xref: /freebsd/sys/kern/kern_fork.c (revision bcdb6ba94d08554eeb9bde4d2468707a612f5d90)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1989, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #include "opt_ktrace.h"
38 #include "opt_kstack_pages.h"
39 
40 #define EXTERR_CATEGORY	EXTERR_CAT_FORK
41 #include <sys/systm.h>
42 #include <sys/acct.h>
43 #include <sys/bitstring.h>
44 #include <sys/eventhandler.h>
45 #include <sys/exterrvar.h>
46 #include <sys/fcntl.h>
47 #include <sys/filedesc.h>
48 #include <sys/jail.h>
49 #include <sys/kernel.h>
50 #include <sys/kthread.h>
51 #include <sys/ktr.h>
52 #include <sys/ktrace.h>
53 #include <sys/sysctl.h>
54 #include <sys/lock.h>
55 #include <sys/malloc.h>
56 #include <sys/msan.h>
57 #include <sys/mutex.h>
58 #include <sys/priv.h>
59 #include <sys/proc.h>
60 #include <sys/procdesc.h>
61 #include <sys/ptrace.h>
62 #include <sys/racct.h>
63 #include <sys/resourcevar.h>
64 #include <sys/sched.h>
65 #include <sys/sdt.h>
66 #include <sys/signalvar.h>
67 #include <sys/sx.h>
68 #include <sys/syscall.h>
69 #include <sys/syscallsubr.h>
70 #include <sys/sysent.h>
71 #include <sys/sysproto.h>
72 #include <sys/vmmeter.h>
73 #include <sys/vnode.h>
74 #include <sys/unistd.h>
75 
76 #include <security/audit/audit.h>
77 #include <security/mac/mac_framework.h>
78 
79 #include <vm/vm.h>
80 #include <vm/pmap.h>
81 #include <vm/vm_map.h>
82 #include <vm/vm_extern.h>
83 #include <vm/uma.h>
84 
85 #ifdef KDTRACE_HOOKS
86 #include <sys/dtrace_bsd.h>
87 dtrace_fork_func_t	dtrace_fasttrap_fork;
88 #endif
89 
90 SDT_PROVIDER_DECLARE(proc);
91 SDT_PROBE_DEFINE3(proc, , , create, "struct proc *", "struct proc *", "int");
92 
93 #ifndef _SYS_SYSPROTO_H_
94 struct fork_args {
95 	int     dummy;
96 };
97 #endif
98 
99 /* ARGSUSED */
100 int
sys_fork(struct thread * td,struct fork_args * uap)101 sys_fork(struct thread *td, struct fork_args *uap)
102 {
103 	struct fork_req fr;
104 	int error, pid;
105 
106 	bzero(&fr, sizeof(fr));
107 	fr.fr_flags = RFFDG | RFPROC;
108 	fr.fr_pidp = &pid;
109 	error = fork1(td, &fr);
110 	if (error == 0) {
111 		td->td_retval[0] = pid;
112 		td->td_retval[1] = 0;
113 	}
114 	return (error);
115 }
116 
117 /* ARGUSED */
118 int
sys_pdfork(struct thread * td,struct pdfork_args * uap)119 sys_pdfork(struct thread *td, struct pdfork_args *uap)
120 {
121 	struct fork_req fr;
122 	int error, fd, pid;
123 
124 	bzero(&fr, sizeof(fr));
125 	fr.fr_flags = RFFDG | RFPROC | RFPROCDESC;
126 	fr.fr_pidp = &pid;
127 	fr.fr_pd_fd = &fd;
128 	fr.fr_pd_flags = uap->flags;
129 	AUDIT_ARG_FFLAGS(uap->flags);
130 	/*
131 	 * It is necessary to return fd by reference because 0 is a valid file
132 	 * descriptor number, and the child needs to be able to distinguish
133 	 * itself from the parent using the return value.
134 	 */
135 	error = fork1(td, &fr);
136 	if (error == 0) {
137 		td->td_retval[0] = pid;
138 		td->td_retval[1] = 0;
139 		error = copyout(&fd, uap->fdp, sizeof(fd));
140 	}
141 	return (error);
142 }
143 
144 /* ARGSUSED */
145 int
sys_vfork(struct thread * td,struct vfork_args * uap)146 sys_vfork(struct thread *td, struct vfork_args *uap)
147 {
148 	struct fork_req fr;
149 	int error, pid;
150 
151 	bzero(&fr, sizeof(fr));
152 	fr.fr_flags = RFFDG | RFPROC | RFPPWAIT | RFMEM;
153 	fr.fr_pidp = &pid;
154 	error = fork1(td, &fr);
155 	if (error == 0) {
156 		td->td_retval[0] = pid;
157 		td->td_retval[1] = 0;
158 	}
159 	return (error);
160 }
161 
162 int
sys_rfork(struct thread * td,struct rfork_args * uap)163 sys_rfork(struct thread *td, struct rfork_args *uap)
164 {
165 	struct fork_req fr;
166 	int error, pid;
167 
168 	/* Don't allow kernel-only flags. */
169 	if ((uap->flags & RFKERNELONLY) != 0)
170 		return (EXTERROR(EINVAL, "Kernel-only flags %#jx", uap->flags));
171 	/* RFSPAWN must not appear with others */
172 	if ((uap->flags & RFSPAWN) != 0 && uap->flags != RFSPAWN)
173 		return (EXTERROR(EINVAL, "RFSPAWN must be the only flag %#jx",
174 		    uap->flags));
175 
176 	AUDIT_ARG_FFLAGS(uap->flags);
177 	bzero(&fr, sizeof(fr));
178 	if ((uap->flags & RFSPAWN) != 0) {
179 		fr.fr_flags = RFFDG | RFPROC | RFPPWAIT | RFMEM;
180 		fr.fr_flags2 = FR2_DROPSIG_CAUGHT;
181 	} else {
182 		fr.fr_flags = uap->flags;
183 	}
184 	fr.fr_pidp = &pid;
185 	error = fork1(td, &fr);
186 	if (error == 0) {
187 		td->td_retval[0] = pid;
188 		td->td_retval[1] = 0;
189 	}
190 	return (error);
191 }
192 
193 int
sys_pdrfork(struct thread * td,struct pdrfork_args * uap)194 sys_pdrfork(struct thread *td, struct pdrfork_args *uap)
195 {
196 	struct fork_req fr;
197 	int error, fd, pid;
198 
199 	bzero(&fr, sizeof(fr));
200 	fd = -1;
201 
202 	AUDIT_ARG_FFLAGS(uap->pdflags);
203 	AUDIT_ARG_CMD(uap->rfflags);
204 
205 	if ((uap->rfflags & (RFSTOPPED | RFHIGHPID)) != 0)
206 		return (EXTERROR(EINVAL,
