xref: /linux/kernel/exit.c (revision 5e8d780d745c1619aba81fe7166c5a4b5cad2b84)
1 /*
2  *  linux/kernel/exit.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6 
7 #include <linux/config.h>
8 #include <linux/mm.h>
9 #include <linux/slab.h>
10 #include <linux/interrupt.h>
11 #include <linux/smp_lock.h>
12 #include <linux/module.h>
13 #include <linux/capability.h>
14 #include <linux/completion.h>
15 #include <linux/personality.h>
16 #include <linux/tty.h>
17 #include <linux/namespace.h>
18 #include <linux/key.h>
19 #include <linux/security.h>
20 #include <linux/cpu.h>
21 #include <linux/acct.h>
22 #include <linux/file.h>
23 #include <linux/binfmts.h>
24 #include <linux/ptrace.h>
25 #include <linux/profile.h>
26 #include <linux/mount.h>
27 #include <linux/proc_fs.h>
28 #include <linux/mempolicy.h>
29 #include <linux/cpuset.h>
30 #include <linux/syscalls.h>
31 #include <linux/signal.h>
32 #include <linux/posix-timers.h>
33 #include <linux/cn_proc.h>
34 #include <linux/mutex.h>
35 #include <linux/futex.h>
36 #include <linux/compat.h>
37 #include <linux/pipe_fs_i.h>
38 #include <linux/audit.h> /* for audit_free() */
39 #include <linux/resource.h>
40 
41 #include <asm/uaccess.h>
42 #include <asm/unistd.h>
43 #include <asm/pgtable.h>
44 #include <asm/mmu_context.h>
45 
46 extern void sem_exit (void);
47 extern struct task_struct *child_reaper;
48 
49 static void exit_mm(struct task_struct * tsk);
50 
51 static void __unhash_process(struct task_struct *p)
52 {
53 	nr_threads--;
54 	detach_pid(p, PIDTYPE_PID);
55 	if (thread_group_leader(p)) {
56 		detach_pid(p, PIDTYPE_PGID);
57 		detach_pid(p, PIDTYPE_SID);
58 
59 		list_del_rcu(&p->tasks);
60 		__get_cpu_var(process_counts)--;
61 	}
62 	list_del_rcu(&p->thread_group);
63 	remove_parent(p);
64 }
65 
66 /*
67  * This function expects the tasklist_lock write-locked.
68  */
69 static void __exit_signal(struct task_struct *tsk)
70 {
71 	struct signal_struct *sig = tsk->signal;
72 	struct sighand_struct *sighand;
73 
74 	BUG_ON(!sig);
75 	BUG_ON(!atomic_read(&sig->count));
76 
77 	rcu_read_lock();
78 	sighand = rcu_dereference(tsk->sighand);
79 	spin_lock(&sighand->siglock);
80 
81 	posix_cpu_timers_exit(tsk);
82 	if (atomic_dec_and_test(&sig->count))
83 		posix_cpu_timers_exit_group(tsk);
84 	else {
85 		/*
86 		 * If there is any task waiting for the group exit
87 		 * then notify it:
88 		 */
89 		if (sig->group_exit_task && atomic_read(&sig->count) == sig->notify_count) {
90 			wake_up_process(sig->group_exit_task);
91 			sig->group_exit_task = NULL;
92 		}
93 		if (tsk == sig->curr_target)
94 			sig->curr_target = next_thread(tsk);
95 		/*
96 		 * Accumulate here the counters for all threads but the
97 		 * group leader as they die, so they can be added into
98 		 * the process-wide totals when those are taken.
99 		 * The group leader stays around as a zombie as long
100 		 * as there are other threads.  When it gets reaped,
101 		 * the exit.c code will add its counts into these totals.
102 		 * We won't ever get here for the group leader, since it
103 		 * will have been the last reference on the signal_struct.
104 		 */
105 		sig->utime = cputime_add(sig->utime, tsk->utime);
106 		sig->stime = cputime_add(sig->stime, tsk->stime);
107 		sig->min_flt += tsk->min_flt;
108 		sig->maj_flt += tsk->maj_flt;
109 		sig->nvcsw += tsk->nvcsw;
110 		sig->nivcsw += tsk->nivcsw;
111 		sig->sched_time += tsk->sched_time;
112 		sig = NULL; /* Marker for below. */
113 	}
114 
115 	__unhash_process(tsk);
116 
117 	tsk->signal = NULL;
118 	tsk->sighand = NULL;
119 	spin_unlock(&sighand->siglock);
120 	rcu_read_unlock();
121 
122 	__cleanup_sighand(sighand);
123 	clear_tsk_thread_flag(tsk,TIF_SIGPENDING);
124 	flush_sigqueue(&tsk->pending);
125 	if (sig) {
126 		flush_sigqueue(&sig->shared_pending);
127 		__cleanup_signal(sig);
128 	}
129 }
130 
131 static void delayed_put_task_struct(struct rcu_head *rhp)
132 {
133 	put_task_struct(container_of(rhp, struct task_struct, rcu));
134 }
135 
136 void release_task(struct task_struct * p)
137 {
138 	int zap_leader;
139 	task_t *leader;
140 repeat:
141 	atomic_dec(&p->user->processes);
142 	write_lock_irq(&tasklist_lock);
143 	ptrace_unlink(p);
144 	BUG_ON(!list_empty(&p->ptrace_list) || !list_empty(&p->ptrace_children));
145 	__exit_signal(p);
146 
147 	/*
148 	 * If we are the last non-leader member of the thread
149 	 * group, and the leader is zombie, then notify the
150 	 * group leader's parent process. (if it wants notification.)
151 	 */
152 	zap_leader = 0;
153 	leader = p->group_leader;
154 	if (leader != p && thread_group_empty(leader) && leader->exit_state == EXIT_ZOMBIE) {
155 		BUG_ON(leader->exit_signal == -1);
156 		do_notify_parent(leader, leader->exit_signal);
157 		/*
158 		 * If we were the last child thread and the leader has
159 		 * exited already, and the leader's parent ignores SIGCHLD,
160 		 * then we are the one who should release the leader.
161 		 *
162 		 * do_notify_parent() will have marked it self-reaping in
163 		 * that case.
164 		 */
165 		zap_leader = (leader->exit_signal == -1);
166 	}
167 
168 	sched_exit(p);
169 	write_unlock_irq(&tasklist_lock);
170 	proc_flush_task(p);
171 	release_thread(p);
172 	call_rcu(&p->rcu, delayed_put_task_struct);
173 
174 	p = leader;
175 	if (unlikely(zap_leader))
176 		goto repeat;
177 }
178 
179 /*
180  * This checks not only the pgrp, but falls back on the pid if no
181  * satisfactory pgrp is found. I dunno - gdb doesn't work correctly
182  * without this...
183  */
184 int session_of_pgrp(int pgrp)
185 {
186 	struct task_struct *p;
187 	int sid = -1;
188 
189 	read_lock(&tasklist_lock);
190 	do_each_task_pid(pgrp, PIDTYPE_PGID, p) {
191 		if (p->signal->session > 0) {
192 			sid = p->signal->session;
193 			goto out;
194 		}
195 	} while_each_task_pid(pgrp, PIDTYPE_PGID, p);
196 	p = find_task_by_pid(pgrp);
197 	if (p)
198 		sid = p->signal->session;
199 out:
200 	read_unlock(&tasklist_lock);
201 
202 	return sid;
203 }
204 
205 /*
206  * Determine if a process group is "orphaned", according to the POSIX
207  * definition in 2.2.2.52.  Orphaned process groups are not to be affected
208  * by terminal-generated stop signals.  Newly orphaned process groups are
209  * to receive a SIGHUP and a SIGCONT.
