1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/kernel/exit.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 */ 7 8 #include <linux/mm.h> 9 #include <linux/slab.h> 10 #include <linux/sched/autogroup.h> 11 #include <linux/sched/mm.h> 12 #include <linux/sched/stat.h> 13 #include <linux/sched/task.h> 14 #include <linux/sched/task_stack.h> 15 #include <linux/sched/cputime.h> 16 #include <linux/interrupt.h> 17 #include <linux/module.h> 18 #include <linux/capability.h> 19 #include <linux/completion.h> 20 #include <linux/personality.h> 21 #include <linux/tty.h> 22 #include <linux/iocontext.h> 23 #include <linux/key.h> 24 #include <linux/cpu.h> 25 #include <linux/acct.h> 26 #include <linux/tsacct_kern.h> 27 #include <linux/file.h> 28 #include <linux/fdtable.h> 29 #include <linux/freezer.h> 30 #include <linux/binfmts.h> 31 #include <linux/nsproxy.h> 32 #include <linux/pid_namespace.h> 33 #include <linux/ptrace.h> 34 #include <linux/profile.h> 35 #include <linux/mount.h> 36 #include <linux/proc_fs.h> 37 #include <linux/kthread.h> 38 #include <linux/mempolicy.h> 39 #include <linux/taskstats_kern.h> 40 #include <linux/delayacct.h> 41 #include <linux/cgroup.h> 42 #include <linux/syscalls.h> 43 #include <linux/signal.h> 44 #include <linux/posix-timers.h> 45 #include <linux/cn_proc.h> 46 #include <linux/mutex.h> 47 #include <linux/futex.h> 48 #include <linux/pipe_fs_i.h> 49 #include <linux/audit.h> /* for audit_free() */ 50 #include <linux/resource.h> 51 #include <linux/blkdev.h> 52 #include <linux/task_io_accounting_ops.h> 53 #include <linux/tracehook.h> 54 #include <linux/fs_struct.h> 55 #include <linux/init_task.h> 56 #include <linux/perf_event.h> 57 #include <trace/events/sched.h> 58 #include <linux/hw_breakpoint.h> 59 #include <linux/oom.h> 60 #include <linux/writeback.h> 61 #include <linux/shm.h> 62 #include <linux/kcov.h> 63 #include <linux/random.h> 64 #include <linux/rcuwait.h> 65 #include <linux/compat.h> 66 #include <linux/io_uring.h> 67 68 #include <linux/uaccess.h> 69 #include <asm/unistd.h> 70 #include <asm/mmu_context.h> 71 72 static void __unhash_process(struct task_struct *p, bool group_dead) 73 { 74 nr_threads--; 75 detach_pid(p, PIDTYPE_PID); 76 if (group_dead) { 77 detach_pid(p, PIDTYPE_TGID); 78 detach_pid(p, PIDTYPE_PGID); 79 detach_pid(p, PIDTYPE_SID); 80 81 list_del_rcu(&p->tasks); 82 list_del_init(&p->sibling); 83 __this_cpu_dec(process_counts); 84 } 85 list_del_rcu(&p->thread_group); 86 list_del_rcu(&p->thread_node); 87 } 88 89 /* 90 * This function expects the tasklist_lock write-locked. 91 */ 92 static void __exit_signal(struct task_struct *tsk) 93 { 94 struct signal_struct *sig = tsk->signal; 95 bool group_dead = thread_group_leader(tsk); 96 struct sighand_struct *sighand; 97 struct tty_struct *tty; 98 u64 utime, stime; 99 100 sighand = rcu_dereference_check(tsk->sighand, 101 lockdep_tasklist_lock_is_held()); 102 spin_lock(&sighand->siglock); 103 104 #ifdef CONFIG_POSIX_TIMERS 105 posix_cpu_timers_exit(tsk); 106 if (group_dead) 107 posix_cpu_timers_exit_group(tsk); 108 #endif 109 110 if (group_dead) { 111 tty = sig->tty; 112 sig->tty = NULL; 113 } else { 114 /* 115 * If there is any task waiting for the group exit 116 * then notify it: 117 */ 118 if (sig->notify_count > 0 && !