criu core dump when checkpointing a normal user vnc application.

[coldbloodx]

Description

Steps to reproduce the issue:

1. follow https://criu.org/VNC create vncserver.sh like below:

[root@laworks criutool]# cat vncserver.sh
#!/bin/bash
set -m
Xvnc :25 -v -geometry 1440x900 -interface 0.0.0.0 -SecurityTypes none &
pid=$!
trap "kill $pid; wait" EXIT
sleep 3
DISPLAY=:25 $@

2. run an xclock like below:

[leo@laworks 4cpu]$ unshare -c -i ./vncserver.sh xclock
_XSERVTransmkdir: Owner of /tmp/.X11-unix should be set to root

Xvnc TigerVNC 1.13.1 - built Apr 22 2024 00:00:00
Copyright (C) 1999-2022 TigerVNC Team and many others (see README.rst)
See https://www.tigervnc.org for information on TigerVNC.
Underlying X server release 12011000


Thu Sep 19 14:25:44 2024
 vncext:      VNC extension running!
 vncext:      Listening for VNC connections on 0.0.0.0 interface(s), port 5925
 vncext:      created VNC server for screen 0

3. run criu dump pgrep vncserver.sh, then coredump happens

[root@laworks criutool]# criu dump -t 3781956 -D temp -j
Error (criu/namespaces.c:931): Unable to convert uid or gid
Error (criu/namespaces.c:997): One or more namespaces doesn't belong to the target user namespace
munmap_chunk(): invalid pointer
Aborted (core dumped)

4. check system log, found below core dump info:

Sep 19 14:29:00 laworks systemd[1]: Started Process Core Dump (PID 3782082/UID 0).
Sep 19 14:29:00 laworks systemd-coredump[3782083]: [🡕] Process 3782079 (criu) of user 0 dumped core.

                                                   Stack trace of thread 3782079:
                                                   #0  0x00007fb4ee08b94c __pthread_kill_implementation (libc.so.6 + 0x8b94c)
                                                   #1  0x00007fb4ee03e646 raise (libc.so.6 + 0x3e646)
                                                   #2  0x00007fb4ee0287f3 abort (libc.so.6 + 0x287f3)
                                                   #3  0x00007fb4ee029130 __libc_message.cold (libc.so.6 + 0x29130)
                                                   #4  0x00007fb4ee0959f7 malloc_printerr (libc.so.6 + 0x959f7)
                                                   #5  0x00007fb4ee095c8c munmap_chunk (libc.so.6 + 0x95c8c)
                                                   #6  0x00007fb4ee099d7a free (libc.so.6 + 0x99d7a)
                                                   #7  0x0000000000484397 free_userns_maps (criu + 0x84397)
                                                   #8  0x000000000044f55c cr_dump_tasks (criu + 0x4f55c)
                                                   #9  0x0000000000429985 main (criu + 0x29985)
                                                   #10 0x00007fb4ee029590 __libc_start_call_main (libc.so.6 + 0x29590)
                                                   #11 0x00007fb4ee029640 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29640)
                                                   #12 0x0000000000429ac5 _start (criu + 0x29ac5)
                                                   ELF object binary architecture: AMD x86-64

5. in /var/lib/systemd/coredump/ found a coredump file, uploaded as attachment.

[root@laworks criutool]# ll /var/lib/systemd/coredump/
total 168
-rw-r----- 1 root root 169996 Sep 19 14:29 core.criu.0.9f266cde1c6846b7ae0556ac80433149.3782079.1726727340000000.zst

Describe the results you received:
criu core dump...

Describe the results you expected:
criu could dump vncserver.sh process tree successfully.

Additional information you deem important (e.g. issue happens only occasionally):
core dump file.
core.criu.0.9f266cde1c6846b7ae0556ac80433149.3782079.1726727340000000.zip

CRIU logs and information:

CRIU full dump/restore logs:

(00.001862) net: Lock network
(00.001879) id_map: 1011 1011 1
(00.001890) id_map: 1077 1077 1
(00.002091) Error (criu/namespaces.c:931): Unable to convert uid or gid
(00.002663) Error (criu/namespaces.c:997): One or more namespaces doesn't belong to the target user namespace
(00.002688) net: Unlock network
(00.002699) Unfreezing tasks into 1
(00.002702)     Unseizing 3781956 into 1
(00.002709)     Unseizing 3781957 into 1
(00.002717)     Unseizing 3781960 into 1
free(): invalid pointer

Output of `criu --version`:

[root@laworks criutool]# criu  --version
Version: 3.19

Output of `criu check --all`:

[root@laworks criutool]# criu check --all
Warn  (criu/cr-check.c:1346): Nftables based locking requires libnftables and set concatenations support
Looks good but some kernel features are missing
which, depending on your process tree, may cause
dump or restore failure.

Additional environment details:

[github-actions]

A friendly reminder that this issue had no activity for 30 days.