xref: /illumos-gate/usr/src/uts/common/os/exit.c (revision bbf215553c7233fbab8a0afdf1fac74c44781867)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright 2018 Joyent, Inc.
25  * Copyright 2020 Oxide Computer Company
26  * Copyright 2021 OmniOS Community Edition (OmniOSce) Association.
27  */
28 
29 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
30 
31 #include <sys/types.h>
32 #include <sys/param.h>
33 #include <sys/sysmacros.h>
34 #include <sys/systm.h>
35 #include <sys/cred.h>
36 #include <sys/user.h>
37 #include <sys/errno.h>
38 #include <sys/proc.h>
39 #include <sys/ucontext.h>
40 #include <sys/procfs.h>
41 #include <sys/vnode.h>
42 #include <sys/acct.h>
43 #include <sys/var.h>
44 #include <sys/cmn_err.h>
45 #include <sys/debug.h>
46 #include <sys/wait.h>
47 #include <sys/siginfo.h>
48 #include <sys/procset.h>
49 #include <sys/class.h>
50 #include <sys/file.h>
51 #include <sys/session.h>
52 #include <sys/kmem.h>
53 #include <sys/vtrace.h>
54 #include <sys/prsystm.h>
55 #include <sys/ipc.h>
56 #include <sys/sem_impl.h>
57 #include <c2/audit.h>
58 #include <sys/aio_impl.h>
59 #include <vm/as.h>
60 #include <sys/poll.h>
61 #include <sys/door.h>
62 #include <sys/lwpchan_impl.h>
63 #include <sys/utrap.h>
64 #include <sys/task.h>
65 #include <sys/exacct.h>
66 #include <sys/cyclic.h>
67 #include <sys/schedctl.h>
68 #include <sys/rctl.h>
69 #include <sys/contract_impl.h>
70 #include <sys/contract/process_impl.h>
71 #include <sys/list.h>
72 #include <sys/dtrace.h>
73 #include <sys/pool.h>
74 #include <sys/sdt.h>
75 #include <sys/corectl.h>
76 #include <sys/core.h>
77 #include <sys/brand.h>
78 #include <sys/libc_kernel.h>
79 
80 /*
81  * convert code/data pair into old style wait status
82  */
83 int
wstat(int code,int data)84 wstat(int code, int data)
85 {
86 	int stat = (data & 0377);
87 
88 	switch (code) {
89 	case CLD_EXITED:
90 		stat <<= 8;
91 		break;
92 	case CLD_DUMPED:
93 		stat |= WCOREFLG;
94 		break;
95 	case CLD_KILLED:
96 		break;
97 	case CLD_TRAPPED:
98 	case CLD_STOPPED:
99 		stat <<= 8;
100 		stat |= WSTOPFLG;
101 		break;
102 	case CLD_CONTINUED:
103 		stat = WCONTFLG;
104 		break;
105 	default:
106 		cmn_err(CE_PANIC, "wstat: bad code");
107 		/* NOTREACHED */
108 	}
109 	return (stat);
110 }
111 
112 static char *
exit_reason(char * buf,size_t bufsz,int what,int why)113 exit_reason(char *buf, size_t bufsz, int what, int why)
114 {
115 	switch (why) {
116 	case CLD_EXITED:
117 		(void) snprintf(buf, bufsz, "exited with status %d", what);
118 		break;
119 	case CLD_KILLED:
120 		(void) snprintf(buf, bufsz, "exited on fatal signal %d", what);
121 		break;
122 	case CLD_DUMPED:
123 		(void) snprintf(buf, bufsz, "core dumped on signal %d", what);
124 		break;
125 	default:
126 		(void) snprintf(buf, bufsz, "encountered unknown error "
127 		    "(%d, %d)", why, what);
128 		break;
129 	}
130 
131 	return (buf);
132 }
133 
134 /*
135  * exit system call: pass back caller's arg.
136  */
137 void
rexit(int rval)138 rexit(int rval)
139 {
140 	exit(CLD_EXITED, rval);
141 }
142 
143 /*
144  * Called by proc_exit() when a zone's init exits, presumably because
145  * it failed.  As long as the given zone is still in the "running"
146  * state, we will re-exec() init, but first we need to reset things
147  * which are usually inherited across exec() but will break init's
148  * assumption that it is being exec()'d from a virgin process.  Most
149  * importantly this includes closing all file descriptors (exec only
150  * closes those marked close-on-exec) and resetting signals (exec only
151  * resets handled signals, and we need to clear any signals which
152  * killed init).  Anything else that exec(2) says would be inherited,
153  * but would affect the execution of init, needs to be reset.
154  */
155 static int
restart_init(int what,int why)156 restart_init(int what, int why)
157 {
158 	kthread_t *t = curthread;
159 	klwp_t *lwp = ttolwp(t);
160 	proc_t *p = ttoproc(t);
161 	proc_t *pp = p->p_zone->zone_zsched;
162 	user_t *up = PTOU(p);
163 
164 	vnode_t *oldcd, *oldrd;
165 	int i, err;
166 	char reason_buf[64];
167 
168 	/*
169 	 * Let zone admin (and global zone admin if this is for a non-global
170 	 * zone) know that init has failed and will be restarted.
171 	 */
172 	zcmn_err(p->p_zone->zone_id, CE_WARN,
173 	    "init(8) %s: restarting automatically",
174 	    exit_reason(reason_buf, sizeof (reason_buf), what, why));
175 
176 	if (!INGLOBALZONE(p)) {
177 		cmn_err(CE_WARN, "init(8) for zone %s (pid %d) %s: "
178 		    "restarting automatically",
179 		    p->p_zone->zone_name, p->p_pid, reason_buf);
180 	}
181 
182 	/*
183 	 * Remove any fpollinfo_t's for this (last) thread from our file
184 	 * descriptors so closeall() can ASSERT() that they're all gone.
185 	 * Then close all open file descriptors in the process.
186 	 */
187 	pollcleanup();
188 	closeall(P_FINFO(p));
189 
190 	/*
191 	 * Grab p_lock and begin clearing miscellaneous global process
192 	 * state that needs to be reset before we exec the new init(8).
193 	 */
194 
195 	mutex_enter(&p->p_lock);
196 	prbarrier(p);
197 
198 	p->p_flag &= ~(SKILLED | SEXTKILLED | SEXITING | SDOCORE);
199 	up->u_cmask = CMASK;
200 
201 	sigemptyset(&t->t_hold);
202 	sigemptyset(&t->t_sig);
203 	sigemptyset(&t->t_extsig);
204 
205 	sigemptyset(&p->p_sig);
206 	sigemptyset(&p->p_extsig);
207 
208 	sigdelq(p, t, 0);
209 	sigdelq(p, NULL, 0);
210 
211 	if (p->p_killsqp) {
212 		siginfofree(p->p_killsqp);
213 		p->p_killsqp = NULL;
214 	}
215 
216 	/*
217 	 * Reset any signals that are ignored back to the default disposition.