--sig->notify_count) 119 wake_up_process(sig->group_exit_task); 120 121 if (tsk == sig->curr_target) 122 sig->curr_target = next_thread(tsk); 123 } 124 125 add_device_randomness((const void*) &tsk->se.sum_exec_runtime, 126 sizeof(unsigned long long)); 127 128 /* 129 * Accumulate here the counters for all threads as they die. We could 130 * skip the group leader because it is the last user of signal_struct, 131 * but we want to avoid the race with thread_group_cputime() which can 132 * see the empty ->thread_head list. 133 */ 134 task_cputime(tsk, &utime, &stime); 135 write_seqlock(&sig->stats_lock); 136 sig->utime += utime; 137 sig->stime += stime; 138 sig->gtime += task_gtime(tsk); 139 sig->min_flt += tsk->min_flt; 140 sig->maj_flt += tsk->maj_flt; 141 sig->nvcsw += tsk->nvcsw; 142 sig->nivcsw += tsk->nivcsw; 143 sig->inblock += task_io_get_inblock(tsk); 144 sig->oublock += task_io_get_oublock(tsk); 145 task_io_accounting_add(&sig->ioac, &tsk->ioac); 146 sig->sum_sched_runtime += tsk->se.sum_exec_runtime; 147 sig->nr_threads--; 148 __unhash_process(tsk, group_dead); 149 write_sequnlock(&sig->stats_lock); 150 151 /* 152 * Do this under ->siglock, we can race with another thread 153 * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals. 154 */ 155 flush_sigqueue(&tsk->pending); 156 tsk->sighand = NULL; 157 spin_unlock(&sighand->siglock); 158 159 __cleanup_sighand(sighand); 160 clear_tsk_thread_flag(tsk, TIF_SIGPENDING); 161 if (group_dead) { 162 flush_sigqueue(&sig->shared_pending); 163 tty_kref_put(tty); 164 } 165 exit_task_sigqueue_cache(tsk); 166 } 167 168 static void delayed_put_task_struct(struct rcu_head *rhp) 169 { 170 struct task_struct *tsk = container_of(rhp, struct task_struct, rcu); 171 172 perf_event_delayed_put(tsk); 173 trace_sched_process_free(tsk); 174 put_task_struct(tsk); 175 } 176 177 void put_task_struct_rcu_user(struct task_struct *task) 178 { 179 if (refcount_dec_and_test(&task->rcu_users)) 180 call_rcu(&task->rcu, delayed_put_task_struct); 181 } 182 183 void release_task(struct task_struct *p) 184 { 185 struct task_struct *leader; 186 struct pid *thread_pid; 187 int zap_leader; 188 repeat: 189 /* don't need to get the RCU readlock here - the process is dead and 190 * can't be modifying its own credentials. But shut RCU-lockdep up */ 191 rcu_read_lock(); 192 atomic_dec(&__task_cred(p)->user->processes); 193 rcu_read_unlock(); 194 195 cgroup_release(p); 196 197 write_lock_irq(&tasklist_lock); 198 ptrace_release_task(p); 199 thread_pid = get_pid(p->thread_pid); 200 __exit_signal(p); 201 202 /* 203 * If we are the last non-leader member of the thread 204 * group, and the leader is zombie, then notify the 205 * group leader's parent process. (if it wants notification.) 206 */ 207 zap_leader = 0; 208 leader = p->group_leader; 209 if (leader != p && thread_group_empty(leader) 210 && leader->exit_state == EXIT_ZOMBIE) { 211 /* 212 * If we were the last child thread and the leader has 213 * exited already, and the leader's parent ignores SIGCHLD, 214 * then we are the one who should release the leader. 215 */ 216 zap_leader = do_notify_parent(leader, leader->exit_signal); 217 if (zap_leader) 218 leader->exit_state = EXIT_DEAD; 219 } 220 221 write_unlock_irq(&tasklist_lock); 222 seccomp_filter_release(p); 223 proc_flush_pid(thread_pid); 224 put_pid(thread_pid); 225 release_thread(p); 226 put_task_struct_rcu_user(p); 227 228 p = leader; 229 if (unlikely(zap_leader)) 230 goto repeat; 231 } 232 233 int rcuwait_wake_up(struct rcuwait *w) 234 { 235 int ret = 0; 236 struct task_struct *task; 237 238 rcu_read_lock(); 239 240 /* 241 * Order condition vs @task, such that everything prior to the load 242 * of @task is visible. This is the condition as to why the user called 243 * rcuwait_wake() in the first place. Pairs with set_current_state() 244 * barrier (A) in rcuwait_wait_event(). 245 * 246 * WAIT WAKE 247 * [S] tsk = current [S] cond = true 248 * MB (A) MB (B) 249 * [L] cond [L] tsk 250 */ 251 smp_mb(); /* (B) */ 252 253 task = rcu_dereference(w->task); 254 if (task) 255 ret = wake_up_process(task); 256 rcu_read_unlock(); 257 258 return ret; 259 } 260 EXPORT_SYMBOL_GPL(rcuwait_wake_up); 261 262 /* 263 * Determine if a process group is "orphaned", according to the POSIX 264 * definition in 2.2.2.52. Orphaned process groups are not to be affected 265 * by terminal-generated stop signals. Newly orphaned process groups are 266 * to receive a SIGHUP and a SIGCONT. 