From 89e9ebd6df077efdb88c9056fc0bd89eecec4469 Mon Sep 17 00:00:00 2001
From: Snir Schreiber <ssheribe@redhat.com>
Date: Wed, 24 Jun 2026 11:49:55 +0000
Subject: [PATCH] agent: fix deadlock when cgroup is destroyed during container
 deletion

When a cgroup is destroyed while kata-agent is processing container deletion
(e.g., systemd deactivates the scope before signal_process completes), two
issues occur that cause the deletion to hang:

1. **cgroups_notifier infinite loop**: The inotify event loop attempts to read
   from non-existent cgroup files (memory.events, cgroup.events) repeatedly,
   causing thousands of failed read attempts, log buffer overflow (1000+ dropped
   messages), CPU spinning, and overwhelming the tokio async runtime.

2. **signal_process RPC hang**: The get_pids() call fails with an error when
   trying to read from the destroyed cgroup, causing the RPC to return an error
   instead of completing successfully. This leaves CRI-O waiting indefinitely
   for the response.

**Fixes:**

1. **notifier.rs**: Check if cgroup paths exist BEFORE attempting to read from
   them in the event loop. This allows clean exit when the cgroup is destroyed.

2. **rpc.rs**: Make get_pids() failure non-fatal in signal_process. If the
   cgroup is already destroyed, there are no processes left to signal anyway,
   so we can safely continue and return success.

Together, these fixes allow container deletion to complete cleanly even when
systemd races to clean up the cgroup before kata-agent finishes processing.

Fixes: Container deletion hanging indefinitely
Fixes: Node corruption due to leaked vxlan interfaces

Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
---
 src/agent/rustjail/src/cgroups/notifier.rs | 18 ++++++++++++------
 src/agent/src/rpc.rs                       | 17 ++++++++++++++++-
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/src/agent/rustjail/src/cgroups/notifier.rs b/src/agent/rustjail/src/cgroups/notifier.rs
index e9819da4aed2..ad3f3a8dcc0b 100644
--- a/src/agent/rustjail/src/cgroups/notifier.rs
+++ b/src/agent/rustjail/src/cgroups/notifier.rs
@@ -110,6 +110,18 @@ async fn register_memory_event_v2(
             // info!("is1: {}", event.wd == wd1);
             info!(sl(), "event.wd: {:?}", event.wd);
 
+            // When a cgroup is destroyed, an event is sent to eventfd.
+            // Check if the control paths are gone BEFORE trying to read from them.
+            // This prevents infinite loops and log floods when the cgroup is destroyed
+            // while events are being processed.
+            if !Path::new(&event_control_path).exists() || !Path::new(&cgroup_event_control_path).exists() {
+                info!(
+                    sl(),
+                    "container[{}] cgroup path no longer exists, stopping event monitoring", &containere_id
+                );
+                return;
+            }
+
             if event.wd == ev_wd {
                 let oom = get_value_from_cgroup(&event_control_path, "oom_kill");
                 if oom.unwrap_or(0) > 0 {
@@ -124,12 +136,6 @@ async fn register_memory_event_v2(
                     return;
                 }
             }
-
-            // When a cgroup is destroyed, an event is sent to eventfd.
-            // So if the control path is gone, return instead of notifying.
-            if !Path::new(&event_control_path).exists() {
-                return;
-            }
         }
     });
 
diff --git a/src/agent/src/rpc.rs b/src/agent/src/rpc.rs
index f9df3e1860ed..420e48f1db52 100644
--- a/src/agent/src/rpc.rs
+++ b/src/agent/src/rpc.rs
@@ -524,7 +524,22 @@ impl AgentService {
                 );
             }
 
-            let pids = self.get_pids(&cid).await?;
+            // When the cgroup is destroyed early (e.g., systemd deactivated the scope before
+            // we finish processing), get_pids() may fail. This is not an error - it just means
+            // there are no processes left to signal. Log and continue.
+            let pids = match self.get_pids(&cid).await {
+                Ok(pids) => pids,
+                Err(err) => {
+                    warn!(
+                        sl(),
+                        "get_pids failed, cgroup may be destroyed";
+                        "container-id" => &cid,
+                        "exec-id" => &eid,
+                        "error" => format!("{:?}", err),
+                    );
+                    Vec::new()
+                }
+            };
             for pid in pids.iter() {
                 let res = unsafe { libc::kill(*pid, sig) };
                 if let Err(err) = Errno::result(res).map(drop) {