218 	 * Other u_signal members will be cleared when exec calls sigdefault().
219 	 */
220 	for (i = 1; i < NSIG; i++) {
221 		if (up->u_signal[i - 1] == SIG_IGN) {
222 			up->u_signal[i - 1] = SIG_DFL;
223 			sigemptyset(&up->u_sigmask[i - 1]);
224 		}
225 	}
226 
227 	/*
228 	 * Clear the current signal, any signal info associated with it, and
229 	 * any signal information from contracts and/or contract templates.
230 	 */
231 	lwp->lwp_cursig = 0;
232 	lwp->lwp_extsig = 0;
233 	if (lwp->lwp_curinfo != NULL) {
234 		siginfofree(lwp->lwp_curinfo);
235 		lwp->lwp_curinfo = NULL;
236 	}
237 	lwp_ctmpl_clear(lwp);
238 
239 	/*
240 	 * Reset both the process root directory and the current working
241 	 * directory to the root of the zone just as we do during boot.
242 	 */
243 	VN_HOLD(p->p_zone->zone_rootvp);
244 	oldrd = up->u_rdir;
245 	up->u_rdir = p->p_zone->zone_rootvp;
246 
247 	VN_HOLD(p->p_zone->zone_rootvp);
248 	oldcd = up->u_cdir;
249 	up->u_cdir = p->p_zone->zone_rootvp;
250 
251 	if (up->u_cwd != NULL) {
252 		refstr_rele(up->u_cwd);
253 		up->u_cwd = NULL;
254 	}
255 
256 	/* Reset security flags */
257 	mutex_enter(&pp->p_lock);
258 	p->p_secflags = pp->p_secflags;
259 	mutex_exit(&pp->p_lock);
260 
261 	mutex_exit(&p->p_lock);
262 
263 	if (oldrd != NULL)
264 		VN_RELE(oldrd);
265 	if (oldcd != NULL)
266 		VN_RELE(oldcd);
267 
268 	/*
269 	 * It's possible that a zone's init will have become privilege aware
270 	 * and modified privilege sets; reset them.
271 	 */
272 	cred_t *oldcr, *newcr;
273 
274 	mutex_enter(&p->p_crlock);
275 	oldcr = p->p_cred;
276 	mutex_enter(&pp->p_crlock);
277 	crhold(newcr = p->p_cred = pp->p_cred);
278 	mutex_exit(&pp->p_crlock);
279 	mutex_exit(&p->p_crlock);
280 	crfree(oldcr);
281 	/* Additional hold for the current thread - expected by crset() */
282 	crhold(newcr);
283 	crset(p, newcr);
284 
285 	/* Free the controlling tty.  (freectty() always assumes curproc.) */
286 	ASSERT(p == curproc);
287 	(void) freectty(B_TRUE);
288 
289 	/*
290 	 * Now exec() the new init(8) on top of the current process.  If we
291 	 * succeed, the caller will treat this like a successful system call.
292 	 * If we fail, we issue messages and the caller will proceed with exit.
293 	 */
294 	err = exec_init(p->p_zone->zone_initname, NULL);
295 
296 	if (err == 0)
297 		return (0);
298 
299 	zcmn_err(p->p_zone->zone_id, CE_WARN,
300 	    "failed to restart init(8) (err=%d): system reboot required", err);
301 
302 	if (!INGLOBALZONE(p)) {
303 		cmn_err(CE_WARN, "failed to restart init(8) for zone %s "
304 		    "(pid %d, err=%d): zoneadm(8) boot required",
305 		    p->p_zone->zone_name, p->p_pid, err);
306 	}
307 
308 	return (-1);
309 }
310 
311 /*
312  * Release resources.
313  * Enter zombie state.
314  * Wake up parent and init processes,
315  * and dispose of children.
316  */
317 void
exit(int why,int what)318 exit(int why, int what)
319 {
320 	/*
321 	 * If proc_exit() fails, then some other lwp in the process
322 	 * got there first.  We just have to call lwp_exit() to allow
323 	 * the other lwp to finish exiting the process.  Otherwise we're
324 	 * restarting init, and should return.
325 	 */
326 	if (proc_exit(why, what) != 0) {
327 		mutex_enter(&curproc->p_lock);
328 		ASSERT(curproc->p_flag & SEXITLWPS);
329 		lwp_exit();
330 		/* NOTREACHED */
331 	}
332 }
333 
334 /*
335  * Set the SEXITING flag on the process, after making sure /proc does
336  * not have it locked.  This is done in more places than proc_exit(),
337  * so it is a separate function.
338  */
339 void
proc_is_exiting(proc_t * p)340 proc_is_exiting(proc_t *p)
341 {
342 	mutex_enter(&p->p_lock);
343 	prbarrier(p);
344 	p->p_flag |= SEXITING;
345 	mutex_exit(&p->p_lock);
346 }
347 
348 /*
349  * Return true if zone's init is restarted, false if exit processing should
350  * proceeed.
351  */
352 static boolean_t
zone_init_exit(zone_t * z,int why,int what)353 zone_init_exit(zone_t *z, int why, int what)
354 {
355 	/*
356 	 * Typically we don't let the zone's init exit unless zone_start_init()
357 	 * failed its exec, or we are shutting down the zone or the machine,
358 	 * although the various flags handled within this function will control
359 	 * the behavior.
360 	 *
361 	 * Since we are single threaded, we don't need to lock the following
362 	 * accesses to zone_proc_initpid.
363 	 */
364 	if (z->zone_boot_err != 0 ||
365 	    zone_status_get(z) >= ZONE_IS_SHUTTING_DOWN ||
366 	    zone_status_get(global_zone) >= ZONE_IS_SHUTTING_DOWN) {
367 		/*
368 		 * Clear the zone's init pid and proceed with exit processing.
369 		 */
370 		z->zone_proc_initpid = -1;
371 		return (B_FALSE);
372 	}
373 
374 	/*
375 	 * There are a variety of configuration flags on the zone to control
376 	 * init exit behavior.
377 	 *
378 	 * If the init process should be restarted, the "zone_restart_init"
379 	 * member will be set.
380 	 */
381 	if (!z->zone_restart_init) {
382 		/*
383 		 * The zone has been set up to halt when init exits.
384 		 */
385 		(void) zone_kadmin(A_SHUTDOWN, AD_HALT, NULL, zone_kcred());
386 		z->zone_proc_initpid = -1;
387 		return (B_FALSE);
388 	}
389 
390 	/*
391 	 * At this point we know we're configured to restart init, but there
392 	 * are various modifiers to that behavior.
393 	 */
394 
395 	if (z->zone_reboot_on_init_exit) {
396 		/*
397 		 * Some init programs in branded zones do not tolerate a
398 		 * restart in the traditional manner; setting
399 		 * "zone_reboot_on_init_exit" will cause the entire zone to be
400 		 * rebooted instead.