210  *
211  * "I ask you, have you ever known what it is to be an orphan?"
212  */
213 static int will_become_orphaned_pgrp(int pgrp, task_t *ignored_task)
214 {
215 	struct task_struct *p;
216 	int ret = 1;
217 
218 	do_each_task_pid(pgrp, PIDTYPE_PGID, p) {
219 		if (p == ignored_task
220 				|| p->exit_state
221 				|| p->real_parent->pid == 1)
222 			continue;
223 		if (process_group(p->real_parent) != pgrp
224 			    && p->real_parent->signal->session == p->signal->session) {
225 			ret = 0;
226 			break;
227 		}
228 	} while_each_task_pid(pgrp, PIDTYPE_PGID, p);
229 	return ret;	/* (sighing) "Often!" */
230 }
231 
232 int is_orphaned_pgrp(int pgrp)
233 {
234 	int retval;
235 
236 	read_lock(&tasklist_lock);
237 	retval = will_become_orphaned_pgrp(pgrp, NULL);
238 	read_unlock(&tasklist_lock);
239 
240 	return retval;
241 }
242 
243 static int has_stopped_jobs(int pgrp)
244 {
245 	int retval = 0;
246 	struct task_struct *p;
247 
248 	do_each_task_pid(pgrp, PIDTYPE_PGID, p) {
249 		if (p->state != TASK_STOPPED)
250 			continue;
251 
252 		/* If p is stopped by a debugger on a signal that won't
253 		   stop it, then don't count p as stopped.  This isn't
254 		   perfect but it's a good approximation.  */
255 		if (unlikely (p->ptrace)
256 		    && p->exit_code != SIGSTOP
257 		    && p->exit_code != SIGTSTP
258 		    && p->exit_code != SIGTTOU
259 		    && p->exit_code != SIGTTIN)
260 			continue;
261 
262 		retval = 1;
263 		break;
264 	} while_each_task_pid(pgrp, PIDTYPE_PGID, p);
265 	return retval;
266 }
267 
268 /**
269  * reparent_to_init - Reparent the calling kernel thread to the init task.
270  *
271  * If a kernel thread is launched as a result of a system call, or if
272  * it ever exits, it should generally reparent itself to init so that
273  * it is correctly cleaned up on exit.
274  *
275  * The various task state such as scheduling policy and priority may have
276  * been inherited from a user process, so we reset them to sane values here.
277  *
278  * NOTE that reparent_to_init() gives the caller full capabilities.
279  */
280 static void reparent_to_init(void)
281 {
282 	write_lock_irq(&tasklist_lock);
283 
284 	ptrace_unlink(current);
285 	/* Reparent to init */
286 	remove_parent(current);
287 	current->parent = child_reaper;
288 	current->real_parent = child_reaper;
289 	add_parent(current);
290 
291 	/* Set the exit signal to SIGCHLD so we signal init on exit */
292 	current->exit_signal = SIGCHLD;
293 
294 	if ((current->policy == SCHED_NORMAL ||
295 			current->policy == SCHED_BATCH)
296 				&& (task_nice(current) < 0))
297 		set_user_nice(current, 0);
298 	/* cpus_allowed? */
299 	/* rt_priority? */
300 	/* signals? */
301 	security_task_reparent_to_init(current);
302 	memcpy(current->signal->rlim, init_task.signal->rlim,
303 	       sizeof(current->signal->rlim));
304 	atomic_inc(&(INIT_USER->__count));
305 	write_unlock_irq(&tasklist_lock);
306 	switch_uid(INIT_USER);
307 }
308 
309 void __set_special_pids(pid_t session, pid_t pgrp)
310 {
311 	struct task_struct *curr = current->group_leader;
312 
313 	if (curr->signal->session != session) {
314 		detach_pid(curr, PIDTYPE_SID);
315 		curr->signal->session = session;
316 		attach_pid(curr, PIDTYPE_SID, session);
317 	}
318 	if (process_group(curr) != pgrp) {
319 		detach_pid(curr, PIDTYPE_PGID);
320 		curr->signal->pgrp = pgrp;
321 		attach_pid(curr, PIDTYPE_PGID, pgrp);
322 	}
323 }
324 
325 void set_special_pids(pid_t session, pid_t pgrp)
326 {
327 	write_lock_irq(&tasklist_lock);
328 	__set_special_pids(session, pgrp);
329 	write_unlock_irq(&tasklist_lock);
330 }
331 
332 /*
333  * Let kernel threads use this to say that they
334  * allow a certain signal (since daemonize() will
335  * have disabled all of them by default).
336  */
337 int allow_signal(int sig)
338 {
339 	if (!valid_signal(sig) || sig < 1)
340 		return -EINVAL;
341 
342 	spin_lock_irq(&current->sighand->siglock);
343 	sigdelset(&current->blocked, sig);
344 	if (!current->mm) {
345 		/* Kernel threads handle their own signals.
346 		   Let the signal code know it'll be handled, so
347 		   that they don't get converted to SIGKILL or
348 		   just silently dropped */
349 		current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
350 	}
351 	recalc_sigpending();
352 	spin_unlock_irq(&current->sighand->siglock);
353 	return 0;
354 }
355 
356 EXPORT_SYMBOL(allow_signal);
357 
358 int disallow_signal(int sig)
359 {
360 	if (!valid_signal(sig) || sig < 1)
361 		return -EINVAL;
362 
363 	spin_lock_irq(&current->sighand->siglock);
364 	sigaddset(&current->blocked, sig);
365 	recalc_sigpending();
366 	spin_unlock_irq(&current->sighand->siglock);
367 	return 0;
368 }
369 
370 EXPORT_SYMBOL(disallow_signal);
371 
372 /*
373  *	Put all the gunge required to become a kernel thread without
374  *	attached user resources in one place where it belongs.
375  */
376 
377 void daemonize(const char *name, ...)
378 {
379 	va_list args;
380 	struct fs_struct *fs;
381 	sigset_t blocked;
382 
383 	va_start(args, name);
384 	vsnprintf(current->comm, sizeof(current->comm), name, args);
385 	va_end(args);
386 
387 	/*
388 	 * If we were started as result of loading a module, close all of the
389 	 * user space pages.  We don't need them, and if we didn't close them
390 	 * they would be locked into memory.
391 	 */
392 	exit_mm(current);
393 
394 	set_special_pids(1, 1);
395 	mutex_lock(&tty_mutex);
396 	current->signal->tty = NULL;
397 	mutex_unlock(&tty_mutex);
398 
399 	/* Block and flush all signals */
400 	sigfillset(&blocked);
401 	sigprocmask(SIG_BLOCK, &blocked, NULL);
402 	flush_signals(current);
403 
404 	/* Become as one with the init task */
405 
406 	exit_fs(current);	/* current->fs->count--; */
407 	fs = init_task.fs;
408 	current->fs = fs;
409 	atomic_inc(&fs->count);
410 	exit_namespace(current);
411 	current->namespace = init_task.namespace;
412 	get_namespace(current->namespace);
413  	exit_files(current);
414 	current->files = init_task.files;
415 	atomic_inc(&current->files->count);
416 
417 	reparent_to_init();
418 }
419 
420 EXPORT_SYMBOL(daemonize);
421 
422 static void close_files(struct files_struct * files)
423 {
424 	int i, j;
425 	struct fdtable *fdt;
426 
427 	j = 0;
428 
429 	/*
430 	 * It is safe to dereference the fd table without RCU or
431 	 * ->file_lock because this is the last reference to the
432 	 * files structure.
