exit.c 44.1 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7 8
/*
 *  linux/kernel/exit.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

#include <linux/mm.h>
#include <linux/slab.h>
9
#include <linux/sched/autogroup.h>
10
#include <linux/sched/mm.h>
11
#include <linux/sched/stat.h>
12
#include <linux/sched/task.h>
13
#include <linux/sched/task_stack.h>
14
#include <linux/sched/cputime.h>
Linus Torvalds's avatar
Linus Torvalds committed
15 16
#include <linux/interrupt.h>
#include <linux/module.h>
17
#include <linux/capability.h>
Linus Torvalds's avatar
Linus Torvalds committed
18 19 20
#include <linux/completion.h>
#include <linux/personality.h>
#include <linux/tty.h>
21
#include <linux/iocontext.h>
Linus Torvalds's avatar
Linus Torvalds committed
22 23 24
#include <linux/key.h>
#include <linux/cpu.h>
#include <linux/acct.h>
25
#include <linux/tsacct_kern.h>
Linus Torvalds's avatar
Linus Torvalds committed
26
#include <linux/file.h>
Al Viro's avatar
Al Viro committed
27
#include <linux/fdtable.h>
28
#include <linux/freezer.h>
Linus Torvalds's avatar
Linus Torvalds committed
29
#include <linux/binfmts.h>
30
#include <linux/nsproxy.h>
31
#include <linux/pid_namespace.h>
Linus Torvalds's avatar
Linus Torvalds committed
32 33 34 35
#include <linux/ptrace.h>
#include <linux/profile.h>
#include <linux/mount.h>
#include <linux/proc_fs.h>
36
#include <linux/kthread.h>
Linus Torvalds's avatar
Linus Torvalds committed
37
#include <linux/mempolicy.h>
38
#include <linux/taskstats_kern.h>
39
#include <linux/delayacct.h>
40
#include <linux/cgroup.h>
Linus Torvalds's avatar
Linus Torvalds committed
41
#include <linux/syscalls.h>
42
#include <linux/signal.h>
43
#include <linux/posix-timers.h>
44
#include <linux/cn_proc.h>
45
#include <linux/mutex.h>
46
#include <linux/futex.h>
47
#include <linux/pipe_fs_i.h>
48
#include <linux/audit.h> /* for audit_free() */
Adrian Bunk's avatar
Adrian Bunk committed
49
#include <linux/resource.h>
50
#include <linux/blkdev.h>
51
#include <linux/task_io_accounting_ops.h>
Roland McGrath's avatar
Roland McGrath committed
52
#include <linux/tracehook.h>
53
#include <linux/fs_struct.h>
54
#include <linux/userfaultfd_k.h>
55
#include <linux/init_task.h>
56
#include <linux/perf_event.h>
57
#include <trace/events/sched.h>
58
#include <linux/hw_breakpoint.h>
Ying Han's avatar
Ying Han committed
59
#include <linux/oom.h>
60
#include <linux/writeback.h>
Al Viro's avatar
Al Viro committed
61
#include <linux/shm.h>
62
#include <linux/kcov.h>
63
#include <linux/random.h>
64
#include <linux/rcuwait.h>
Linus Torvalds's avatar
Linus Torvalds committed
65

66
#include <linux/uaccess.h>
Linus Torvalds's avatar
Linus Torvalds committed
67 68 69 70
#include <asm/unistd.h>
#include <asm/pgtable.h>
#include <asm/mmu_context.h>

71
static void __unhash_process(struct task_struct *p, bool group_dead)
Linus Torvalds's avatar
Linus Torvalds committed
72 73
{
	nr_threads--;
74
	detach_pid(p, PIDTYPE_PID);
75
	if (group_dead) {
Linus Torvalds's avatar
Linus Torvalds committed
76 77
		detach_pid(p, PIDTYPE_PGID);
		detach_pid(p, PIDTYPE_SID);
78

79
		list_del_rcu(&p->tasks);
80
		list_del_init(&p->sibling);
81
		__this_cpu_dec(process_counts);
Linus Torvalds's avatar
Linus Torvalds committed
82
	}
83
	list_del_rcu(&p->thread_group);
84
	list_del_rcu(&p->thread_node);
Linus Torvalds's avatar
Linus Torvalds committed
85 86
}

87 88 89 90 91 92
/*
 * This function expects the tasklist_lock write-locked.
 */
static void __exit_signal(struct task_struct *tsk)
{
	struct signal_struct *sig = tsk->signal;
93
	bool group_dead = thread_group_leader(tsk);
94
	struct sighand_struct *sighand;
95
	struct tty_struct *uninitialized_var(tty);
96
	u64 utime, stime;
97

98
	sighand = rcu_dereference_check(tsk->sighand,
99
					lockdep_tasklist_lock_is_held());
100 101
	spin_lock(&sighand->siglock);

102
#ifdef CONFIG_POSIX_TIMERS
103
	posix_cpu_timers_exit(tsk);
104
	if (group_dead) {
105
		posix_cpu_timers_exit_group(tsk);
106
	} else {
107 108 109 110 111 112 113
		/*
		 * This can only happen if the caller is de_thread().
		 * FIXME: this is the temporary hack, we should teach
		 * posix-cpu-timers to handle this case correctly.
		 */
		if (unlikely(has_group_leader_pid(tsk)))
			posix_cpu_timers_exit_group(tsk);
114 115
	}
#endif
116

117 118 119 120
	if (group_dead) {
		tty = sig->tty;
		sig->tty = NULL;
	} else {
121 122 123 124
		/*
		 * If there is any task waiting for the group exit
		 * then notify it:
		 */
125
		if (sig->notify_count > 0 && !--sig->notify_count)
126
			wake_up_process(sig->group_exit_task);
127

128 129 130 131
		if (tsk == sig->curr_target)
			sig->curr_target = next_thread(tsk);
	}