401 		 */
402 
403 		if (z->zone_restart_init_0) {
404 			/*
405 			 * Some init programs in branded zones only want to
406 			 * restart if they exit 0, otherwise the zone should
407 			 * shutdown. Setting the "zone_restart_init_0" member
408 			 * controls this behavior.
409 			 */
410 			if (why == CLD_EXITED && what == 0) {
411 				/* Trigger a zone reboot */
412 				(void) zone_kadmin(A_REBOOT, 0, NULL,
413 				    zone_kcred());
414 			} else {
415 				/* Shutdown instead of reboot */
416 				(void) zone_kadmin(A_SHUTDOWN, AD_HALT, NULL,
417 				    zone_kcred());
418 			}
419 		} else {
420 			/* Trigger a zone reboot */
421 			(void) zone_kadmin(A_REBOOT, 0, NULL, zone_kcred());
422 		}
423 
424 		z->zone_proc_initpid = -1;
425 		return (B_FALSE);
426 	}
427 
428 	if (z->zone_restart_init_0) {
429 		/*
430 		 * Some init programs in branded zones only want to restart if
431 		 * they exit 0, otherwise the zone should shutdown. Setting the
432 		 * "zone_restart_init_0" member controls this behavior.
433 		 *
434 		 * In this case we only restart init if it exited successfully.
435 		 */
436 		if (why == CLD_EXITED && what == 0 &&
437 		    restart_init(what, why) == 0) {
438 			return (B_TRUE);
439 		}
440 	} else {
441 		/*
442 		 * No restart modifiers on the zone, attempt to restart init.
443 		 */
444 		if (restart_init(what, why) == 0)
445 			return (B_TRUE);
446 	}
447 
448 	/*
449 	 * The restart failed, or the criteria for a restart are not met;
450 	 * the zone will shut down.
451 	 */
452 	(void) zone_kadmin(A_SHUTDOWN, AD_HALT, NULL, zone_kcred());
453 	z->zone_proc_initpid = -1;
454 	return (B_FALSE);
455 }
456 
457 /*
458  * Return value:
459  *   1 - exitlwps() failed, call (or continue) lwp_exit()
460  *   0 - restarting init.  Return through system call path
461  */
462 int
proc_exit(int why,int what)463 proc_exit(int why, int what)
464 {
465 	kthread_t *t = curthread;
466 	klwp_t *lwp = ttolwp(t);
467 	proc_t *p = ttoproc(t);
468 	zone_t *z = p->p_zone;
469 	timeout_id_t tmp_id;
470 	int rv;
471 	proc_t *q;
472 	task_t *tk;
473 	vnode_t *exec_vp, *execdir_vp, *cdir, *rdir;
474 	sigqueue_t *sqp;
475 	lwpdir_t *lwpdir;
476 	uint_t lwpdir_sz;
477 	tidhash_t *tidhash;
478 	uint_t tidhash_sz;
479 	ret_tidhash_t *ret_tidhash;
480 	refstr_t *cwd;
481 	hrtime_t hrutime, hrstime;
482 	int evaporate;
483 
484 	/*
485 	 * Stop and discard the process's lwps except for the current one,
486 	 * unless some other lwp beat us to it.  If exitlwps() fails then
487 	 * return and the calling lwp will call (or continue in) lwp_exit().
488 	 */
489 	proc_is_exiting(p);
490 	if (exitlwps(0) != 0)
491 		return (1);
492 
493 	mutex_enter(&p->p_lock);
494 	if (p->p_ttime > 0) {
495 		/*
496 		 * Account any remaining ticks charged to this process
497 		 * on its way out.
498 		 */
499 		(void) task_cpu_time_incr(p->p_task, p->p_ttime);
500 		p->p_ttime = 0;
501 	}
502 	mutex_exit(&p->p_lock);
503 
504 	DTRACE_PROC(lwp__exit);
505 	DTRACE_PROC1(exit, int, why);
506 
507 	/*
508 	 * Will perform any brand specific proc exit processing, since this
509 	 * is always the last lwp, will also perform lwp_exit and free brand
510 	 * data
511 	 */
512 	if (PROC_IS_BRANDED(p)) {
513 		lwp_detach_brand_hdlrs(lwp);
514 		brand_clearbrand(p, B_FALSE);
515 	}
516 
517 	/*
518 	 * Don't let init exit unless zone_start_init() failed its exec, or
519 	 * we are shutting down the zone or the machine.
520 	 *
521 	 * Since we are single threaded, we don't need to lock the
522 	 * following accesses to zone_proc_initpid.
523 	 */
524 	if (p->p_pid == z->zone_proc_initpid) {
525 		/* If zone's init restarts, we're done here. */
526 		if (zone_init_exit(z, why, what))
527 			return (0);
528 	}
529 
530 	lwp_pcb_exit();
531 
532 	/*
533 	 * Allocate a sigqueue now, before we grab locks.
534 	 * It will be given to sigcld(), below.
535 	 * Special case:  If we will be making the process disappear
536 	 * without a trace because it is either:
537 	 *	* an exiting SSYS process, or
538 	 *	* a posix_spawn() vfork child who requests it,
539 	 * we don't bother to allocate a useless sigqueue.
540 	 */
541 	evaporate = (p->p_flag & SSYS) || ((p->p_flag & SVFORK) &&
542 	    why == CLD_EXITED && what == _EVAPORATE);
543 	if (!evaporate)
544 		sqp = kmem_zalloc(sizeof (sigqueue_t), KM_SLEEP);
545 
546 	/*
547 	 * revoke any doors created by the process.
548 	 */
549 	if (p->p_door_list)
550 		door_exit();
551 
552 	/*
553 	 * Release schedctl data structures.
554 	 */
555 	if (p->p_pagep)
556 		schedctl_proc_cleanup();
557 
558 	/*
559 	 * make sure all pending kaio has completed.
560 	 */
561 	if (p->p_aio)
562 		aio_cleanup_exit();
563 
564 	/*
565 	 * discard the lwpchan cache.
566 	 */
567 	if (p->p_lcp != NULL)
568 		lwpchan_destroy_cache(0);
569 
570 	/*
571 	 * Clean up any DTrace helper actions or probes for the process.
572 	 */
573 	if (p->p_dtrace_helpers != NULL) {
574 		ASSERT(dtrace_helpers_cleanup != NULL);
575 		(*dtrace_helpers_cleanup)(p);
576 	}
577 
578 	/*
579 	 * Clean up any signalfd state for the process.
580 	 */
581 	if (p->p_sigfd != NULL) {
582 		VERIFY(sigfd_exit_helper != NULL);
583 		(*sigfd_exit_helper)();
584 	}
585 
586 	/* untimeout the realtime timers */
587 	if (p->p_itimer != NULL)
588 		timer_exit();
589 
590 	if ((tmp_id = p->p_alarmid) != 0) {
591 		p->p_alarmid = 0;
592 		(void) untimeout(tmp_id);
593 	}
594 
595 	/*
596 	 * If we had generated any upanic(2) state, free that now.