433 	 */
434 	fdt = files_fdtable(files);
435 	for (;;) {
436 		unsigned long set;
437 		i = j * __NFDBITS;
438 		if (i >= fdt->max_fdset || i >= fdt->max_fds)
439 			break;
440 		set = fdt->open_fds->fds_bits[j++];
441 		while (set) {
442 			if (set & 1) {
443 				struct file * file = xchg(&fdt->fd[i], NULL);
444 				if (file)
445 					filp_close(file, files);
446 			}
447 			i++;
448 			set >>= 1;
449 		}
450 	}
451 }
452 
453 struct files_struct *get_files_struct(struct task_struct *task)
454 {
455 	struct files_struct *files;
456 
457 	task_lock(task);
458 	files = task->files;
459 	if (files)
460 		atomic_inc(&files->count);
461 	task_unlock(task);
462 
463 	return files;
464 }
465 
466 void fastcall put_files_struct(struct files_struct *files)
467 {
468 	struct fdtable *fdt;
469 
470 	if (atomic_dec_and_test(&files->count)) {
471 		close_files(files);
472 		/*
473 		 * Free the fd and fdset arrays if we expanded them.
474 		 * If the fdtable was embedded, pass files for freeing
475 		 * at the end of the RCU grace period. Otherwise,
476 		 * you can free files immediately.
477 		 */
478 		fdt = files_fdtable(files);
479 		if (fdt == &files->fdtab)
480 			fdt->free_files = files;
481 		else
482 			kmem_cache_free(files_cachep, files);
483 		free_fdtable(fdt);
484 	}
485 }
486 
487 EXPORT_SYMBOL(put_files_struct);
488 
489 static inline void __exit_files(struct task_struct *tsk)
490 {
491 	struct files_struct * files = tsk->files;
492 
493 	if (files) {
494 		task_lock(tsk);
495 		tsk->files = NULL;
496 		task_unlock(tsk);
497 		put_files_struct(files);
498 	}
499 }
500 
501 void exit_files(struct task_struct *tsk)
502 {
503 	__exit_files(tsk);
504 }
505 
506 static inline void __put_fs_struct(struct fs_struct *fs)
507 {
508 	/* No need to hold fs->lock if we are killing it */
509 	if (atomic_dec_and_test(&fs->count)) {
510 		dput(fs->root);
511 		mntput(fs->rootmnt);
512 		dput(fs->pwd);
513 		mntput(fs->pwdmnt);
514 		if (fs->altroot) {
515 			dput(fs->altroot);
516 			mntput(fs->altrootmnt);
517 		}
518 		kmem_cache_free(fs_cachep, fs);
519 	}
520 }
521 
522 void put_fs_struct(struct fs_struct *fs)
523 {
524 	__put_fs_struct(fs);
525 }
526 
527 static inline void __exit_fs(struct task_struct *tsk)
528 {
529 	struct fs_struct * fs = tsk->fs;
530 
531 	if (fs) {
532 		task_lock(tsk);
533 		tsk->fs = NULL;
534 		task_unlock(tsk);
535 		__put_fs_struct(fs);
536 	}
537 }
538 
539 void exit_fs(struct task_struct *tsk)
540 {
541 	__exit_fs(tsk);
542 }
543 
544 EXPORT_SYMBOL_GPL(exit_fs);
545 
546 /*
547  * Turn us into a lazy TLB process if we
548  * aren't already..
549  */
550 static void exit_mm(struct task_struct * tsk)
551 {
552 	struct mm_struct *mm = tsk->mm;
553 
554 	mm_release(tsk, mm);
555 	if (!mm)
556 		return;
557 	/*
558 	 * Serialize with any possible pending coredump.
559 	 * We must hold mmap_sem around checking core_waiters
560 	 * and clearing tsk->mm.  The core-inducing thread
561 	 * will increment core_waiters for each thread in the
562 	 * group with ->mm != NULL.
563 	 */
564 	down_read(&mm->mmap_sem);
565 	if (mm->core_waiters) {
566 		up_read(&mm->mmap_sem);
567 		down_write(&mm->mmap_sem);
568 		if (!--mm->core_waiters)
569 			complete(mm->core_startup_done);
570 		up_write(&mm->mmap_sem);
571 
572 		wait_for_completion(&mm->core_done);
573 		down_read(&mm->mmap_sem);
574 	}
575 	atomic_inc(&mm->mm_count);
576 	BUG_ON(mm != tsk->active_mm);
577 	/* more a memory barrier than a real lock */
578 	task_lock(tsk);
579 	tsk->mm = NULL;
580 	up_read(&mm->mmap_sem);
581 	enter_lazy_tlb(mm, current);
582 	task_unlock(tsk);
583 	mmput(mm);
584 }
585 
586 static inline void choose_new_parent(task_t *p, task_t *reaper)
587 {
588 	/*
589 	 * Make sure we're not reparenting to ourselves and that
590 	 * the parent is not a zombie.
591 	 */
592 	BUG_ON(p == reaper || reaper->exit_state);
593 	p->real_parent = reaper;
594 }
595 
596 static void reparent_thread(task_t *p, task_t *father, int traced)
597 {
598 	/* We don't want people slaying init.  */
599 	if (p->exit_signal != -1)
600 		p->exit_signal = SIGCHLD;
601 
602 	if (p->pdeath_signal)
603 		/* We already hold the tasklist_lock here.  */
604 		group_send_sig_info(p->pdeath_signal, SEND_SIG_NOINFO, p);
605 
606 	/* Move the child from its dying parent to the new one.  */
607 	if (unlikely(traced)) {
608 		/* Preserve ptrace links if someone else is tracing this child.  */
609 		list_del_init(&p->ptrace_list);
610 		if (p->parent != p->real_parent)
611 			list_add(&p->ptrace_list, &p->real_parent->ptrace_children);
612 	} else {
613 		/* If this child is being traced, then we're the one tracing it
614 		 * anyway, so let go of it.
615 		 */
616 		p->ptrace = 0;
617 		remove_parent(p);
618 		p->parent = p->real_parent;
619 		add_parent(p);
620 
621 		/* If we'd notified the old parent about this child's death,
622 		 * also notify the new parent.
623 		 */
624 		if (p->exit_state == EXIT_ZOMBIE && p->exit_signal != -1 &&
625 		    thread_group_empty(p))
626 			do_notify_parent(p, p->exit_signal);
627 		else if (p->state == TASK_TRACED) {
628 			/*
629 			 * If it was at a trace stop, turn it into
630 			 * a normal stop since it's no longer being
631 			 * traced.
632 			 */
633 			ptrace_untrace(p);
634 		}
635 	}
636 
637 	/*
638 	 * process group orphan check
639 	 * Case ii: Our child is in a different pgrp
640 	 * than we are, and it was the only connection
641 	 * outside, so the child pgrp is now orphaned.
642 	 */
643 	if ((process_group(p) != process_group(father)) &&
644 	    (p->signal->session == father->signal->session)) {
645 		int pgrp = process_group(p);
646 
647 		if (will_become_orphaned_pgrp(pgrp, NULL) && has_stopped_jobs(pgrp)) {
648 			__kill_pg_info(SIGHUP, SEND_SIG_PRIV, pgrp);
649 			__kill_pg_info(SIGCONT, SEND_SIG_PRIV, pgrp);
650 		}
651 	}
652 }
653 
654 /*
655  * When we die, we re-parent all our children.
