linux-kernel - [PATCH] KVM: Move VM's worker kthreads back to the original cgroups before exiting.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20211214050708.4040200-1-vipinsh@google.com>
Date:   Tue, 14 Dec 2021 05:07:08 +0000
From:   Vipin Sharma <vipinsh@...gle.com>
To:     pbonzini@...hat.com, seanjc@...gle.com
Cc:     dmatlack@...gle.com, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Vipin Sharma <vipinsh@...gle.com>
Subject: [PATCH] KVM: Move VM's worker kthreads back to the original cgroups
 before exiting.

VM worker kthreads can linger in the VM process's cgroup for sometime
after KVM temrinates the VM process.

KVM terminates the worker kthreads by calling kthread_stop() which waits
on the signal generated by exit_mm() in do_exit() during kthread's exit.
However, these kthreads are removed from the cgroup using cgroup_exit()
call which happens after exit_mm() in do_exit(). A VM process can
terminate between the time window of exit_mm() to cgroup_exit(), leaving
only worker kthreads in the cgroup.

Moving worker kthreads back to the original cgroup (kthreadd_task's
cgroup) makes sure that cgroup is empty as soon as the main VM process
is terminated.

Signed-off-by: Vipin Sharma <vipinsh@...gle.com>
---
 virt/kvm/kvm_main.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index b0f7e6eb00ff..edd304a18f16 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -5785,7 +5785,7 @@ static int kvm_vm_worker_thread(void *context)
 	init_context = NULL;
 
 	if (err)
-		return err;
+		goto out;
 
 	/* Wait to be woken up by the spawner before proceeding. */
 	kthread_parkme();
@@ -5793,6 +5793,15 @@ static int kvm_vm_worker_thread(void *context)
 	if (!kthread_should_stop())
 		err = thread_fn(kvm, data);
 
+out:
+	/*
+	 * We need to move the kthread back to its original cgroups, so that it
+	 * doesn't linger in the cgroups of the user process after that has
+	 * already terminated. exit_mm() in do_exit() signals kthread_stop() to
+	 * return, whereas, removal of the task from the cgroups happens in
+	 * cgroup_exit() which happens after exit_mm().
+	 */
+	WARN_ON(cgroup_attach_task_all(kthreadd_task, current));
 	return err;
 }
 

base-commit: d8f6ef45a623d650f9b97e11553adb4978f6aa70
-- 
2.34.1.173.g76aa8bc2d0-goog