267 * 268 * "I ask you, have you ever known what it is to be an orphan?" 269 */ 270 static int will_become_orphaned_pgrp(struct pid *pgrp, 271 struct task_struct *ignored_task) 272 { 273 struct task_struct *p; 274 275 do_each_pid_task(pgrp, PIDTYPE_PGID, p) { 276 if ((p == ignored_task) || 277 (p->exit_state && thread_group_empty(p)) || 278 is_global_init(p->real_parent)) 279 continue; 280 281 if (task_pgrp(p->real_parent) != pgrp && 282 task_session(p->real_parent) == task_session(p)) 283 return 0; 284 } while_each_pid_task(pgrp, PIDTYPE_PGID, p); 285 286 return 1; 287 } 288 289 int is_current_pgrp_orphaned(void) 290 { 291 int retval; 292 293 read_lock(&tasklist_lock); 294 retval = will_become_orphaned_pgrp(task_pgrp(current), NULL); 295 read_unlock(&tasklist_lock); 296 297 return retval; 298 } 299 300 static bool has_stopped_jobs(struct pid *pgrp) 301 { 302 struct task_struct *p; 303 304 do_each_pid_task(pgrp, PIDTYPE_PGID, p) { 305 if (p->signal->flags & SIGNAL_STOP_STOPPED) 306 return true; 307 } while_each_pid_task(pgrp, PIDTYPE_PGID, p); 308 309 return false; 310 } 311 312 /* 313 * Check to see if any process groups have become orphaned as 314 * a result of our exiting, and if they have any stopped jobs, 315 * send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2) 316 */ 317 static void 318 kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent) 319 { 320 struct pid *pgrp = task_pgrp(tsk); 321 struct task_struct *ignored_task = tsk; 322 323 if (!parent) 324 /* exit: our father is in a different pgrp than 325 * we are and we were the only connection outside. 326 */ 327 parent = tsk->real_parent; 328 else 329 /* reparent: our child is in a different pgrp than 330 * we are, and it was the only connection outside. 331 */ 332 ignored_task = NULL; 333 334 if (task_pgrp(parent) != pgrp && 335 task_session(parent) == task_session(tsk) && 336 will_become_orphaned_pgrp(pgrp, ignored_task) && 337 has_stopped_jobs(pgrp)) { 338 __kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp); 339 __kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp); 340 } 341 } 342 343 #ifdef CONFIG_MEMCG 344 /* 345 * A task is exiting. If it owned this mm, find a new owner for the mm. 346 */ 347 void mm_update_next_owner(struct mm_struct *mm) 348 { 349 struct task_struct *c, *g, *p = current; 350 351 retry: 352 /* 353 * If the exiting or execing task is not the owner, it's 354 * someone else's problem. 355 */ 356 if (mm->owner != p) 357 return; 358 /* 359 * The current owner is exiting/execing and there are no other 360 * candidates. Do not leave the mm pointing to a possibly 361 * freed task structure. 362 */ 363 if (atomic_read(&mm->mm_users) <= 1) { 364 WRITE_ONCE(mm->owner, NULL); 365 return; 366 } 367 368 read_lock(&tasklist_lock); 369 /* 370 * Search in the children 371 */ 372 list_for_each_entry(c, &p->children, sibling) { 373 if (c->mm == mm) 374 goto assign_new_owner; 375 } 376 377 /* 378 * Search in the siblings 379 */ 380 list_for_each_entry(c, &p->real_parent->children, sibling) { 381 if (c->mm == mm) 382 goto assign_new_owner; 383 } 384 385 /* 386 * Search through everything else, we should not get here often. 387 */ 388 for_each_process(g) { 389 if (g->flags & PF_KTHREAD) 390 continue; 391 for_each_thread(g, c) { 392 if (c->mm == mm) 393 goto assign_new_owner; 394 if (c->mm) 395 break; 396 } 397 } 398 read_unlock(&tasklist_lock); 399 /* 400 * We found no owner yet mm_users > 1: this implies that we are 401 * most likely racing with swapoff (try_to_unuse()) or /proc or 402 * ptrace or page migration (get_task_mm()). Mark owner as NULL. 403 */ 404 WRITE_ONCE(mm->owner, NULL); 405 return; 406 407 assign_new_owner: 408 BUG_ON(c == p); 409 get_task_struct(c); 410 /* 411 * The task_lock protects c->mm from changing. 