656  * Try to give them to another thread in our thread
657  * group, and if no such member exists, give it to
658  * the global child reaper process (ie "init")
659  */
660 static void forget_original_parent(struct task_struct * father,
661 					  struct list_head *to_release)
662 {
663 	struct task_struct *p, *reaper = father;
664 	struct list_head *_p, *_n;
665 
666 	do {
667 		reaper = next_thread(reaper);
668 		if (reaper == father) {
669 			reaper = child_reaper;
670 			break;
671 		}
672 	} while (reaper->exit_state);
673 
674 	/*
675 	 * There are only two places where our children can be:
676 	 *
677 	 * - in our child list
678 	 * - in our ptraced child list
679 	 *
680 	 * Search them and reparent children.
681 	 */
682 	list_for_each_safe(_p, _n, &father->children) {
683 		int ptrace;
684 		p = list_entry(_p,struct task_struct,sibling);
685 
686 		ptrace = p->ptrace;
687 
688 		/* if father isn't the real parent, then ptrace must be enabled */
689 		BUG_ON(father != p->real_parent && !ptrace);
690 
691 		if (father == p->real_parent) {
692 			/* reparent with a reaper, real father it's us */
693 			choose_new_parent(p, reaper);
694 			reparent_thread(p, father, 0);
695 		} else {
696 			/* reparent ptraced task to its real parent */
697 			__ptrace_unlink (p);
698 			if (p->exit_state == EXIT_ZOMBIE && p->exit_signal != -1 &&
699 			    thread_group_empty(p))
700 				do_notify_parent(p, p->exit_signal);
701 		}
702 
703 		/*
704 		 * if the ptraced child is a zombie with exit_signal == -1
705 		 * we must collect it before we exit, or it will remain
706 		 * zombie forever since we prevented it from self-reap itself
707 		 * while it was being traced by us, to be able to see it in wait4.
708 		 */
709 		if (unlikely(ptrace && p->exit_state == EXIT_ZOMBIE && p->exit_signal == -1))
710 			list_add(&p->ptrace_list, to_release);
711 	}
712 	list_for_each_safe(_p, _n, &father->ptrace_children) {
713 		p = list_entry(_p,struct task_struct,ptrace_list);
714 		choose_new_parent(p, reaper);
715 		reparent_thread(p, father, 1);
716 	}
717 }
718 
719 /*
720  * Send signals to all our closest relatives so that they know
721  * to properly mourn us..
722  */
723 static void exit_notify(struct task_struct *tsk)
724 {
725 	int state;
726 	struct task_struct *t;
727 	struct list_head ptrace_dead, *_p, *_n;
728 
729 	if (signal_pending(tsk) && !(tsk->signal->flags & SIGNAL_GROUP_EXIT)
730 	    && !thread_group_empty(tsk)) {
731 		/*
732 		 * This occurs when there was a race between our exit
733 		 * syscall and a group signal choosing us as the one to
734 		 * wake up.  It could be that we are the only thread
735 		 * alerted to check for pending signals, but another thread
736 		 * should be woken now to take the signal since we will not.
737 		 * Now we'll wake all the threads in the group just to make
738 		 * sure someone gets all the pending signals.
739 		 */
740 		read_lock(&tasklist_lock);
741 		spin_lock_irq(&tsk->sighand->siglock);
742 		for (t = next_thread(tsk); t != tsk; t = next_thread(t))
743 			if (!signal_pending(t) && !(t->flags & PF_EXITING)) {
744 				recalc_sigpending_tsk(t);
745 				if (signal_pending(t))
746 					signal_wake_up(t, 0);
747 			}
748 		spin_unlock_irq(&tsk->sighand->siglock);
749 		read_unlock(&tasklist_lock);
750 	}
751 
752 	write_lock_irq(&tasklist_lock);
753 
754 	/*
755 	 * This does two things:
756 	 *
757   	 * A.  Make init inherit all the child processes
758 	 * B.  Check to see if any process groups have become orphaned
759 	 *	as a result of our exiting, and if they have any stopped
760 	 *	jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2)
761 	 */
762 
763 	INIT_LIST_HEAD(&ptrace_dead);
764 	forget_original_parent(tsk, &ptrace_dead);
765 	BUG_ON(!list_empty(&tsk->children));
766 	BUG_ON(!list_empty(&tsk->ptrace_children));
767 
768 	/*
769 	 * Check to see if any process groups have become orphaned
770 	 * as a result of our exiting, and if they have any stopped
771 	 * jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2)
772 	 *
773 	 * Case i: Our father is in a different pgrp than we are
774 	 * and we were the only connection outside, so our pgrp
775 	 * is about to become orphaned.
776 	 */
777 
778 	t = tsk->real_parent;
779 
780 	if ((process_group(t) != process_group(tsk)) &&
781 	    (t->signal->session == tsk->signal->session) &&
782 	    will_become_orphaned_pgrp(process_group(tsk), tsk) &&
783 	    has_stopped_jobs(process_group(tsk))) {
784 		__kill_pg_info(SIGHUP, SEND_SIG_PRIV, process_group(tsk));
785 		__kill_pg_info(SIGCONT, SEND_SIG_PRIV, process_group(tsk));
786 	}
787 
788 	/* Let father know we died
789 	 *
790 	 * Thread signals are configurable, but you aren't going to use
791 	 * that to send signals to arbitary processes.
792 	 * That stops right now.
793 	 *
794 	 * If the parent exec id doesn't match the exec id we saved
795 	 * when we started then we know the parent has changed security
796 	 * domain.
797 	 *
798 	 * If our self_exec id doesn't match our parent_exec_id then
799 	 * we have changed execution domain as these two values started
800 	 * the same after a fork.
801 	 *
802 	 */
803 
804 	if (tsk->exit_signal != SIGCHLD && tsk->exit_signal != -1 &&
805 	    ( tsk->parent_exec_id != t->self_exec_id  ||
806 	      tsk->self_exec_id != tsk->parent_exec_id)
807 	    && !capable(CAP_KILL))
808 		tsk->exit_signal = SIGCHLD;
809 
810 
811 	/* If something other than our normal parent is ptracing us, then
812 	 * send it a SIGCHLD instead of honoring exit_signal.  exit_signal
813 	 * only has special meaning to our real parent.
814 	 */
815 	if (tsk->exit_signal != -1 && thread_group_empty(tsk)) {
816 		int signal = tsk->parent == tsk->real_parent ? tsk->exit_signal : SIGCHLD;
817 		do_notify_parent(tsk, signal);
818 	} else if (tsk->ptrace) {
819 		do_notify_parent(tsk, SIGCHLD);
820 	}
821 
822 	state = EXIT_ZOMBIE;
823 	if (tsk->exit_signal == -1 &&
824 	    (likely(tsk->ptrace == 0) ||
825 	     unlikely(tsk->parent->signal->flags & SIGNAL_GROUP_EXIT)))
826 		state = EXIT_DEAD;
827 	tsk->exit_state = state;
828 
829 	write_unlock_irq(&tasklist_lock);
830 
831 	list_for_each_safe(_p, _n, &ptrace_dead) {
832 		list_del_init(_p);
833 		t = list_entry(_p,struct task_struct,ptrace_list);
834 		release_task(t);
835 	}
836 
837 	/* If the process is dead, release it - nobody will wait for it */
838 	if (state == EXIT_DEAD)
839 		release_task(tsk);
840 }
841 
842 fastcall NORET_TYPE void do_exit(long code)
843 {
844 	struct task_struct *tsk = current;
845 	int group_dead;
846 
847 	profile_task_exit(tsk);
848 
849 	WARN_ON(atomic_read(&tsk->fs_excl));
850 
851 	if (unlikely(in_interrupt()))
852 		panic("Aiee, killing interrupt handler!");
853 	if (unlikely(!tsk->pid))
854 		panic("Attempted to kill the idle task!");
855 	if (unlikely(tsk == child_reaper))
856 		panic("Attempted to kill init!");
857 
858 	if (unlikely(current->ptrace & PT_TRACE_EXIT)) {
859 		current->ptrace_message = code;
860 		ptrace_notify((PTRACE_EVENT_EXIT << 8) | SIGTRAP);
861 	}
862 
863 	/*
864 	 * We're taking recursive faults here in do_exit. Safest is to just
865 	 * leave this task alone and wait for reboot.
