exit.c 42.6 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10
/*
 *  linux/kernel/exit.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/interrupt.h>
#include <linux/module.h>
11
#include <linux/capability.h>
L
Linus Torvalds 已提交
12 13 14
#include <linux/completion.h>
#include <linux/personality.h>
#include <linux/tty.h>
15
#include <linux/iocontext.h>
L
Linus Torvalds 已提交
16 17 18 19
#include <linux/key.h>
#include <linux/security.h>
#include <linux/cpu.h>
#include <linux/acct.h>
20
#include <linux/tsacct_kern.h>
L
Linus Torvalds 已提交
21
#include <linux/file.h>
A
Al Viro 已提交
22
#include <linux/fdtable.h>
23
#include <linux/freezer.h>
L
Linus Torvalds 已提交
24
#include <linux/binfmts.h>
S
Serge E. Hallyn 已提交
25
#include <linux/nsproxy.h>
26
#include <linux/pid_namespace.h>
L
Linus Torvalds 已提交
27 28 29 30
#include <linux/ptrace.h>
#include <linux/profile.h>
#include <linux/mount.h>
#include <linux/proc_fs.h>
31
#include <linux/kthread.h>
L
Linus Torvalds 已提交
32
#include <linux/mempolicy.h>
33
#include <linux/taskstats_kern.h>
34
#include <linux/delayacct.h>
35
#include <linux/cgroup.h>
L
Linus Torvalds 已提交
36
#include <linux/syscalls.h>
37
#include <linux/signal.h>
38
#include <linux/posix-timers.h>
M
Matt Helsley 已提交
39
#include <linux/cn_proc.h>
40
#include <linux/mutex.h>
41
#include <linux/futex.h>
42
#include <linux/pipe_fs_i.h>
43
#include <linux/audit.h> /* for audit_free() */
A
Adrian Bunk 已提交
44
#include <linux/resource.h>
45
#include <linux/blkdev.h>
46
#include <linux/task_io_accounting_ops.h>
R
Roland McGrath 已提交
47
#include <linux/tracehook.h>
48
#include <linux/fs_struct.h>
D
David Howells 已提交
49
#include <linux/init_task.h>
50
#include <linux/perf_event.h>
51
#include <trace/events/sched.h>
52
#include <linux/hw_breakpoint.h>
Y
Ying Han 已提交
53
#include <linux/oom.h>
54
#include <linux/writeback.h>
A
Al Viro 已提交
55
#include <linux/shm.h>
L
Linus Torvalds 已提交
56 57 58 59 60 61

#include <asm/uaccess.h>
#include <asm/unistd.h>
#include <asm/pgtable.h>
#include <asm/mmu_context.h>

A
Adrian Bunk 已提交
62 63
static void exit_mm(struct task_struct * tsk);

64
static void __unhash_process(struct task_struct *p, bool group_dead)
L
Linus Torvalds 已提交
65 66
{
	nr_threads--;
67
	detach_pid(p, PIDTYPE_PID);
68
	if (group_dead) {
L
Linus Torvalds 已提交
69 70
		detach_pid(p, PIDTYPE_PGID);
		detach_pid(p, PIDTYPE_SID);
71

72
		list_del_rcu(&p->tasks);
73
		list_del_init(&p->sibling);
74
		__this_cpu_dec(process_counts);
L
Linus Torvalds 已提交
75
	}
O
Oleg Nesterov 已提交
76
	list_del_rcu(&p->thread_group);
77
	list_del_rcu(&p->thread_node);
L
Linus Torvalds 已提交
78 79
}

80 81 82 83 84 85
/*
 * This function expects the tasklist_lock write-locked.
 */
static void __exit_signal(struct task_struct *tsk)
{
	struct signal_struct *sig = tsk->signal;
86
	bool group_dead = thread_group_leader(tsk);
87
	struct sighand_struct *sighand;
88
	struct tty_struct *uninitialized_var(tty);
89
	cputime_t utime, stime;
90

91
	sighand = rcu_dereference_check(tsk->sighand,
92
					lockdep_tasklist_lock_is_held());
93 94 95
	spin_lock(&sighand->siglock);

	posix_cpu_timers_exit(tsk);
96
	if (group_dead) {
97
		posix_cpu_timers_exit_group(tsk);
98 99
		tty = sig->tty;
		sig->tty = NULL;
100
	} else {
101 102 103 104 105 106 107 108
		/*
		 * This can only happen if the caller is de_thread().
		 * FIXME: this is the temporary hack, we should teach
		 * posix-cpu-timers to handle this case correctly.
		 */
		if (unlikely(has_group_leader_pid(tsk)))
			posix_cpu_timers_exit_group(tsk);

109 110 111 112
		/*
		 * If there is any task waiting for the group exit
		 * then notify it:
		 */
113
		if (sig->notify_count > 0 && !--sig->notify_count)
114
			wake_up_process(sig->group_exit_task);
115

116 117 118 119 120 121 122 123 124 125 126 127
		if (tsk == sig->curr_target)
			sig->curr_target = next_thread(tsk);
		/*
		 * Accumulate here the counters for all threads but the
		 * group leader as they die, so they can be added into
		 * the process-wide totals when those are taken.
		 * The group leader stays around as a zombie as long
		 * as there are other threads.  When it gets reaped,
		 * the exit.c code will add its counts into these totals.
		 * We won't ever get here for the group leader, since it
		 * will have been the last reference on the signal_struct.
		 */
128 129 130 131
		task_cputime(tsk, &utime, &stime);
		sig->utime += utime;
		sig->stime += stime;
		sig->gtime += task_gtime(tsk);
132 133 134 135
		sig->min_flt += tsk->min_flt;
		sig->maj_flt += tsk->maj_flt;
		sig->nvcsw += tsk->nvcsw;
		sig->nivcsw += tsk->nivcsw;
136 137
		sig->inblock += task_io_get_inblock(tsk);
		sig->oublock += task_io_get_oublock(tsk);
138
		task_io_accounting_add(&sig->ioac, &tsk->ioac);
139
		sig->sum_sched_runtime += tsk->se.sum_exec_runtime;
140 141
	}

142
	sig->nr_threads--;
143
	__unhash_process(tsk, group_dead);
144

145 146 147 148 149
	/*
	 * Do this under ->siglock, we can race with another thread
	 * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
	 */
	flush_sigqueue(&tsk->pending);
150
	tsk->sighand = NULL;
151 152
	spin_unlock(&sighand->siglock);

153
	__cleanup_sighand(sighand);
154
	clear_tsk_thread_flag(tsk,TIF_SIGPENDING);
155
	if (group_dead) {
156
		flush_sigqueue(&sig->shared_pending);
157
		tty_kref_put(tty);
158 159 160
	}
}

161 162
static void delayed_put_task_struct(struct rcu_head *rhp)
{
163 164
	struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);

165
	perf_event_delayed_put(tsk);
166 167
	trace_sched_process_free(tsk);
	put_task_struct(tsk);
168 169
}

R
Roland McGrath 已提交
170

L
Linus Torvalds 已提交
171 172
void release_task(struct task_struct * p)
{
173
	struct task_struct *leader;
L
Linus Torvalds 已提交
174
	int zap_leader;
175
repeat:
176
	/* don't need to get the RCU readlock here - the process is dead and
177 178
	 * can't be modifying its own credentials. But shut RCU-lockdep up */
	rcu_read_lock();
179
	atomic_dec(&__task_cred(p)->user->processes);
180
	rcu_read_unlock();
181

182
	proc_flush_task(p);
183

L
Linus Torvalds 已提交
184
	write_lock_irq(&tasklist_lock);
T
Tejun Heo 已提交
185
	ptrace_release_task(p);
L
Linus Torvalds 已提交
186
	__exit_signal(p);
187

