a UDPLITE socket is -actually encountered, it will fail at lookup time with a clear -error rather than failing the entire dump preemptively. - -Fixes: https://github.com/checkpoint-restore/criu/issues/3002 - -Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default -Signed-off-by: Adrian Reber ---- - criu/sockets.c | 14 +++++++++----- - 1 file changed, 9 insertions(+), 5 deletions(-) - -diff --git a/criu/sockets.c b/criu/sockets.c -index e4adae03cd..7778b46881 100644 ---- a/criu/sockets.c -+++ b/criu/sockets.c -@@ -827,16 +827,20 @@ static int collect_err(int err, struct ns_id *ns, void *arg) - if (err == -ENOENT) { - pr_debug("%s: %d\n", msg, err); - /* -- * Unlike other modules RAW sockets are -- * always optional and not commonly used. -+ * Unlike other modules RAW and UDPLITE sockets -+ * are always optional and not commonly used. - * Currently we warn user about lack of - * a particular module support in "check" - * procedure. Thus don't fail on lack of -- * RAW diags in a regular dump. If we meet -- * a raw socket we will simply fail on dump -+ * these diags in a regular dump. If we meet -+ * such a socket we will simply fail on dump - * procedure because it won't be resolved. -+ * -+ * Note: IPPROTO_UDPLITE support was removed -+ * from the kernel starting with v7.1. - */ -- if (gr->protocol == IPPROTO_RAW) -+ if (gr->protocol == IPPROTO_RAW || -+ gr->protocol == IPPROTO_UDPLITE) - return 0; - return -ENOENT; - } diff --git a/0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch b/0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch deleted file mode 100644 index 5d9d5d5..0000000 --- a/0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 23905c26b86afdc01bcfa85ae0a3aab015fc81f1 Mon Sep 17 00:00:00 2001 -From: Adrian Reber -Date: Tue, 21 Apr 2026 07:58:00 +0000 -Subject: [PATCH] zdtm: Skip socket_udplite test when kernel lacks UDPLITE - -Kernel 7.1 removed IPPROTO_UDPLITE support. Add a checkskip -script that probes for a UDPLITE socket and skips the test -with EPROTONOSUPPORT instead of failing. - -Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default -Signed-off-by: Adrian Reber ---- - test/zdtm/static/socket_udplite.checkskip | 15 +++++++++++++++ - 1 file changed, 15 insertions(+) - create mode 100755 test/zdtm/static/socket_udplite.checkskip - -diff --git a/test/zdtm/static/socket_udplite.checkskip b/test/zdtm/static/socket_udplite.checkskip -new file mode 100755 -index 0000000000..a562550843 ---- /dev/null -+++ b/test/zdtm/static/socket_udplite.checkskip -@@ -0,0 +1,15 @@ -+#!/usr/bin/env python3 -+# IPPROTO_UDPLITE was removed in kernel 7.1, skip the test if the -+# protocol is not available. -+import socket -+import errno -+ -+try: -+ socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDPLITE).close() -+except OSError as e: -+ if e.errno == errno.EPROTONOSUPPORT: -+ print("UDPLITE is not supported by this kernel.") -+ exit(1) -+ raise -+ -+exit(0) diff --git a/3023.patch b/3023.patch deleted file mode 100644 index 8b7c0bc..0000000 --- a/3023.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 51660aba34b41c08d892bda6528abe992a5687e7 Mon Sep 17 00:00:00 2001 -From: Adrian Reber -Date: Tue, 19 May 2026 17:11:35 +0000 -Subject: [PATCH] zdtm: unregister rseq before zeroing the rseq area - -Starting with Linux 7.1, the kernel enforces strict read-only field -protection for the rseq V2 ABI. Userspace is no longer allowed to -modify kernel-managed fields (cpu_id_start, cpu_id, node_id, mm_cid) -while rseq is registered. Violations are detected on the next context -switch and the offending process is killed with SIGSEGV. - -The rseq01 test was zeroing the entire glibc-registered rseq area -with memset() before calling test_init(), which internally calls -fork(). This corrupted the read-only fields while the glibc rseq -registration was still active, causing the kernel to send SIGSEGV -during the fork. - -Fix this by calling unregister_old_rseq() before the memset in both -main() and thread_routine(), so the kernel is no longer monitoring -those fields when they are zeroed. The subsequent register_thread() -call re-registers rseq with the clean area. - -Link: https://github.com/torvalds/linux/commit/7f0023215262221ca08d56be2203e8a4770be033 - -Assisted-by: Claude Code (https://claude.ai/code):claude-opus-4-6 -Signed-off-by: Adrian Reber ---- - test/zdtm/transition/rseq01.