866 	 */
867 	if (unlikely(tsk->flags & PF_EXITING)) {
868 		printk(KERN_ALERT
869 			"Fixing recursive fault but reboot is needed!\n");
870 		if (tsk->io_context)
871 			exit_io_context();
872 		set_current_state(TASK_UNINTERRUPTIBLE);
873 		schedule();
874 	}
875 
876 	tsk->flags |= PF_EXITING;
877 
878 	if (unlikely(in_atomic()))
879 		printk(KERN_INFO "note: %s[%d] exited with preempt_count %d\n",
880 				current->comm, current->pid,
881 				preempt_count());
882 
883 	acct_update_integrals(tsk);
884 	if (tsk->mm) {
885 		update_hiwater_rss(tsk->mm);
886 		update_hiwater_vm(tsk->mm);
887 	}
888 	group_dead = atomic_dec_and_test(&tsk->signal->live);
889 	if (group_dead) {
890  		hrtimer_cancel(&tsk->signal->real_timer);
891 		exit_itimers(tsk->signal);
892 	}
893 	acct_collect(code, group_dead);
894 	if (unlikely(tsk->robust_list))
895 		exit_robust_list(tsk);
896 #if defined(CONFIG_FUTEX) && defined(CONFIG_COMPAT)
897 	if (unlikely(tsk->compat_robust_list))
898 		compat_exit_robust_list(tsk);
899 #endif
900 	if (unlikely(tsk->audit_context))
901 		audit_free(tsk);
902 	exit_mm(tsk);
903 
904 	if (group_dead)
905 		acct_process();
906 	exit_sem(tsk);
907 	__exit_files(tsk);
908 	__exit_fs(tsk);
909 	exit_namespace(tsk);
910 	exit_thread();
911 	cpuset_exit(tsk);
912 	exit_keys(tsk);
913 
914 	if (group_dead && tsk->signal->leader)
915 		disassociate_ctty(1);
916 
917 	module_put(task_thread_info(tsk)->exec_domain->module);
918 	if (tsk->binfmt)
919 		module_put(tsk->binfmt->module);
920 
921 	tsk->exit_code = code;
922 	proc_exit_connector(tsk);
923 	exit_notify(tsk);
924 #ifdef CONFIG_NUMA
925 	mpol_free(tsk->mempolicy);
926 	tsk->mempolicy = NULL;
927 #endif
928 	/*
929 	 * This must happen late, after the PID is not
930 	 * hashed anymore:
931 	 */
932 	if (unlikely(!list_empty(&tsk->pi_state_list)))
933 		exit_pi_state_list(tsk);
934 	if (unlikely(current->pi_state_cache))
935 		kfree(current->pi_state_cache);
936 	/*
937 	 * If DEBUG_MUTEXES is on, make sure we are holding no locks:
938 	 */
939 	mutex_debug_check_no_locks_held(tsk);
940 	rt_mutex_debug_check_no_locks_held(tsk);
941 
942 	if (tsk->io_context)
943 		exit_io_context();
944 
945 	if (tsk->splice_pipe)
946 		__free_pipe_info(tsk->splice_pipe);
947 
948 	/* PF_DEAD causes final put_task_struct after we schedule. */
949 	preempt_disable();
950 	BUG_ON(tsk->flags & PF_DEAD);
951 	tsk->flags |= PF_DEAD;
952 
953 	schedule();
954 	BUG();
955 	/* Avoid "noreturn function does return".  */
956 	for (;;) ;
957 }
958 
959 EXPORT_SYMBOL_GPL(do_exit);
960 
961 NORET_TYPE void complete_and_exit(struct completion *comp, long code)
962 {
963 	if (comp)
964 		complete(comp);
965 
966 	do_exit(code);
967 }
968 
969 EXPORT_SYMBOL(complete_and_exit);
970 
971 asmlinkage long sys_exit(int error_code)
972 {
973 	do_exit((error_code&0xff)<<8);
974 }
975 
976 /*
977  * Take down every thread in the group.  This is called by fatal signals
978  * as well as by sys_exit_group (below).
979  */
980 NORET_TYPE void
981 do_group_exit(int exit_code)
982 {
983 	BUG_ON(exit_code & 0x80); /* core dumps don't get here */
984 
985 	if (current->signal->flags & SIGNAL_GROUP_EXIT)
986 		exit_code = current->signal->group_exit_code;
987 	else if (!thread_group_empty(current)) {
988 		struct signal_struct *const sig = current->signal;
989 		struct sighand_struct *const sighand = current->sighand;
990 		spin_lock_irq(&sighand->siglock);
991 		if (sig->flags & SIGNAL_GROUP_EXIT)
992 			/* Another thread got here before we took the lock.  */
993 			exit_code = sig->group_exit_code;
994 		else {
995 			sig->group_exit_code = exit_code;
996 			zap_other_threads(current);
997 		}
998 		spin_unlock_irq(&sighand->siglock);
999 	}
1000 
1001 	do_exit(exit_code);
1002 	/* NOTREACHED */
1003 }
1004 
1005 /*
1006  * this kills every thread in the thread group. Note that any externally
1007  * wait4()-ing process will get the correct exit code - even if this
1008  * thread is not the thread group leader.
1009  */
1010 asmlinkage void sys_exit_group(int error_code)
1011 {
1012 	do_group_exit((error_code & 0xff) << 8);
1013 }
1014 
1015 static int eligible_child(pid_t pid, int options, task_t *p)
1016 {
1017 	if (pid > 0) {
1018 		if (p->pid != pid)
1019 			return 0;
1020 	} else if (!pid) {
1021 		if (process_group(p) != process_group(current))
1022 			return 0;
1023 	} else if (pid != -1) {
1024 		if (process_group(p) != -pid)
1025 			return 0;
1026 	}
1027 
1028 	/*
1029 	 * Do not consider detached threads that are
1030 	 * not ptraced:
1031 	 */
1032 	if (p->exit_signal == -1 && !p->ptrace)
1033 		return 0;
1034 
1035 	/* Wait for all children (clone and not) if __WALL is set;
1036 	 * otherwise, wait for clone children *only* if __WCLONE is
1037 	 * set; otherwise, wait for non-clone children *only*.  (Note:
1038 	 * A "clone" child here is one that reports to its parent
1039 	 * using a signal other than SIGCHLD.) */
1040 	if (((p->exit_signal != SIGCHLD) ^ ((options & __WCLONE) != 0))
1041 	    && !(options & __WALL))
1042 		return 0;
1043 	/*
1044 	 * Do not consider thread group leaders that are
1045 	 * in a non-empty thread group:
1046 	 */
1047 	if (current->tgid != p->tgid && delay_group_leader(p))
1048 		return 2;
1049 
1050 	if (security_task_wait(p))
1051 		return 0;
1052 
1053 	return 1;
1054 }
1055 
1056 static int wait_noreap_copyout(task_t *p, pid_t pid, uid_t uid,
1057 			       int why, int status,
1058 			       struct siginfo __user *infop,
1059 			       struct rusage __user *rusagep)
1060 {
1061 	int retval = rusagep ? getrusage(p, RUSAGE_BOTH, rusagep) : 0;
1062 	put_task_struct(p);
1063 	if (!retval)
1064 		retval = put_user(SIGCHLD, &infop->si_signo);
1065 	if (!retval)
1066 		retval = put_user(0, &infop->si_errno);
1067 	if (!retval)
1068 		retval = put_user((short)why, &infop->si_code);
1069 	if (!retval)
1070 		retval = put_user(pid, &infop->si_pid);
1071 	if (!retval)
1072 		retval = put_user(uid, &infop->si_uid);
1073 	if (!retval)
1074 		retval = put_user(status, &infop->si_status);
1075 	if (!retval)
1076 		retval = pid;
1077 	return retval;
1078 }
1079 
1080 /*
1081  * Handle sys_wait4 work for one task in state EXIT_ZOMBIE.  We hold
1082  * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
1083  * the lock and this task is uninteresting.  If we return nonzero, we have
1084  * released the lock and the system call should return.