L
Linus Torvalds 已提交
188 189 190 191 192 193 194 195 196 197 198 199
	/*
	 * If we are the last non-leader member of the thread
	 * group, and the leader is zombie, then notify the
	 * group leader's parent process. (if it wants notification.)
	 */
	zap_leader = 0;
	leader = p->group_leader;
	if (leader != p && thread_group_empty(leader) && leader->exit_state == EXIT_ZOMBIE) {
		/*
		 * If we were the last child thread and the leader has
		 * exited already, and the leader's parent ignores SIGCHLD,
		 * then we are the one who should release the leader.
R
Roland McGrath 已提交
200
		 */
201
		zap_leader = do_notify_parent(leader, leader->exit_signal);
R
Roland McGrath 已提交
202 203
		if (zap_leader)
			leader->exit_state = EXIT_DEAD;
L
Linus Torvalds 已提交
204 205 206 207
	}

	write_unlock_irq(&tasklist_lock);
	release_thread(p);
208
	call_rcu(&p->rcu, delayed_put_task_struct);
L
Linus Torvalds 已提交
209 210 211 212 213 214 215 216 217 218

	p = leader;
	if (unlikely(zap_leader))
		goto repeat;
}

/*
 * This checks not only the pgrp, but falls back on the pid if no
 * satisfactory pgrp is found. I dunno - gdb doesn't work correctly
 * without this...
219 220
 *
 * The caller must hold rcu lock or the tasklist lock.
L
Linus Torvalds 已提交
221
 */
222
struct pid *session_of_pgrp(struct pid *pgrp)
L
Linus Torvalds 已提交
223 224
{
	struct task_struct *p;
225
	struct pid *sid = NULL;
226

227
	p = pid_task(pgrp, PIDTYPE_PGID);
228
	if (p == NULL)
229
		p = pid_task(pgrp, PIDTYPE_PID);
230
	if (p != NULL)
231
		sid = task_session(p);
232

L
Linus Torvalds 已提交
233 234 235 236 237 238 239 240 241 242 243
	return sid;
}

/*
 * Determine if a process group is "orphaned", according to the POSIX
 * definition in 2.2.2.52.  Orphaned process groups are not to be affected
 * by terminal-generated stop signals.  Newly orphaned process groups are
 * to receive a SIGHUP and a SIGCONT.
 *
 * "I ask you, have you ever known what it is to be an orphan?"
 */
244
static int will_become_orphaned_pgrp(struct pid *pgrp, struct task_struct *ignored_task)
L
Linus Torvalds 已提交
245 246 247
{
	struct task_struct *p;

248
	do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
249 250 251
		if ((p == ignored_task) ||
		    (p->exit_state && thread_group_empty(p)) ||
		    is_global_init(p->real_parent))
L
Linus Torvalds 已提交
252
			continue;
253

254
		if (task_pgrp(p->real_parent) != pgrp &&
255 256
		    task_session(p->real_parent) == task_session(p))
			return 0;
257
	} while_each_pid_task(pgrp, PIDTYPE_PGID, p);
258 259

	return 1;
L
Linus Torvalds 已提交
260 261
}

262
int is_current_pgrp_orphaned(void)
L
Linus Torvalds 已提交
263 264 265 266
{
	int retval;

	read_lock(&tasklist_lock);
267
	retval = will_become_orphaned_pgrp(task_pgrp(current), NULL);
L
Linus Torvalds 已提交
268 269 270 271 272
	read_unlock(&tasklist_lock);

	return retval;
}

273
static bool has_stopped_jobs(struct pid *pgrp)
L
Linus Torvalds 已提交
274 275 276
{
	struct task_struct *p;

277
	do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
278 279
		if (p->signal->flags & SIGNAL_STOP_STOPPED)
			return true;
280
	} while_each_pid_task(pgrp, PIDTYPE_PGID, p);
281 282

	return false;
L
Linus Torvalds 已提交
283 284
}

285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315
/*
 * Check to see if any process groups have become orphaned as
 * a result of our exiting, and if they have any stopped jobs,
 * send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2)
 */
static void
kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent)
{
	struct pid *pgrp = task_pgrp(tsk);
	struct task_struct *ignored_task = tsk;

	if (!parent)
		 /* exit: our father is in a different pgrp than
		  * we are and we were the only connection outside.
		  */
		parent = tsk->real_parent;
	else
		/* reparent: our child is in a different pgrp than
		 * we are, and it was the only connection outside.
		 */
		ignored_task = NULL;

	if (task_pgrp(parent) != pgrp &&
	    task_session(parent) == task_session(tsk) &&
	    will_become_orphaned_pgrp(pgrp, ignored_task) &&
	    has_stopped_jobs(pgrp)) {
		__kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp);
		__kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp);
	}
}

L
Linus Torvalds 已提交
316
/*
317 318
 * Let kernel threads use this to say that they allow a certain signal.
 * Must not be used if kthread was cloned with CLONE_SIGHAND.
L
Linus Torvalds 已提交
319 320 321
 */
int allow_signal(int sig)
{
322
	if (!valid_signal(sig) || sig < 1)
L
Linus Torvalds 已提交
323 324 325
		return -EINVAL;

	spin_lock_irq(&current->sighand->siglock);
326
	/* This is only needed for daemonize()'ed kthreads */
L
Linus Torvalds 已提交
327
	sigdelset(&current->blocked, sig);
328 329 330 331 332 333
	/*
	 * Kernel threads handle their own signals. Let the signal code
	 * know it'll be handled, so that they don't get converted to
	 * SIGKILL or just silently dropped.
	 */
	current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
L
Linus Torvalds 已提交
334 335 336 337 338 339 340 341 342
	recalc_sigpending();
	spin_unlock_irq(&current->sighand->siglock);
	return 0;
}

EXPORT_SYMBOL(allow_signal);

int disallow_signal(int sig)
{
343
	if (!valid_signal(sig) || sig < 1)
L
Linus Torvalds 已提交
344 345 346
		return -EINVAL;

	spin_lock_irq(&current->sighand->siglock);
347
	current->sighand->action[(sig)-1].sa.sa_handler = SIG_IGN;
L
Linus Torvalds 已提交
348 349 350 351 352 353 354
	recalc_sigpending();
	spin_unlock_irq(&current->sighand->siglock);
	return 0;
}

EXPORT_SYMBOL(disallow_signal);

O
Oleg Nesterov 已提交
355
#ifdef CONFIG_MEMCG
356
/*
357
 * A task is exiting.   If it owned this mm, find a new owner for the mm.
358 359 360 361 362 363
 */
void mm_update_next_owner(struct mm_struct *mm)
{
	struct task_struct *c, *g, *p = current;

retry:
364 365 366 367 368
	/*
	 * If the exiting or execing task is not the owner, it's
	 * someone else's problem.
	 */
	if (mm->owner != p)
369
		return;
370 371 372 373 374 375 376 377 378
	/*
	 * The current owner is exiting/execing and there are no other
	 * candidates.  Do not leave the mm pointing to a possibly
	 * freed task structure.
	 */
	if (atomic_read(&mm->mm_users) <= 1) {
		mm->owner = NULL;
		return;
	}
379 380 381 382 383 384 385 386 387 388 389 390 391

	read_lock(&tasklist_lock);
	/*
	 * Search in the children
	 */
	list_for_each_entry(c, &p->children, sibling) {
		if (c->mm == mm)
			goto assign_new_owner;
	}

	/*
	 * Search in the siblings
	 */
392
	list_for_each_entry(c, &p->real_parent->children, sibling) {
393 394 395 396 397
		if (c->mm == mm)
			goto assign_new_owner;
	}

	/*
398
	 * Search through everything else, we should not get here often.
399
	 */
400 401 402 403 404 405 406 407 408
	for_each_process(g) {
		if (g->flags & PF_KTHREAD)
			continue;
		for_each_thread(g, c) {
			if (c->mm == mm)
				goto assign_new_owner;
			if (c->mm)
				break;
		}
409
	}
410
	read_unlock(&tasklist_lock);
411 412 413
	/*
	 * We found no owner yet mm_users > 1: this implies that we are
	 * most likely racing with swapoff (try_to_unuse()) or /proc or
414
	 * ptrace or page migration (get_task_mm()).  Mark owner as NULL.
415 416
	 */
	mm->owner = NULL;
417 418 419 420 421 422 423 424 425 426
	return;

assign_new_owner:
	BUG_ON(c == p);
	get_task_struct(c);
	/*
	 * The task_lock protects c->mm from changing.
	 * We always want mm->owner->mm == mm
	 */
	task_lock(c);
427 428 429 430 431
	/*
	 * Delay read_unlock() till we have the task_lock()
	 * to ensure that c does not slip away underneath us
	 */
	read_unlock(&tasklist_lock);
432 433 434 435 436 437 438 439 440
	if (c->mm != mm) {
		task_unlock(c);
		put_task_struct(c);
		goto retry;
	}
	mm->owner = c;
	task_unlock(c);
	put_task_struct(c);
}
O
Oleg Nesterov 已提交
441
#endif /* CONFIG_MEMCG */
442

L
Linus Torvalds 已提交
443 444 445 446
/*
 * Turn us into a lazy TLB process if we
 * aren't already..
 */
A
Adrian Bunk 已提交
447
static void exit_mm(struct task_struct * tsk)
L
Linus Torvalds 已提交
448 449
{
	struct mm_struct *mm = tsk->mm;
450
	struct core_state *core_state;
L
Linus Torvalds 已提交
451