597 	 */
598 	if (p->p_upanic != NULL) {
599 		kmem_free(p->p_upanic, PRUPANIC_BUFLEN);
600 		p->p_upanic = NULL;
601 	}
602 
603 	/*
604 	 * Remove any fpollinfo_t's for this (last) thread from our file
605 	 * descriptors so closeall() can ASSERT() that they're all gone.
606 	 */
607 	pollcleanup();
608 
609 	if (p->p_rprof_cyclic != CYCLIC_NONE) {
610 		mutex_enter(&cpu_lock);
611 		cyclic_remove(p->p_rprof_cyclic);
612 		mutex_exit(&cpu_lock);
613 	}
614 
615 	mutex_enter(&p->p_lock);
616 
617 	/*
618 	 * Clean up any DTrace probes associated with this process.
619 	 */
620 	if (p->p_dtrace_probes) {
621 		ASSERT(dtrace_fasttrap_exit_ptr != NULL);
622 		dtrace_fasttrap_exit_ptr(p);
623 	}
624 
625 	while ((tmp_id = p->p_itimerid) != 0) {
626 		p->p_itimerid = 0;
627 		mutex_exit(&p->p_lock);
628 		(void) untimeout(tmp_id);
629 		mutex_enter(&p->p_lock);
630 	}
631 
632 	lwp_cleanup();
633 
634 	/*
635 	 * We are about to exit; prevent our resource associations from
636 	 * being changed.
637 	 */
638 	pool_barrier_enter();
639 
640 	/*
641 	 * Block the process against /proc now that we have really
642 	 * acquired p->p_lock (to manipulate p_tlist at least).
643 	 */
644 	prbarrier(p);
645 
646 	sigfillset(&p->p_ignore);
647 	sigemptyset(&p->p_siginfo);
648 	sigemptyset(&p->p_sig);
649 	sigemptyset(&p->p_extsig);
650 	sigemptyset(&t->t_sig);
651 	sigemptyset(&t->t_extsig);
652 	sigemptyset(&p->p_sigmask);
653 	sigdelq(p, t, 0);
654 	lwp->lwp_cursig = 0;
655 	lwp->lwp_extsig = 0;
656 	p->p_flag &= ~(SKILLED | SEXTKILLED);
657 	if (lwp->lwp_curinfo) {
658 		siginfofree(lwp->lwp_curinfo);
659 		lwp->lwp_curinfo = NULL;
660 	}
661 
662 	t->t_proc_flag |= TP_LWPEXIT;
663 	ASSERT(p->p_lwpcnt == 1 && p->p_zombcnt == 0);
664 	prlwpexit(t);		/* notify /proc */
665 	lwp_hash_out(p, t->t_tid);
666 	prexit(p);
667 
668 	p->p_lwpcnt = 0;
669 	p->p_tlist = NULL;
670 	sigqfree(p);
671 	term_mstate(t);
672 	p->p_mterm = gethrtime();
673 
674 	exec_vp = p->p_exec;
675 	execdir_vp = p->p_execdir;
676 	p->p_exec = NULLVP;
677 	p->p_execdir = NULLVP;
678 	mutex_exit(&p->p_lock);
679 
680 	pr_free_watched_pages(p);
681 
682 	closeall(P_FINFO(p));
683 
684 	/* Free the controlling tty.  (freectty() always assumes curproc.) */
685 	ASSERT(p == curproc);
686 	(void) freectty(B_TRUE);
687 
688 #if defined(__sparc)
689 	if (p->p_utraps != NULL)
690 		utrap_free(p);
691 #endif
692 	if (p->p_semacct)			/* IPC semaphore exit */
693 		semexit(p);
694 	rv = wstat(why, what);
695 
696 	acct(rv & 0xff);
697 	exacct_commit_proc(p, rv);
698 
699 	/*
700 	 * Release any resources associated with C2 auditing
701 	 */
702 	if (AU_AUDITING()) {
703 		/*
704 		 * audit exit system call
705 		 */
706 		audit_exit(why, what);
707 	}
708 
709 	/*
710 	 * Free address space.
711 	 */
712 	relvm();
713 
714 	if (exec_vp) {
715 		/*
716 		 * Close this executable which has been opened when the process
717 		 * was created by getproc().
718 		 */
719 		(void) VOP_CLOSE(exec_vp, FREAD, 1, (offset_t)0, CRED(), NULL);
720 		VN_RELE(exec_vp);
721 	}
722 	if (execdir_vp)
723 		VN_RELE(execdir_vp);
724 
725 	/*
726 	 * Release held contracts.
727 	 */
728 	contract_exit(p);
729 
730 	/*
731 	 * Depart our encapsulating process contract.
732 	 */
733 	if ((p->p_flag & SSYS) == 0) {
734 		ASSERT(p->p_ct_process);
735 		contract_process_exit(p->p_ct_process, p, rv);
736 	}
737 
738 	/*
739 	 * Remove pool association, and block if requested by pool_do_bind.
740 	 */
741 	mutex_enter(&p->p_lock);
742 	ASSERT(p->p_pool->pool_ref > 0);
743 	atomic_dec_32(&p->p_pool->pool_ref);
744 	p->p_pool = pool_default;
745 	/*
746 	 * Now that our address space has been freed and all other threads
747 	 * in this process have exited, set the PEXITED pool flag.  This
748 	 * tells the pools subsystems to ignore this process if it was
749 	 * requested to rebind this process to a new pool.
750 	 */
751 	p->p_poolflag |= PEXITED;
752 	pool_barrier_exit();
753 	mutex_exit(&p->p_lock);
754 
755 	mutex_enter(&pidlock);
756 
757 	/*
758 	 * Delete this process from the newstate list of its parent. We
759 	 * will put it in the right place in the sigcld in the end.
760 	 */
761 	delete_ns(p->p_parent, p);
762 
763 	/*
764 	 * Reassign the orphans to the next of kin.
765 	 * Don't rearrange init's orphanage.
766 	 */
767 	if ((q = p->p_orphan) != NULL && p != proc_init) {
768 
769 		proc_t *nokp = p->p_nextofkin;
770 
771 		for (;;) {
772 			q->p_nextofkin = nokp;
773 			if (q->p_nextorph == NULL)
774 				break;
775 			q = q->p_nextorph;
776 		}
777 		q->p_nextorph = nokp->p_orphan;
778 		nokp->p_orphan = p->p_orphan;
779 		p->p_orphan = NULL;
780 	}
781 
782 	/*
783 	 * Reassign the children to init.
784 	 * Don't try to assign init's children to init.