207 		    "Kernel-only flags %#jx", uap->rfflags));
208 
209 	/* RFSPAWN must not appear with others */
210 	if ((uap->rfflags & RFSPAWN) != 0) {
211 		if (uap->rfflags != RFSPAWN)
212 			return (EXTERROR(EINVAL,
213 			    "RFSPAWN must be the only flag %#jx",
214 			    uap->rfflags));
215 		fr.fr_flags = RFFDG | RFPROC | RFPPWAIT | RFMEM | RFPROCDESC;
216 		fr.fr_flags2 = FR2_DROPSIG_CAUGHT;
217 	} else {
218 		if ((uap->rfflags & (RFPROC | RFPROCDESC)) !=
219 		    (RFPROC | RFPROCDESC)) {
220 			return (EXTERROR(EINVAL,
221 			    "RFPROC|RFPROCDESC required %#jx", uap->rfflags));
222 		}
223 		fr.fr_flags = uap->rfflags;
224 	}
225 
226 	fr.fr_pidp = &pid;
227 	fr.fr_pd_fd = &fd;
228 	fr.fr_pd_flags = uap->pdflags;
229 	error = fork1(td, &fr);
230 	if (error == 0) {
231 		td->td_retval[0] = pid;
232 		td->td_retval[1] = 0;
233 		if ((fr.fr_flags & (RFPROC | RFPROCDESC)) ==
234 		    (RFPROC | RFPROCDESC) || uap->rfflags == RFSPAWN)
235 			error = copyout(&fd, uap->fdp, sizeof(fd));
236 	}
237 	return (error);
238 }
239 
240 int __exclusive_cache_line	nprocs = 1;		/* process 0 */
241 int	lastpid = 0;
242 SYSCTL_INT(_kern, OID_AUTO, lastpid, CTLFLAG_RD, &lastpid, 0,
243     "Last used PID");
244 
245 /*
246  * Random component to lastpid generation.  We mix in a random factor to make
247  * it a little harder to predict.  We sanity check the modulus value to avoid
248  * doing it in critical paths.  Don't let it be too small or we pointlessly
249  * waste randomness entropy, and don't let it be impossibly large.  Using a
250  * modulus that is too big causes a LOT more process table scans and slows
251  * down fork processing as the pidchecked caching is defeated.
252  */
253 static int randompid = 0;
254 
255 static int
sysctl_kern_randompid(SYSCTL_HANDLER_ARGS)256 sysctl_kern_randompid(SYSCTL_HANDLER_ARGS)
257 {
258 	int error, pid;
259 
260 	error = sysctl_wire_old_buffer(req, sizeof(int));
261 	if (error != 0)
262 		return(error);
263 	sx_xlock(&allproc_lock);
264 	pid = randompid;
265 	error = sysctl_handle_int(oidp, &pid, 0, req);
266 	if (error == 0 && req->newptr != NULL) {
267 		if (pid == 0)
268 			randompid = 0;
269 		else if (pid == 1)
270 			/* generate a random PID modulus between 100 and 1123 */
271 			randompid = 100 + arc4random() % 1024;
272 		else if (pid < 0 || pid > pid_max - 100)
273 			/* out of range */
274 			randompid = pid_max - 100;
275 		else if (pid < 100)
276 			/* Make it reasonable */
277 			randompid = 100;
278 		else
279 			randompid = pid;
280 	}
281 	sx_xunlock(&allproc_lock);
282 	return (error);
283 }
284 
285 SYSCTL_PROC(_kern, OID_AUTO, randompid,
286     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 0,
287     sysctl_kern_randompid, "I",
288     "Random PID modulus. Special values: 0: disable, 1: choose random value");
289 
290 extern bitstr_t proc_id_pidmap;
291 extern bitstr_t proc_id_grpidmap;
292 extern bitstr_t proc_id_sessidmap;
293 extern bitstr_t proc_id_reapmap;
294 
295 /*
296  * Find an unused process ID
297  *
298  * If RFHIGHPID is set (used during system boot), do not allocate
299  * low-numbered pids.
300  */
301 static int
fork_findpid(int flags)302 fork_findpid(int flags)
303 {
304 	pid_t result;
305 	int trypid, random;
306 
307 	/*
308 	 * Avoid calling arc4random with procid_lock held.
309 	 */
310 	random = 0;
311 	if (__predict_false(randompid))
312 		random = arc4random() % randompid;
313 
314 	mtx_lock(&procid_lock);
315 
316 	trypid = lastpid + 1;
317 	if (flags & RFHIGHPID) {
318 		if (trypid < 10)
319 			trypid = 10;
320 	} else {
321 		trypid += random;
322 	}
323 retry:
324 	if (trypid >= pid_max)
325 		trypid = 2;
326 
327 	bit_ffc_at(&proc_id_pidmap, trypid, pid_max, &result);
328 	if (result == -1) {
329 		KASSERT(trypid != 2, ("unexpectedly ran out of IDs"));
330 		trypid = 2;
331 		goto retry;
332 	}
333 	if (bit_test(&proc_id_grpidmap, result) ||
334 	    bit_test(&proc_id_sessidmap, result) ||
335 	    bit_test(&proc_id_reapmap, result)) {
336 		trypid = result + 1;
337 		goto retry;
338 	}
339 
340 	/*
341 	 * RFHIGHPID does not mess with the lastpid counter during boot.
342 	 */
343 	if ((flags & RFHIGHPID) == 0)
344 		lastpid = result;
345 
346 	bit_set(&proc_id_pidmap, result);
347 	mtx_unlock(&procid_lock);
348 
349 	return (result);
350 }
351 
352 static int
fork_norfproc(struct thread * td,int flags)353 fork_norfproc(struct thread *td, int flags)
354 {
355 	struct proc *p1;
356 	int error;
357 
358 	KASSERT((flags & RFPROC) == 0,
359 	    ("fork_norfproc called with RFPROC set"));
360 	p1 = td->td_proc;
361 
362 	/*
363 	 * Quiesce other threads if necessary.  If RFMEM is not specified we
364 	 * must ensure that other threads do not concurrently create a second
365 	 * process sharing the vmspace, see vmspace_unshare().