452
	mm_release(tsk, mm);
L
Linus Torvalds 已提交
453 454
	if (!mm)
		return;
455
	sync_mm_rss(mm);
L
Linus Torvalds 已提交
456 457
	/*
	 * Serialize with any possible pending coredump.
458
	 * We must hold mmap_sem around checking core_state
L
Linus Torvalds 已提交
459
	 * and clearing tsk->mm.  The core-inducing thread
460
	 * will increment ->nr_threads for each thread in the
L
Linus Torvalds 已提交
461 462 463
	 * group with ->mm != NULL.
	 */
	down_read(&mm->mmap_sem);
464 465 466
	core_state = mm->core_state;
	if (core_state) {
		struct core_thread self;
L
Linus Torvalds 已提交
467 468
		up_read(&mm->mmap_sem);

469 470 471 472 473 474 475 476
		self.task = tsk;
		self.next = xchg(&core_state->dumper.next, &self);
		/*
		 * Implies mb(), the result of xchg() must be visible
		 * to core_state->dumper.
		 */
		if (atomic_dec_and_test(&core_state->nr_threads))
			complete(&core_state->startup);
L
Linus Torvalds 已提交
477

O
Oleg Nesterov 已提交
478 479 480 481
		for (;;) {
			set_task_state(tsk, TASK_UNINTERRUPTIBLE);
			if (!self.task) /* see coredump_finish() */
				break;
482
			freezable_schedule();
O
Oleg Nesterov 已提交
483 484
		}
		__set_task_state(tsk, TASK_RUNNING);
L
Linus Torvalds 已提交
485 486 487
		down_read(&mm->mmap_sem);
	}
	atomic_inc(&mm->mm_count);
E
Eric Sesterhenn 已提交
488
	BUG_ON(mm != tsk->active_mm);
L
Linus Torvalds 已提交
489 490 491 492 493 494
	/* more a memory barrier than a real lock */
	task_lock(tsk);
	tsk->mm = NULL;
	up_read(&mm->mmap_sem);
	enter_lazy_tlb(mm, current);
	task_unlock(tsk);
495
	mm_update_next_owner(mm);
L
Linus Torvalds 已提交
496 497 498 499
	mmput(mm);
}

/*
500 501 502 503 504
 * When we die, we re-parent all our children, and try to:
 * 1. give them to another thread in our thread group, if such a member exists
 * 2. give it to the first ancestor process which prctl'd itself as a
 *    child_subreaper for its children (like a service manager)
 * 3. give it to the init process (PID 1) in our pid namespace
L
Linus Torvalds 已提交
505
 */
506
static struct task_struct *find_new_reaper(struct task_struct *father)
507 508
	__releases(&tasklist_lock)
	__acquires(&tasklist_lock)
L
Linus Torvalds 已提交
509
{
510 511
	struct pid_namespace *pid_ns = task_active_pid_ns(father);
	struct task_struct *thread;
L
Linus Torvalds 已提交
512

513 514 515 516 517 518 519 520
	thread = father;
	while_each_thread(father, thread) {
		if (thread->flags & PF_EXITING)
			continue;
		if (unlikely(pid_ns->child_reaper == father))
			pid_ns->child_reaper = thread;
		return thread;
	}
L
Linus Torvalds 已提交
521

522 523
	if (unlikely(pid_ns->child_reaper == father)) {
		write_unlock_irq(&tasklist_lock);
524 525 526 527 528
		if (unlikely(pid_ns == &init_pid_ns)) {
			panic("Attempted to kill init! exitcode=0x%08x\n",
				father->signal->group_exit_code ?:
					father->exit_code);
		}
L
Linus Torvalds 已提交
529

530 531
		zap_pid_ns_processes(pid_ns);
		write_lock_irq(&tasklist_lock);
532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554
	} else if (father->signal->has_child_subreaper) {
		struct task_struct *reaper;

		/*
		 * Find the first ancestor marked as child_subreaper.
		 * Note that the code below checks same_thread_group(reaper,
		 * pid_ns->child_reaper).  This is what we need to DTRT in a
		 * PID namespace. However we still need the check above, see
		 * http://marc.info/?l=linux-kernel&m=131385460420380
		 */
		for (reaper = father->real_parent;
		     reaper != &init_task;
		     reaper = reaper->real_parent) {
			if (same_thread_group(reaper, pid_ns->child_reaper))
				break;
			if (!reaper->signal->is_child_subreaper)
				continue;
			thread = reaper;
			do {
				if (!(thread->flags & PF_EXITING))
					return reaper;
			} while_each_thread(reaper, thread);
		}
L
Linus Torvalds 已提交
555
	}
556

557 558 559
	return pid_ns->child_reaper;
}

560 561 562
/*
* Any that need to be release_task'd are put on the @dead list.
 */
563
static void reparent_leader(struct task_struct *father, struct task_struct *p,
564 565 566
				struct list_head *dead)
{
	list_move_tail(&p->sibling, &p->real_parent->children);
567 568 569

	if (p->exit_state == EXIT_DEAD)
		return;
570 571 572 573 574 575 576
	/*
	 * If this is a threaded reparent there is no need to
	 * notify anyone anything has happened.
	 */
	if (same_thread_group(p->real_parent, father))
		return;

577
	/* We don't want people slaying init. */
578 579 580
	p->exit_signal = SIGCHLD;

	/* If it has exited notify the new parent about this child's death. */
T
Tejun Heo 已提交
581
	if (!p->ptrace &&
582
	    p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
583
		if (do_notify_parent(p, p->exit_signal)) {
584 585 586 587 588 589 590 591
			p->exit_state = EXIT_DEAD;
			list_move_tail(&p->sibling, dead);
		}
	}

	kill_orphaned_pgrp(p, father);
}

592
static void forget_original_parent(struct task_struct *father)
L
Linus Torvalds 已提交
593
{
594
	struct task_struct *p, *n, *reaper;
595
	LIST_HEAD(dead_children);
596 597

	write_lock_irq(&tasklist_lock);
598 599 600 601 602
	/*
	 * Note that exit_ptrace() and find_new_reaper() might
	 * drop tasklist_lock and reacquire it.
	 */
	exit_ptrace(father);
603
	reaper = find_new_reaper(father);
R
Roland McGrath 已提交
604

605
	list_for_each_entry_safe(p, n, &father->children, sibling) {
606 607 608 609
		struct task_struct *t = p;
		do {
			t->real_parent = reaper;
			if (t->parent == father) {
T
Tejun Heo 已提交
610
				BUG_ON(t->ptrace);
611 612 613 614 615 616 617
				t->parent = t->real_parent;
			}
			if (t->pdeath_signal)
				group_send_sig_info(t->pdeath_signal,
						    SEND_SIG_NOINFO, t);
		} while_each_thread(p, t);
		reparent_leader(father, p, &dead_children);
L
Linus Torvalds 已提交
618
	}
619
	write_unlock_irq(&tasklist_lock);
620

621 622
	BUG_ON(!list_empty(&father->children));

623 624
	list_for_each_entry_safe(p, n, &dead_children, sibling) {
		list_del_init(&p->sibling);
625 626
		release_task(p);
	}
L
Linus Torvalds 已提交
627 628 629 630 631 632
}

/*
 * Send signals to all our closest relatives so that they know
 * to properly mourn us..
 */
633
static void exit_notify(struct task_struct *tsk, int group_dead)
L
Linus Torvalds 已提交
634
{
635
	bool autoreap;
L
Linus Torvalds 已提交
636 637 638 639 640 641 642 643 644

	/*
	 * This does two things:
	 *
  	 * A.  Make init inherit all the child processes
	 * B.  Check to see if any process groups have become orphaned
	 *	as a result of our exiting, and if they have any stopped
	 *	jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2)
	 */
645
	forget_original_parent(tsk);
L
Linus Torvalds 已提交
646

647
	write_lock_irq(&tasklist_lock);
648 649
	if (group_dead)
		kill_orphaned_pgrp(tsk->group_leader, NULL);
L
Linus Torvalds 已提交
650

O
Oleg Nesterov 已提交
651 652 653 654 655 656 657 658 659 660 661 662
	if (unlikely(tsk->ptrace)) {
		int sig = thread_group_leader(tsk) &&
				thread_group_empty(tsk) &&
				!ptrace_reparented(tsk) ?
			tsk->exit_signal : SIGCHLD;
		autoreap = do_notify_parent(tsk, sig);
	} else if (thread_group_leader(tsk)) {
		autoreap = thread_group_empty(tsk) &&
			do_notify_parent(tsk, tsk->exit_signal);
	} else {
		autoreap = true;
	}
L
Linus Torvalds 已提交
663