785 	 */
786 	if ((q = p->p_child) != NULL && p != proc_init) {
787 		struct proc	*np;
788 		struct proc	*initp = proc_init;
789 		boolean_t	setzonetop = B_FALSE;
790 
791 		if (!INGLOBALZONE(curproc))
792 			setzonetop = B_TRUE;
793 
794 		pgdetach(p);
795 
796 		do {
797 			np = q->p_sibling;
798 			/*
799 			 * Delete it from its current parent new state
800 			 * list and add it to init new state list
801 			 */
802 			delete_ns(q->p_parent, q);
803 
804 			q->p_ppid = 1;
805 			q->p_pidflag &= ~(CLDNOSIGCHLD | CLDWAITPID);
806 			if (setzonetop) {
807 				mutex_enter(&q->p_lock);
808 				q->p_flag |= SZONETOP;
809 				mutex_exit(&q->p_lock);
810 			}
811 			q->p_parent = initp;
812 
813 			/*
814 			 * Since q will be the first child,
815 			 * it will not have a previous sibling.
816 			 */
817 			q->p_psibling = NULL;
818 			if (initp->p_child) {
819 				initp->p_child->p_psibling = q;
820 			}
821 			q->p_sibling = initp->p_child;
822 			initp->p_child = q;
823 			if (q->p_proc_flag & P_PR_PTRACE) {
824 				mutex_enter(&q->p_lock);
825 				sigtoproc(q, NULL, SIGKILL);
826 				mutex_exit(&q->p_lock);
827 			}
828 			/*
829 			 * sigcld() will add the child to parents
830 			 * newstate list.
831 			 */
832 			if (q->p_stat == SZOMB)
833 				sigcld(q, NULL);
834 		} while ((q = np) != NULL);
835 
836 		p->p_child = NULL;
837 		ASSERT(p->p_child_ns == NULL);
838 	}
839 
840 	TRACE_1(TR_FAC_PROC, TR_PROC_EXIT, "proc_exit: %p", p);
841 
842 	mutex_enter(&p->p_lock);
843 	CL_EXIT(curthread); /* tell the scheduler that curthread is exiting */
844 
845 	/*
846 	 * Have our task accummulate our resource usage data before they
847 	 * become contaminated by p_cacct etc., and before we renounce
848 	 * membership of the task.
849 	 *
850 	 * We do this regardless of whether or not task accounting is active.
851 	 * This is to avoid having nonsense data reported for this task if
852 	 * task accounting is subsequently enabled. The overhead is minimal;
853 	 * by this point, this process has accounted for the usage of all its
854 	 * LWPs. We nonetheless do the work here, and under the protection of
855 	 * pidlock, so that the movement of the process's usage to the task
856 	 * happens at the same time as the removal of the process from the
857 	 * task, from the point of view of exacct_snapshot_task_usage().
858 	 */
859 	exacct_update_task_mstate(p);
860 
861 	hrutime = mstate_aggr_state(p, LMS_USER);
862 	hrstime = mstate_aggr_state(p, LMS_SYSTEM);
863 	p->p_utime = (clock_t)NSEC_TO_TICK(hrutime) + p->p_cutime;
864 	p->p_stime = (clock_t)NSEC_TO_TICK(hrstime) + p->p_cstime;
865 
866 	p->p_acct[LMS_USER]	+= p->p_cacct[LMS_USER];
867 	p->p_acct[LMS_SYSTEM]	+= p->p_cacct[LMS_SYSTEM];
868 	p->p_acct[LMS_TRAP]	+= p->p_cacct[LMS_TRAP];
869 	p->p_acct[LMS_TFAULT]	+= p->p_cacct[LMS_TFAULT];
870 	p->p_acct[LMS_DFAULT]	+= p->p_cacct[LMS_DFAULT];
871 	p->p_acct[LMS_KFAULT]	+= p->p_cacct[LMS_KFAULT];
872 	p->p_acct[LMS_USER_LOCK] += p->p_cacct[LMS_USER_LOCK];
873 	p->p_acct[LMS_SLEEP]	+= p->p_cacct[LMS_SLEEP];
874 	p->p_acct[LMS_WAIT_CPU]	+= p->p_cacct[LMS_WAIT_CPU];
875 	p->p_acct[LMS_STOPPED]	+= p->p_cacct[LMS_STOPPED];
876 
877 	p->p_ru.minflt	+= p->p_cru.minflt;
878 	p->p_ru.majflt	+= p->p_cru.majflt;
879 	p->p_ru.nswap	+= p->p_cru.nswap;
880 	p->p_ru.inblock	+= p->p_cru.inblock;
881 	p->p_ru.oublock	+= p->p_cru.oublock;
882 	p->p_ru.msgsnd	+= p->p_cru.msgsnd;
883 	p->p_ru.msgrcv	+= p->p_cru.msgrcv;
884 	p->p_ru.nsignals += p->p_cru.nsignals;
885 	p->p_ru.nvcsw	+= p->p_cru.nvcsw;
886 	p->p_ru.nivcsw	+= p->p_cru.nivcsw;
887 	p->p_ru.sysc	+= p->p_cru.sysc;
888 	p->p_ru.ioch	+= p->p_cru.ioch;
889 
890 	p->p_stat = SZOMB;
891 	p->p_proc_flag &= ~P_PR_PTRACE;
892 	p->p_wdata = what;
893 	p->p_wcode = (char)why;
894 
895 	cdir = PTOU(p)->u_cdir;
896 	rdir = PTOU(p)->u_rdir;
897 	cwd = PTOU(p)->u_cwd;
898 
899 	ASSERT(cdir != NULL || p->p_parent == &p0);
900 
901 	/*
902 	 * Release resource controls, as they are no longer enforceable.
903 	 */
904 	rctl_set_free(p->p_rctls);
905 
906 	/*
907 	 * Decrement tk_nlwps counter for our task.max-lwps resource control.
908 	 * An extended accounting record, if that facility is active, is
909 	 * scheduled to be written.  We cannot give up task and project
910 	 * membership at this point because that would allow zombies to escape
911 	 * from the max-processes resource controls.  Zombies stay in their
912 	 * current task and project until the process table slot is released
913 	 * in freeproc().
914 	 */
915 	tk = p->p_task;
916 
917 	mutex_enter(&p->p_zone->zone_nlwps_lock);
918 	tk->tk_nlwps--;
919 	tk->tk_proj->kpj_nlwps--;
920 	p->p_zone->zone_nlwps--;
921 	mutex_exit(&p->p_zone->zone_nlwps_lock);
922 
923 	/*
924 	 * Clear the lwp directory and the lwpid hash table
925 	 * now that /proc can't bother us any more.
926 	 * We free the memory below, after dropping p->p_lock.
927 	 */
928 	lwpdir = p->p_lwpdir;
929 	lwpdir_sz = p->p_lwpdir_sz;
930 	tidhash = p->p_tidhash;
931 	tidhash_sz = p->p_tidhash_sz;
932 	ret_tidhash = p->p_ret_tidhash;
933 	p->p_lwpdir = NULL;
934 	p->p_lwpfree = NULL;
935 	p->p_lwpdir_sz = 0;
936 	p->p_tidhash = NULL;
937 	p->p_tidhash_sz = 0;
938 	p->p_ret_tidhash = NULL;
939 
940 	/*
941 	 * If the process has context ops installed, call the exit routine
942 	 * on behalf of this last remaining thread. Normally exitpctx() is
943 	 * called during thread_exit() or lwp_exit(), but because this is the
944 	 * last thread in the process, we must call it here. By the time
945 	 * thread_exit() is called (below), the association with the relevant
946 	 * process has been lost.