412 * We always want mm->owner->mm == mm 413 */ 414 task_lock(c); 415 /* 416 * Delay read_unlock() till we have the task_lock() 417 * to ensure that c does not slip away underneath us 418 */ 419 read_unlock(&tasklist_lock); 420 if (c->mm != mm) { 421 task_unlock(c); 422 put_task_struct(c); 423 goto retry; 424 } 425 WRITE_ONCE(mm->owner, c); 426 task_unlock(c); 427 put_task_struct(c); 428 } 429 #endif /* CONFIG_MEMCG */ 430 431 /* 432 * Turn us into a lazy TLB process if we 433 * aren't already.. 434 */ 435 static void exit_mm(void) 436 { 437 struct mm_struct *mm = current->mm; 438 struct core_state *core_state; 439 440 exit_mm_release(current, mm); 441 if (!mm) 442 return; 443 sync_mm_rss(mm); 444 /* 445 * Serialize with any possible pending coredump. 446 * We must hold mmap_lock around checking core_state 447 * and clearing tsk->mm. The core-inducing thread 448 * will increment ->nr_threads for each thread in the 449 * group with ->mm != NULL. 450 */ 451 mmap_read_lock(mm); 452 core_state = mm->core_state; 453 if (core_state) { 454 struct core_thread self; 455 456 mmap_read_unlock(mm); 457 458 self.task = current; 459 if (self.task->flags & PF_SIGNALED) 460 self.next = xchg(&core_state->dumper.next, &self); 461 else 462 self.task = NULL; 463 /* 464 * Implies mb(), the result of xchg() must be visible 465 * to core_state->dumper. 466 */ 467 if (atomic_dec_and_test(&core_state->nr_threads)) 468 complete(&core_state->startup); 469 470 for (;;) { 471 set_current_state(TASK_UNINTERRUPTIBLE); 472 if (!self.task) /* see coredump_finish() */ 473 break; 474 freezable_schedule(); 475 } 476 __set_current_state(TASK_RUNNING); 477 mmap_read_lock(mm); 478 } 479 mmgrab(mm); 480 BUG_ON(mm != current->active_mm); 481 /* more a memory barrier than a real lock */ 482 task_lock(current); 483 /* 484 * When a thread stops operating on an address space, the loop 485 * in membarrier_private_expedited() may not observe that 486 * tsk->mm, and the loop in membarrier_global_expedited() may 487 * not observe a MEMBARRIER_STATE_GLOBAL_EXPEDITED 488 * rq->membarrier_state, so those would not issue an IPI. 489 * Membarrier requires a memory barrier after accessing 490 * user-space memory, before clearing tsk->mm or the 491 * rq->membarrier_state. 492 */ 493 smp_mb__after_spinlock(); 494 local_irq_disable(); 495 current->mm = NULL; 496 membarrier_update_current_mm(NULL); 497 enter_lazy_tlb(mm, current); 498 local_irq_enable(); 499 task_unlock(current); 500 mmap_read_unlock(mm); 501 mm_update_next_owner(mm); 502 mmput(mm); 503 if (test_thread_flag(TIF_MEMDIE)) 504 exit_oom_victim(); 505 } 506 507 static struct task_struct *find_alive_thread(struct task_struct *p) 508 { 509 struct task_struct *t; 510 511 for_each_thread(p, t) { 512 if (!(t->flags & PF_EXITING)) 513 return t; 514 } 515 return NULL; 516 } 517 518 static struct task_struct *find_child_reaper(struct task_struct *father, 519 struct list_head *dead) 520 __releases(&tasklist_lock) 521 __acquires(&tasklist_lock) 522 { 523 struct pid_namespace *pid_ns = task_active_pid_ns(father); 524 struct task_struct *reaper = pid_ns->child_reaper; 525 struct task_struct *p, *n; 526 527 if (likely(reaper != father)) 528 return reaper; 529 530 reaper = find_alive_thread(father); 531 if (reaper) { 532 pid_ns->child_reaper = reaper; 533 return reaper; 534 } 535 536 write_unlock_irq(&tasklist_lock); 537 538 list_for_each_entry_safe(p, n, dead, ptrace_entry) { 539 list_del_init(&p->ptrace_entry); 540 release_task(p); 541 } 542 543 zap_pid_ns_processes(pid_ns); 544 write_lock_irq(&tasklist_lock); 545 546 return father; 547 } 548 549 /* 550 * When we die, we re-parent all our children, and try to: 551 * 1. give them to another thread in our thread group, if such a member exists 552 * 2. give it to the first ancestor process which prctl'd itself as a 553 * child_subreaper for its children (like a service manager) 554 * 3. give it to the init process (PID 1) in our pid namespace 555 */ 556 static struct task_struct *find_new_reaper(struct task_struct *father, 557 struct task_struct *child_reaper) 558 { 559 struct task_struct *thread, *reaper; 560 561 thread = find_alive_thread(father); 562 if (thread) 563 return thread; 564 565 if (father->signal->has_child_subreaper) { 566 unsigned int ns_level = task_pid(father)->level; 567 /* 568 * Find the first ->is_child_subreaper ancestor in our pid_ns. 569 * We can't check reaper != child_reaper to ensure we do not 570 * cross the namespaces, the exiting parent could be injected 571 * by setns() + fork(). 572 * We check pid->level, this is slightly more efficient than 573 * task_active_pid_ns(reaper) != task_active_pid_ns(father). 574 */ 575 for (reaper = father->real_parent; 576 task_pid(reaper)->level == ns_level; 577 reaper = reaper->real_parent) { 578 if (reaper == &init_task) 579 break; 580 if (!reaper->signal->is_child_subreaper) 581 continue; 582 thread = find_alive_thread(reaper); 583 if (thread) 584 return thread; 585 } 586 } 587 588 return child_reaper; 589 } 590 591 /* 592 * Any that need to be release_task'd are put on the @dead list. 593 */ 594 static void reparent_leader(struct task_struct *father, struct task_struct *p, 595 struct list_head *dead) 596 { 597 if (unlikely(p->exit_state == EXIT_DEAD)) 598 return; 599 600 /* We don't want people slaying init. */ 601 p->exit_signal = SIGCHLD; 602 603 /* If it has exited notify the new parent about this child's death. */ 604 if (!p->ptrace && 605 p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) { 606 if (do_notify_parent(p, p->exit_signal)) { 607 p->exit_state = EXIT_DEAD; 608 list_add(&p->ptrace_entry, dead); 609 } 610 } 611 612 kill_orphaned_pgrp(p, father); 613 } 614 615 /* 616 * This does two things: 617 * 618 * A. Make init inherit all the child processes 619 * B. Check to see if any process groups have become orphaned 620 * as a result of our exiting, and if they have any stopped 621 * jobs, send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2) 622 */ 623 static void forget_original_parent(struct task_struct *father, 624 struct list_head *dead) 625 { 626 struct task_struct *p, *t, *reaper; 627 628 if (unlikely(!list_empty(&father->ptraced))) 629 exit_ptrace(father, dead); 630 631 /* Can drop and reacquire tasklist_lock */ 632 reaper = find_child_reaper(father, dead); 633 if (list_empty(&father->children)) 634 return; 635 636 reaper = find_new_reaper(father, reaper); 637 list_for_each_entry(p, &father->children, sibling) { 638 for_each_thread(p, t) { 639 RCU_INIT_POINTER(t->real_parent, reaper); 640 BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father)); 641 if (likely(!t->ptrace)) 642 t->parent = t->real_parent; 643 if (t->pdeath_signal) 644 group_send_sig_info(t->pdeath_signal, 645 SEND_SIG_NOINFO, t, 646 PIDTYPE_TGID); 647 } 648 /* 649 * If this is a threaded reparent there is no need to 650 * notify anyone anything has happened. 651 */ 652 if (!same_thread_group(reaper, father)) 653 reparent_leader(father, p, dead); 654 } 655 list_splice_tail_init(&father->children, &reaper->children); 656 } 657 658 /* 659 * Send signals to all our closest relatives so that they know 660 * to properly mourn us.. 661 */ 662 static void exit_notify(struct task_struct *tsk, int group_dead) 663 { 664 bool autoreap; 665 struct task_struct *p, *n; 666 LIST_HEAD(dead); 667 668 write_lock_irq(&tasklist_lock); 669 forget_original_parent(tsk, &dead); 670 671 if (group_dead) 672 kill_orphaned_pgrp(tsk->group_leader, NULL); 673 674 tsk->exit_state = EXIT_ZOMBIE; 675 if (unlikely(tsk->ptrace)) { 676 int sig = thread_group_leader(tsk) && 677 thread_group_empty(tsk) && 678 !ptrace_reparented(tsk) ? 