132 133 134
	add_device_randomness((const void*) &tsk->se.sum_exec_runtime,
			      sizeof(unsigned long long));

135
	/*
136 137 138 139
	 * Accumulate here the counters for all threads as they die. We could
	 * skip the group leader because it is the last user of signal_struct,
	 * but we want to avoid the race with thread_group_cputime() which can
	 * see the empty ->thread_head list.
140 141
	 */
	task_cputime(tsk, &utime, &stime);
142
	write_seqlock(&sig->stats_lock);
143 144 145 146 147 148 149 150 151 152 153
	sig->utime += utime;
	sig->stime += stime;
	sig->gtime += task_gtime(tsk);
	sig->min_flt += tsk->min_flt;
	sig->maj_flt += tsk->maj_flt;
	sig->nvcsw += tsk->nvcsw;
	sig->nivcsw += tsk->nivcsw;
	sig->inblock += task_io_get_inblock(tsk);
	sig->oublock += task_io_get_oublock(tsk);
	task_io_accounting_add(&sig->ioac, &tsk->ioac);
	sig->sum_sched_runtime += tsk->se.sum_exec_runtime;
154
	sig->nr_threads--;
155
	__unhash_process(tsk, group_dead);
156
	write_sequnlock(&sig->stats_lock);
157

158 159 160 161 162
	/*
	 * Do this under ->siglock, we can race with another thread
	 * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
	 */
	flush_sigqueue(&tsk->pending);
163
	tsk->sighand = NULL;
164 165
	spin_unlock(&sighand->siglock);

166
	__cleanup_sighand(sighand);
167
	clear_tsk_thread_flag(tsk, TIF_SIGPENDING);
168
	if (group_dead) {
169
		flush_sigqueue(&sig->shared_pending);
170
		tty_kref_put(tty);
171 172 173
	}
}

174 175
static void delayed_put_task_struct(struct rcu_head *rhp)
{
176 177
	struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);

178
	perf_event_delayed_put(tsk);
179 180
	trace_sched_process_free(tsk);
	put_task_struct(tsk);
181 182
}

Roland McGrath's avatar
Roland McGrath committed
183

184
void release_task(struct task_struct *p)
Linus Torvalds's avatar
Linus Torvalds committed
185
{
186
	struct task_struct *leader;
Linus Torvalds's avatar
Linus Torvalds committed
187
	int zap_leader;
188
repeat:
189
	/* don't need to get the RCU readlock here - the process is dead and
190 191
	 * can't be modifying its own credentials. But shut RCU-lockdep up */
	rcu_read_lock();
192
	atomic_dec(&__task_cred(p)->user->processes);
193
	rcu_read_unlock();
194

195
	proc_flush_task(p);
196

Linus Torvalds's avatar
Linus Torvalds committed
197
	write_lock_irq(&tasklist_lock);
Tejun Heo's avatar
Tejun Heo committed
198
	ptrace_release_task(p);
Linus Torvalds's avatar
Linus Torvalds committed
199
	__exit_signal(p);
200

Linus Torvalds's avatar
Linus Torvalds committed
201 202 203 204 205 206 207
	/*
	 * If we are the last non-leader member of the thread
	 * group, and the leader is zombie, then notify the
	 * group leader's parent process. (if it wants notification.)
	 */
	zap_leader = 0;
	leader = p->group_leader;
208 209
	if (leader != p && thread_group_empty(leader)
			&& leader->exit_state == EXIT_ZOMBIE) {
Linus Torvalds's avatar
Linus Torvalds committed
210 211 212 213
		/*
		 * If we were the last child thread and the leader has
		 * exited already, and the leader's parent ignores SIGCHLD,
		 * then we are the one who should release the leader.
Roland McGrath's avatar
Roland McGrath committed
214
		 */
215
		zap_leader = do_notify_parent(leader, leader->exit_signal);
Roland McGrath's avatar
Roland McGrath committed
216 217
		if (zap_leader)
			leader->exit_state = EXIT_DEAD;
Linus Torvalds's avatar
Linus Torvalds committed
218 219 220 221
	}

	write_unlock_irq(&tasklist_lock);
	release_thread(p);
222
	call_rcu(&p->rcu, delayed_put_task_struct);
Linus Torvalds's avatar
Linus Torvalds committed
223 224 225 226 227 228

	p = leader;
	if (unlikely(zap_leader))
		goto repeat;
}

229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291
/*
 * Note that if this function returns a valid task_struct pointer (!NULL)
 * task->usage must remain >0 for the duration of the RCU critical section.
 */
struct task_struct *task_rcu_dereference(struct task_struct **ptask)
{
	struct sighand_struct *sighand;
	struct task_struct *task;

	/*
	 * We need to verify that release_task() was not called and thus
	 * delayed_put_task_struct() can't run and drop the last reference
	 * before rcu_read_unlock(). We check task->sighand != NULL,
	 * but we can read the already freed and reused memory.
	 */
retry:
	task = rcu_dereference(*ptask);
	if (!task)
		return NULL;

	probe_kernel_address(&task->sighand, sighand);

	/*
	 * Pairs with atomic_dec_and_test() in put_task_struct(). If this task
	 * was already freed we can not miss the preceding update of this
	 * pointer.
	 */
	smp_rmb();
	if (unlikely(task != READ_ONCE(*ptask)))
		goto retry;

