41

What is the function of the bioset process? Why is there no documentation for the bioset process? Why are there no definitive answers to the questions about the bioset process already posted?

What was found so far is only speculation:

  • virus; because there is no documentation to verify that it is a legitimate process, not even an answer saying that it is a legitimate process
  • kernel process; because the symbol for the process is the same as other kernel processes and user is unable to modify, stop, end, or kill the bioset process
  • key logger; seems to access the internet and is associated with applications that access the internet
  • time bomb; will start to break the functions of applications over time
  • other; speculations much less likely or totally outrageous
  • Karl Richter: Thank you for the edit. It says exactly the same thing, but it does look better. – James Jadesword Oct 24 '15 at 4:04
  • I'm seeing this under the parent process kthreadd. – Lonnie Best Sep 6 '16 at 11:43
  • I get a load of these processes if I do a large IO operation like creating a huge gzip. – Kris Jul 1 '19 at 15:08
19

It's part of the kernel block IO:

https://lwn.net/Articles/26404/

Those bioset threads specifically are part of some recovery system.

https://github.com/torvalds/linux/blob/c4004b02f8e5b9ce357a0bb1641756cc86962664/block/bio.c#L1904

| improve this answer | |
  • 3
    should I be worried about hardware device, if huge amount of bioset threads are spawn? – serup Nov 9 '16 at 12:58
  • 1
    no worries, see github.com/raspberrypi/linux/issues/1427 – jeffmcneill Mar 29 '17 at 3:29
  • That github issue does not tell you anything! – not2qubit Feb 4 '18 at 14:39
  • 1
    It's not a recovery system, despite what the name "rescue" might imply. It's sort of an internal kernel detail. A situation can arise where a thread wants to submit a block io request, but isn't allowed to, because it could cause deadlock. So it gives the request to the bioset kernel thread, and then the bioset thread submits it, which is allowed because it's a different thread. It's been replaced somewhere in the 5.x kernels. – TrentP Oct 19 at 17:52
3

I just noticed this process and was curious about it as well, so I did some cursory research ...

I'm still not certain, but it appears to be a kernel process related to block I/O (hence the "bio" in bioset) ... it also appears in the device-mapper code: https://github.com/torvalds/linux/search?utf8=%E2%9C%93&q=bioset

| improve this answer | |
  • Jesse Taylor: I tried your link and even did the search again and found references to bioset, but no information on the process itself. – James Jadesword Oct 24 '15 at 4:06
  • 2
    This article has a more detailed explanation: johanlouwers.blogspot.com/2017/10/… /* * bio_set is used to allow other portions of the IO system to * allocate their own private memory pools for bio and iovec structures. * These memory pools in turn all allocate from the bio_slab * and the bvec_slabs[]. */ – J. Taylor Dec 21 '17 at 1:50
3

The bioset process is coming from the kernel thread (often PID 2) and is used in pretty much anything that is using a Block IO memory or device operation. I would guess that bioset stand for "Block layer IO scheduler ...something".

The links already provided in previous comments will explain it in more details. But here is a full picture of the Linux IO subsystem.

enter image description here

| improve this answer | |
  • Very nice and interesting picture. Any web-link to the source? – Xavi Montero Sep 28 '18 at 16:51
  • No I think it was a Google find... – not2qubit Sep 29 '18 at 21:40
2

Bioset on my computer seems to be embedded in the kernel. It starts with a parent process of 2. It encyrpts all internal communication.

Previously, I caught hacker on my serial terminal. After digging around it seems that I had been compromised by several items. Maybe windigo and ebuny. Trojanish type.

I can connect to the internet with low priv user, root connects to keyserver, and soon I have lots of dns/udp processes and kernel sockets open up.

This guy loves communication with udp packets to its primary servers.

Just letting you know my experience. Also if you are connecting to servers, you should remove all your local private keys and update your server keys. It spreads by via ssh.

Recommend everyone install ids, auditd, and configure their firefox really well. It has been a learning curve for me.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.