947 	 *
948 	 * We also free the context here.
949 	 */
950 	if (p->p_pctx) {
951 		kpreempt_disable();
952 		exitpctx(p);
953 		kpreempt_enable();
954 
955 		freepctx(p, 0);
956 	}
957 
958 	/*
959 	 * curthread's proc pointer is changed to point to the 'sched'
960 	 * process for the corresponding zone, except in the case when
961 	 * the exiting process is in fact a zsched instance, in which
962 	 * case the proc pointer is set to p0.  We do so, so that the
963 	 * process still points at the right zone when we call the VN_RELE()
964 	 * below.
965 	 *
966 	 * This is because curthread's original proc pointer can be freed as
967 	 * soon as the child sends a SIGCLD to its parent.  We use zsched so
968 	 * that for user processes, even in the final moments of death, the
969 	 * process is still associated with its zone.
970 	 */
971 	if (p != t->t_procp->p_zone->zone_zsched)
972 		t->t_procp = t->t_procp->p_zone->zone_zsched;
973 	else
974 		t->t_procp = &p0;
975 
976 	mutex_exit(&p->p_lock);
977 	if (!evaporate) {
978 		p->p_pidflag &= ~CLDPEND;
979 		sigcld(p, sqp);
980 	} else {
981 		/*
982 		 * Do what sigcld() would do if the disposition
983 		 * of the SIGCHLD signal were set to be ignored.
984 		 */
985 		cv_broadcast(&p->p_srwchan_cv);
986 		freeproc(p);
987 	}
988 	mutex_exit(&pidlock);
989 
990 	/*
991 	 * We don't release u_cdir and u_rdir until SZOMB is set.
992 	 * This protects us against dofusers().
993 	 */
994 	if (cdir)
995 		VN_RELE(cdir);
996 	if (rdir)
997 		VN_RELE(rdir);
998 	if (cwd)
999 		refstr_rele(cwd);
1000 
1001 	/*
1002 	 * task_rele() may ultimately cause the zone to go away (or
1003 	 * may cause the last user process in a zone to go away, which
1004 	 * signals zsched to go away).  So prior to this call, we must
1005 	 * no longer point at zsched.
1006 	 */
1007 	t->t_procp = &p0;
1008 
1009 	kmem_free(lwpdir, lwpdir_sz * sizeof (lwpdir_t));
1010 	kmem_free(tidhash, tidhash_sz * sizeof (tidhash_t));
1011 	while (ret_tidhash != NULL) {
1012 		ret_tidhash_t *next = ret_tidhash->rth_next;
1013 		kmem_free(ret_tidhash->rth_tidhash,
1014 		    ret_tidhash->rth_tidhash_sz * sizeof (tidhash_t));
1015 		kmem_free(ret_tidhash, sizeof (*ret_tidhash));
1016 		ret_tidhash = next;
1017 	}
1018 
1019 	thread_exit();
1020 	/* NOTREACHED */
1021 }
1022 
1023 /*
1024  * Format siginfo structure for wait system calls.
1025  */
1026 void
winfo(proc_t * pp,k_siginfo_t * ip,int waitflag)1027 winfo(proc_t *pp, k_siginfo_t *ip, int waitflag)
1028 {
1029 	ASSERT(MUTEX_HELD(&pidlock));
1030 
1031 	bzero(ip, sizeof (k_siginfo_t));
1032 	ip->si_signo = SIGCLD;
1033 	ip->si_code = pp->p_wcode;
1034 	ip->si_pid = pp->p_pid;
1035 	ip->si_ctid = PRCTID(pp);
1036 	ip->si_zoneid = pp->p_zone->zone_id;
1037 	ip->si_status = pp->p_wdata;
1038 	ip->si_stime = pp->p_stime;
1039 	ip->si_utime = pp->p_utime;
1040 
1041 	if (waitflag) {
1042 		pp->p_wcode = 0;
1043 		pp->p_wdata = 0;
1044 		pp->p_pidflag &= ~CLDPEND;
1045 	}
1046 }
1047 
1048 /*
1049  * Wait system call.
1050  * Search for a terminated (zombie) child,
1051  * finally lay it to rest, and collect its status.
1052  * Look also for stopped children,
1053  * and pass back status from them.
1054  */
1055 int
waitid(idtype_t idtype,id_t id,k_siginfo_t * ip,int options)1056 waitid(idtype_t idtype, id_t id, k_siginfo_t *ip, int options)
1057 {
1058 	int found;
1059 	proc_t *cp, *pp;
1060 	int proc_gone;
1061 	int waitflag = !(options & WNOWAIT);
1062 
1063 	/*
1064 	 * Obsolete flag, defined here only for binary compatibility
1065 	 * with old statically linked executables.  Delete this when
1066 	 * we no longer care about these old and broken applications.
1067 	 */
1068 #define	_WNOCHLD	0400
1069 	options &= ~_WNOCHLD;
1070 
1071 	if (options == 0 || (options & ~WOPTMASK))
1072 		return (EINVAL);
1073 
1074 	switch (idtype) {
1075 	case P_PID:
1076 	case P_PGID:
1077 		if (id < 0 || id >= maxpid)
1078 			return (EINVAL);
1079 		/* FALLTHROUGH */
1080 	case P_ALL:
1081 		break;
1082 	default:
1083 		return (EINVAL);
1084 	}
1085 
1086 	pp = ttoproc(curthread);
1087 
1088 	/*
1089 	 * lock parent mutex so that sibling chain can be searched.
1090 	 */
1091 	mutex_enter(&pidlock);
1092 
1093 	/*
1094 	 * if we are only looking for exited processes and child_ns list
1095 	 * is empty no reason to look at all children.
1096 	 */
1097 	if (idtype == P_ALL &&
1098 	    (options & ~WNOWAIT) == (WNOHANG | WEXITED) &&
1099 	    pp->p_child_ns == NULL) {
1100 		if (pp->p_child) {
1101 			mutex_exit(&pidlock);
1102 			bzero(ip, sizeof (k_siginfo_t));
1103 			return (0);
1104 		}
1105 		mutex_exit(&pidlock);
1106 		return (ECHILD);
1107 	}
1108 
1109 	while (pp->p_child != NULL) {
1110 
1111 		proc_gone = 0;
1112 
1113 		for (cp = pp->p_child_ns; cp != NULL; cp = cp->p_sibling_ns) {
1114 			if (idtype != P_PID && (cp->p_pidflag & CLDWAITPID))
1115 				continue;
1116 			if (idtype == P_PID && id != cp->p_pid)
1117 				continue;
1118 			if (idtype == P_PGID && id != cp->p_pgrp)
1119 				continue;
1120 
1121 			switch (cp->p_wcode) {
1122 
1123 			case CLD_TRAPPED:
1124 			case CLD_STOPPED:
1125 			case CLD_CONTINUED:
1126 				cmn_err(CE_PANIC,
1127 				    "waitid: wrong state %d on the p_newstate"
1128 				    " list", cp->p_wcode);
1129 				break;
1130 
1131 			case CLD_EXITED:
1132 			case CLD_DUMPED:
1133 			case CLD_KILLED:
1134 				if (!(options & WEXITED)) {
1135 					/*
1136 					 * Count how many are already gone
1137 					 * for good.