	/*
	 * We've re-checked that "task == *ptask", now we have two different
	 * cases:
	 *
	 * 1. This is actually the same task/task_struct. In this case
	 *    sighand != NULL tells us it is still alive.
	 *
	 * 2. This is another task which got the same memory for task_struct.
	 *    We can't know this of course, and we can not trust
	 *    sighand != NULL.
	 *
	 *    In this case we actually return a random value, but this is
	 *    correct.
	 *
	 *    If we return NULL - we can pretend that we actually noticed that
	 *    *ptask was updated when the previous task has exited. Or pretend
	 *    that probe_slab_address(&sighand) reads NULL.
	 *
	 *    If we return the new task (because sighand is not NULL for any
	 *    reason) - this is fine too. This (new) task can't go away before
	 *    another gp pass.
	 *
	 *    And note: We could even eliminate the false positive if re-read
	 *    task->sighand once again to avoid the falsely NULL. But this case
	 *    is very unlikely so we don't care.
	 */
	if (!sighand)
		return NULL;

	return task;
}

292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320
void rcuwait_wake_up(struct rcuwait *w)
{
	struct task_struct *task;

	rcu_read_lock();

	/*
	 * Order condition vs @task, such that everything prior to the load
	 * of @task is visible. This is the condition as to why the user called
	 * rcuwait_trywake() in the first place. Pairs with set_current_state()
	 * barrier (A) in rcuwait_wait_event().
	 *
	 *    WAIT                WAKE
	 *    [S] tsk = current	  [S] cond = true
	 *        MB (A)	      MB (B)
	 *    [L] cond		  [L] tsk
	 */
	smp_rmb(); /* (B) */

	/*
	 * Avoid using task_rcu_dereference() magic as long as we are careful,
	 * see comment in rcuwait_wait_event() regarding ->exit_state.
	 */
	task = rcu_dereference(w->task);
	if (task)
		wake_up_process(task);
	rcu_read_unlock();
}

321 322 323 324 325 326 327 328 329 330 331 332 333
struct task_struct *try_get_task_struct(struct task_struct **ptask)
{
	struct task_struct *task;

	rcu_read_lock();
	task = task_rcu_dereference(ptask);
	if (task)
		get_task_struct(task);
	rcu_read_unlock();

	return task;
}

Linus Torvalds's avatar
Linus Torvalds committed
334 335 336 337 338 339 340 341
/*
 * Determine if a process group is "orphaned", according to the POSIX
 * definition in 2.2.2.52.  Orphaned process groups are not to be affected
 * by terminal-generated stop signals.  Newly orphaned process groups are
 * to receive a SIGHUP and a SIGCONT.
 *
 * "I ask you, have you ever known what it is to be an orphan?"
 */
342 343
static int will_become_orphaned_pgrp(struct pid *pgrp,
					struct task_struct *ignored_task)
Linus Torvalds's avatar
Linus Torvalds committed
344 345 346
{
	struct task_struct *p;

347
	do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
348 349 350
		if ((p == ignored_task) ||
		    (p->exit_state && thread_group_empty(p)) ||
		    is_global_init(p->real_parent))
Linus Torvalds's avatar
Linus Torvalds committed
351
			continue;
352

353
		if (task_pgrp(p->real_parent) != pgrp &&
354 355
		    task_session(p->real_parent) == task_session(p))
			return 0;
356
	} while_each_pid_task(pgrp, PIDTYPE_PGID, p);
357 358

	return 1;
Linus Torvalds's avatar
Linus Torvalds committed
359 360
}

361
int is_current_pgrp_orphaned(void)
Linus Torvalds's avatar
Linus Torvalds committed
362 363 364 365
{
	int retval;

	read_lock(&tasklist_lock);
366
	retval = will_become_orphaned_pgrp(task_pgrp(current), NULL);
Linus Torvalds's avatar
Linus Torvalds committed
367 368 369 370 371
	read_unlock(&tasklist_lock);

	return retval;
}

372
static bool has_stopped_jobs(struct pid *pgrp)
Linus Torvalds's avatar
Linus Torvalds committed
373 374 375
{
	struct task_struct *p;

376
	do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
377 378
		if (p->signal->flags & SIGNAL_STOP_STOPPED)
			return true;
379
	} while_each_pid_task(pgrp, PIDTYPE_PGID, p);
380 381

	return false;
Linus Torvalds's avatar
Linus Torvalds committed
382 383
}

384 385 386 387 388 389 390 391 392 393 394 395
/*
 * Check to see if any process groups have become orphaned as
 * a result of our exiting, and if they have any stopped jobs,
 * send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2)
 */
static void
kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent)
{
	struct pid *pgrp = task_pgrp(tsk);
	struct task_struct *ignored_task = tsk;

	if (!parent)
396 397 398
		/* exit: our father is in a different pgrp than
		 * we are and we were the only connection outside.
		 */
399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414
		parent = tsk->real_parent;
	else
		/* reparent: our child is in a different pgrp than
		 * we are, and it was the only connection outside.
		 */
		ignored_task = NULL;

	if (task_pgrp(parent) != pgrp &&
	    task_session(parent) == task_session(tsk) &&
	    will_become_orphaned_pgrp(pgrp, ignored_task) &&
	    has_stopped_jobs(pgrp)) {
		__kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp);
		__kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp);
	}
}

Oleg Nesterov's avatar
Oleg Nesterov committed
415
#ifdef CONFIG_MEMCG
416
/*
417
 * A task is exiting.   If it owned this mm, find a new owner for the mm.
418 419 420 421 422 423
 */
void mm_update_next_owner(struct mm_struct *mm)
{
	struct task_struct *c, *g, *p = current;

retry:
424 425 426 427 428
	/*
	 * If the exiting or execing task is not the owner, it's
	 * someone else's problem.
	 */
	if (mm->owner != p)
429
		return;
430 431 432 433 434 435 436 437 438
	/*
	 * The current owner is exiting/execing and there are no other
	 * candidates.  Do not leave the mm pointing to a possibly
	 * freed task structure.
	 */
	if (atomic_read(&mm->mm_users) <= 1) {
		mm->owner = NULL;
		return;
	}
439 440 441 442 443 444 445 446 447 448 449 450 451

	read_lock(&tasklist_lock);
	/*
	 * Search in the children
	 */
	list_for_each_entry(c, &p->children, sibling) {
		if (c->mm == mm)
			goto assign_new_owner;
	}