366 	 */
367 	if ((p1->p_flag & (P_HADTHREADS | P_SYSTEM)) == P_HADTHREADS &&
368 	    ((flags & (RFCFDG | RFFDG)) != 0 || (flags & RFMEM) == 0)) {
369 		PROC_LOCK(p1);
370 		if (thread_single(p1, SINGLE_BOUNDARY)) {
371 			PROC_UNLOCK(p1);
372 			return (ERESTART);
373 		}
374 		PROC_UNLOCK(p1);
375 	}
376 
377 	error = vm_forkproc(td, NULL, NULL, NULL, flags);
378 	if (error != 0)
379 		goto fail;
380 
381 	/*
382 	 * Close all file descriptors.
383 	 */
384 	if ((flags & RFCFDG) != 0) {
385 		struct filedesc *fdtmp;
386 		struct pwddesc *pdtmp;
387 
388 		pdtmp = pdinit(td->td_proc->p_pd, false);
389 		fdtmp = fdinit();
390 		pdescfree(td);
391 		fdescfree(td);
392 		p1->p_fd = fdtmp;
393 		p1->p_pd = pdtmp;
394 	}
395 
396 	/*
397 	 * Unshare file descriptors (from parent).
398 	 */
399 	if ((flags & RFFDG) != 0) {
400 		fdunshare(td);
401 		pdunshare(td);
402 	}
403 
404 fail:
405 	if ((p1->p_flag & (P_HADTHREADS | P_SYSTEM)) == P_HADTHREADS &&
406 	    ((flags & (RFCFDG | RFFDG)) != 0 || (flags & RFMEM) == 0)) {
407 		PROC_LOCK(p1);
408 		thread_single_end(p1, SINGLE_BOUNDARY);
409 		PROC_UNLOCK(p1);
410 	}
411 	return (error);
412 }
413 
414 static void
do_fork(struct thread * td,struct fork_req * fr,struct proc * p2,struct thread * td2,struct vmspace * vm2,struct file * fp_procdesc)415 do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread *td2,
416     struct vmspace *vm2, struct file *fp_procdesc)
417 {
418 	struct proc *p1, *pptr;
419 	struct filedesc *fd;
420 	struct filedesc_to_leader *fdtol;
421 	struct pwddesc *pd;
422 	struct sigacts *newsigacts;
423 
424 	p1 = td->td_proc;
425 
426 	PROC_LOCK(p1);
427 	bcopy(&p1->p_startcopy, &p2->p_startcopy,
428 	    __rangeof(struct proc, p_startcopy, p_endcopy));
429 	pargs_hold(p2->p_args);
430 	PROC_UNLOCK(p1);
431 
432 	bzero(&p2->p_startzero,
433 	    __rangeof(struct proc, p_startzero, p_endzero));
434 
435 	/* Tell the prison that we exist. */
436 	prison_proc_hold(p2->p_ucred->cr_prison);
437 
438 	p2->p_state = PRS_NEW;		/* protect against others */
439 	p2->p_pid = fork_findpid(fr->fr_flags);
440 	AUDIT_ARG_PID(p2->p_pid);
441 	TSFORK(p2->p_pid, p1->p_pid);
442 
443 	sx_xlock(&allproc_lock);
444 	LIST_INSERT_HEAD(&allproc, p2, p_list);
445 	allproc_gen++;
446 	prison_proc_link(p2->p_ucred->cr_prison, p2);
447 	sx_xunlock(&allproc_lock);
448 
449 	sx_xlock(PIDHASHLOCK(p2->p_pid));
450 	LIST_INSERT_HEAD(PIDHASH(p2->p_pid), p2, p_hash);
451 	sx_xunlock(PIDHASHLOCK(p2->p_pid));
452 
453 	tidhash_add(td2);
454 
455 	/*
456 	 * Malloc things while we don't hold any locks.
457 	 */
458 	if (fr->fr_flags & RFSIGSHARE)
459 		newsigacts = NULL;
460 	else
461 		newsigacts = sigacts_alloc();
462 
463 	/*
464 	 * Copy filedesc.
465 	 */
466 	if (fr->fr_flags & RFCFDG) {
467 		pd = pdinit(p1->p_pd, false);
468 		fd = fdinit();
469 		fdtol = NULL;
470 	} else if (fr->fr_flags & RFFDG) {
471 		if (fr->fr_flags2 & FR2_SHARE_PATHS)
472 			pd = pdshare(p1->p_pd);
473 		else
474 			pd = pdcopy(p1->p_pd);
475 		fd = fdcopy(p1->p_fd, p2);
476 		fdtol = NULL;
477 	} else {
478 		if (fr->fr_flags2 & FR2_SHARE_PATHS)
479 			pd = pdcopy(p1->p_pd);
480 		else
481 			pd = pdshare(p1->p_pd);
482 		fd = fdshare(p1->p_fd);
483 		if (p1->p_fdtol == NULL)
484 			p1->p_fdtol = filedesc_to_leader_alloc(NULL, NULL,
485 			    p1->p_leader);
486 		if ((fr->fr_flags & RFTHREAD) != 0) {
487 			/*
488 			 * Shared file descriptor table, and shared
489 			 * process leaders.
490 			 */
491 			fdtol = filedesc_to_leader_share(p1->p_fdtol, p1->p_fd);
492 		} else {
493 			/*
494 			 * Shared file descriptor table, and different
495 			 * process leaders.
496 			 */
497 			fdtol = filedesc_to_leader_alloc(p1->p_fdtol,
498 			    p1->p_fd, p2);
499 		}
500 	}
501 	/*
502 	 * Make a proc table entry for the new process.
503 	 * Start by zeroing the section of proc that is zero-initialized,
504 	 * then copy the section that is copied directly from the parent.
505 	 */
506 
507 	PROC_LOCK(p2);
508 	PROC_LOCK(p1);
509 
510 	bzero(&td2->td_startzero,
511 	    __rangeof(struct thread, td_startzero, td_endzero));
512 
513 	bcopy(&td->td_startcopy, &td2->td_startcopy,
514 	    __rangeof(struct thread, td_startcopy, td_endcopy));
515 
516 	bcopy(&p2->p_comm, &td2->td_name, sizeof(td2->td_name));
517 	td2->td_sigstk = td->td_sigstk;
518 	td2->td_flags = TDF_INMEM;
519 	td2->td_lend_user_pri = PRI_MAX;
520 
521 #ifdef VIMAGE
522 	td2->td_vnet = NULL;
523 	td2->td_vnet_lpush = NULL;
524 #endif
525 
526 	/*
527 	 * Allow the scheduler to initialize the child.
528 	 */
529 	thread_lock(td);
530 	sched_fork(td, td2);
531 	/*
532 	 * Request AST to check for TDP_RFPPWAIT.  Do it here
533 	 * to avoid calling thread_lock() again.