679 tsk->exit_signal : SIGCHLD; 680 autoreap = do_notify_parent(tsk, sig); 681 } else if (thread_group_leader(tsk)) { 682 autoreap = thread_group_empty(tsk) && 683 do_notify_parent(tsk, tsk->exit_signal); 684 } else { 685 autoreap = true; 686 } 687 688 if (autoreap) { 689 tsk->exit_state = EXIT_DEAD; 690 list_add(&tsk->ptrace_entry, &dead); 691 } 692 693 /* mt-exec, de_thread() is waiting for group leader */ 694 if (unlikely(tsk->signal->notify_count < 0)) 695 wake_up_process(tsk->signal->group_exit_task); 696 write_unlock_irq(&tasklist_lock); 697 698 list_for_each_entry_safe(p, n, &dead, ptrace_entry) { 699 list_del_init(&p->ptrace_entry); 700 release_task(p); 701 } 702 } 703 704 #ifdef CONFIG_DEBUG_STACK_USAGE 705 static void check_stack_usage(void) 706 { 707 static DEFINE_SPINLOCK(low_water_lock); 708 static int lowest_to_date = THREAD_SIZE; 709 unsigned long free; 710 711 free = stack_not_used(current); 712 713 if (free >= lowest_to_date) 714 return; 715 716 spin_lock(&low_water_lock); 717 if (free < lowest_to_date) { 718 pr_info("%s (%d) used greatest stack depth: %lu bytes left\n", 719 current->comm, task_pid_nr(current), free); 720 lowest_to_date = free; 721 } 722 spin_unlock(&low_water_lock); 723 } 724 #else 725 static inline void check_stack_usage(void) {} 726 #endif 727 728 void __noreturn do_exit(long code) 729 { 730 struct task_struct *tsk = current; 731 int group_dead; 732 733 /* 734 * We can get here from a kernel oops, sometimes with preemption off. 735 * Start by checking for critical errors. 736 * Then fix up important state like USER_DS and preemption. 737 * Then do everything else. 738 */ 739 740 WARN_ON(blk_needs_flush_plug(tsk)); 741 742 if (unlikely(in_interrupt())) 743 panic("Aiee, killing interrupt handler!"); 744 if (unlikely(!tsk->pid)) 745 panic("Attempted to kill the idle task!"); 746 747 /* 748 * If do_exit is called because this processes oopsed, it's possible 749 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before 750 * continuing. Amongst other possible reasons, this is to prevent 751 * mm_release()->clear_child_tid() from writing to a user-controlled 752 * kernel address. 753 */ 754 force_uaccess_begin(); 755 756 if (unlikely(in_atomic())) { 757 pr_info("note: %s[%d] exited with preempt_count %d\n", 758 current->comm, task_pid_nr(current), 759 preempt_count()); 760 preempt_count_set(PREEMPT_ENABLED); 761 } 762 763 profile_task_exit(tsk); 764 kcov_task_exit(tsk); 765 766 ptrace_event(PTRACE_EVENT_EXIT, code); 767 768 validate_creds_for_do_exit(tsk); 769 770 /* 771 * We're taking recursive faults here in do_exit. Safest is to just 772 * leave this task alone and wait for reboot. 773 */ 774 if (unlikely(tsk->flags & PF_EXITING)) { 775 pr_alert("Fixing recursive fault but reboot is needed!\n"); 776 futex_exit_recursive(tsk); 777 set_current_state(TASK_UNINTERRUPTIBLE); 778 schedule(); 779 } 780 781 io_uring_files_cancel(tsk->files); 782 exit_signals(tsk); /* sets PF_EXITING */ 783 784 /* sync mm's RSS info before statistics gathering */ 785 if (tsk->mm) 786 sync_mm_rss(tsk->mm); 787 acct_update_integrals(tsk); 788 group_dead = atomic_dec_and_test(&tsk->signal->live); 789 if (group_dead) { 790 /* 791 * If the last thread of global init has exited, panic 792 * immediately to get a useable coredump. 