Memcr corrupted execution flow

[adrianM27]

Observed for version last commit dfeaa80

Memcr execution flow gets corrupted and jumps to not enabled code parts and exits:

2025-06-02T01:29:18.850Z memcr[3892]: [+] got MEMCR_CHECKPOINT for 15959.
2025-06-02T01:29:18.850Z memcr[3892]: [+] Checkpoint request scheduled...
2025-06-02T01:29:18.851Z memcr[3892]: [+] handling MEMCR_CHECKPOINT for 15959.
2025-06-02T01:29:18.851Z memcr[3892]: [+] Service waiting for worker checkpoint with timeout 20[s]...
2025-06-02T01:29:18.858Z memcr[3892]: [16215] memcr worker is started to checkpoint 15959.
2025-06-02T01:29:18.859Z memcr[3892]: [+] seizing target pid 15959
2025-06-02T01:29:18.859Z memcr[3892]: [i] 1 thread
2025-06-02T01:29:18.859Z memcr[3892]: [+] blocking signals
2025-06-02T01:29:18.859Z memcr[3892]: [+] restore crc:
2025-06-02T01:29:18.864Z memcr[3892]: [-] dump checksum do not match!
2025-06-02T01:29:18.864Z memcr[3892]: [16215] Restore failed! Killing the target app...

//DobbyInit terminated - pending signal is 5 sent by memcr to seize the pid
2025-06-02T01:29:18.865Z audit[15959]: ANOM_ABEND auid=4294967295 uid=30004 gid=30000 ses=4294967295 subj=dobby_default (enforce) pid=15959 comm="DobbyInit" exe="/usr/libexec/DobbyInit" sig=5 res=1

// memcr restarted
2025-06-02T01:29:19.438Z memcr[16388]: [x] Trying to configure UNIX /tmp/memcrcom socket.
2025-06-02T01:29:19.454Z memcr[16388]: [x] Waiting for a checkpoint command on a socket

Memcr runs in service mode, checksum and encryption is not enabled, compression LZ4 is enabled

memcr -d -N -l /tmp/memcrcom -f -z -t 20

Issue observed only for DobbyInit process and repeats several times in a row with the same log flow. Memcr restart helped to recover only single time. System reboot seems to recover

[adrianM27]

Following logs, corruption happens somether here:

memcr/memcr.c

Lines 2184 to 2208 in dfeaa80

	ret = execute_blob(&ctx, mmap_blob, mmap_blob_size, sizeof(parasite_blob), 0);
	if (ret >= -4096LU) {
	fprintf(stdout, "[-] mmap failed: %lx\n", ret);
	signals_unblock(pid);
	ctx_restore(pid);
	return -1;
	}
	/* copy parasite_blob into the mmapped area */
	ctx.blob = (void *)ret;
	poke(pid, ctx.blob, (unsigned long *)parasite_blob, sizeof(parasite_blob));
	setup_parasite_args(pid, ctx.blob);
	/* clone parasite which will trap and wait for instruction */
	ret = execute_blob(&ctx, clone_blob, clone_blob_size, (unsigned long)ctx.blob, 0);
	assert(ret > 0);
	parasite_pid_clone = ret;
	/* translate lxc ns pid to global one */
	iterate_pstree(pid, 0, MAX_THREADS, update_parasite_pid);
	parasite_watch_start(parasite_pid);
	ret = cmd_checkpoint(pid);

[adrianM27]

That DobbyInit process is tiny, here is a succesful checkpoint example:

2025-06-02T00:41:38.551Z memcr[3892]: [+] got MEMCR_CHECKPOINT for 15959.
2025-06-02T00:41:38.551Z memcr[3892]: [+] Checkpoint request scheduled...
2025-06-02T00:41:38.551Z memcr[3892]: [+] handling MEMCR_CHECKPOINT for 15959.
2025-06-02T00:41:38.551Z memcr[3892]: [+] Service waiting for worker checkpoint with timeout 20[s]...
2025-06-02T00:41:38.551Z memcr[3892]: [15729] memcr worker is started to checkpoint 15959.
2025-06-02T00:41:38.559Z memcr[3892]: [+] seizing target pid 15959
2025-06-02T00:41:38.559Z memcr[3892]: [i] 1 thread
2025-06-02T00:41:38.559Z memcr[3892]: [+] blocking signals
2025-06-02T00:41:38.586Z memcr[3892]: [i] parasite pid 15730 (namespace pid 17403)
2025-06-02T00:41:38.587Z memcr[3892]: [+] watching parasite 15730
2025-06-02T00:41:38.587Z memcr[3892]: [i] 36 candidate VMAs, VSS 3068 kB, RSS 84 kB
2025-06-02T00:41:38.587Z memcr[3892]: [+] mprotect off
2025-06-02T00:41:38.587Z memcr[3892]: [+] downloading pages
2025-06-02T00:41:38.590Z memcr[3892]: [i] 00024000..00045000 heap 12 kB
2025-06-02T00:41:38.592Z memcr[3892]: [i] f77bb000..f77bd000 anon 8 kB
2025-06-02T00:41:38.595Z memcr[3892]: [i] f78e7000..f78e9000 anon 8 kB
2025-06-02T00:41:38.596Z memcr[3892]: [i] f790b000..f790d000 anon 4 kB
2025-06-02T00:41:38.597Z memcr[3892]: [i] f7940000..f7944000 anon 16 kB
2025-06-02T00:41:38.597Z memcr[3892]: [i] fffc3000..fffe4000 stck 8 kB
2025-06-02T00:41:38.597Z memcr[3892]: [i] download took 10 ms
2025-06-02T00:41:38.597Z memcr[3892]: [i] stored at /******/pages-15959.img
2025-06-02T00:41:38.597Z memcr[3892]: [i] vm stats
2025-06-02T00:41:38.597Z memcr[3892]: [i] VmRSS 84 kB -> 28 kB (diff 56 kB)
2025-06-02T00:41:38.597Z memcr[3892]: [i] RssAnon 84 kB -> 28 kB (diff 56 kB)
2025-06-02T00:41:38.597Z memcr[3892]: [i] RssFile 0 kB -> 0 kB (diff 0 kB)
2025-06-02T00:41:38.597Z memcr[3892]: [i] RssShmem 0 kB
2025-06-02T00:41:38.598Z memcr[3892]: [15729] Sending OK response.
2025-06-02T00:41:38.598Z memcr[3892]: [15729] Waiting for restore command...
2025-06-02T00:41:38.598Z memcr[3892]: [+] Service received checkpoint response, informing client...
2025-06-02T00:41:38.598Z memcr[3892]: [+] cmd handled for 15959.
...
...
2025-06-02T00:41:59.273Z memcr[3892]: [+] got MEMCR_RESTORE for 15959.
2025-06-02T00:41:59.273Z memcr[3892]: [+] Nothing to abort
2025-06-02T00:41:59.274Z memcr[3892]: [+] Restore request scheduled...
2025-06-02T00:41:59.274Z memcr[3892]: [+] handling MEMCR_RESTORE for 15959.
2025-06-02T00:41:59.274Z memcr[3892]: [+] Service waiting for worker to restore with timeout 20[s]...
2025-06-02T00:41:59.274Z memcr[3892]: [15729] Worker received RESTORE command for 15959.
2025-06-02T00:41:59.274Z memcr[3892]: [+] uploading pages
2025-06-02T00:41:59.275Z memcr[3892]: [i] upload took 1 ms
2025-06-02T00:41:59.275Z memcr[3892]: [+] mprotect on
2025-06-02T00:41:59.279Z memcr[3892]: [+] unblocking signals
2025-06-02T00:41:59.279Z memcr[3892]: [+] unseizing target
2025-06-02T00:41:59.279Z memcr[3892]: [15729] Sending OK response.

[Poopi]

Adrian, please check with the last version.In addition please provide a test code snippet for further analysis.