664
	tsk->exit_state = autoreap ? EXIT_DEAD : EXIT_ZOMBIE;
L
Linus Torvalds 已提交
665

666 667
	/* mt-exec, de_thread() is waiting for group leader */
	if (unlikely(tsk->signal->notify_count < 0))
668
		wake_up_process(tsk->signal->group_exit_task);
L
Linus Torvalds 已提交
669 670 671
	write_unlock_irq(&tasklist_lock);

	/* If the process is dead, release it - nobody will wait for it */
672
	if (autoreap)
L
Linus Torvalds 已提交
673 674 675
		release_task(tsk);
}

676 677 678 679 680 681 682
#ifdef CONFIG_DEBUG_STACK_USAGE
static void check_stack_usage(void)
{
	static DEFINE_SPINLOCK(low_water_lock);
	static int lowest_to_date = THREAD_SIZE;
	unsigned long free;

683
	free = stack_not_used(current);
684 685 686 687 688 689

	if (free >= lowest_to_date)
		return;

	spin_lock(&low_water_lock);
	if (free < lowest_to_date) {
690 691 692
		printk(KERN_WARNING "%s (%d) used greatest stack depth: "
				"%lu bytes left\n",
				current->comm, task_pid_nr(current), free);
693 694 695 696 697 698 699 700
		lowest_to_date = free;
	}
	spin_unlock(&low_water_lock);
}
#else
static inline void check_stack_usage(void) {}
#endif

701
void do_exit(long code)
L
Linus Torvalds 已提交
702 703 704 705 706 707
{
	struct task_struct *tsk = current;
	int group_dead;

	profile_task_exit(tsk);

708
	WARN_ON(blk_needs_flush_plug(tsk));
709

L
Linus Torvalds 已提交
710 711 712 713 714
	if (unlikely(in_interrupt()))
		panic("Aiee, killing interrupt handler!");
	if (unlikely(!tsk->pid))
		panic("Attempted to kill the idle task!");

715 716 717 718 719 720 721 722 723
	/*
	 * If do_exit is called because this processes oopsed, it's possible
	 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
	 * continuing. Amongst other possible reasons, this is to prevent
	 * mm_release()->clear_child_tid() from writing to a user-controlled
	 * kernel address.
	 */
	set_fs(USER_DS);

T
Tejun Heo 已提交
724
	ptrace_event(PTRACE_EVENT_EXIT, code);
L
Linus Torvalds 已提交
725

726 727
	validate_creds_for_do_exit(tsk);

728 729 730 731 732 733 734
	/*
	 * We're taking recursive faults here in do_exit. Safest is to just
	 * leave this task alone and wait for reboot.
	 */
	if (unlikely(tsk->flags & PF_EXITING)) {
		printk(KERN_ALERT
			"Fixing recursive fault but reboot is needed!\n");
735 736 737 738 739 740 741 742 743 744
		/*
		 * We can do this unlocked here. The futex code uses
		 * this flag just to verify whether the pi state
		 * cleanup has been done or not. In the worst case it
		 * loops once more. We pretend that the cleanup was
		 * done as there is no way to return. Either the
		 * OWNER_DIED bit is set by now or we push the blocked
		 * task into the wait for ever nirwana as well.
		 */
		tsk->flags |= PF_EXITPIDONE;
745 746 747 748
		set_current_state(TASK_UNINTERRUPTIBLE);
		schedule();
	}

O
Oleg Nesterov 已提交
749
	exit_signals(tsk);  /* sets PF_EXITING */
750 751
	/*
	 * tsk->flags are checked in the futex code to protect against
752
	 * an exiting task cleaning up the robust pi futexes.
753
	 */
754
	smp_mb();
755
	raw_spin_unlock_wait(&tsk->pi_lock);
L
Linus Torvalds 已提交
756 757 758

	if (unlikely(in_atomic()))
		printk(KERN_INFO "note: %s[%d] exited with preempt_count %d\n",
759
				current->comm, task_pid_nr(current),
L
Linus Torvalds 已提交
760 761 762
				preempt_count());

	acct_update_integrals(tsk);
763 764 765
	/* sync mm's RSS info before statistics gathering */
	if (tsk->mm)
		sync_mm_rss(tsk->mm);
L
Linus Torvalds 已提交
766
	group_dead = atomic_dec_and_test(&tsk->signal->live);
767
	if (group_dead) {
768
		hrtimer_cancel(&tsk->signal->real_timer);
769
		exit_itimers(tsk->signal);
J
Jiri Pirko 已提交
770 771
		if (tsk->mm)
			setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
772
	}
773
	acct_collect(code, group_dead);
M
Miloslav Trmac 已提交
774 775
	if (group_dead)
		tty_audit_exit();
776
	audit_free(tsk);
777

778
	tsk->exit_code = code;
779
	taskstats_exit(tsk, group_dead);
780

L
Linus Torvalds 已提交
781 782
	exit_mm(tsk);

783
	if (group_dead)
784
		acct_process();
785 786
	trace_sched_process_exit(tsk);

L
Linus Torvalds 已提交
787
	exit_sem(tsk);
788
	exit_shm(tsk);
789 790
	exit_files(tsk);
	exit_fs(tsk);
791 792
	if (group_dead)
		disassociate_ctty(1);
793
	exit_task_namespaces(tsk);
794
	exit_task_work(tsk);
L
Linus Torvalds 已提交
795
	exit_thread();
796 797 798 799 800 801 802 803 804

	/*
	 * Flush inherited counters to the parent - before the parent
	 * gets woken up by child-exit notifications.
	 *
	 * because of cgroup mode, must be called before cgroup_exit()
	 */
	perf_event_exit_task(tsk);

805
	cgroup_exit(tsk);
L
Linus Torvalds 已提交
806

A
Al Viro 已提交
807
	module_put(task_thread_info(tsk)->exec_domain->module);
L
Linus Torvalds 已提交
808

809 810 811
	/*
	 * FIXME: do that only when needed, using sched_exit tracepoint
	 */
812
	flush_ptrace_hw_breakpoint(tsk);
813

814
	exit_notify(tsk, group_dead);
815
	proc_exit_connector(tsk);
L
Linus Torvalds 已提交
816
#ifdef CONFIG_NUMA
817
	task_lock(tsk);
818
	mpol_put(tsk->mempolicy);
L
Linus Torvalds 已提交
819
	tsk->mempolicy = NULL;
820
	task_unlock(tsk);
L
Linus Torvalds 已提交
821
#endif
822
#ifdef CONFIG_FUTEX
823 824
	if (unlikely(current->pi_state_cache))
		kfree(current->pi_state_cache);
825
#endif
826
	/*
827
	 * Make sure we are holding no locks:
828
	 */
829
	debug_check_no_locks_held();
830 831 832 833 834 835
	/*
	 * We can do this unlocked here. The futex code uses this flag
	 * just to verify whether the pi state cleanup has been done
	 * or not. In the worst case it loops once more.
	 */
	tsk->flags |= PF_EXITPIDONE;
L
Linus Torvalds 已提交
836

837
	if (tsk->io_context)
838
		exit_io_context(tsk);
839

840
	if (tsk->splice_pipe)
841
		free_pipe_info(tsk->splice_pipe);
842

843 844 845
	if (tsk->task_frag.page)
		put_page(tsk->task_frag.page);

846 847
	validate_creds_for_do_exit(tsk);

848
	check_stack_usage();
C
Coywolf Qi Hunt 已提交
849
	preempt_disable();
850 851
	if (tsk->nr_dirtied)
		__this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);
852
	exit_rcu();
853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868

	/*
	 * The setting of TASK_RUNNING by try_to_wake_up() may be delayed
	 * when the following two conditions become true.
	 *   - There is race condition of mmap_sem (It is acquired by
	 *     exit_mm()), and
	 *   - SMI occurs before setting TASK_RUNINNG.
	 *     (or hypervisor of virtual machine switches to other guest)
	 *  As a result, we may become TASK_RUNNING after becoming TASK_DEAD
	 *
	 * To avoid it, we have to wait for releasing tsk->pi_lock which
	 * is held by try_to_wake_up()
	 */
	smp_mb();
	raw_spin_unlock_wait(&tsk->pi_lock);