793 */ 794 if (unlikely(is_global_init(tsk))) 795 panic("Attempted to kill init! exitcode=0x%08x\n", 796 tsk->signal->group_exit_code ?: (int)code); 797 798 #ifdef CONFIG_POSIX_TIMERS 799 hrtimer_cancel(&tsk->signal->real_timer); 800 exit_itimers(tsk->signal); 801 #endif 802 if (tsk->mm) 803 setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm); 804 } 805 acct_collect(code, group_dead); 806 if (group_dead) 807 tty_audit_exit(); 808 audit_free(tsk); 809 810 tsk->exit_code = code; 811 taskstats_exit(tsk, group_dead); 812 813 exit_mm(); 814 815 if (group_dead) 816 acct_process(); 817 trace_sched_process_exit(tsk); 818 819 exit_sem(tsk); 820 exit_shm(tsk); 821 exit_files(tsk); 822 exit_fs(tsk); 823 if (group_dead) 824 disassociate_ctty(1); 825 exit_task_namespaces(tsk); 826 exit_task_work(tsk); 827 exit_thread(tsk); 828 829 /* 830 * Flush inherited counters to the parent - before the parent 831 * gets woken up by child-exit notifications. 832 * 833 * because of cgroup mode, must be called before cgroup_exit() 834 */ 835 perf_event_exit_task(tsk); 836 837 sched_autogroup_exit_task(tsk); 838 cgroup_exit(tsk); 839 840 /* 841 * FIXME: do that only when needed, using sched_exit tracepoint 842 */ 843 flush_ptrace_hw_breakpoint(tsk); 844 845 exit_tasks_rcu_start(); 846 exit_notify(tsk, group_dead); 847 proc_exit_connector(tsk); 848 mpol_put_task_policy(tsk); 849 #ifdef CONFIG_FUTEX 850 if (unlikely(current->pi_state_cache)) 851 kfree(current->pi_state_cache); 852 #endif 853 /* 854 * Make sure we are holding no locks: 855 */ 856 debug_check_no_locks_held(); 857 858 if (tsk->io_context) 859 exit_io_context(tsk); 860 861 if (tsk->splice_pipe) 862 free_pipe_info(tsk->splice_pipe); 863 864 if (tsk->task_frag.page) 865 put_page(tsk->task_frag.page); 866 867 validate_creds_for_do_exit(tsk); 868 869 check_stack_usage(); 870 preempt_disable(); 871 if (tsk->nr_dirtied) 872 __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied); 873 exit_rcu(); 874 exit_tasks_rcu_finish(); 875 876 lockdep_free_task(tsk); 877 do_task_dead(); 878 } 879 EXPORT_SYMBOL_GPL(do_exit); 880 881 void complete_and_exit(struct completion *comp, long code) 882 { 883 if (comp) 884 complete(comp); 885 886 do_exit(code); 887 } 888 EXPORT_SYMBOL(complete_and_exit); 889 890 SYSCALL_DEFINE1(exit, int, error_code) 891 { 892 do_exit((error_code&0xff)<<8); 893 } 894 895 /* 896 * Take down every thread in the group. This is called by fatal signals 897 * as well as by sys_exit_group (below). 898 */ 899 void 900 do_group_exit(int exit_code) 901 { 902 struct signal_struct *sig = current->signal; 903 904 BUG_ON(exit_code & 0x80); /* core dumps don't get here */ 905 906 if (signal_group_exit(sig)) 907 exit_code = sig->group_exit_code; 908 else if (!thread_group_empty(current)) { 909 struct sighand_struct *const sighand = current->sighand; 910 911 spin_lock_irq(&sighand->siglock); 912 if (signal_group_exit(sig)) 913 /* Another thread got here before we took the lock. */ 914 exit_code = sig->group_exit_code; 915 else { 916 sig->group_exit_code = exit_code; 917 sig->flags = SIGNAL_GROUP_EXIT; 918 zap_other_threads(current); 919 } 920 spin_unlock_irq(&sighand->siglock); 921 } 922 923 do_exit(exit_code); 924 /* NOTREACHED */ 925 } 926 927 /* 928 * this kills every thread in the thread group. Note that any externally 929 * wait4()-ing process will get the correct exit code - even if this 930 * thread is not the thread group leader. 931 */ 932 SYSCALL_DEFINE1(exit_group, int, error_code) 933 { 934 do_group_exit((error_code & 0xff) << 8); 935 /* NOTREACHED */ 936 return 0; 937 } 938 939 struct waitid_info { 940 pid_t pid; 941 uid_t uid; 942 int status; 943 int cause; 944 }; 945 946 struct wait_opts { 947 enum pid_type wo_type; 948 int wo_flags; 949 struct pid *wo_pid; 950 951 struct waitid_info *wo_info; 952 int wo_stat; 953 struct rusage *wo_rusage; 954 955 wait_queue_entry_t child_wait; 956 int notask_error; 957 }; 958 959 static int eligible_pid(struct wait_opts *wo, struct task_struct *p) 960 { 961 return wo->wo_type == PIDTYPE_MAX || 962 task_pid_type(p, wo->wo_type) == wo->wo_pid; 963 } 964 965 static int 966 eligible_child(struct wait_opts *wo, bool ptrace, struct task_struct *p) 967 { 968 if (!eligible_pid(wo, p)) 969 return 0; 970 971 /* 972 * Wait for all children (clone and not) if __WALL is set or 973 * if it is traced by us. 974 */ 975 if (ptrace || (wo->wo_flags & __WALL)) 976 return 1; 977 978 /* 979 * Otherwise, wait for clone children *only* if __WCLONE is set; 980 * otherwise, wait for non-clone children *only*. 