534 	 */
535 	if ((fr->fr_flags & RFPPWAIT) != 0)
536 		ast_sched_locked(td, TDA_VFORK);
537 	thread_unlock(td);
538 
539 	/*
540 	 * Duplicate sub-structures as needed.
541 	 * Increase reference counts on shared objects.
542 	 */
543 	p2->p_flag = P_INMEM;
544 	p2->p_flag2 = p1->p_flag2 & (P2_ASLR_DISABLE | P2_ASLR_ENABLE |
545 	    P2_ASLR_IGNSTART | P2_NOTRACE | P2_NOTRACE_EXEC |
546 	    P2_PROTMAX_ENABLE | P2_PROTMAX_DISABLE | P2_TRAPCAP |
547 	    P2_STKGAP_DISABLE | P2_STKGAP_DISABLE_EXEC | P2_NO_NEW_PRIVS |
548 	    P2_WXORX_DISABLE | P2_WXORX_ENABLE_EXEC | P2_LOGSIGEXIT_CTL |
549 	    P2_LOGSIGEXIT_ENABLE);
550 	if ((fr->fr_flags & RFPROCDESC) != 0) {
551 		p2->p_zombieref = PZOMBIEREF_PROCDESC;
552 		if ((fr->fr_pd_flags & PD_NOWAITPID) == 0 &&
553 		    (fr->fr_flags & RFNOWAIT) == 0)
554 			p2->p_zombieref |= (PZOMBIEREF_PARENT |
555 			    PZOMBIEREF_NEEDPARENT);
556 	} else {
557 		p2->p_zombieref = PZOMBIEREF_PARENT | PZOMBIEREF_NEEDPARENT;
558 	}
559 	p2->p_swtick = ticks;
560 	if (p1->p_flag & P_PROFIL)
561 		startprofclock(p2);
562 
563 	if (fr->fr_flags & RFSIGSHARE) {
564 		p2->p_sigacts = sigacts_hold(p1->p_sigacts);
565 	} else {
566 		sigacts_copy(newsigacts, p1->p_sigacts);
567 		p2->p_sigacts = newsigacts;
568 		if ((fr->fr_flags2 & (FR2_DROPSIG_CAUGHT | FR2_KPROC)) != 0) {
569 			mtx_lock(&p2->p_sigacts->ps_mtx);
570 			if ((fr->fr_flags2 & FR2_DROPSIG_CAUGHT) != 0)
571 				sig_drop_caught(p2);
572 			if ((fr->fr_flags2 & FR2_KPROC) != 0)
573 				p2->p_sigacts->ps_flag |= PS_NOCLDWAIT;
574 			mtx_unlock(&p2->p_sigacts->ps_mtx);
575 		}
576 	}
577 
578 	if (fr->fr_flags & RFTSIGZMB)
579 	        p2->p_sigparent = RFTSIGNUM(fr->fr_flags);
580 	else if (fr->fr_flags & RFLINUXTHPN)
581 	        p2->p_sigparent = SIGUSR1;
582 	else
583 	        p2->p_sigparent = SIGCHLD;
584 
585 	if ((fr->fr_flags2 & FR2_KPROC) != 0) {
586 		p2->p_flag |= P_SYSTEM | P_KPROC;
587 		td2->td_pflags |= TDP_KTHREAD;
588 	}
589 
590 	p2->p_textvp = p1->p_textvp;
591 	p2->p_textdvp = p1->p_textdvp;
592 	p2->p_fd = fd;
593 	p2->p_fdtol = fdtol;
594 	p2->p_pd = pd;
595 
596 	if (p1->p_flag2 & P2_INHERIT_PROTECTED) {
597 		p2->p_flag |= P_PROTECTED;
598 		p2->p_flag2 |= P2_INHERIT_PROTECTED;
599 	}
600 
601 	/*
602 	 * p_limit is copy-on-write.  Bump its refcount.
603 	 */
604 	lim_fork(p1, p2);
605 
606 	thread_cow_get_proc(td2, p2);
607 
608 	pstats_fork(p1->p_stats, p2->p_stats);
609 
610 	PROC_UNLOCK(p1);
611 	PROC_UNLOCK(p2);
612 
613 	/*
614 	 * Bump references to the text vnode and directory, and copy
615 	 * the hardlink name.
616 	 */
617 	if (p2->p_textvp != NULL)
618 		vrefact(p2->p_textvp);
619 	if (p2->p_textdvp != NULL)
620 		vrefact(p2->p_textdvp);
621 	p2->p_binname = p1->p_binname == NULL ? NULL :
622 	    strdup(p1->p_binname, M_PARGS);
623 
624 	/*
625 	 * Set up linkage for kernel based threading.
626 	 */
627 	if ((fr->fr_flags & RFTHREAD) != 0) {
628 		mtx_lock(&ppeers_lock);
629 		p2->p_peers = p1->p_peers;
630 		p1->p_peers = p2;
631 		p2->p_leader = p1->p_leader;
632 		mtx_unlock(&ppeers_lock);
633 		PROC_LOCK(p1->p_leader);
634 		if ((p1->p_leader->p_flag & P_WEXIT) != 0) {
635 			PROC_UNLOCK(p1->p_leader);
636 			/*
637 			 * The task leader is exiting, so process p1 is
638 			 * going to be killed shortly.  Since p1 obviously
639 			 * isn't dead yet, we know that the leader is either
640 			 * sending SIGKILL's to all the processes in this
641 			 * task or is sleeping waiting for all the peers to
642 			 * exit.  We let p1 complete the fork, but we need
643 			 * to go ahead and kill the new process p2 since
644 			 * the task leader may not get a chance to send
645 			 * SIGKILL to it.  We leave it on the list so that
646 			 * the task leader will wait for this new process
647 			 * to commit suicide.
648 			 */
649 			PROC_LOCK(p2);
650 			kern_psignal(p2, SIGKILL);
651 			PROC_UNLOCK(p2);
652 		} else
653 			PROC_UNLOCK(p1->p_leader);
654 	} else {
655 		p2->p_peers = NULL;
656 		p2->p_leader = p2;
657 	}
658 
659 	sx_xlock(&proctree_lock);
660 	PGRP_LOCK(p1->p_pgrp);
661 	PROC_LOCK(p2);
662 	PROC_LOCK(p1);
663 
664 	/*
665 	 * Preserve some more flags in subprocess.  P_PROFIL has already
666 	 * been preserved.