1085  */
1086 static int wait_task_zombie(task_t *p, int noreap,
1087 			    struct siginfo __user *infop,
1088 			    int __user *stat_addr, struct rusage __user *ru)
1089 {
1090 	unsigned long state;
1091 	int retval;
1092 	int status;
1093 
1094 	if (unlikely(noreap)) {
1095 		pid_t pid = p->pid;
1096 		uid_t uid = p->uid;
1097 		int exit_code = p->exit_code;
1098 		int why, status;
1099 
1100 		if (unlikely(p->exit_state != EXIT_ZOMBIE))
1101 			return 0;
1102 		if (unlikely(p->exit_signal == -1 && p->ptrace == 0))
1103 			return 0;
1104 		get_task_struct(p);
1105 		read_unlock(&tasklist_lock);
1106 		if ((exit_code & 0x7f) == 0) {
1107 			why = CLD_EXITED;
1108 			status = exit_code >> 8;
1109 		} else {
1110 			why = (exit_code & 0x80) ? CLD_DUMPED : CLD_KILLED;
1111 			status = exit_code & 0x7f;
1112 		}
1113 		return wait_noreap_copyout(p, pid, uid, why,
1114 					   status, infop, ru);
1115 	}
1116 
1117 	/*
1118 	 * Try to move the task's state to DEAD
1119 	 * only one thread is allowed to do this:
1120 	 */
1121 	state = xchg(&p->exit_state, EXIT_DEAD);
1122 	if (state != EXIT_ZOMBIE) {
1123 		BUG_ON(state != EXIT_DEAD);
1124 		return 0;
1125 	}
1126 	if (unlikely(p->exit_signal == -1 && p->ptrace == 0)) {
1127 		/*
1128 		 * This can only happen in a race with a ptraced thread
1129 		 * dying on another processor.
1130 		 */
1131 		return 0;
1132 	}
1133 
1134 	if (likely(p->real_parent == p->parent) && likely(p->signal)) {
1135 		struct signal_struct *psig;
1136 		struct signal_struct *sig;
1137 
1138 		/*
1139 		 * The resource counters for the group leader are in its
1140 		 * own task_struct.  Those for dead threads in the group
1141 		 * are in its signal_struct, as are those for the child
1142 		 * processes it has previously reaped.  All these
1143 		 * accumulate in the parent's signal_struct c* fields.
1144 		 *
1145 		 * We don't bother to take a lock here to protect these
1146 		 * p->signal fields, because they are only touched by
1147 		 * __exit_signal, which runs with tasklist_lock
1148 		 * write-locked anyway, and so is excluded here.  We do
1149 		 * need to protect the access to p->parent->signal fields,
1150 		 * as other threads in the parent group can be right
1151 		 * here reaping other children at the same time.
1152 		 */
1153 		spin_lock_irq(&p->parent->sighand->siglock);
1154 		psig = p->parent->signal;
1155 		sig = p->signal;
1156 		psig->cutime =
1157 			cputime_add(psig->cutime,
1158 			cputime_add(p->utime,
1159 			cputime_add(sig->utime,
1160 				    sig->cutime)));
1161 		psig->cstime =
1162 			cputime_add(psig->cstime,
1163 			cputime_add(p->stime,
1164 			cputime_add(sig->stime,
1165 				    sig->cstime)));
1166 		psig->cmin_flt +=
1167 			p->min_flt + sig->min_flt + sig->cmin_flt;
1168 		psig->cmaj_flt +=
1169 			p->maj_flt + sig->maj_flt + sig->cmaj_flt;
1170 		psig->cnvcsw +=
1171 			p->nvcsw + sig->nvcsw + sig->cnvcsw;
1172 		psig->cnivcsw +=
1173 			p->nivcsw + sig->nivcsw + sig->cnivcsw;
1174 		spin_unlock_irq(&p->parent->sighand->siglock);
1175 	}
1176 
1177 	/*
1178 	 * Now we are sure this task is interesting, and no other
1179 	 * thread can reap it because we set its state to EXIT_DEAD.
1180 	 */
1181 	read_unlock(&tasklist_lock);
1182 
1183 	retval = ru ? getrusage(p, RUSAGE_BOTH, ru) : 0;
1184 	status = (p->signal->flags & SIGNAL_GROUP_EXIT)
1185 		? p->signal->group_exit_code : p->exit_code;
1186 	if (!retval && stat_addr)
1187 		retval = put_user(status, stat_addr);
1188 	if (!retval && infop)
1189 		retval = put_user(SIGCHLD, &infop->si_signo);
1190 	if (!retval && infop)
1191 		retval = put_user(0, &infop->si_errno);
1192 	if (!retval && infop) {
1193 		int why;
1194 
1195 		if ((status & 0x7f) == 0) {
1196 			why = CLD_EXITED;
1197 			status >>= 8;
1198 		} else {
1199 			why = (status & 0x80) ? CLD_DUMPED : CLD_KILLED;
1200 			status &= 0x7f;
1201 		}
1202 		retval = put_user((short)why, &infop->si_code);
1203 		if (!retval)
1204 			retval = put_user(status, &infop->si_status);
1205 	}
1206 	if (!retval && infop)
1207 		retval = put_user(p->pid, &infop->si_pid);
1208 	if (!retval && infop)
1209 		retval = put_user(p->uid, &infop->si_uid);
1210 	if (retval) {
1211 		// TODO: is this safe?
1212 		p->exit_state = EXIT_ZOMBIE;
1213 		return retval;
1214 	}
1215 	retval = p->pid;
1216 	if (p->real_parent != p->parent) {
1217 		write_lock_irq(&tasklist_lock);
1218 		/* Double-check with lock held.  */
1219 		if (p->real_parent != p->parent) {
1220 			__ptrace_unlink(p);
1221 			// TODO: is this safe?
1222 			p->exit_state = EXIT_ZOMBIE;
1223 			/*
1224 			 * If this is not a detached task, notify the parent.
1225 			 * If it's still not detached after that, don't release
1226 			 * it now.
1227 			 */
1228 			if (p->exit_signal != -1) {
1229 				do_notify_parent(p, p->exit_signal);
1230 				if (p->exit_signal != -1)
1231 					p = NULL;
1232 			}
1233 		}
1234 		write_unlock_irq(&tasklist_lock);
1235 	}
1236 	if (p != NULL)
1237 		release_task(p);
1238 	BUG_ON(!retval);
1239 	return retval;
1240 }
1241 
1242 /*
1243  * Handle sys_wait4 work for one task in state TASK_STOPPED.  We hold
1244  * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
1245  * the lock and this task is uninteresting.  If we return nonzero, we have
1246  * released the lock and the system call should return.