1138 					 */
1139 					proc_gone++;
1140 					break;
1141 				}
1142 				if (!waitflag) {
1143 					winfo(cp, ip, 0);
1144 				} else {
1145 					winfo(cp, ip, 1);
1146 					freeproc(cp);
1147 				}
1148 				mutex_exit(&pidlock);
1149 				if (waitflag) {		/* accept SIGCLD */
1150 					sigcld_delete(ip);
1151 					sigcld_repost();
1152 				}
1153 				return (0);
1154 			}
1155 
1156 			if (idtype == P_PID)
1157 				break;
1158 		}
1159 
1160 		/*
1161 		 * Wow! None of the threads on the p_sibling_ns list were
1162 		 * interesting threads. Check all the kids!
1163 		 */
1164 		found = 0;
1165 		for (cp = pp->p_child; cp != NULL; cp = cp->p_sibling) {
1166 			if (idtype == P_PID && id != cp->p_pid)
1167 				continue;
1168 			if (idtype == P_PGID && id != cp->p_pgrp)
1169 				continue;
1170 
1171 			switch (cp->p_wcode) {
1172 			case CLD_TRAPPED:
1173 				if (!(options & WTRAPPED))
1174 					break;
1175 				winfo(cp, ip, waitflag);
1176 				mutex_exit(&pidlock);
1177 				if (waitflag) {		/* accept SIGCLD */
1178 					sigcld_delete(ip);
1179 					sigcld_repost();
1180 				}
1181 				return (0);
1182 
1183 			case CLD_STOPPED:
1184 				if (!(options & WSTOPPED))
1185 					break;
1186 				/* Is it still stopped? */
1187 				mutex_enter(&cp->p_lock);
1188 				if (!jobstopped(cp)) {
1189 					mutex_exit(&cp->p_lock);
1190 					break;
1191 				}
1192 				mutex_exit(&cp->p_lock);
1193 				winfo(cp, ip, waitflag);
1194 				mutex_exit(&pidlock);
1195 				if (waitflag) {		/* accept SIGCLD */
1196 					sigcld_delete(ip);
1197 					sigcld_repost();
1198 				}
1199 				return (0);
1200 
1201 			case CLD_CONTINUED:
1202 				if (!(options & WCONTINUED))
1203 					break;
1204 				winfo(cp, ip, waitflag);
1205 				mutex_exit(&pidlock);
1206 				if (waitflag) {		/* accept SIGCLD */
1207 					sigcld_delete(ip);
1208 					sigcld_repost();
1209 				}
1210 				return (0);
1211 
1212 			case CLD_EXITED:
1213 			case CLD_DUMPED:
1214 			case CLD_KILLED:
1215 				if (idtype != P_PID &&
1216 				    (cp->p_pidflag & CLDWAITPID))
1217 					continue;
1218 				/*
1219 				 * Don't complain if a process was found in
1220 				 * the first loop but we broke out of the loop
1221 				 * because of the arguments passed to us.
1222 				 */
1223 				if (proc_gone == 0) {
1224 					cmn_err(CE_PANIC,
1225 					    "waitid: wrong state on the"
1226 					    " p_child list");
1227 				} else {
1228 					break;
1229 				}
1230 			}
1231 
1232 			found++;
1233 
1234 			if (idtype == P_PID)
1235 				break;
1236 		}
1237 
1238 		/*
1239 		 * If we found no interesting processes at all,
1240 		 * break out and return ECHILD.
1241 		 */
1242 		if (found + proc_gone == 0)
1243 			break;
1244 
1245 		if (options & WNOHANG) {
1246 			mutex_exit(&pidlock);
1247 			bzero(ip, sizeof (k_siginfo_t));
1248 			/*
1249 			 * We should set ip->si_signo = SIGCLD,
1250 			 * but there is an SVVS test that expects
1251 			 * ip->si_signo to be zero in this case.
1252 			 */
1253 			return (0);
1254 		}
1255 
1256 		/*
1257 		 * If we found no processes of interest that could
1258 		 * change state while we wait, we don't wait at all.
1259 		 * Get out with ECHILD according to SVID.
1260 		 */
1261 		if (found == proc_gone)
1262 			break;
1263 
1264 		if (!cv_wait_sig_swap(&pp->p_cv, &pidlock)) {
1265 			mutex_exit(&pidlock);
1266 			return (EINTR);
1267 		}
1268 	}
1269 	mutex_exit(&pidlock);
1270 	return (ECHILD);
1271 }
1272 
1273 int
waitsys(idtype_t idtype,id_t id,siginfo_t * infop,int options)1274 waitsys(idtype_t idtype, id_t id, siginfo_t *infop, int options)
1275 {
1276 	int error;
1277 	k_siginfo_t info;
1278 
1279 	if (error = waitid(idtype, id, &info, options))
1280 		return (set_errno(error));
1281 	if (copyout(&info, infop, sizeof (k_siginfo_t)))
1282 		return (set_errno(EFAULT));
1283 	return (0);
1284 }
1285 
1286 #ifdef _SYSCALL32_IMPL
1287 
1288 int
waitsys32(idtype_t idtype,id_t id,siginfo_t * infop,int options)1289 waitsys32(idtype_t idtype, id_t id, siginfo_t *infop, int options)
1290 {
1291 	int error;
1292 	k_siginfo_t info;
1293 	siginfo32_t info32;
1294 
1295 	if (error = waitid(idtype, id, &info, options))
1296 		return (set_errno(error));
1297 	siginfo_kto32(&info, &info32);
1298 	if (copyout(&info32, infop, sizeof (info32)))
1299 		return (set_errno(EFAULT));
1300 	return (0);
1301 }
1302 
1303 #endif	/* _SYSCALL32_IMPL */
1304 
1305 void
proc_detach(proc_t * p)1306 proc_detach(proc_t *p)
1307 {
1308 	proc_t *q;
1309 
1310 	ASSERT(MUTEX_HELD(&pidlock));
1311 
1312 	q = p->p_parent;
1313 	ASSERT(q != NULL);
1314 
1315 	/*
1316 	 * Take it off the newstate list of its parent
1317 	 */
1318 	delete_ns(q, p);
1319 
1320 	if (q->p_child == p) {
1321 		q->p_child = p->p_sibling;
1322 		/*
1323 		 * If the parent has no children, it better not
1324 		 * have any with new states either!