	/*
	 * Search in the siblings
	 */
452
	list_for_each_entry(c, &p->real_parent->children, sibling) {
453 454 455 456 457
		if (c->mm == mm)
			goto assign_new_owner;
	}

	/*
458
	 * Search through everything else, we should not get here often.
459
	 */
460 461 462 463 464 465 466 467 468
	for_each_process(g) {
		if (g->flags & PF_KTHREAD)
			continue;
		for_each_thread(g, c) {
			if (c->mm == mm)
				goto assign_new_owner;
			if (c->mm)
				break;
		}
469
	}
470
	read_unlock(&tasklist_lock);
471 472 473
	/*
	 * We found no owner yet mm_users > 1: this implies that we are
	 * most likely racing with swapoff (try_to_unuse()) or /proc or
474
	 * ptrace or page migration (get_task_mm()).  Mark owner as NULL.
475 476
	 */
	mm->owner = NULL;
477 478 479 480 481 482 483 484 485 486
	return;

assign_new_owner:
	BUG_ON(c == p);
	get_task_struct(c);
	/*
	 * The task_lock protects c->mm from changing.
	 * We always want mm->owner->mm == mm
	 */
	task_lock(c);
487 488 489 490 491
	/*
	 * Delay read_unlock() till we have the task_lock()
	 * to ensure that c does not slip away underneath us
	 */
	read_unlock(&tasklist_lock);
492 493 494 495 496 497 498 499 500
	if (c->mm != mm) {
		task_unlock(c);
		put_task_struct(c);
		goto retry;
	}
	mm->owner = c;
	task_unlock(c);
	put_task_struct(c);
}
Oleg Nesterov's avatar
Oleg Nesterov committed
501
#endif /* CONFIG_MEMCG */
502

Linus Torvalds's avatar
Linus Torvalds committed
503 504 505 506
/*
 * Turn us into a lazy TLB process if we
 * aren't already..
 */
507
static void exit_mm(void)
Linus Torvalds's avatar
Linus Torvalds committed
508
{
509
	struct mm_struct *mm = current->mm;
510
	struct core_state *core_state;
Linus Torvalds's avatar
Linus Torvalds committed
511

512
	mm_release(current, mm);
Linus Torvalds's avatar
Linus Torvalds committed
513 514
	if (!mm)
		return;
515
	sync_mm_rss(mm);
Linus Torvalds's avatar
Linus Torvalds committed
516 517
	/*
	 * Serialize with any possible pending coredump.
518
	 * We must hold mmap_sem around checking core_state
Linus Torvalds's avatar
Linus Torvalds committed
519
	 * and clearing tsk->mm.  The core-inducing thread
520
	 * will increment ->nr_threads for each thread in the
Linus Torvalds's avatar
Linus Torvalds committed
521 522 523
	 * group with ->mm != NULL.
	 */
	down_read(&mm->mmap_sem);
524 525 526
	core_state = mm->core_state;
	if (core_state) {
		struct core_thread self;
527

Linus Torvalds's avatar
Linus Torvalds committed
528 529
		up_read(&mm->mmap_sem);

530
		self.task = current;
531 532 533 534 535 536 537
		self.next = xchg(&core_state->dumper.next, &self);
		/*
		 * Implies mb(), the result of xchg() must be visible
		 * to core_state->dumper.
		 */
		if (atomic_dec_and_test(&core_state->nr_threads))
			complete(&core_state->startup);
Linus Torvalds's avatar
Linus Torvalds committed
538

Oleg Nesterov's avatar
Oleg Nesterov committed
539
		for (;;) {
540
			set_current_state(TASK_UNINTERRUPTIBLE);
Oleg Nesterov's avatar
Oleg Nesterov committed
541 542
			if (!self.task) /* see coredump_finish() */
				break;
543
			freezable_schedule();
Oleg Nesterov's avatar
Oleg Nesterov committed
544
		}
545
		__set_current_state(TASK_RUNNING);
Linus Torvalds's avatar
Linus Torvalds committed
546 547
		down_read(&mm->mmap_sem);
	}
Vegard Nossum's avatar
Vegard Nossum committed
548
	mmgrab(mm);
549
	BUG_ON(mm != current->active_mm);
Linus Torvalds's avatar
Linus Torvalds committed
550
	/* more a memory barrier than a real lock */
551 552
	task_lock(current);
	current->mm = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
553 554
	up_read(&mm->mmap_sem);
	enter_lazy_tlb(mm, current);
555
	task_unlock(current);
556
	mm_update_next_owner(mm);
557
	userfaultfd_exit(mm);
Linus Torvalds's avatar
Linus Torvalds committed
558
	mmput(mm);
559
	if (test_thread_flag(TIF_MEMDIE))
560
		exit_oom_victim();
Linus Torvalds's avatar
Linus Torvalds committed
561 562
}

563 564 565 566 567 568 569 570 571 572 573
static struct task_struct *find_alive_thread(struct task_struct *p)
{
	struct task_struct *t;

	for_each_thread(p, t) {
		if (!(t->flags & PF_EXITING))
			return t;
	}
	return NULL;
}

574 575 576 577 578 579 580 581 582 583
static struct task_struct *find_child_reaper(struct task_struct *father)
	__releases(&tasklist_lock)
	__acquires(&tasklist_lock)
{
	struct pid_namespace *pid_ns = task_active_pid_ns(father);
	struct task_struct *reaper = pid_ns->child_reaper;

	if (likely(reaper != father))
		return reaper;

