From f22c95d2d9ff38272c0950382ee53be427ff8408 Mon Sep 17 00:00:00 2001 From: Efim Verzakov Date: Fri, 20 Feb 2026 14:10:01 +0000 Subject: [PATCH] restore: move cgroup restore after creds are prepared prepare_cgroup_namespace() can call userns_call() to move the task into a cgroup. userns_call() uses sendmsg() with SCM_CREDENTIALS to communicate with usernsd. If the user namespace maps are configured such that the parent's UID (typically 0) is not mapped to the same UID in the child namespace (i.e., lower_first != 0), the getuid() syscall in the child will return the overflow UID (65534) until the child's credentials are explicitly set within the namespace. When sendmsg() is called with SCM_CREDENTIALS containing the overflow UID, the kernel's __scm_send function returns -EINVAL, causing the restore to fail. [avagin: tweaked the commit message] Signed-off-by: Efim Verzakov Signed-off-by: Andrei Vagin --- criu/cr-restore.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/criu/cr-restore.c b/criu/cr-restore.c index f0acb4d7c..e622425d6 100644 --- a/criu/cr-restore.c +++ b/criu/cr-restore.c @@ -1572,7 +1572,12 @@ static int __restore_task_with_children(void *_arg) /* Wait prepare_userns */ if (restore_finish_ns_stage(CR_STATE_ROOT_TASK, CR_STATE_PREPARE_NAMESPACES) < 0) goto err; + } + if (needs_prep_creds(current) && (prepare_userns_creds())) + goto err; + + if (current->parent == NULL) { /* * Since we don't support nesting of cgroup namespaces, let's * only set up the cgns (if it exists) in the init task. @@ -1581,9 +1586,6 @@ static int __restore_task_with_children(void *_arg) goto err; } - if (needs_prep_creds(current) && (prepare_userns_creds())) - goto err; - /* * Call this _before_ forking to optimize cgroups * restore -- if all tasks live in one set of cgroups