cgroupfs: don't add a task in the root cgroup if it is already there.

PiperOrigin-RevId: 377975013

2 files changed, 11 insertions, 1 deletions

diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go
index febe7fe50..c666be2cb 100644
--- a/pkg/sentry/kernel/kernel.go
+++ b/pkg/sentry/kernel/kernel.go
@@ -1861,7 +1861,9 @@ func (k *Kernel) PopulateNewCgroupHierarchy(root Cgroup) {
 			return
 		}
 		t.mu.Lock()
-		t.enterCgroupLocked(root)
+		// A task can be in the cgroup if it has been created after the
+		// cgroup hierarchy was registered.
+		t.enterCgroupIfNotYetLocked(root)
 		t.mu.Unlock()
 	})
 	k.tasks.mu.RUnlock()
diff --git a/pkg/sentry/kernel/task_cgroup.go b/pkg/sentry/kernel/task_cgroup.go
index 25d2504fa..7c138e80f 100644
--- a/pkg/sentry/kernel/task_cgroup.go
+++ b/pkg/sentry/kernel/task_cgroup.go
@@ -85,6 +85,14 @@ func (t *Task) enterCgroupLocked(c Cgroup) {
 	c.Enter(t)
 }
 
+// +checklocks:t.mu
+func (t *Task) enterCgroupIfNotYetLocked(c Cgroup) {
+	if _, ok := t.cgroups[c]; ok {
+		return
+	}
+	t.enterCgroupLocked(c)
+}
+
 // LeaveCgroups removes t out from all its cgroups.
 func (t *Task) LeaveCgroups() {
 	t.mu.Lock()