O
Oleg Nesterov 已提交
869
	/* causes final put_task_struct in finish_task_switch(). */
870
	tsk->state = TASK_DEAD;
871
	tsk->flags |= PF_NOFREEZE;	/* tell freezer to ignore us */
L
Linus Torvalds 已提交
872 873 874
	schedule();
	BUG();
	/* Avoid "noreturn function does return".  */
A
Alan Cox 已提交
875 876
	for (;;)
		cpu_relax();	/* For when BUG is null */
L
Linus Torvalds 已提交
877 878
}

879 880
EXPORT_SYMBOL_GPL(do_exit);

881
void complete_and_exit(struct completion *comp, long code)
L
Linus Torvalds 已提交
882 883 884
{
	if (comp)
		complete(comp);
O
Oleg Nesterov 已提交
885

L
Linus Torvalds 已提交
886 887 888 889 890
	do_exit(code);
}

EXPORT_SYMBOL(complete_and_exit);

891
SYSCALL_DEFINE1(exit, int, error_code)
L
Linus Torvalds 已提交
892 893 894 895 896 897 898 899
{
	do_exit((error_code&0xff)<<8);
}

/*
 * Take down every thread in the group.  This is called by fatal signals
 * as well as by sys_exit_group (below).
 */
900
void
L
Linus Torvalds 已提交
901 902
do_group_exit(int exit_code)
{
903 904
	struct signal_struct *sig = current->signal;

L
Linus Torvalds 已提交
905 906
	BUG_ON(exit_code & 0x80); /* core dumps don't get here */

907 908
	if (signal_group_exit(sig))
		exit_code = sig->group_exit_code;
L
Linus Torvalds 已提交
909 910 911
	else if (!thread_group_empty(current)) {
		struct sighand_struct *const sighand = current->sighand;
		spin_lock_irq(&sighand->siglock);
912
		if (signal_group_exit(sig))
L
Linus Torvalds 已提交
913 914 915 916
			/* Another thread got here before we took the lock.  */
			exit_code = sig->group_exit_code;
		else {
			sig->group_exit_code = exit_code;
917
			sig->flags = SIGNAL_GROUP_EXIT;
L
Linus Torvalds 已提交
918 919 920 921 922 923 924 925 926 927 928 929 930 931
			zap_other_threads(current);
		}
		spin_unlock_irq(&sighand->siglock);
	}

	do_exit(exit_code);
	/* NOTREACHED */
}

/*
 * this kills every thread in the thread group. Note that any externally
 * wait4()-ing process will get the correct exit code - even if this
 * thread is not the thread group leader.
 */
932
SYSCALL_DEFINE1(exit_group, int, error_code)
L
Linus Torvalds 已提交
933 934
{
	do_group_exit((error_code & 0xff) << 8);
935 936
	/* NOTREACHED */
	return 0;
L
Linus Torvalds 已提交
937 938
}

939 940 941
struct wait_opts {
	enum pid_type		wo_type;
	int			wo_flags;
942
	struct pid		*wo_pid;
943 944 945 946 947

	struct siginfo __user	*wo_info;
	int __user		*wo_stat;
	struct rusage __user	*wo_rusage;

948
	wait_queue_t		child_wait;
949 950 951
	int			notask_error;
};

952 953
static inline
struct pid *task_pid_type(struct task_struct *task, enum pid_type type)
E
Eric W. Biederman 已提交
954
{
955 956 957
	if (type != PIDTYPE_PID)
		task = task->group_leader;
	return task->pids[type].pid;
E
Eric W. Biederman 已提交
958 959
}

960
static int eligible_pid(struct wait_opts *wo, struct task_struct *p)
L
Linus Torvalds 已提交
961
{
962 963 964
	return	wo->wo_type == PIDTYPE_MAX ||
		task_pid_type(p, wo->wo_type) == wo->wo_pid;
}
L
Linus Torvalds 已提交
965

966 967 968 969
static int eligible_child(struct wait_opts *wo, struct task_struct *p)
{
	if (!eligible_pid(wo, p))
		return 0;
L
Linus Torvalds 已提交
970 971 972 973 974
	/* Wait for all children (clone and not) if __WALL is set;
	 * otherwise, wait for clone children *only* if __WCLONE is
	 * set; otherwise, wait for non-clone children *only*.  (Note:
	 * A "clone" child here is one that reports to its parent
	 * using a signal other than SIGCHLD.) */
975 976
	if (((p->exit_signal != SIGCHLD) ^ !!(wo->wo_flags & __WCLONE))
	    && !(wo->wo_flags & __WALL))
L
Linus Torvalds 已提交
977 978
		return 0;

979
	return 1;
L
Linus Torvalds 已提交
980 981
}

982 983
static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p,
				pid_t pid, uid_t uid, int why, int status)
L
Linus Torvalds 已提交
984
{
985 986 987
	struct siginfo __user *infop;
	int retval = wo->wo_rusage
		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
988

L
Linus Torvalds 已提交
989
	put_task_struct(p);
990
	infop = wo->wo_info;
991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004
	if (infop) {
		if (!retval)
			retval = put_user(SIGCHLD, &infop->si_signo);
		if (!retval)
			retval = put_user(0, &infop->si_errno);
		if (!retval)
			retval = put_user((short)why, &infop->si_code);
		if (!retval)
			retval = put_user(pid, &infop->si_pid);
		if (!retval)
			retval = put_user(uid, &infop->si_uid);
		if (!retval)
			retval = put_user(status, &infop->si_status);
	}
L
Linus Torvalds 已提交
1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015
	if (!retval)
		retval = pid;
	return retval;
}

/*
 * Handle sys_wait4 work for one task in state EXIT_ZOMBIE.  We hold
 * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
 * the lock and this task is uninteresting.  If we return nonzero, we have
 * released the lock and the system call should return.
 */
1016
static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
L
Linus Torvalds 已提交
1017 1018
{
	unsigned long state;
1019
	int retval, status, traced;
1020
	pid_t pid = task_pid_vnr(p);
1021
	uid_t uid = from_kuid_munged(current_user_ns(), task_uid(p));
1022
	struct siginfo __user *infop;
L
Linus Torvalds 已提交
1023

1024
	if (!likely(wo->wo_flags & WEXITED))
R
Roland McGrath 已提交
1025 1026
		return 0;

1027
	if (unlikely(wo->wo_flags & WNOWAIT)) {
L
Linus Torvalds 已提交
1028
		int exit_code = p->exit_code;
1029
		int why;
L
Linus Torvalds 已提交
1030 1031 1032 1033 1034 1035 1036 1037 1038 1039

		get_task_struct(p);
		read_unlock(&tasklist_lock);
		if ((exit_code & 0x7f) == 0) {
			why = CLD_EXITED;
			status = exit_code >> 8;
		} else {
			why = (exit_code & 0x80) ? CLD_DUMPED : CLD_KILLED;
			status = exit_code & 0x7f;
		}
1040
		return wait_noreap_copyout(wo, p, pid, uid, why, status);
L
Linus Torvalds 已提交
1041 1042
	}

1043
	traced = ptrace_reparented(p);
L
Linus Torvalds 已提交
1044
	/*
1045
	 * Move the task's state to DEAD/TRACE, only one thread can do this.
L
Linus Torvalds 已提交
1046
	 */
1047
	state = traced && thread_group_leader(p) ? EXIT_TRACE : EXIT_DEAD;
1048
	if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE)
L
Linus Torvalds 已提交
1049
		return 0;
1050 1051
	/*
	 * It can be ptraced but not reparented, check
O
Oleg Nesterov 已提交
1052
	 * thread_group_leader() to filter out sub-threads.
1053
	 */
O
Oleg Nesterov 已提交
1054
	if (likely(!traced) && thread_group_leader(p)) {
1055 1056
		struct signal_struct *psig;
		struct signal_struct *sig;
J
Jiri Pirko 已提交
1057
		unsigned long maxrss;
1058
		cputime_t tgutime, tgstime;
1059