584 585
	reaper = find_alive_thread(father);
	if (reaper) {
586 587 588 589 590 591 592 593 594 595 596 597 598 599 600
		pid_ns->child_reaper = reaper;
		return reaper;
	}

	write_unlock_irq(&tasklist_lock);
	if (unlikely(pid_ns == &init_pid_ns)) {
		panic("Attempted to kill init! exitcode=0x%08x\n",
			father->signal->group_exit_code ?: father->exit_code);
	}
	zap_pid_ns_processes(pid_ns);
	write_lock_irq(&tasklist_lock);

	return father;
}

Linus Torvalds's avatar
Linus Torvalds committed
601
/*
602 603 604 605 606
 * When we die, we re-parent all our children, and try to:
 * 1. give them to another thread in our thread group, if such a member exists
 * 2. give it to the first ancestor process which prctl'd itself as a
 *    child_subreaper for its children (like a service manager)
 * 3. give it to the init process (PID 1) in our pid namespace
Linus Torvalds's avatar
Linus Torvalds committed
607
 */
608 609
static struct task_struct *find_new_reaper(struct task_struct *father,
					   struct task_struct *child_reaper)
Linus Torvalds's avatar
Linus Torvalds committed
610
{
611
	struct task_struct *thread, *reaper;
Linus Torvalds's avatar
Linus Torvalds committed
612

613 614
	thread = find_alive_thread(father);
	if (thread)
615
		return thread;
Linus Torvalds's avatar
Linus Torvalds committed
616

617
	if (father->signal->has_child_subreaper) {
618
		unsigned int ns_level = task_pid(father)->level;
619
		/*
620
		 * Find the first ->is_child_subreaper ancestor in our pid_ns.
621 622 623 624 625
		 * We can't check reaper != child_reaper to ensure we do not
		 * cross the namespaces, the exiting parent could be injected
		 * by setns() + fork().
		 * We check pid->level, this is slightly more efficient than
		 * task_active_pid_ns(reaper) != task_active_pid_ns(father).
626
		 */
627 628
		for (reaper = father->real_parent;
		     task_pid(reaper)->level == ns_level;
629
		     reaper = reaper->real_parent) {
630
			if (reaper == &init_task)
631 632 633
				break;
			if (!reaper->signal->is_child_subreaper)
				continue;
634 635 636
			thread = find_alive_thread(reaper);
			if (thread)
				return thread;
637
		}
Linus Torvalds's avatar
Linus Torvalds committed
638
	}
639

640
	return child_reaper;
641 642
}

643 644 645
/*
* Any that need to be release_task'd are put on the @dead list.
 */
646
static void reparent_leader(struct task_struct *father, struct task_struct *p,
647 648
				struct list_head *dead)
{
649
	if (unlikely(p->exit_state == EXIT_DEAD))
650 651
		return;

652
	/* We don't want people slaying init. */
653 654 655
	p->exit_signal = SIGCHLD;

	/* If it has exited notify the new parent about this child's death. */
Tejun Heo's avatar
Tejun Heo committed
656
	if (!p->ptrace &&
657
	    p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
658
		if (do_notify_parent(p, p->exit_signal)) {
659
			p->exit_state = EXIT_DEAD;
660
			list_add(&p->ptrace_entry, dead);
661 662 663 664 665 666
		}
	}

	kill_orphaned_pgrp(p, father);
}

667 668 669 670 671 672 673 674 675 676
/*
 * This does two things:
 *
 * A.  Make init inherit all the child processes
 * B.  Check to see if any process groups have become orphaned
 *	as a result of our exiting, and if they have any stopped
 *	jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2)
 */
static void forget_original_parent(struct task_struct *father,
					struct list_head *dead)
Linus Torvalds's avatar
Linus Torvalds committed
677
{
678
	struct task_struct *p, *t, *reaper;
679

680
	if (unlikely(!list_empty(&father->ptraced)))
681
		exit_ptrace(father, dead);
Roland McGrath's avatar
Roland McGrath committed
682

683
	/* Can drop and reacquire tasklist_lock */
684
	reaper = find_child_reaper(father);
685
	if (list_empty(&father->children))
686
		return;
687 688

	reaper = find_new_reaper(father, reaper);
689
	list_for_each_entry(p, &father->children, sibling) {
690
		for_each_thread(p, t) {
691
			t->real_parent = reaper;
692 693
			BUG_ON((!t->ptrace) != (t->parent == father));
			if (likely(!t->ptrace))
694 695 696 697
				t->parent = t->real_parent;
			if (t->pdeath_signal)
				group_send_sig_info(t->pdeath_signal,
						    SEND_SIG_NOINFO, t);
698
		}
699 700 701 702 703
		/*
		 * If this is a threaded reparent there is no need to
		 * notify anyone anything has happened.
		 */
		if (!same_thread_group(reaper, father))
704
			reparent_leader(father, p, dead);
Linus Torvalds's avatar
Linus Torvalds committed
705
	}
706
	list_splice_tail_init(&father->children, &reaper->children);
Linus Torvalds's avatar
Linus Torvalds committed
707 708 709 710 711 712
}

/*
 * Send signals to all our closest relatives so that they know
 * to properly mourn us..
 */
713
static void exit_notify(struct task_struct *tsk, int group_dead)
Linus Torvalds's avatar
Linus Torvalds committed
714
{
715
	bool autoreap;
716 717
	struct task_struct *p, *n;
	LIST_HEAD(dead);
Linus Torvalds's avatar
Linus Torvalds committed
718

719
	write_lock_irq(&tasklist_lock);
720 721
	forget_original_parent(tsk, &dead);

722 723
	if (group_dead)
		kill_orphaned_pgrp(tsk->group_leader, NULL);
Linus Torvalds's avatar
Linus Torvalds committed
724