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/test/zdtm/transition/rseq01.c b/test/zdtm/transition/rseq01.c -index 9c5925bc45..0d5485e162 100644 ---- a/test/zdtm/transition/rseq01.c -+++ b/test/zdtm/transition/rseq01.c -@@ -252,6 +252,7 @@ void *thread_routine(void *args) - int cpu; - - rseq_ptr = rseq_area(); -+ unregister_old_rseq(); - memset((void *)rseq_ptr, 0, rseq_reg_size()); - register_thread(); - task_waiter_complete(&waiter, 1); -@@ -277,6 +278,7 @@ int main(int argc, char *argv[]) - pthread_t thread; - - rseq_ptr = rseq_area(); -+ unregister_old_rseq(); - memset((void *)rseq_ptr, 0, rseq_reg_size()); - - test_init(argc, argv); diff --git a/criu.spec b/criu.spec index 897e63b..06102ba 100644 --- a/criu.spec +++ b/criu.spec @@ -12,19 +12,12 @@ %undefine _annotated_build Name: criu -Version: 4.2 -Release: 22%{?dist} +Version: 4.2.1 +Release: 1%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{version}.tar.gz -Patch0: 0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch -Patch1: 0001-tty-fix-compiler-error.patch -Patch2: 0002-net-Route-veth-restore-through-usernsd-for-userns-mode.patch -Patch3: 0003-zdtm-Fix-rseq01-test-for-kernel-7.0-rseq-changes.patch -Patch4: 0004-sockets-Treat-UDPLITE-as-optional-in-collect_err.patch -Patch5: 0005-zdtm-Skip-socket_udplite-test-when-kernel-lacks-UDPLITE.patch -Patch6: https://patch-diff.githubusercontent.com/raw/checkpoint-restore/criu/pull/3023.patch # Add protobuf-c as a dependency. # We use this patch because the protobuf-c package name @@ -121,13 +114,6 @@ This script can help to workaround the so called "PID mismatch" problem. %prep %setup -q -%patch -P 0 -p1 -%patch -P 1 -p1 -%patch -P 2 -p1 -%patch -P 3 -p1 -%patch -P 4 -p1 -%patch -P 5 -p1 -%patch -P 6 -p1 %patch -P 99 -p1 %build @@ -216,6 +202,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Tue Jul 21 2026 Radostin Stoyanov - 4.2.1-1 +- Update to 4.2.1 +- Drop patches merged upstream + * Wed Jul 15 2026 Fedora Release Engineering - 4.2-22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild diff --git a/sources b/sources index 8f69f50..0744768 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (criu-4.2.tar.gz) = f7e0ac17d46dd560bb2439f617a0a3b3933eb86f4b8b9b16852d300e4ffc6a4851d72be9342dfd40792a53fca8b65d26fde4e1b1f02bcd04923a8b6f0e5c8a62 +SHA512 (criu-4.2.1.tar.gz) = 73a4f5d9e6af2d07c0b234201cce09a827dcb1dcb1b1095cb3944a0a37dd34f4d5ef3ce34e12568c38dff2b517809e64aff55be605e934d2ab39daa659ca9a97 From 7602c68e46300a30225be27e5b94905c28bb79e0 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 22 Jul 2026 11:12:29 +0200 Subject: [PATCH 37/37] Rebuilt for Python 3.15.0b4 ABI change --- criu.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/criu.spec b/criu.spec index 06102ba..7102dfa 100644 --- a/criu.spec +++ b/criu.spec @@ -13,7 +13,7 @@ Name: criu Version: 4.2.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Tool for Checkpoint/Restore in User-space License: GPL-2.0-only AND LGPL-2.1-only AND MIT URL: http://criu.org/ @@ -202,6 +202,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a %tmpfiles_create %{name}.conf %changelog +* Wed Jul 22 2026 Python Maint - 4.2.1-2 +- Rebuilt for Python 3.15.0b4 ABI change + * Tue Jul 21 2026 Radostin Stoyanov - 4.2.1-1 - Update to 4.2.1 - Drop patches merged upstream