From cbba3875717ae78322966cce6cf62966352862d0 Mon Sep 17 00:00:00 2001
From: Nayana Bidari <nybidari@google.com>
Date: Fri, 8 Nov 2024 10:46:41 -0800
Subject: [PATCH] Fix mount source validation.

PiperOrigin-RevId: 694560314
---
 runsc/boot/restore.go             |  6 +++---
 runsc/container/container_test.go | 11 +++++++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/runsc/boot/restore.go b/runsc/boot/restore.go
index b90178cec..4846bcc6a 100644
--- a/runsc/boot/restore.go
+++ b/runsc/boot/restore.go
@@ -256,15 +256,15 @@ func extractAnnotationsToValidate(o map[string]string) map[string]string {
 	const (
 		gvisorPrefix   = "dev.gvisor."
 		internalPrefix = "dev.gvisor.internal."
-
-		mntSrcAnnotation = "dev.gvisor.spec.mount.source"
+		mntPrefix      = "dev.gvisor.spec.mount."
 	)
 
 	n := make(map[string]string)
 	for key, val := range o {
-		if strings.HasPrefix(key, internalPrefix) || key == mntSrcAnnotation {
+		if strings.HasPrefix(key, internalPrefix) || (strings.HasPrefix(key, mntPrefix) && strings.HasSuffix(key, ".source")) {
 			continue
 		}
+
 		if strings.HasPrefix(key, gvisorPrefix) {
 			n[key] = val
 		}
diff --git a/runsc/container/container_test.go b/runsc/container/container_test.go
index bbba6ac1f..f634134fc 100644
--- a/runsc/container/container_test.go
+++ b/runsc/container/container_test.go
@@ -3793,6 +3793,17 @@ func TestSpecValidation(t *testing.T) {
 			},
 			wantErr: "Mounts does not match across checkpoint restore",
 		},
+		{
+			name: "AnnotationsMountsSuccess",
+			mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {
+				spec.Annotations = make(map[string]string)
+				spec.Annotations["dev.gvisor.spec.mount.mnt1.source"] = "path1"
+
+				restoreSpec.Annotations = make(map[string]string)
+				restoreSpec.Annotations["dev.gvisor.spec.mount.mnt2.source"] = "path2"
+			},
+			wantErr: "",
+		},
 		{
 			name: "AnnotationsFail",
 			mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {