From 55afaa25d2d7827cd51841a5cc2f09981544b894 Mon Sep 17 00:00:00 2001 From: ningmingxiao Date: Wed, 15 Jul 2026 10:28:19 +0800 Subject: [PATCH] adaptation: avoid holding lock across runtime update callback updateContainers currently holds the Adaptation mutex while calling the runtime-provided updateFn. containerd's updateFn acquires its local NRI mutex, while CRI lifecycle paths acquire the same locks in the opposite order: lifecycle: local mutex -> Adaptation mutex update: Adaptation mutex -> local mutex Concurrent lifecycle and plugin-initiated update requests can therefore deadlock. updateContainers does not access mutable Adaptation state. Invoke updateFn without holding the Adaptation mutex and leave synchronization of runtime-owned state to the runtime. Fixes https://github.com/containerd/containerd/issues/13733 Signed-off-by: ningmingxiao --- pkg/adaptation/adaptation.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/pkg/adaptation/adaptation.go b/pkg/adaptation/adaptation.go index bf0ca88a..fd3707c5 100644 --- a/pkg/adaptation/adaptation.go +++ b/pkg/adaptation/adaptation.go @@ -479,9 +479,6 @@ func (r *Adaptation) RemoveContainer(ctx context.Context, req *RemoveContainerRe // Perform a set of unsolicited container updates requested by a plugin. func (r *Adaptation) updateContainers(ctx context.Context, req []*ContainerUpdate) ([]*ContainerUpdate, error) { - r.Lock() - defer r.Unlock() - return r.updateFn(ctx, req) }