667 	 */
668 	p2->p_flag |= p1->p_flag & P_SUGID;
669 	td2->td_pflags |= td->td_pflags & (TDP_ALTSTACK | TDP_SIGFASTBLOCK);
670 	td2->td_pflags2 |= td->td_pflags2 & TDP2_UEXTERR;
671 	if (p1->p_flag & P_CONTROLT) {
672 		SESS_LOCK(p1->p_session);
673 		if (p1->p_session->s_ttyvp != NULL)
674 			p2->p_flag |= P_CONTROLT;
675 		SESS_UNLOCK(p1->p_session);
676 	}
677 	if (fr->fr_flags & RFPPWAIT)
678 		p2->p_flag |= P_PPWAIT;
679 
680 	p2->p_pgrp = p1->p_pgrp;
681 	LIST_INSERT_AFTER(p1, p2, p_pglist);
682 	PGRP_UNLOCK(p1->p_pgrp);
683 	LIST_INIT(&p2->p_children);
684 	LIST_INIT(&p2->p_orphans);
685 
686 	callout_init_mtx(&p2->p_itcallout, &p2->p_mtx, 0);
687 
688 	PROC_UNLOCK(p1);
689 
690 	/*
691 	 * Attach the new process to its parent.
692 	 *
693 	 * If RFNOWAIT is set, the newly created process becomes a child
694 	 * of init.  This effectively disassociates the child from the
695 	 * parent.
696 	 */
697 	if ((fr->fr_flags & RFNOWAIT) != 0) {
698 		pptr = p1->p_reaper;
699 		p2->p_reaper = pptr;
700 	} else {
701 		p2->p_reaper = (p1->p_treeflag & P_TREE_REAPER) != 0 ?
702 		    p1 : p1->p_reaper;
703 		pptr = p1;
704 	}
705 	p2->p_pptr = pptr;
706 	p2->p_oppid = pptr->p_pid;
707 	LIST_INSERT_HEAD(&pptr->p_children, p2, p_sibling);
708 	LIST_INIT(&p2->p_reaplist);
709 	LIST_INSERT_HEAD(&p2->p_reaper->p_reaplist, p2, p_reapsibling);
710 	if (p2->p_reaper == p1 && p1 != initproc) {
711 		p2->p_reapsubtree = p2->p_pid;
712 		proc_id_set_cond(PROC_ID_REAP, p2->p_pid);
713 	} else {
714 		/*
715 		 * Explicitly copy this field under the proctree lock, as it
716 		 * might have changed since the bulk copying of the parent's
717 		 * fields.
718 		 */
719 		p2->p_reapsubtree = p1->p_reapsubtree;
720 	}
721 	sx_xunlock(&proctree_lock);
722 
723 	/* Inform accounting that we have forked. */
724 	p2->p_acflag = AFORK;
725 	PROC_UNLOCK(p2);
726 
727 #ifdef KTRACE
728 	ktrprocfork(p1, p2);
729 #endif
730 
731 	/*
732 	 * Finish creating the child process.  It will return via a different
733 	 * execution path later.  (ie: directly into user mode)
734 	 */
735 	vm_forkproc(td, p2, td2, vm2, fr->fr_flags);
736 
737 	if (fr->fr_flags == (RFFDG | RFPROC)) {
738 		VM_CNT_INC(v_forks);
739 		VM_CNT_ADD(v_forkpages, p2->p_vmspace->vm_dsize +
740 		    p2->p_vmspace->vm_ssize);
741 	} else if (fr->fr_flags == (RFFDG | RFPROC | RFPPWAIT | RFMEM)) {
742 		VM_CNT_INC(v_vforks);
743 		VM_CNT_ADD(v_vforkpages, p2->p_vmspace->vm_dsize +
744 		    p2->p_vmspace->vm_ssize);
745 	} else if (p1 == &proc0) {
746 		VM_CNT_INC(v_kthreads);
747 		VM_CNT_ADD(v_kthreadpages, p2->p_vmspace->vm_dsize +
748 		    p2->p_vmspace->vm_ssize);
749 	} else {
750 		VM_CNT_INC(v_rforks);
751 		VM_CNT_ADD(v_rforkpages, p2->p_vmspace->vm_dsize +
752 		    p2->p_vmspace->vm_ssize);
753 	}
754 
755 	/*
756 	 * Associate the process descriptor with the process before anything
757 	 * can happen that might cause that process to need the descriptor.
758 	 * However, don't do this until after fork(2) can no longer fail.
759 	 */
760 	if (fr->fr_flags & RFPROCDESC)
761 		procdesc_new(p2, fr->fr_pd_flags);
762 
763 	/*
764 	 * Both processes are set up, now check if any loadable modules want
765 	 * to adjust anything.
766 	 */
767 	EVENTHANDLER_DIRECT_INVOKE(process_fork, p1, p2, fr->fr_flags);
768 
769 	/*
770 	 * Set the child start time and mark the process as being complete.
771 	 */
772 	PROC_LOCK(p2);
773 	PROC_LOCK(p1);
774 	microuptime(&p2->p_stats->p_start);
775 	PROC_SLOCK(p2);
776 	p2->p_state = PRS_NORMAL;
777 	PROC_SUNLOCK(p2);
778 
779 #ifdef KDTRACE_HOOKS
780 	/*
781 	 * Tell the DTrace fasttrap provider about the new process so that any
782 	 * tracepoints inherited from the parent can be removed. We have to do
783 	 * this only after p_state is PRS_NORMAL since the fasttrap module will
784 	 * use pfind() later on.
785 	 */
786 	if ((fr->fr_flags & RFMEM) == 0 && dtrace_fasttrap_fork)
787 		dtrace_fasttrap_fork(p1, p2);
788 #endif
789 	if (fr->fr_flags & RFPPWAIT) {
790 		td->td_pflags |= TDP_RFPPWAIT;
791 		td->td_rfppwait_p = p2;
792 		td->td_dbgflags |= TDB_VFORK;
793 	}
794 	PROC_UNLOCK(p2);
795 
796 	/*
797 	 * Tell any interested parties about the new process.
798 	 */
799 	knote_fork(p1->p_klist, p2->p_pid);
800 
801 	PROC_UNLOCK(p1);
802 	SDT_PROBE3(proc, , , create, p2, p1, fr->fr_flags);
803 
804 	if (fr->fr_flags & RFPROCDESC) {
805 		procdesc_finit(p2->p_procdesc, fp_procdesc);
806 		fdrop(fp_procdesc, td);
807 	}
808 
809 	/*
810 	 * Speculative check for PTRACE_FORK. PTRACE_FORK is not
811 	 * synced with forks in progress so it is OK if we miss it
812 	 * if being set atm.
813 	 */
814 	if ((p1->p_ptevents & PTRACE_FORK) != 0) {
815 		sx_xlock(&proctree_lock);
816 		PROC_LOCK(p2);
817 
818 		/*
819 		 * p1->p_ptevents & p1->p_pptr are protected by both
820 		 * process and proctree locks for modifications,
821 		 * so owning proctree_lock allows the race-free read.
