From cff99dbcc2ea3e54574bc2812d8b14abe2d17c94 Mon Sep 17 00:00:00 2001 From: 3idey Date: Tue, 10 Feb 2026 13:52:25 +0200 Subject: [PATCH] fsnotify: Fix mnt_id type to avoid undefined behavior with -1 sentinel mnt_id was declared as uint32_t but assigned -1 when absent, which yields UINT32_MAX. When passed to mntns_get_root_by_mnt_id(int), the conversion from UINT32_MAX to int is implementation-defined and can become a large positive value, potentially causing lookup_nsid_by_mnt_id() to return NULL and trigger BUG_ON(). Change mnt_id to int with an explicit cast from f_handle->mnt_id when present, so the sentinel -1 is preserved reliably across platforms. Signed-off-by: 3idey --- criu/fsnotify.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/criu/fsnotify.c b/criu/fsnotify.c index 8e4c4faf9..eb80dd961 100644 --- a/criu/fsnotify.c +++ b/criu/fsnotify.c @@ -529,12 +529,12 @@ static char *get_mark_path(const char *who, struct file_remap *remap, FhEntry *f } else if (f_handle->path) { int mntns_root; char *fpath = "."; - uint32_t mnt_id = f_handle->has_mnt_id ? f_handle->mnt_id : -1; + int mnt_id = f_handle->has_mnt_id ? (int)f_handle->mnt_id : -1; /* irmap cache is collected in the root namespaces. */ mntns_root = mntns_get_root_by_mnt_id(mnt_id); if (mntns_root < 0) { - pr_err("Failed to get mount namespace root for path hint (mnt_id %#x path %s)\n", + pr_err("Failed to get mount namespace root for path hint (mnt_id %d path %s)\n", mnt_id, f_handle->path); goto err; }