1325 		 */
1326 		ASSERT(q->p_child ? 1 : q->p_child_ns == NULL);
1327 	}
1328 
1329 	if (p->p_sibling) {
1330 		p->p_sibling->p_psibling = p->p_psibling;
1331 	}
1332 
1333 	if (p->p_psibling) {
1334 		p->p_psibling->p_sibling = p->p_sibling;
1335 	}
1336 }
1337 
1338 /*
1339  * Remove zombie children from the process table.
1340  */
1341 void
freeproc(proc_t * p)1342 freeproc(proc_t *p)
1343 {
1344 	proc_t *q;
1345 	task_t *tk;
1346 
1347 	ASSERT(p->p_stat == SZOMB);
1348 	ASSERT(p->p_tlist == NULL);
1349 	ASSERT(MUTEX_HELD(&pidlock));
1350 
1351 	sigdelq(p, NULL, 0);
1352 	if (p->p_killsqp) {
1353 		siginfofree(p->p_killsqp);
1354 		p->p_killsqp = NULL;
1355 	}
1356 
1357 	prfree(p);	/* inform /proc */
1358 
1359 	/*
1360 	 * Don't free the init processes.
1361 	 * Other dying processes will access it.
1362 	 */
1363 	if (p == proc_init)
1364 		return;
1365 
1366 
1367 	/*
1368 	 * We wait until now to free the cred structure because a
1369 	 * zombie process's credentials may be examined by /proc.
1370 	 * No cred locking needed because there are no threads at this point.
1371 	 */
1372 	upcount_dec(crgetruid(p->p_cred), crgetzoneid(p->p_cred));
1373 	crfree(p->p_cred);
1374 	if (p->p_corefile != NULL) {
1375 		corectl_path_rele(p->p_corefile);
1376 		p->p_corefile = NULL;
1377 	}
1378 	if (p->p_content != NULL) {
1379 		corectl_content_rele(p->p_content);
1380 		p->p_content = NULL;
1381 	}
1382 
1383 	if (p->p_nextofkin && !((p->p_nextofkin->p_flag & SNOWAIT) ||
1384 	    (PTOU(p->p_nextofkin)->u_signal[SIGCLD - 1] == SIG_IGN))) {
1385 		/*
1386 		 * This should still do the right thing since p_utime/stime
1387 		 * get set to the correct value on process exit, so it
1388 		 * should get properly updated
1389 		 */
1390 		p->p_nextofkin->p_cutime += p->p_utime;
1391 		p->p_nextofkin->p_cstime += p->p_stime;
1392 
1393 		p->p_nextofkin->p_cacct[LMS_USER] += p->p_acct[LMS_USER];
1394 		p->p_nextofkin->p_cacct[LMS_SYSTEM] += p->p_acct[LMS_SYSTEM];
1395 		p->p_nextofkin->p_cacct[LMS_TRAP] += p->p_acct[LMS_TRAP];
1396 		p->p_nextofkin->p_cacct[LMS_TFAULT] += p->p_acct[LMS_TFAULT];
1397 		p->p_nextofkin->p_cacct[LMS_DFAULT] += p->p_acct[LMS_DFAULT];
1398 		p->p_nextofkin->p_cacct[LMS_KFAULT] += p->p_acct[LMS_KFAULT];
1399 		p->p_nextofkin->p_cacct[LMS_USER_LOCK]
1400 		    += p->p_acct[LMS_USER_LOCK];
1401 		p->p_nextofkin->p_cacct[LMS_SLEEP] += p->p_acct[LMS_SLEEP];
1402 		p->p_nextofkin->p_cacct[LMS_WAIT_CPU]
1403 		    += p->p_acct[LMS_WAIT_CPU];
1404 		p->p_nextofkin->p_cacct[LMS_STOPPED] += p->p_acct[LMS_STOPPED];
1405 
1406 		p->p_nextofkin->p_cru.minflt	+= p->p_ru.minflt;
1407 		p->p_nextofkin->p_cru.majflt	+= p->p_ru.majflt;
1408 		p->p_nextofkin->p_cru.nswap	+= p->p_ru.nswap;
1409 		p->p_nextofkin->p_cru.inblock	+= p->p_ru.inblock;
1410 		p->p_nextofkin->p_cru.oublock	+= p->p_ru.oublock;
1411 		p->p_nextofkin->p_cru.msgsnd	+= p->p_ru.msgsnd;
1412 		p->p_nextofkin->p_cru.msgrcv	+= p->p_ru.msgrcv;
1413 		p->p_nextofkin->p_cru.nsignals	+= p->p_ru.nsignals;
1414 		p->p_nextofkin->p_cru.nvcsw	+= p->p_ru.nvcsw;
1415 		p->p_nextofkin->p_cru.nivcsw	+= p->p_ru.nivcsw;
1416 		p->p_nextofkin->p_cru.sysc	+= p->p_ru.sysc;
1417 		p->p_nextofkin->p_cru.ioch	+= p->p_ru.ioch;
1418 
1419 	}
1420 
1421 	q = p->p_nextofkin;
1422 	if (q && q->p_orphan == p)
1423 		q->p_orphan = p->p_nextorph;
1424 	else if (q) {
1425 		for (q = q->p_orphan; q; q = q->p_nextorph)
1426 			if (q->p_nextorph == p)
1427 				break;
1428 		ASSERT(q && q->p_nextorph == p);
1429 		q->p_nextorph = p->p_nextorph;
1430 	}
1431 
1432 	/*
1433 	 * The process table slot is being freed, so it is now safe to give up
1434 	 * task and project membership.
1435 	 */
1436 	mutex_enter(&p->p_lock);
1437 	tk = p->p_task;
1438 	task_detach(p);
1439 	mutex_exit(&p->p_lock);
1440 
1441 	proc_detach(p);
1442 	pid_exit(p, tk);	/* frees pid and proc structure */
1443 
1444 	task_rele(tk);
1445 }
1446 
1447 /*
1448  * Delete process "child" from the newstate list of process "parent"
1449  */
1450 void
delete_ns(proc_t * parent,proc_t * child)1451 delete_ns(proc_t *parent, proc_t *child)
1452 {
1453 	proc_t **ns;
1454 
1455 	ASSERT(MUTEX_HELD(&pidlock));
1456 	ASSERT(child->p_parent == parent);
1457 	for (ns = &parent->p_child_ns; *ns != NULL; ns = &(*ns)->p_sibling_ns) {
1458 		if (*ns == child) {
1459 
1460 			ASSERT((*ns)->p_parent == parent);
1461 
1462 			*ns = child->p_sibling_ns;
1463 			child->p_sibling_ns = NULL;
1464 			return;
1465 		}
1466 	}
1467 }
1468 
1469 /*
1470  * Add process "child" to the new state list of process "parent"
1471  */
1472 void
add_ns(proc_t * parent,proc_t * child)1473 add_ns(proc_t *parent, proc_t *child)
1474 {
1475 	ASSERT(child->p_sibling_ns == NULL);
1476 	child->p_sibling_ns = parent->p_child_ns;
1477 	parent->p_child_ns = child;
1478 }
1479