From 3749bdab6512ad78b1ae669d3ed45966fba159df Mon Sep 17 00:00:00 2001 From: Lucas Manning Date: Tue, 9 Jan 2024 14:28:47 -0800 Subject: [PATCH] Check for nil task before attempting to return a mount namespace. If we try to mount something with an empty set of tasks grabbing the mount namespace panics. PiperOrigin-RevId: 597045687 --- pkg/sentry/kernel/kernel.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go index 13ddf5116..38c2ab45a 100644 --- a/pkg/sentry/kernel/kernel.go +++ b/pkg/sentry/kernel/kernel.go @@ -1631,13 +1631,13 @@ func (ctx *supervisorContext) Value(key any) any { // The supervisor context is global root. return auth.NewRootCredentials(ctx.Kernel.rootUserNamespace) case vfs.CtxRoot: - if ctx.Kernel.globalInit == nil { + if ctx.Kernel.globalInit == nil || ctx.Kernel.globalInit.Leader() == nil { return vfs.VirtualDentry{} } root := ctx.Kernel.GlobalInit().Leader().MountNamespace().Root(ctx) return root case vfs.CtxMountNamespace: - if ctx.Kernel.globalInit == nil { + if ctx.Kernel.globalInit == nil || ctx.Kernel.globalInit.Leader() == nil { return nil } mntns := ctx.Kernel.GlobalInit().Leader().MountNamespace()