L
Linus Torvalds 已提交
1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070
		/*
		 * The resource counters for the group leader are in its
		 * own task_struct.  Those for dead threads in the group
		 * are in its signal_struct, as are those for the child
		 * processes it has previously reaped.  All these
		 * accumulate in the parent's signal_struct c* fields.
		 *
		 * We don't bother to take a lock here to protect these
		 * p->signal fields, because they are only touched by
		 * __exit_signal, which runs with tasklist_lock
		 * write-locked anyway, and so is excluded here.  We do
1071
		 * need to protect the access to parent->signal fields,
L
Linus Torvalds 已提交
1072 1073
		 * as other threads in the parent group can be right
		 * here reaping other children at the same time.
1074
		 *
1075
		 * We use thread_group_cputime_adjusted() to get times for the thread
1076 1077
		 * group, which consolidates times for all threads in the
		 * group including the group leader.
L
Linus Torvalds 已提交
1078
		 */
1079
		thread_group_cputime_adjusted(p, &tgutime, &tgstime);
1080 1081
		spin_lock_irq(&p->real_parent->sighand->siglock);
		psig = p->real_parent->signal;
1082
		sig = p->signal;
1083 1084
		psig->cutime += tgutime + sig->cutime;
		psig->cstime += tgstime + sig->cstime;
1085
		psig->cgtime += task_gtime(p) + sig->gtime + sig->cgtime;
1086 1087 1088 1089 1090 1091 1092 1093
		psig->cmin_flt +=
			p->min_flt + sig->min_flt + sig->cmin_flt;
		psig->cmaj_flt +=
			p->maj_flt + sig->maj_flt + sig->cmaj_flt;
		psig->cnvcsw +=
			p->nvcsw + sig->nvcsw + sig->cnvcsw;
		psig->cnivcsw +=
			p->nivcsw + sig->nivcsw + sig->cnivcsw;
1094 1095 1096 1097 1098 1099
		psig->cinblock +=
			task_io_get_inblock(p) +
			sig->inblock + sig->cinblock;
		psig->coublock +=
			task_io_get_oublock(p) +
			sig->oublock + sig->coublock;
J
Jiri Pirko 已提交
1100 1101 1102
		maxrss = max(sig->maxrss, sig->cmaxrss);
		if (psig->cmaxrss < maxrss)
			psig->cmaxrss = maxrss;
1103 1104
		task_io_accounting_add(&psig->ioac, &p->ioac);
		task_io_accounting_add(&psig->ioac, &sig->ioac);
1105
		spin_unlock_irq(&p->real_parent->sighand->siglock);
L
Linus Torvalds 已提交
1106 1107 1108 1109
	}

	/*
	 * Now we are sure this task is interesting, and no other
1110
	 * thread can reap it because we its state == DEAD/TRACE.
L
Linus Torvalds 已提交
1111 1112 1113
	 */
	read_unlock(&tasklist_lock);

1114 1115
	retval = wo->wo_rusage
		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
L
Linus Torvalds 已提交
1116 1117
	status = (p->signal->flags & SIGNAL_GROUP_EXIT)
		? p->signal->group_exit_code : p->exit_code;
1118 1119 1120 1121
	if (!retval && wo->wo_stat)
		retval = put_user(status, wo->wo_stat);

	infop = wo->wo_info;
L
Linus Torvalds 已提交
1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140
	if (!retval && infop)
		retval = put_user(SIGCHLD, &infop->si_signo);
	if (!retval && infop)
		retval = put_user(0, &infop->si_errno);
	if (!retval && infop) {
		int why;

		if ((status & 0x7f) == 0) {
			why = CLD_EXITED;
			status >>= 8;
		} else {
			why = (status & 0x80) ? CLD_DUMPED : CLD_KILLED;
			status &= 0x7f;
		}
		retval = put_user((short)why, &infop->si_code);
		if (!retval)
			retval = put_user(status, &infop->si_status);
	}
	if (!retval && infop)
1141
		retval = put_user(pid, &infop->si_pid);
L
Linus Torvalds 已提交
1142
	if (!retval && infop)
1143
		retval = put_user(uid, &infop->si_uid);
1144
	if (!retval)
1145
		retval = pid;
1146

1147
	if (state == EXIT_TRACE) {
L
Linus Torvalds 已提交
1148
		write_lock_irq(&tasklist_lock);
1149 1150
		/* We dropped tasklist, ptracer could die and untrace */
		ptrace_unlink(p);
1151 1152 1153 1154 1155

		/* If parent wants a zombie, don't release it now */
		state = EXIT_ZOMBIE;
		if (do_notify_parent(p, p->exit_signal))
			state = EXIT_DEAD;
1156
		p->exit_state = state;
L
Linus Torvalds 已提交
1157 1158
		write_unlock_irq(&tasklist_lock);
	}
1159
	if (state == EXIT_DEAD)
L
Linus Torvalds 已提交
1160
		release_task(p);
1161

L
Linus Torvalds 已提交
1162 1163 1164
	return retval;
}

1165 1166 1167
static int *task_stopped_code(struct task_struct *p, bool ptrace)
{
	if (ptrace) {
T
Tejun Heo 已提交
1168 1169
		if (task_is_stopped_or_traced(p) &&
		    !(p->jobctl & JOBCTL_LISTENING))
1170 1171 1172 1173 1174 1175 1176 1177
			return &p->exit_code;
	} else {
		if (p->signal->flags & SIGNAL_STOP_STOPPED)
			return &p->signal->group_exit_code;
	}
	return NULL;
}

1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194
/**
 * wait_task_stopped - Wait for %TASK_STOPPED or %TASK_TRACED
 * @wo: wait options
 * @ptrace: is the wait for ptrace
 * @p: task to wait for
 *
 * Handle sys_wait4() work for %p in state %TASK_STOPPED or %TASK_TRACED.
 *
 * CONTEXT:
 * read_lock(&tasklist_lock), which is released if return value is
 * non-zero.  Also, grabs and releases @p->sighand->siglock.
 *
 * RETURNS:
 * 0 if wait condition didn't exist and search for other wait conditions
 * should continue.  Non-zero return, -errno on failure and @p's pid on
 * success, implies that tasklist_lock is released and wait condition
 * search should terminate.
L
Linus Torvalds 已提交
1195
 */
1196 1197
static int wait_task_stopped(struct wait_opts *wo,
				int ptrace, struct task_struct *p)
L
Linus Torvalds 已提交
1198
{
1199
	struct siginfo __user *infop;
1200
	int retval, exit_code, *p_code, why;
1201
	uid_t uid = 0; /* unneeded, required by compiler */
1202
	pid_t pid;
L
Linus Torvalds 已提交
1203

1204 1205 1206
	/*
	 * Traditionally we see ptrace'd stopped tasks regardless of options.
	 */
1207
	if (!ptrace && !(wo->wo_flags & WUNTRACED))
R
Roland McGrath 已提交
1208 1209
		return 0;

1210 1211 1212
	if (!task_stopped_code(p, ptrace))
		return 0;

1213 1214 1215
	exit_code = 0;
	spin_lock_irq(&p->sighand->siglock);

1216 1217
	p_code = task_stopped_code(p, ptrace);
	if (unlikely(!p_code))
1218 1219
		goto unlock_sig;

1220
	exit_code = *p_code;
1221 1222 1223
	if (!exit_code)
		goto unlock_sig;

1224
	if (!unlikely(wo->wo_flags & WNOWAIT))
1225
		*p_code = 0;
1226

1227
	uid = from_kuid_munged(current_user_ns(), task_uid(p));
1228 1229 1230
unlock_sig:
	spin_unlock_irq(&p->sighand->siglock);
	if (!exit_code)
L
Linus Torvalds 已提交
1231 1232 1233 1234 1235 1236 1237 1238 1239 1240
		return 0;

	/*
	 * Now we are pretty sure this task is interesting.
	 * Make sure it doesn't get reaped out from under us while we
	 * give up the lock and then examine it below.  We don't want to
	 * keep holding onto the tasklist_lock while we call getrusage and
	 * possibly take page faults for user memory.
	 */
	get_task_struct(p);
1241
	pid = task_pid_vnr(p);
R
Roland McGrath 已提交
1242
	why = ptrace ? CLD_TRAPPED : CLD_STOPPED;
L
Linus Torvalds 已提交
1243 1244
	read_unlock(&tasklist_lock);

1245 1246 1247 1248 1249 1250 1251
	if (unlikely(wo->wo_flags & WNOWAIT))
		return wait_noreap_copyout(wo, p, pid, uid, why, exit_code);

	retval = wo->wo_rusage
		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
	if (!retval && wo->wo_stat)
		retval = put_user((exit_code << 8) | 0x7f, wo->wo_stat);
L
Linus Torvalds 已提交
1252

1253
	infop = wo->wo_info;
L
Linus Torvalds 已提交
1254 1255 1256 1257 1258
	if (!retval && infop)
		retval = put_user(SIGCHLD, &infop->si_signo);
	if (!retval && infop)
		retval = put_user(0, &infop->si_errno);
	if (!retval && infop)
R
Roland McGrath 已提交
1259
		retval = put_user((short)why, &infop->si_code);
L
Linus Torvalds 已提交
1260 1261 1262
	if (!retval && infop)
		retval = put_user(exit_code, &infop->si_status);
	if (!retval && infop)
1263
		retval = put_user(pid, &infop->si_pid);
L
Linus Torvalds 已提交
1264
	if (!retval && infop)
1265
		retval = put_user(uid, &infop->si_uid);
L
Linus Torvalds 已提交
1266
	if (!retval)
1267
		retval = pid;
L
Linus Torvalds 已提交
1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279
	put_task_struct(p);