822 		 */
823 		if ((p1->p_ptevents & PTRACE_FORK) != 0) {
824 			/*
825 			 * Arrange for debugger to receive the fork event.
826 			 *
827 			 * We can report PL_FLAG_FORKED regardless of
828 			 * P_FOLLOWFORK settings, but it does not make a sense
829 			 * for runaway child.
830 			 */
831 			td->td_dbgflags |= TDB_FORK;
832 			td->td_dbg_forked = p2->p_pid;
833 			td2->td_dbgflags |= TDB_STOPATFORK;
834 			proc_set_traced(p2, true);
835 			CTR2(KTR_PTRACE,
836 			    "do_fork: attaching to new child pid %d: oppid %d",
837 			    p2->p_pid, p2->p_oppid);
838 			proc_reparent(p2, p1->p_pptr, false);
839 		}
840 		PROC_UNLOCK(p2);
841 		sx_xunlock(&proctree_lock);
842 	}
843 
844 	/*
845 	 * Activate procdesc NOTE_FORK after we attached the debugger
846 	 * to the child.  This guarantees that a debugger which does
847 	 * kevent() on the process descriptor to get notifications of
848 	 * fork events, can properly observe the child right after the
849 	 * notification fired.
850 	 */
851 	procdesc_fork(p1, p2->p_pid);
852 
853 	racct_proc_fork_done(p2);
854 
855 	if ((fr->fr_flags & RFSTOPPED) == 0) {
856 		if (fr->fr_pidp != NULL)
857 			*fr->fr_pidp = p2->p_pid;
858 		/*
859 		 * If RFSTOPPED not requested, make child runnable and
860 		 * add to run queue.
861 		 */
862 		thread_lock(td2);
863 		TD_SET_CAN_RUN(td2);
864 		sched_add(td2, SRQ_BORING);
865 	} else {
866 		*fr->fr_procp = p2;
867 	}
868 }
869 
870 static void
ast_vfork(struct thread * td,int tda __unused)871 ast_vfork(struct thread *td, int tda __unused)
872 {
873 	struct proc *p, *p2;
874 
875 	MPASS(td->td_pflags & TDP_RFPPWAIT);
876 
877 	p = td->td_proc;
878 	/*
879 	 * Preserve synchronization semantics of vfork.  If
880 	 * waiting for child to exec or exit, fork set
881 	 * P_PPWAIT on child, and there we sleep on our proc
882 	 * (in case of exit).
883 	 *
884 	 * Do it after the ptracestop() above is finished, to
885 	 * not block our debugger until child execs or exits
886 	 * to finish vfork wait.
887 	 */
888 	td->td_pflags &= ~TDP_RFPPWAIT;
889 	p2 = td->td_rfppwait_p;
890 again:
891 	PROC_LOCK(p2);
892 	while (p2->p_flag & P_PPWAIT) {
893 		PROC_LOCK(p);
894 		if (thread_suspend_check_needed()) {
895 			PROC_UNLOCK(p2);
896 			thread_suspend_check(0);
897 			PROC_UNLOCK(p);
898 			goto again;
899 		} else {
900 			PROC_UNLOCK(p);
901 		}
902 		cv_timedwait(&p2->p_pwait, &p2->p_mtx, hz);
903 	}
904 	PROC_UNLOCK(p2);
905 
906 	if (td->td_dbgflags & TDB_VFORK) {
907 		PROC_LOCK(p);
908 		if (p->p_ptevents & PTRACE_VFORK)
909 			ptracestop(td, SIGTRAP, NULL);
910 		td->td_dbgflags &= ~TDB_VFORK;
911 		PROC_UNLOCK(p);
912 	}
913 }
914 
915 int
fork1(struct thread * td,struct fork_req * fr)916 fork1(struct thread *td, struct fork_req *fr)
917 {
918 	struct proc *p1, *newproc;
919 	struct thread *td2;
920 	struct vmspace *vm2;
921 	struct ucred *cred;
922 	struct file *fp_procdesc;
923 	struct pgrp *pg;
924 	vm_ooffset_t mem_charged;
925 	int error, nprocs_new;
926 	static int curfail;
927 	static struct timeval lastfail;
928 	int flags, pages;
929 	bool killsx_locked, singlethreaded;
930 
931 	flags = fr->fr_flags;
932 	pages = fr->fr_pages;
933 
934 	if ((flags & RFSTOPPED) != 0)
935 		MPASS(fr->fr_procp != NULL && fr->fr_pidp == NULL);
936 	else
937 		MPASS(fr->fr_procp == NULL);
938 
939 	if ((flags & ~(RFFLAGS | RFTSIGFLAGS(RFTSIGMASK))) != 0)
940 		return (EXTERROR(EINVAL,
941 		    "Undef or unimplemented flags %#jx", flags));
942 
943 	if ((flags & RFTSIGFLAGS(RFTSIGMASK)) != 0 && (flags & RFTSIGZMB) == 0)
944 		return (EXTERROR(EINVAL,
945 		    "Signal value requires RFTSIGZMB", flags));
946 
947 	if ((flags & (RFFDG | RFCFDG)) == (RFFDG | RFCFDG))
948 		return (EXTERROR(EINVAL, "Can not copy and clear"));
949 
950 	if ((flags & RFTSIGZMB) != 0 && (u_int)RFTSIGNUM(flags) > _SIG_MAXSIG)
951 		return (EXTERROR(EINVAL, "Invalid signal", RFTSIGNUM(flags)));
952 
953 	if ((flags & RFPROCDESC) != 0) {
954 		if ((flags & RFPROC) == 0)
955 			return (EXTERROR(EINVAL,
956 	    "Can not not create a process yet get a process descriptor"));
957 
958 		if (fr->fr_pd_fd == NULL)
959 			return (EXTERROR(EINVAL,
960 		    "Must provide a place to put a procdesc if creating one"));
961 
962 		if ((fr->fr_pd_flags & ~PD_ALLOWED_AT_FORK) != 0)
963 			return (EXTERROR(EINVAL,
964 			    "Invallid pdflags at fork %#jx", fr->fr_pd_flags));
965 	}
966 
967 	p1 = td->td_proc;
968 
969 	/*
970 	 * Here we don't create a new process, but we divorce
971 	 * certain parts of a process from itself.