1247  */
1248 static int wait_task_stopped(task_t *p, int delayed_group_leader, int noreap,
1249 			     struct siginfo __user *infop,
1250 			     int __user *stat_addr, struct rusage __user *ru)
1251 {
1252 	int retval, exit_code;
1253 
1254 	if (!p->exit_code)
1255 		return 0;
1256 	if (delayed_group_leader && !(p->ptrace & PT_PTRACED) &&
1257 	    p->signal && p->signal->group_stop_count > 0)
1258 		/*
1259 		 * A group stop is in progress and this is the group leader.
1260 		 * We won't report until all threads have stopped.
1261 		 */
1262 		return 0;
1263 
1264 	/*
1265 	 * Now we are pretty sure this task is interesting.
1266 	 * Make sure it doesn't get reaped out from under us while we
1267 	 * give up the lock and then examine it below.  We don't want to
1268 	 * keep holding onto the tasklist_lock while we call getrusage and
1269 	 * possibly take page faults for user memory.
1270 	 */
1271 	get_task_struct(p);
1272 	read_unlock(&tasklist_lock);
1273 
1274 	if (unlikely(noreap)) {
1275 		pid_t pid = p->pid;
1276 		uid_t uid = p->uid;
1277 		int why = (p->ptrace & PT_PTRACED) ? CLD_TRAPPED : CLD_STOPPED;
1278 
1279 		exit_code = p->exit_code;
1280 		if (unlikely(!exit_code) ||
1281 		    unlikely(p->state & TASK_TRACED))
1282 			goto bail_ref;
1283 		return wait_noreap_copyout(p, pid, uid,
1284 					   why, (exit_code << 8) | 0x7f,
1285 					   infop, ru);
1286 	}
1287 
1288 	write_lock_irq(&tasklist_lock);
1289 
1290 	/*
1291 	 * This uses xchg to be atomic with the thread resuming and setting
1292 	 * it.  It must also be done with the write lock held to prevent a
1293 	 * race with the EXIT_ZOMBIE case.
1294 	 */
1295 	exit_code = xchg(&p->exit_code, 0);
1296 	if (unlikely(p->exit_state)) {
1297 		/*
1298 		 * The task resumed and then died.  Let the next iteration
1299 		 * catch it in EXIT_ZOMBIE.  Note that exit_code might
1300 		 * already be zero here if it resumed and did _exit(0).
1301 		 * The task itself is dead and won't touch exit_code again;
1302 		 * other processors in this function are locked out.
1303 		 */
1304 		p->exit_code = exit_code;
1305 		exit_code = 0;
1306 	}
1307 	if (unlikely(exit_code == 0)) {
1308 		/*
1309 		 * Another thread in this function got to it first, or it
1310 		 * resumed, or it resumed and then died.
1311 		 */
1312 		write_unlock_irq(&tasklist_lock);
1313 bail_ref:
1314 		put_task_struct(p);
1315 		/*
1316 		 * We are returning to the wait loop without having successfully
1317 		 * removed the process and having released the lock. We cannot
1318 		 * continue, since the "p" task pointer is potentially stale.
1319 		 *
1320 		 * Return -EAGAIN, and do_wait() will restart the loop from the
1321 		 * beginning. Do _not_ re-acquire the lock.
1322 		 */
1323 		return -EAGAIN;
1324 	}
1325 
1326 	/* move to end of parent's list to avoid starvation */
1327 	remove_parent(p);
1328 	add_parent(p);
1329 
1330 	write_unlock_irq(&tasklist_lock);
1331 
1332 	retval = ru ? getrusage(p, RUSAGE_BOTH, ru) : 0;
1333 	if (!retval && stat_addr)
1334 		retval = put_user((exit_code << 8) | 0x7f, stat_addr);
1335 	if (!retval && infop)
1336 		retval = put_user(SIGCHLD, &infop->si_signo);
1337 	if (!retval && infop)
1338 		retval = put_user(0, &infop->si_errno);
1339 	if (!retval && infop)
1340 		retval = put_user((short)((p->ptrace & PT_PTRACED)
1341 					  ? CLD_TRAPPED : CLD_STOPPED),
1342 				  &infop->si_code);
1343 	if (!retval && infop)
1344 		retval = put_user(exit_code, &infop->si_status);
1345 	if (!retval && infop)
1346 		retval = put_user(p->pid, &infop->si_pid);
1347 	if (!retval && infop)
1348 		retval = put_user(p->uid, &infop->si_uid);
1349 	if (!retval)
1350 		retval = p->pid;
1351 	put_task_struct(p);
1352 
1353 	BUG_ON(!retval);
1354 	return retval;
1355 }
1356 
1357 /*
1358  * Handle do_wait work for one task in a live, non-stopped state.
1359  * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
1360  * the lock and this task is uninteresting.  If we return nonzero, we have
1361  * released the lock and the system call should return.
1362  */
1363 static int wait_task_continued(task_t *p, int noreap,
1364 			       struct siginfo __user *infop,
1365 			       int __user *stat_addr, struct rusage __user *ru)
1366 {
1367 	int retval;
1368 	pid_t pid;
1369 	uid_t uid;
1370 
1371 	if (unlikely(!p->signal))
1372 		return 0;
1373 
1374 	if (!(p->signal->flags & SIGNAL_STOP_CONTINUED))
1375 		return 0;
1376 
1377 	spin_lock_irq(&p->sighand->siglock);
1378 	/* Re-check with the lock held.  */
1379 	if (!(p->signal->flags & SIGNAL_STOP_CONTINUED)) {
1380 		spin_unlock_irq(&p->sighand->siglock);
1381 		return 0;
1382 	}
1383 	if (!noreap)
1384 		p->signal->flags &= ~SIGNAL_STOP_CONTINUED;
1385 	spin_unlock_irq(&p->sighand->siglock);
1386 
1387 	pid = p->pid;
1388 	uid = p->uid;
1389 	get_task_struct(p);
1390 	read_unlock(&tasklist_lock);
1391 
1392 	if (!infop) {
1393 		retval = ru ? getrusage(p, RUSAGE_BOTH, ru) : 0;
1394 		put_task_struct(p);
1395 		if (!retval && stat_addr)
1396 			retval = put_user(0xffff, stat_addr);
1397 		if (!retval)
1398 			retval = p->pid;
1399 	} else {
1400 		retval = wait_noreap_copyout(p, pid, uid,
1401 					     CLD_CONTINUED, SIGCONT,
1402 					     infop, ru);
1403 		BUG_ON(retval == 0);
1404 	}
1405 
1406 	return retval;
1407 }
1408 
1409 
1410 static inline int my_ptrace_child(struct task_struct *p)
1411 {
1412 	if (!(p->ptrace & PT_PTRACED))
1413 		return 0;
1414 	if (!(p->ptrace & PT_ATTACHED))
1415 		return 1;
1416 	/*
1417 	 * This child was PTRACE_ATTACH'd.  We should be seeing it only if
1418 	 * we are the attacher.  If we are the real parent, this is a race
1419 	 * inside ptrace_attach.  It is waiting for the tasklist_lock,
1420 	 * which we have to switch the parent links, but has already set
1421 	 * the flags in p->ptrace.