	BUG_ON(!retval);
	return retval;
}

/*
 * Handle do_wait work for one task in a live, non-stopped state.
 * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
 * the lock and this task is uninteresting.  If we return nonzero, we have
 * released the lock and the system call should return.
 */
1280
static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
L
Linus Torvalds 已提交
1281 1282 1283 1284 1285
{
	int retval;
	pid_t pid;
	uid_t uid;

1286
	if (!unlikely(wo->wo_flags & WCONTINUED))
R
Roland McGrath 已提交
1287 1288
		return 0;

L
Linus Torvalds 已提交
1289 1290 1291 1292 1293 1294 1295 1296 1297
	if (!(p->signal->flags & SIGNAL_STOP_CONTINUED))
		return 0;

	spin_lock_irq(&p->sighand->siglock);
	/* Re-check with the lock held.  */
	if (!(p->signal->flags & SIGNAL_STOP_CONTINUED)) {
		spin_unlock_irq(&p->sighand->siglock);
		return 0;
	}
1298
	if (!unlikely(wo->wo_flags & WNOWAIT))
L
Linus Torvalds 已提交
1299
		p->signal->flags &= ~SIGNAL_STOP_CONTINUED;
1300
	uid = from_kuid_munged(current_user_ns(), task_uid(p));
L
Linus Torvalds 已提交
1301 1302
	spin_unlock_irq(&p->sighand->siglock);

1303
	pid = task_pid_vnr(p);
L
Linus Torvalds 已提交
1304 1305 1306
	get_task_struct(p);
	read_unlock(&tasklist_lock);

1307 1308 1309
	if (!wo->wo_info) {
		retval = wo->wo_rusage
			? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
L
Linus Torvalds 已提交
1310
		put_task_struct(p);
1311 1312
		if (!retval && wo->wo_stat)
			retval = put_user(0xffff, wo->wo_stat);
L
Linus Torvalds 已提交
1313
		if (!retval)
1314
			retval = pid;
L
Linus Torvalds 已提交
1315
	} else {
1316 1317
		retval = wait_noreap_copyout(wo, p, pid, uid,
					     CLD_CONTINUED, SIGCONT);
L
Linus Torvalds 已提交
1318 1319 1320 1321 1322 1323
		BUG_ON(retval == 0);
	}

	return retval;
}

R
Roland McGrath 已提交
1324 1325 1326
/*
 * Consider @p for a wait by @parent.
 *
1327
 * -ECHILD should be in ->notask_error before the first call.
R
Roland McGrath 已提交
1328 1329
 * Returns nonzero for a final return, when we have unlocked tasklist_lock.
 * Returns zero if the search for a child should continue;
1330
 * then ->notask_error is 0 if @p is an eligible child,
1331
 * or another error from security_task_wait(), or still -ECHILD.
R
Roland McGrath 已提交
1332
 */
1333 1334
static int wait_consider_task(struct wait_opts *wo, int ptrace,
				struct task_struct *p)
R
Roland McGrath 已提交
1335
{
1336 1337 1338 1339 1340 1341
	int ret;

	if (unlikely(p->exit_state == EXIT_DEAD))
		return 0;

	ret = eligible_child(wo, p);
1342
	if (!ret)
R
Roland McGrath 已提交
1343 1344
		return ret;

1345
	ret = security_task_wait(p);
1346 1347 1348 1349 1350 1351 1352 1353
	if (unlikely(ret < 0)) {
		/*
		 * If we have not yet seen any eligible child,
		 * then let this error code replace -ECHILD.
		 * A permission error will give the user a clue
		 * to look for security policy problems, rather
		 * than for mysterious wait bugs.
		 */
1354 1355
		if (wo->notask_error)
			wo->notask_error = ret;
1356
		return 0;
1357 1358
	}

1359
	if (unlikely(p->exit_state == EXIT_TRACE)) {
1360
		/*
1361 1362
		 * ptrace == 0 means we are the natural parent. In this case
		 * we should clear notask_error, debugger will notify us.
1363
		 */
1364
		if (likely(!ptrace))
1365
			wo->notask_error = 0;
1366
		return 0;
1367
	}
1368

1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384
	if (likely(!ptrace) && unlikely(p->ptrace)) {
		/*
		 * If it is traced by its real parent's group, just pretend
		 * the caller is ptrace_do_wait() and reap this child if it
		 * is zombie.
		 *
		 * This also hides group stop state from real parent; otherwise
		 * a single stop can be reported twice as group and ptrace stop.
		 * If a ptracer wants to distinguish these two events for its
		 * own children it should create a separate process which takes
		 * the role of real parent.
		 */
		if (!ptrace_reparented(p))
			ptrace = 1;
	}

1385 1386
	/* slay zombie? */
	if (p->exit_state == EXIT_ZOMBIE) {
1387
		/* we don't reap group leaders with subthreads */
1388 1389 1390 1391 1392 1393 1394 1395 1396
		if (!delay_group_leader(p)) {
			/*
			 * A zombie ptracee is only visible to its ptracer.
			 * Notification and reaping will be cascaded to the
			 * real parent when the ptracer detaches.
			 */
			if (unlikely(ptrace) || likely(!p->ptrace))
				return wait_task_zombie(wo, p);
		}
R
Roland McGrath 已提交
1397

R
Roland McGrath 已提交
1398
		/*
1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423
		 * Allow access to stopped/continued state via zombie by
		 * falling through.  Clearing of notask_error is complex.
		 *
		 * When !@ptrace:
		 *
		 * If WEXITED is set, notask_error should naturally be
		 * cleared.  If not, subset of WSTOPPED|WCONTINUED is set,
		 * so, if there are live subthreads, there are events to
		 * wait for.  If all subthreads are dead, it's still safe
		 * to clear - this function will be called again in finite
		 * amount time once all the subthreads are released and
		 * will then return without clearing.
		 *
		 * When @ptrace:
		 *
		 * Stopped state is per-task and thus can't change once the
		 * target task dies.  Only continued and exited can happen.
		 * Clear notask_error if WCONTINUED | WEXITED.
		 */
		if (likely(!ptrace) || (wo->wo_flags & (WCONTINUED | WEXITED)))
			wo->notask_error = 0;
	} else {
		/*
		 * @p is alive and it's gonna stop, continue or exit, so
		 * there always is something to wait for.
R
Roland McGrath 已提交
1424
		 */
1425
		wo->notask_error = 0;
R
Roland McGrath 已提交
1426 1427
	}

R
Roland McGrath 已提交
1428
	/*
1429 1430
	 * Wait for stopped.  Depending on @ptrace, different stopped state
	 * is used and the two don't interact with each other.
R
Roland McGrath 已提交
1431
	 */
1432 1433 1434
	ret = wait_task_stopped(wo, ptrace, p);
	if (ret)
		return ret;
R
Roland McGrath 已提交
1435 1436

	/*
1437 1438 1439
	 * Wait for continued.  There's only one continued state and the
	 * ptracer can consume it which can confuse the real parent.  Don't
	 * use WCONTINUED from ptracer.  You don't need or want it.
R
Roland McGrath 已提交
1440
	 */
1441
	return wait_task_continued(wo, p);
R
Roland McGrath 已提交
1442 1443 1444 1445 1446
}

/*
 * Do the work of do_wait() for one thread in the group, @tsk.
 *
1447
 * -ECHILD should be in ->notask_error before the first call.
R
Roland McGrath 已提交
1448 1449
 * Returns nonzero for a final return, when we have unlocked tasklist_lock.
 * Returns zero if the search for a child should continue; then
1450
 * ->notask_error is 0 if there were any eligible children,
1451
 * or another error from security_task_wait(), or still -ECHILD.
R
Roland McGrath 已提交
1452
 */
1453
static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
R
Roland McGrath 已提交
1454 1455 1456 1457
{
	struct task_struct *p;

	list_for_each_entry(p, &tsk->children, sibling) {
1458 1459 1460
		int ret = wait_consider_task(wo, 0, p);
		if (ret)
			return ret;
R
Roland McGrath 已提交
1461 1462 1463 1464 1465
	}

	return 0;
}

1466
static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk)
R
Roland McGrath 已提交
1467 1468 1469
{
	struct task_struct *p;