725 726 727 728 729 730 731 732 733 734 735 736
	if (unlikely(tsk->ptrace)) {
		int sig = thread_group_leader(tsk) &&
				thread_group_empty(tsk) &&
				!ptrace_reparented(tsk) ?
			tsk->exit_signal : SIGCHLD;
		autoreap = do_notify_parent(tsk, sig);
	} else if (thread_group_leader(tsk)) {
		autoreap = thread_group_empty(tsk) &&
			do_notify_parent(tsk, tsk->exit_signal);
	} else {
		autoreap = true;
	}
Linus Torvalds's avatar
Linus Torvalds committed
737

738
	tsk->exit_state = autoreap ? EXIT_DEAD : EXIT_ZOMBIE;
739 740
	if (tsk->exit_state == EXIT_DEAD)
		list_add(&tsk->ptrace_entry, &dead);
Linus Torvalds's avatar
Linus Torvalds committed
741

742 743
	/* mt-exec, de_thread() is waiting for group leader */
	if (unlikely(tsk->signal->notify_count < 0))
744
		wake_up_process(tsk->signal->group_exit_task);
Linus Torvalds's avatar
Linus Torvalds committed
745 746
	write_unlock_irq(&tasklist_lock);

747 748 749 750
	list_for_each_entry_safe(p, n, &dead, ptrace_entry) {
		list_del_init(&p->ptrace_entry);
		release_task(p);
	}
Linus Torvalds's avatar
Linus Torvalds committed
751 752
}

753 754 755 756 757 758 759
#ifdef CONFIG_DEBUG_STACK_USAGE
static void check_stack_usage(void)
{
	static DEFINE_SPINLOCK(low_water_lock);
	static int lowest_to_date = THREAD_SIZE;
	unsigned long free;

760
	free = stack_not_used(current);
761 762 763 764 765 766

	if (free >= lowest_to_date)
		return;

	spin_lock(&low_water_lock);
	if (free < lowest_to_date) {
767
		pr_info("%s (%d) used greatest stack depth: %lu bytes left\n",
768
			current->comm, task_pid_nr(current), free);
769 770 771 772 773 774 775 776
		lowest_to_date = free;
	}
	spin_unlock(&low_water_lock);
}
#else
static inline void check_stack_usage(void) {}
#endif

777
void __noreturn do_exit(long code)
Linus Torvalds's avatar
Linus Torvalds committed
778 779 780
{
	struct task_struct *tsk = current;
	int group_dead;
781
	TASKS_RCU(int tasks_rcu_i);
Linus Torvalds's avatar
Linus Torvalds committed
782 783

	profile_task_exit(tsk);
784
	kcov_task_exit(tsk);
Linus Torvalds's avatar
Linus Torvalds committed
785

786
	WARN_ON(blk_needs_flush_plug(tsk));
787

Linus Torvalds's avatar
Linus Torvalds committed
788 789 790 791 792
	if (unlikely(in_interrupt()))
		panic("Aiee, killing interrupt handler!");
	if (unlikely(!tsk->pid))
		panic("Attempted to kill the idle task!");

793 794 795 796 797 798 799 800 801
	/*
	 * If do_exit is called because this processes oopsed, it's possible
	 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
	 * continuing. Amongst other possible reasons, this is to prevent
	 * mm_release()->clear_child_tid() from writing to a user-controlled
	 * kernel address.
	 */
	set_fs(USER_DS);

Tejun Heo's avatar
Tejun Heo committed
802
	ptrace_event(PTRACE_EVENT_EXIT, code);
Linus Torvalds's avatar
Linus Torvalds committed
803

804 805
	validate_creds_for_do_exit(tsk);

806 807 808 809 810
	/*
	 * We're taking recursive faults here in do_exit. Safest is to just
	 * leave this task alone and wait for reboot.
	 */
	if (unlikely(tsk->flags & PF_EXITING)) {
811
		pr_alert("Fixing recursive fault but reboot is needed!\n");
812 813 814 815 816 817 818 819 820 821
		/*
		 * We can do this unlocked here. The futex code uses
		 * this flag just to verify whether the pi state
		 * cleanup has been done or not. In the worst case it
		 * loops once more. We pretend that the cleanup was
		 * done as there is no way to return. Either the
		 * OWNER_DIED bit is set by now or we push the blocked
		 * task into the wait for ever nirwana as well.
		 */
		tsk->flags |= PF_EXITPIDONE;
822 823 824 825
		set_current_state(TASK_UNINTERRUPTIBLE);
		schedule();
	}

826
	exit_signals(tsk);  /* sets PF_EXITING */
827
	/*
828 829
	 * Ensure that all new tsk->pi_lock acquisitions must observe
	 * PF_EXITING. Serializes against futex.c:attach_to_pi_owner().
830
	 */
831
	smp_mb();
832 833 834 835
	/*
	 * Ensure that we must observe the pi_state in exit_mm() ->
	 * mm_release() -> exit_pi_state_list().
	 */
836
	raw_spin_unlock_wait(&tsk->pi_lock);
Linus Torvalds's avatar
Linus Torvalds committed
837

838
	if (unlikely(in_atomic())) {
839 840 841
		pr_info("note: %s[%d] exited with preempt_count %d\n",
			current->comm, task_pid_nr(current),
			preempt_count());
842 843
		preempt_count_set(PREEMPT_ENABLED);
	}
Linus Torvalds's avatar
Linus Torvalds committed
844

845 846 847
	/* sync mm's RSS info before statistics gathering */
	if (tsk->mm)
		sync_mm_rss(tsk->mm);
848
	acct_update_integrals(tsk);
Linus Torvalds's avatar
Linus Torvalds committed
849
	group_dead = atomic_dec_and_test(&tsk->signal->live);
850
	if (group_dead) {
851
#ifdef CONFIG_POSIX_TIMERS
852
		hrtimer_cancel(&tsk->signal->real_timer);
853
		exit_itimers(tsk->signal);
854
#endif
Jiri Pirko's avatar
Jiri Pirko committed
855 856
		if (tsk->mm)
			setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
857
	}
858
	acct_collect(code, group_dead);
859 860
	if (group_dead)
		tty_audit_exit();
861
	audit_free(tsk);
862