972 	 */
973 	if ((flags & RFPROC) == 0) {
974 		if (fr->fr_procp != NULL)
975 			*fr->fr_procp = NULL;
976 		else if (fr->fr_pidp != NULL)
977 			*fr->fr_pidp = 0;
978 		return (fork_norfproc(td, flags));
979 	}
980 
981 	fp_procdesc = NULL;
982 	newproc = NULL;
983 	vm2 = NULL;
984 	killsx_locked = false;
985 	singlethreaded = false;
986 
987 	/*
988 	 * Increment the nprocs resource before allocations occur.
989 	 * Although process entries are dynamically created, we still
990 	 * keep a global limit on the maximum number we will
991 	 * create. There are hard-limits as to the number of processes
992 	 * that can run, established by the KVA and memory usage for
993 	 * the process data.
994 	 *
995 	 * Don't allow a nonprivileged user to use the last ten
996 	 * processes; don't let root exceed the limit.
997 	 */
998 	nprocs_new = atomic_fetchadd_int(&nprocs, 1) + 1;
999 	if (nprocs_new >= maxproc - 10) {
1000 		if (priv_check_cred(td->td_ucred, PRIV_MAXPROC) != 0 ||
1001 		    nprocs_new >= maxproc) {
1002 			error = EAGAIN;
1003 			sx_xlock(&allproc_lock);
1004 			if (ppsratecheck(&lastfail, &curfail, 1)) {
1005 				printf("maxproc limit exceeded by uid %u "
1006 				    "(pid %d); see tuning(7) and "
1007 				    "login.conf(5)\n",
1008 				    td->td_ucred->cr_ruid, p1->p_pid);
1009 			}
1010 			sx_xunlock(&allproc_lock);
1011 			goto fail2;
1012 		}
1013 	}
1014 
1015 	/*
1016 	 * If we are possibly multi-threaded, and there is a process
1017 	 * sending a signal to our group right now, ensure that our
1018 	 * other threads cannot be chosen for the signal queueing.
1019 	 * Otherwise, this might delay signal action, and make the new
1020 	 * child escape the signaling.
1021 	 */
1022 	pg = p1->p_pgrp;
1023 	if (p1->p_numthreads > 1) {
1024 		if (sx_try_slock(&pg->pg_killsx) != 0) {
1025 			killsx_locked = true;
1026 		} else {
1027 			PROC_LOCK(p1);
1028 			if (thread_single(p1, SINGLE_BOUNDARY)) {
1029 				PROC_UNLOCK(p1);
1030 				error = ERESTART;
1031 				goto fail2;
1032 			}
1033 			PROC_UNLOCK(p1);
1034 			singlethreaded = true;
1035 		}
1036 	}
1037 
1038 	/*
1039 	 * Atomically check for signals and block processes from sending
1040 	 * a signal to our process group until the child is visible.
1041 	 */
1042 	if (!killsx_locked && sx_slock_sig(&pg->pg_killsx) != 0) {
1043 		error = ERESTART;
1044 		goto fail2;
1045 	}
1046 	if (__predict_false(p1->p_pgrp != pg || sig_intr() != 0)) {
1047 		/*
1048 		 * Either the process was moved to other process
1049 		 * group, or there is pending signal.  sx_slock_sig()
1050 		 * does not check for signals if not sleeping for the
1051 		 * lock.
1052 		 */
1053 		sx_sunlock(&pg->pg_killsx);
1054 		killsx_locked = false;
1055 		error = ERESTART;
1056 		goto fail2;
1057 	} else {
1058 		killsx_locked = true;
1059 	}
1060 
1061 	/*
1062 	 * If required, create a process descriptor in the parent first; we
1063 	 * will abandon it if something goes wrong. We don't finit() until
1064 	 * later.
1065 	 */
1066 	if (flags & RFPROCDESC) {
1067 		error = procdesc_falloc(td, &fp_procdesc, fr->fr_pd_fd,
1068 		    fr->fr_pd_flags, fr->fr_pd_fcaps);
1069 		if (error != 0)
1070 			goto fail2;
1071 		AUDIT_ARG_FD(*fr->fr_pd_fd);
1072 	}
1073 
1074 	mem_charged = 0;
1075 	if (pages == 0)
1076 		pages = kstack_pages;
1077 	/* Allocate new proc. */
1078 	newproc = uma_zalloc(proc_zone, M_WAITOK);
1079 	PROC_TREE_REF(newproc);
1080 	td2 = FIRST_THREAD_IN_PROC(newproc);
1081 	if (td2 == NULL) {
1082 		td2 = thread_alloc(pages);
1083 		if (td2 == NULL) {
1084 			error = ENOMEM;
1085 			goto fail2;
1086 		}
1087 		proc_linkup(newproc, td2);
1088 	} else {
1089 		error = thread_recycle(td2, pages);
1090 		if (error != 0)
1091 			goto fail2;
1092 	}
1093 
1094 	if ((flags & RFMEM) == 0) {
1095 		vm2 = vmspace_fork(p1->p_vmspace, &mem_charged);
1096 		if (vm2 == NULL) {
1097 			error = ENOMEM;
1098 			goto fail2;
1099 		}
1100 		if (!swap_reserve(mem_charged)) {
1101 			/*
1102 			 * The swap reservation failed. The accounting
1103 			 * from the entries of the copied vm2 will be
1104 			 * subtracted in vmspace_free(), so force the
1105 			 * reservation there.
1106 			 */
1107 			swap_reserve_force(mem_charged);
1108 			error = ENOMEM;
1109 			goto fail2;
1110 		}
1111 	} else
1112 		vm2 = NULL;
1113 
1114 	/*
1115 	 * XXX: This is ugly; when we copy resource usage, we need to bump
1116 	 *      per-cred resource counters.
1117 	 */
1118 	newproc->p_ucred = crcowget(td->td_ucred);
1119 
1120 	/*
1121 	 * Initialize resource accounting for the child process.
1122 	 */
1123 	error = racct_proc_fork(p1, newproc);
1124 	if (error != 0) {
1125 		error = EAGAIN;
1126 		goto fail1;
1127 	}
1128 
1129 #ifdef MAC
1130 	mac_proc_init(newproc);
1131 #endif
1132 
1133 	/*
1134 	 * Increment the count of procs running with this uid. Don't allow
1135 	 * a nonprivileged user to exceed their current limit.