1422 	 */
1423 	return (p->parent != p->real_parent);
1424 }
1425 
1426 static long do_wait(pid_t pid, int options, struct siginfo __user *infop,
1427 		    int __user *stat_addr, struct rusage __user *ru)
1428 {
1429 	DECLARE_WAITQUEUE(wait, current);
1430 	struct task_struct *tsk;
1431 	int flag, retval;
1432 
1433 	add_wait_queue(&current->signal->wait_chldexit,&wait);
1434 repeat:
1435 	/*
1436 	 * We will set this flag if we see any child that might later
1437 	 * match our criteria, even if we are not able to reap it yet.
1438 	 */
1439 	flag = 0;
1440 	current->state = TASK_INTERRUPTIBLE;
1441 	read_lock(&tasklist_lock);
1442 	tsk = current;
1443 	do {
1444 		struct task_struct *p;
1445 		struct list_head *_p;
1446 		int ret;
1447 
1448 		list_for_each(_p,&tsk->children) {
1449 			p = list_entry(_p,struct task_struct,sibling);
1450 
1451 			ret = eligible_child(pid, options, p);
1452 			if (!ret)
1453 				continue;
1454 
1455 			switch (p->state) {
1456 			case TASK_TRACED:
1457 				/*
1458 				 * When we hit the race with PTRACE_ATTACH,
1459 				 * we will not report this child.  But the
1460 				 * race means it has not yet been moved to
1461 				 * our ptrace_children list, so we need to
1462 				 * set the flag here to avoid a spurious ECHILD
1463 				 * when the race happens with the only child.
1464 				 */
1465 				flag = 1;
1466 				if (!my_ptrace_child(p))
1467 					continue;
1468 				/*FALLTHROUGH*/
1469 			case TASK_STOPPED:
1470 				/*
1471 				 * It's stopped now, so it might later
1472 				 * continue, exit, or stop again.
1473 				 */
1474 				flag = 1;
1475 				if (!(options & WUNTRACED) &&
1476 				    !my_ptrace_child(p))
1477 					continue;
1478 				retval = wait_task_stopped(p, ret == 2,
1479 							   (options & WNOWAIT),
1480 							   infop,
1481 							   stat_addr, ru);
1482 				if (retval == -EAGAIN)
1483 					goto repeat;
1484 				if (retval != 0) /* He released the lock.  */
1485 					goto end;
1486 				break;
1487 			default:
1488 			// case EXIT_DEAD:
1489 				if (p->exit_state == EXIT_DEAD)
1490 					continue;
1491 			// case EXIT_ZOMBIE:
1492 				if (p->exit_state == EXIT_ZOMBIE) {
1493 					/*
1494 					 * Eligible but we cannot release
1495 					 * it yet:
1496 					 */
1497 					if (ret == 2)
1498 						goto check_continued;
1499 					if (!likely(options & WEXITED))
1500 						continue;
1501 					retval = wait_task_zombie(
1502 						p, (options & WNOWAIT),
1503 						infop, stat_addr, ru);
1504 					/* He released the lock.  */
1505 					if (retval != 0)
1506 						goto end;
1507 					break;
1508 				}
1509 check_continued:
1510 				/*
1511 				 * It's running now, so it might later
1512 				 * exit, stop, or stop and then continue.
1513 				 */
1514 				flag = 1;
1515 				if (!unlikely(options & WCONTINUED))
1516 					continue;
1517 				retval = wait_task_continued(
1518 					p, (options & WNOWAIT),
1519 					infop, stat_addr, ru);
1520 				if (retval != 0) /* He released the lock.  */
1521 					goto end;
1522 				break;
1523 			}
1524 		}
1525 		if (!flag) {
1526 			list_for_each(_p, &tsk->ptrace_children) {
1527 				p = list_entry(_p, struct task_struct,
1528 						ptrace_list);
1529 				if (!eligible_child(pid, options, p))
1530 					continue;
1531 				flag = 1;
1532 				break;
1533 			}
1534 		}
1535 		if (options & __WNOTHREAD)
1536 			break;
1537 		tsk = next_thread(tsk);
1538 		BUG_ON(tsk->signal != current->signal);
1539 	} while (tsk != current);
1540 
1541 	read_unlock(&tasklist_lock);
1542 	if (flag) {
1543 		retval = 0;
1544 		if (options & WNOHANG)
1545 			goto end;
1546 		retval = -ERESTARTSYS;
1547 		if (signal_pending(current))
1548 			goto end;
1549 		schedule();
1550 		goto repeat;
1551 	}
1552 	retval = -ECHILD;
1553 end:
1554 	current->state = TASK_RUNNING;
1555 	remove_wait_queue(&current->signal->wait_chldexit,&wait);
1556 	if (infop) {
1557 		if (retval > 0)
1558 		retval = 0;
1559 		else {
1560 			/*
1561 			 * For a WNOHANG return, clear out all the fields
1562 			 * we would set so the user can easily tell the
1563 			 * difference.
1564 			 */
1565 			if (!retval)
1566 				retval = put_user(0, &infop->si_signo);
1567 			if (!retval)
1568 				retval = put_user(0, &infop->si_errno);
1569 			if (!retval)
1570 				retval = put_user(0, &infop->si_code);
1571 			if (!retval)
1572 				retval = put_user(0, &infop->si_pid);
1573 			if (!retval)
1574 				retval = put_user(0, &infop->si_uid);
1575 			if (!retval)
1576 				retval = put_user(0, &infop->si_status);
1577 		}
1578 	}
1579 	return retval;
1580 }
1581 
1582 asmlinkage long sys_waitid(int which, pid_t pid,
1583 			   struct siginfo __user *infop, int options,
1584 			   struct rusage __user *ru)
1585 {
1586 	long ret;
1587 
1588 	if (options & ~(WNOHANG|WNOWAIT|WEXITED|WSTOPPED|WCONTINUED))
1589 		return -EINVAL;
1590 	if (!(options & (WEXITED|WSTOPPED|WCONTINUED)))
1591 		return -EINVAL;
1592 
1593 	switch (which) {
1594 	case P_ALL:
1595 		pid = -1;
1596 		break;
1597 	case P_PID:
1598 		if (pid <= 0)
1599 			return -EINVAL;
1600 		break;
1601 	case P_PGID:
1602 		if (pid <= 0)
1603 			return -EINVAL;
1604 		pid = -pid;
1605 		break;
1606 	default:
1607 		return -EINVAL;
1608 	}
1609 
1610 	ret = do_wait(pid, options, infop, NULL, ru);
1611 
1612 	/* avoid REGPARM breakage on x86: */
1613 	prevent_tail_call(ret);
1614 	return ret;
1615 }
1616 
1617 asmlinkage long sys_wait4(pid_t pid, int __user *stat_addr,
1618 			  int options, struct rusage __user *ru)
1619 {
1620 	long ret;
1621 
1622 	if (options & ~(WNOHANG|WUNTRACED|WCONTINUED|
1623 			__WNOTHREAD|__WCLONE|__WALL))
1624 		return -EINVAL;
1625 	ret = do_wait(pid, options | WEXITED, NULL, stat_addr, ru);
1626 
1627 	/* avoid REGPARM breakage on x86: */
1628 	prevent_tail_call(ret);
1629 	return ret;
1630 }
1631 
1632 #ifdef __ARCH_WANT_SYS_WAITPID
1633 
1634 /*
1635  * sys_waitpid() remains for compatibility. waitpid() should be
1636  * implemented by calling sys_wait4() from libc.a.
1637  */
1638 asmlinkage long sys_waitpid(pid_t pid, int __user *stat_addr, int options)
1639 {
1640 	return sys_wait4(pid, stat_addr, options, NULL);
1641 }
1642 
1643 #endif
1644