863
	tsk->exit_code = code;
864
	taskstats_exit(tsk, group_dead);
865

866
	exit_mm();
Linus Torvalds's avatar
Linus Torvalds committed
867

868
	if (group_dead)
869
		acct_process();
870 871
	trace_sched_process_exit(tsk);

Linus Torvalds's avatar
Linus Torvalds committed
872
	exit_sem(tsk);
873
	exit_shm(tsk);
874 875
	exit_files(tsk);
	exit_fs(tsk);
876 877
	if (group_dead)
		disassociate_ctty(1);
878
	exit_task_namespaces(tsk);
879
	exit_task_work(tsk);
880
	exit_thread(tsk);
881 882 883 884 885 886 887 888 889

	/*
	 * Flush inherited counters to the parent - before the parent
	 * gets woken up by child-exit notifications.
	 *
	 * because of cgroup mode, must be called before cgroup_exit()
	 */
	perf_event_exit_task(tsk);

890
	sched_autogroup_exit_task(tsk);
891
	cgroup_exit(tsk);
Linus Torvalds's avatar
Linus Torvalds committed
892

893 894 895
	/*
	 * FIXME: do that only when needed, using sched_exit tracepoint
	 */
896
	flush_ptrace_hw_breakpoint(tsk);
897

898
	TASKS_RCU(preempt_disable());
899
	TASKS_RCU(tasks_rcu_i = __srcu_read_lock(&tasks_rcu_exit_srcu));
900
	TASKS_RCU(preempt_enable());
901
	exit_notify(tsk, group_dead);
902
	proc_exit_connector(tsk);
903
	mpol_put_task_policy(tsk);
904
#ifdef CONFIG_FUTEX
905 906
	if (unlikely(current->pi_state_cache))
		kfree(current->pi_state_cache);
907
#endif
908
	/*
909
	 * Make sure we are holding no locks:
910
	 */
911
	debug_check_no_locks_held();
912 913 914 915 916 917
	/*
	 * We can do this unlocked here. The futex code uses this flag
	 * just to verify whether the pi state cleanup has been done
	 * or not. In the worst case it loops once more.
	 */
	tsk->flags |= PF_EXITPIDONE;
Linus Torvalds's avatar
Linus Torvalds committed
918

919
	if (tsk->io_context)
920
		exit_io_context(tsk);
921

922
	if (tsk->splice_pipe)
923
		free_pipe_info(tsk->splice_pipe);
924

925 926 927
	if (tsk->task_frag.page)
		put_page(tsk->task_frag.page);

928 929
	validate_creds_for_do_exit(tsk);

930
	check_stack_usage();
Coywolf Qi Hunt's avatar
Coywolf Qi Hunt committed
931
	preempt_disable();
932 933
	if (tsk->nr_dirtied)
		__this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);
934
	exit_rcu();
935
	TASKS_RCU(__srcu_read_unlock(&tasks_rcu_exit_srcu, tasks_rcu_i));
936

937
	do_task_dead();
Linus Torvalds's avatar
Linus Torvalds committed
938
}
939 940
EXPORT_SYMBOL_GPL(do_exit);

941
void complete_and_exit(struct completion *comp, long code)
Linus Torvalds's avatar
Linus Torvalds committed
942 943 944
{
	if (comp)
		complete(comp);
Oleg Nesterov's avatar
Oleg Nesterov committed
945

Linus Torvalds's avatar
Linus Torvalds committed
946 947 948 949
	do_exit(code);
}
EXPORT_SYMBOL(complete_and_exit);

950
SYSCALL_DEFINE1(exit, int, error_code)
Linus Torvalds's avatar
Linus Torvalds committed
951 952 953 954 955 956 957 958
{
	do_exit((error_code&0xff)<<8);
}

/*
 * Take down every thread in the group.  This is called by fatal signals
 * as well as by sys_exit_group (below).
 */
959
void
Linus Torvalds's avatar
Linus Torvalds committed
960 961
do_group_exit(int exit_code)
{
962 963
	struct signal_struct *sig = current->signal;

Linus Torvalds's avatar
Linus Torvalds committed
964 965
	BUG_ON(exit_code & 0x80); /* core dumps don't get here */

966 967
	if (signal_group_exit(sig))
		exit_code = sig->group_exit_code;
Linus Torvalds's avatar
Linus Torvalds committed
968 969
	else if (!thread_group_empty(current)) {
		struct sighand_struct *const sighand = current->sighand;
970

Linus Torvalds's avatar
Linus Torvalds committed
971
		spin_lock_irq(&sighand->siglock);
972
		if (signal_group_exit(sig))
Linus Torvalds's avatar
Linus Torvalds committed
973 974 975 976
			/* Another thread got here before we took the lock.  */
			exit_code = sig->group_exit_code;
		else {
			sig->group_exit_code = exit_code;
977
			sig->flags = SIGNAL_GROUP_EXIT;
Linus Torvalds's avatar
Linus Torvalds committed
978 979 980 981 982 983 984 985 986 987 988 989 990 991
			zap_other_threads(current);
		}
		spin_unlock_irq(&sighand->siglock);
	}

	do_exit(exit_code);
	/* NOTREACHED */
}

/*
 * this kills every thread in the thread group. Note that any externally
 * wait4()-ing process will get the correct exit code - even if this
 * thread is not the thread group leader.
 */
992
SYSCALL_DEFINE1(exit_group, int, error_code)
Linus Torvalds's avatar
Linus Torvalds committed
993 994
{
	do_group_exit((error_code & 0xff) << 8);
995 996
	/* NOTREACHED */
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
997 998
}

