Re: [PATCH] KVM: Move VM's worker kthreads back to the original cgroups before exiting.

[Sean Christopherson]

On Tue, Dec 14, 2021, Vipin Sharma wrote:
> VM worker kthreads can linger in the VM process's cgroup for sometime
> after KVM temrinates the VM process.
> 
> KVM terminates the worker kthreads by calling kthread_stop() which waits
> on the signal generated by exit_mm() in do_exit() during kthread's exit.
> However, these kthreads are removed from the cgroup using cgroup_exit()
> call which happens after exit_mm() in do_exit(). A VM process can
> terminate between the time window of exit_mm() to cgroup_exit(), leaving
> only worker kthreads in the cgroup.
> 
> Moving worker kthreads back to the original cgroup (kthreadd_task's
> cgroup) makes sure that cgroup is empty as soon as the main VM process
> is terminated.
> 
> Signed-off-by: Vipin Sharma <vipinsh@xxxxxxxxxx>
> ---
>  virt/kvm/kvm_main.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index b0f7e6eb00ff..edd304a18f16 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -5785,7 +5785,7 @@ static int kvm_vm_worker_thread(void *context)
>  	init_context = NULL;
>  
>  	if (err)
> -		return err;
> +		goto out;
>  
>  	/* Wait to be woken up by the spawner before proceeding. */
>  	kthread_parkme();
> @@ -5793,6 +5793,15 @@ static int kvm_vm_worker_thread(void *context)
>  	if (!kthread_should_stop())
>  		err = thread_fn(kvm, data);
>  
> +out:
> +	/*
> +	 * We need to move the kthread back to its original cgroups, so that it
> +	 * doesn't linger in the cgroups of the user process after that has
> +	 * already terminated. exit_mm() in do_exit() signals kthread_stop() to
> +	 * return, whereas, removal of the task from the cgroups happens in
> +	 * cgroup_exit() which happens after exit_mm().
> +	 */
> +	WARN_ON(cgroup_attach_task_all(kthreadd_task, current));

As the build bot noted, kthreadd_task isn't exported, and I doubt you'll convince
folks to let you export it.

Why is it problematic for the kthread to linger in the cgroup?  Conceptually, it's
not really wrong.

>  	return err;
>  }
>  
> 
> base-commit: d8f6ef45a623d650f9b97e11553adb4978f6aa70
> -- 
> 2.34.1.173.g76aa8bc2d0-goog
>