1136 	 */
1137 	cred = td->td_ucred;
1138 	if (!chgproccnt(cred->cr_ruidinfo, 1, lim_cur(td, RLIMIT_NPROC))) {
1139 		if (priv_check_cred(cred, PRIV_PROC_LIMIT) != 0)
1140 			goto fail0;
1141 		chgproccnt(cred->cr_ruidinfo, 1, 0);
1142 	}
1143 
1144 	newproc->p_klist = knlist_alloc(&newproc->p_mtx);
1145 
1146 	do_fork(td, fr, newproc, td2, vm2, fp_procdesc);
1147 	error = 0;
1148 	goto cleanup;
1149 fail0:
1150 	error = EAGAIN;
1151 #ifdef MAC
1152 	mac_proc_destroy(newproc);
1153 #endif
1154 	racct_proc_exit(newproc);
1155 fail1:
1156 	proc_unset_cred(newproc, false);
1157 fail2:
1158 	if (vm2 != NULL)
1159 		vmspace_free(vm2);
1160 	if (newproc != NULL)
1161 		PROC_TREE_UNREF(newproc);
1162 	if ((flags & RFPROCDESC) != 0 && fp_procdesc != NULL) {
1163 		fdclose(td, fp_procdesc, *fr->fr_pd_fd);
1164 		fdrop(fp_procdesc, td);
1165 	}
1166 	atomic_add_int(&nprocs, -1);
1167 cleanup:
1168 	if (killsx_locked)
1169 		sx_sunlock(&pg->pg_killsx);
1170 	if (singlethreaded) {
1171 		PROC_LOCK(p1);
1172 		thread_single_end(p1, SINGLE_BOUNDARY);
1173 		PROC_UNLOCK(p1);
1174 	}
1175 	if (error != 0)
1176 		pause("fork", hz / 2);
1177 	return (error);
1178 }
1179 
1180 /*
1181  * Handle the return of a child process from fork1().  This function
1182  * is called from the MD fork_trampoline() entry point.
1183  */
1184 void
fork_exit(void (* callout)(void *,struct trapframe *),void * arg,struct trapframe * frame)1185 fork_exit(void (*callout)(void *, struct trapframe *), void *arg,
1186     struct trapframe *frame)
1187 {
1188 	struct proc *p;
1189 	struct thread *td;
1190 	struct thread *dtd;
1191 
1192 	kmsan_mark(frame, sizeof(*frame), KMSAN_STATE_INITED);
1193 
1194 	td = curthread;
1195 	p = td->td_proc;
1196 	KASSERT(p->p_state == PRS_NORMAL, ("executing process is still new"));
1197 
1198 	CTR4(KTR_PROC, "fork_exit: new thread %p (td_sched %p, pid %d, %s)",
1199 	    td, td_get_sched(td), p->p_pid, td->td_name);
1200 
1201 	sched_fork_exit(td);
1202 
1203 	/*
1204 	 * Processes normally resume in mi_switch() after being
1205 	 * cpu_switch()'ed to, but when children start up they arrive here
1206 	 * instead, so we must do much the same things as mi_switch() would.
1207 	 */
1208 	if ((dtd = PCPU_GET(deadthread))) {
1209 		PCPU_SET(deadthread, NULL);
1210 		thread_stash(dtd);
1211 	}
1212 	thread_unlock(td);
1213 
1214 	/*
1215 	 * cpu_fork_kthread_handler intercepts this function call to
1216 	 * have this call a non-return function to stay in kernel mode.
1217 	 * initproc has its own fork handler, but it does return.
1218 	 */
1219 	KASSERT(callout != NULL, ("NULL callout in fork_exit"));
1220 	callout(arg, frame);
1221 
1222 	/*
1223 	 * Check if a kernel thread misbehaved and returned from its main
1224 	 * function.
1225 	 */
1226 	if (p->p_flag & P_KPROC) {
1227 		printf("Kernel thread \"%s\" (pid %d) exited prematurely.\n",
1228 		    td->td_name, p->p_pid);
1229 		kthread_exit();
1230 	}
1231 	mtx_assert(&Giant, MA_NOTOWNED);
1232 
1233 	/*
1234 	 * Now going to return to userland.
1235 	 */
1236 
1237 	if (p->p_sysent->sv_schedtail != NULL)
1238 		(p->p_sysent->sv_schedtail)(td);
1239 
1240 	userret(td, frame);
1241 }
1242 
1243 /*
1244  * Simplified back end of syscall(), used when returning from fork()
1245  * directly into user mode.  This function is passed in to fork_exit()
1246  * as the first parameter and is called when returning to a new
1247  * userland process.
1248  */
1249 void
fork_return(struct thread * td,struct trapframe * frame)1250 fork_return(struct thread *td, struct trapframe *frame)
1251 {
1252 	struct proc *p;
1253 
1254 	p = td->td_proc;
1255 	if (td->td_dbgflags & TDB_STOPATFORK) {
1256 		PROC_LOCK(p);
1257 		if ((p->p_flag & P_TRACED) != 0) {
1258 			/*
1259 			 * Inform the debugger if one is still present.
1260 			 */
1261 			td->td_dbgflags |= TDB_CHILD | TDB_SCX | TDB_FSTP;
1262 			ptracestop(td, SIGSTOP, NULL);
1263 			td->td_dbgflags &= ~(TDB_CHILD | TDB_SCX);
1264 		} else {
1265 			/*
1266 			 * ... otherwise clear the request.
1267 			 */
1268 			td->td_dbgflags &= ~TDB_STOPATFORK;
1269 		}
1270 		PROC_UNLOCK(p);
1271 	} else if (p->p_flag & P_TRACED) {
1272  		/*
1273 		 * This is the start of a new thread in a traced
1274 		 * process.  Report a system call exit event.
1275 		 */
1276 		PROC_LOCK(p);
1277 		td->td_dbgflags |= TDB_SCX;
1278 		if ((p->p_ptevents & PTRACE_SCX) != 0 ||
1279 		    (td->td_dbgflags & TDB_BORN) != 0)
1280 			ptracestop(td, SIGTRAP, NULL);
1281 		td->td_dbgflags &= ~(TDB_SCX | TDB_BORN);
1282 		PROC_UNLOCK(p);
1283 	}
1284 
1285 	/*
1286 	 * If the prison was killed mid-fork, die along with it.
1287 	 */
1288 	if (!prison_isalive(td->td_ucred->cr_prison))
1289 		kern_exit(td, 0, SIGKILL);
1290 
1291 #ifdef KTRACE
1292 	if (KTRPOINT(td, KTR_SYSRET))
1293 		ktrsysret(td->td_sa.code, 0, 0);
1294 #endif
1295 }
1296 
1297 static void
fork_init(void * arg __unused)1298 fork_init(void *arg __unused)
1299 {
1300 	ast_register(TDA_VFORK, ASTR_ASTF_REQUIRED | ASTR_TDP, TDP_RFPPWAIT,
1301 	    ast_vfork);
1302 }
1303 SYSINIT(fork, SI_SUB_INTRINSIC, SI_ORDER_ANY, fork_init, NULL);
1304