999 1000 1001
struct wait_opts {
	enum pid_type		wo_type;
	int			wo_flags;
1002
	struct pid		*wo_pid;
1003 1004 1005 1006 1007

	struct siginfo __user	*wo_info;
	int __user		*wo_stat;
	struct rusage __user	*wo_rusage;

1008
	wait_queue_t		child_wait;
1009 1010 1011
	int			notask_error;
};

1012 1013
static inline
struct pid *task_pid_type(struct task_struct *task, enum pid_type type)
Eric W. Biederman's avatar
Eric W. Biederman committed
1014
{
1015 1016 1017
	if (type != PIDTYPE_PID)
		task = task->group_leader;
	return task->pids[type].pid;
Eric W. Biederman's avatar
Eric W. Biederman committed
1018 1019
}

1020
static int eligible_pid(struct wait_opts *wo, struct task_struct *p)
Linus Torvalds's avatar
Linus Torvalds committed
1021
{
1022 1023 1024
	return	wo->wo_type == PIDTYPE_MAX ||
		task_pid_type(p, wo->wo_type) == wo->wo_pid;
}
Linus Torvalds's avatar
Linus Torvalds committed
1025

1026 1027
static int
eligible_child(struct wait_opts *wo, bool ptrace, struct task_struct *p)
1028 1029 1030
{
	if (!eligible_pid(wo, p))
		return 0;
1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047

	/*
	 * Wait for all children (clone and not) if __WALL is set or
	 * if it is traced by us.
	 */
	if (ptrace || (wo->wo_flags & __WALL))
		return 1;

	/*
	 * Otherwise, wait for clone children *only* if __WCLONE is set;
	 * otherwise, wait for non-clone children *only*.
	 *
	 * Note: a "clone" child here is one that reports to its parent
	 * using a signal other than SIGCHLD, or a non-leader thread which
	 * we can only see if it is traced by us.
	 */
	if ((p->exit_signal != SIGCHLD) ^ !!(wo->wo_flags & __WCLONE))
Linus Torvalds's avatar
Linus Torvalds committed
1048 1049
		return 0;

1050
	return 1;
Linus Torvalds's avatar
Linus Torvalds committed
1051 1052
}

1053 1054
static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p,
				pid_t pid, uid_t uid, int why, int status)
Linus Torvalds's avatar
Linus Torvalds committed
1055
{
1056 1057 1058
	struct siginfo __user *infop;
	int retval = wo->wo_rusage
		? getrusage(p, RUSAGE_BOTH, wo->wo_rusage) : 0;
1059

Linus Torvalds's avatar
Linus Torvalds committed
1060
	put_task_struct(p);
1061
	infop = wo->wo_info;
1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075
	if (infop) {
		if (!retval)
			retval = put_user(SIGCHLD, &infop->si_signo);
		if (!retval)
			retval = put_user(0, &infop->si_errno);
		if (!retval)
			retval = put_user((short)why, &infop->si_code);
		if (!retval)
			retval = put_user(pid, &infop->si_pid);
		if (!retval)
			retval = put_user(uid, &infop->si_uid);
		if (!retval)
			retval = put_user(status, &infop->si_status);
	}
Linus Torvalds's avatar
Linus Torvalds committed
1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086
	if (!retval)
		retval = pid;
	return retval;
}

/*
 * Handle sys_wait4 work for one task in state EXIT_ZOMBIE.  We hold
 * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
 * the lock and this task is uninteresting.  If we return nonzero, we have
 * released the lock and the system call should return.
 */
1087
static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
Linus Torvalds's avatar
Linus Torvalds committed
1088
{
1089
	int state, retval, status;
1090
	pid_t pid = task_pid_vnr(p);
1091
	uid_t uid = from_kuid_munged(current_user_ns(), task_uid(p));
1092
	struct siginfo __user *infop;
Linus Torvalds's avatar
Linus Torvalds committed
1093

1094
	if (!likely(wo->wo_flags & WEXITED))
Roland McGrath's avatar
Roland McGrath committed
1095 1096
		return 0;

1097
	if (unlikely(wo->wo_flags & WNOWAIT)) {
Linus Torvalds's avatar
Linus Torvalds committed
1098
		int exit_code = p->exit_code;
1099
		int why;
Linus Torvalds's avatar
Linus Torvalds committed
1100 1101 1102

		get_task_struct(p);
		read_unlock(&tasklist_lock);
1103 1104
		sched_annotate_sleep();

Linus Torvalds's avatar
Linus Torvalds committed
1105 1106 1107 1108 1109 1110 1111
		if ((exit_code & 0x7f) == 0) {
			why = CLD_EXITED;
			status = exit_code >> 8;
		} else {
			why = (exit_code & 0x80) ? CLD_DUMPED : CLD_KILLED;
			status = exit_code & 0x7f;
		}
1112
		return wait_noreap_copyout(wo, p, pid, uid, why, status);
Linus Torvalds's avatar
Linus Torvalds committed
1113 1114
	}
	/*
1115
	 * Move the task's state to DEAD/TRACE, only one thread can do this.
Linus Torvalds's avatar
Linus Torvalds committed
1116
	 */
1117 1118
	state = (ptrace_reparented(p) && thread_group_leader(p)) ?
		EXIT_TRACE : EXIT_DEAD;
1119
	if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE)
Linus Torvalds's avatar
Linus Torvalds committed
1120
		return 0;
1121 1122 1123 1124 1125
	/*
	 * We own this thread, nobody else can reap it.
	 */
	read_unlock(&tasklist_lock);
	sched_annotate_sleep();
1126

1127
	/*
1128
	 * Check thread_group_leader() to exclude the traced sub-threads.
1129
	 */
1130
	if (state == EXIT_DEAD && thread_group_leader(p)) {