R
Roland McGrath 已提交
1470
	list_for_each_entry(p, &tsk->ptraced, ptrace_entry) {
1471
		int ret = wait_consider_task(wo, 1, p);
R
Roland McGrath 已提交
1472
		if (ret)
R
Roland McGrath 已提交
1473 1474 1475 1476 1477 1478
			return ret;
	}

	return 0;
}

1479 1480 1481 1482 1483 1484 1485
static int child_wait_callback(wait_queue_t *wait, unsigned mode,
				int sync, void *key)
{
	struct wait_opts *wo = container_of(wait, struct wait_opts,
						child_wait);
	struct task_struct *p = key;

1486
	if (!eligible_pid(wo, p))
1487 1488
		return 0;

1489 1490 1491
	if ((wo->wo_flags & __WNOTHREAD) && wait->private != p->parent)
		return 0;

1492 1493 1494
	return default_wake_function(wait, mode, sync, key);
}

1495 1496
void __wake_up_parent(struct task_struct *p, struct task_struct *parent)
{
1497 1498
	__wake_up_sync_key(&parent->signal->wait_chldexit,
				TASK_INTERRUPTIBLE, 1, p);
1499 1500
}

1501
static long do_wait(struct wait_opts *wo)
L
Linus Torvalds 已提交
1502 1503
{
	struct task_struct *tsk;
R
Roland McGrath 已提交
1504
	int retval;
L
Linus Torvalds 已提交
1505

1506
	trace_sched_process_wait(wo->wo_pid);
1507

1508 1509 1510
	init_waitqueue_func_entry(&wo->child_wait, child_wait_callback);
	wo->child_wait.private = current;
	add_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
L
Linus Torvalds 已提交
1511
repeat:
R
Roland McGrath 已提交
1512 1513
	/*
	 * If there is nothing that can match our critiera just get out.
1514 1515 1516
	 * We will clear ->notask_error to zero if we see any child that
	 * might later match our criteria, even if we are not able to reap
	 * it yet.
R
Roland McGrath 已提交
1517
	 */
1518
	wo->notask_error = -ECHILD;
1519 1520
	if ((wo->wo_type < PIDTYPE_MAX) &&
	   (!wo->wo_pid || hlist_empty(&wo->wo_pid->tasks[wo->wo_type])))
1521
		goto notask;
E
Eric W. Biederman 已提交
1522

1523
	set_current_state(TASK_INTERRUPTIBLE);
L
Linus Torvalds 已提交
1524 1525 1526
	read_lock(&tasklist_lock);
	tsk = current;
	do {
1527 1528 1529
		retval = do_wait_thread(wo, tsk);
		if (retval)
			goto end;
1530

1531 1532
		retval = ptrace_do_wait(wo, tsk);
		if (retval)
R
Roland McGrath 已提交
1533 1534
			goto end;

1535
		if (wo->wo_flags & __WNOTHREAD)
L
Linus Torvalds 已提交
1536
			break;
1537
	} while_each_thread(current, tsk);
L
Linus Torvalds 已提交
1538
	read_unlock(&tasklist_lock);
O
Oleg Nesterov 已提交
1539

1540
notask:
1541 1542
	retval = wo->notask_error;
	if (!retval && !(wo->wo_flags & WNOHANG)) {
L
Linus Torvalds 已提交
1543
		retval = -ERESTARTSYS;
R
Roland McGrath 已提交
1544 1545 1546 1547
		if (!signal_pending(current)) {
			schedule();
			goto repeat;
		}
L
Linus Torvalds 已提交
1548 1549
	}
end:
1550
	__set_current_state(TASK_RUNNING);
1551
	remove_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
L
Linus Torvalds 已提交
1552 1553 1554
	return retval;
}

1555 1556
SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
		infop, int, options, struct rusage __user *, ru)
L
Linus Torvalds 已提交
1557
{
1558
	struct wait_opts wo;
E
Eric W. Biederman 已提交
1559 1560
	struct pid *pid = NULL;
	enum pid_type type;
L
Linus Torvalds 已提交
1561 1562 1563 1564 1565 1566 1567 1568 1569
	long ret;

	if (options & ~(WNOHANG|WNOWAIT|WEXITED|WSTOPPED|WCONTINUED))
		return -EINVAL;
	if (!(options & (WEXITED|WSTOPPED|WCONTINUED)))
		return -EINVAL;

	switch (which) {
	case P_ALL:
E
Eric W. Biederman 已提交
1570
		type = PIDTYPE_MAX;
L
Linus Torvalds 已提交
1571 1572
		break;
	case P_PID:
E
Eric W. Biederman 已提交
1573 1574
		type = PIDTYPE_PID;
		if (upid <= 0)
L
Linus Torvalds 已提交
1575 1576 1577
			return -EINVAL;
		break;
	case P_PGID:
E
Eric W. Biederman 已提交
1578 1579
		type = PIDTYPE_PGID;
		if (upid <= 0)
L
Linus Torvalds 已提交
1580 1581 1582 1583 1584 1585
			return -EINVAL;
		break;
	default:
		return -EINVAL;
	}

E
Eric W. Biederman 已提交
1586 1587
	if (type < PIDTYPE_MAX)
		pid = find_get_pid(upid);
1588 1589 1590 1591 1592 1593 1594 1595

	wo.wo_type	= type;
	wo.wo_pid	= pid;
	wo.wo_flags	= options;
	wo.wo_info	= infop;
	wo.wo_stat	= NULL;
	wo.wo_rusage	= ru;
	ret = do_wait(&wo);
1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618

	if (ret > 0) {
		ret = 0;
	} else if (infop) {
		/*
		 * For a WNOHANG return, clear out all the fields
		 * we would set so the user can easily tell the
		 * difference.
		 */
		if (!ret)
			ret = put_user(0, &infop->si_signo);
		if (!ret)
			ret = put_user(0, &infop->si_errno);
		if (!ret)
			ret = put_user(0, &infop->si_code);
		if (!ret)
			ret = put_user(0, &infop->si_pid);
		if (!ret)
			ret = put_user(0, &infop->si_uid);
		if (!ret)
			ret = put_user(0, &infop->si_status);
	}

E
Eric W. Biederman 已提交
1619
	put_pid(pid);
L
Linus Torvalds 已提交
1620 1621 1622
	return ret;
}

1623 1624
SYSCALL_DEFINE4(wait4, pid_t, upid, int __user *, stat_addr,
		int, options, struct rusage __user *, ru)
L
Linus Torvalds 已提交
1625
{
1626
	struct wait_opts wo;
E
Eric W. Biederman 已提交
1627 1628
	struct pid *pid = NULL;
	enum pid_type type;
L
Linus Torvalds 已提交
1629 1630 1631 1632 1633
	long ret;

	if (options & ~(WNOHANG|WUNTRACED|WCONTINUED|
			__WNOTHREAD|__WCLONE|__WALL))
		return -EINVAL;
E
Eric W. Biederman 已提交
1634 1635 1636 1637 1638 1639 1640 1641

	if (upid == -1)
		type = PIDTYPE_MAX;
	else if (upid < 0) {
		type = PIDTYPE_PGID;
		pid = find_get_pid(-upid);
	} else if (upid == 0) {
		type = PIDTYPE_PGID;
1642
		pid = get_task_pid(current, PIDTYPE_PGID);
E
Eric W. Biederman 已提交
1643 1644 1645 1646 1647
	} else /* upid > 0 */ {
		type = PIDTYPE_PID;
		pid = find_get_pid(upid);
	}

1648 1649 1650 1651 1652 1653 1654
	wo.wo_type	= type;
	wo.wo_pid	= pid;
	wo.wo_flags	= options | WEXITED;
	wo.wo_info	= NULL;
	wo.wo_stat	= stat_addr;
	wo.wo_rusage	= ru;
	ret = do_wait(&wo);
E
Eric W. Biederman 已提交
1655
	put_pid(pid);
L
Linus Torvalds 已提交
1656 1657 1658 1659 1660 1661 1662 1663 1664 1665

	return ret;
}

#ifdef __ARCH_WANT_SYS_WAITPID

/*
 * sys_waitpid() remains for compatibility. waitpid() should be
 * implemented by calling sys_wait4() from libc.a.
 */
1666
SYSCALL_DEFINE3(waitpid, pid_t, pid, int __user *, stat_addr, int, options)
L
Linus Torvalds 已提交
1667 1668 1669 1670 1671
{
	return sys_wait4(pid, stat_addr, options, NULL);
}

#endif