981 * 982 * Note: a "clone" child here is one that reports to its parent 983 * using a signal other than SIGCHLD, or a non-leader thread which 984 * we can only see if it is traced by us. 985 */ 986 if ((p->exit_signal != SIGCHLD) ^ !!(wo->wo_flags & __WCLONE)) 987 return 0; 988 989 return 1; 990 } 991 992 /* 993 * Handle sys_wait4 work for one task in state EXIT_ZOMBIE. We hold 994 * read_lock(&tasklist_lock) on entry. If we return zero, we still hold 995 * the lock and this task is uninteresting. If we return nonzero, we have 996 * released the lock and the system call should return. 997 */ 998 static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p) 999 { 1000 int state, status; 1001 pid_t pid = task_pid_vnr(p); 1002 uid_t uid = from_kuid_munged(current_user_ns(), task_uid(p)); 1003 struct waitid_info *infop; 1004 1005 if (!likely(wo->wo_flags & WEXITED)) 1006 return 0; 1007 1008 if (unlikely(wo->wo_flags & WNOWAIT)) { 1009 status = p->exit_code; 1010 get_task_struct(p); 1011 read_unlock(&tasklist_lock); 1012 sched_annotate_sleep(); 1013 if (wo->wo_rusage) 1014 getrusage(p, RUSAGE_BOTH, wo->wo_rusage); 1015 put_task_struct(p); 1016 goto out_info; 1017 } 1018 /* 1019 * Move the task's state to DEAD/TRACE, only one thread can do this. 1020 */ 1021 state = (ptrace_reparented(p) && thread_group_leader(p)) ? 1022 EXIT_TRACE : EXIT_DEAD; 1023 if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE) 1024 return 0; 1025 /* 1026 * We own this thread, nobody else can reap it. 1027 */ 1028 read_unlock(&tasklist_lock); 1029 sched_annotate_sleep(); 1030 1031 /* 1032 * Check thread_group_leader() to exclude the traced sub-threads. 1033 */ 1034 if (state == EXIT_DEAD && thread_group_leader(p)) { 1035 struct signal_struct *sig = p->signal; 1036 struct signal_struct *psig = current->signal; 1037 unsigned long maxrss; 1038 u64 tgutime, tgstime; 1039 1040 /* 1041 * The resource counters for the group leader are in its 1042 * own task_struct. Those for dead threads in the group 1043 * are in its signal_struct, as are those for the child 1044 * processes it has previously reaped. All these 1045 * accumulate in the parent's signal_struct c* fields. 1046 * 1047 * We don't bother to take a lock here to protect these 1048 * p->signal fields because the whole thread group is dead 1049 * and nobody can change them. 1050 * 1051 * psig->stats_lock also protects us from our sub-theads 1052 * which can reap other children at the same time. Until 1053 * we change k_getrusage()-like users to rely on this lock 1054 * we have to take ->siglock as well. 1055 * 1056 * We use thread_group_cputime_adjusted() to get times for 1057 * the thread group, which consolidates times for all threads 1058 * in the group including the group leader. 1059 */ 1060 thread_group_cputime_adjusted(p, &tgutime, &tgstime); 1061 spin_lock_irq(¤t->sighand->siglock); 1062 write_seqlock(&psig->stats_lock); 1063 psig->cutime += tgutime + sig->cutime; 1064 psig->cstime += tgstime + sig->cstime; 1065 psig->cgtime += task_gtime(p) + sig->gtime + sig->cgtime; 1066 psig->cmin_flt += 1067 p->min_flt + sig->min_flt + sig->cmin_flt; 1068 psig->cmaj_flt += 1069 p->maj_flt + sig->maj_flt + sig->cmaj_flt; 1070 psig->cnvcsw += 1071 p->nvcsw + sig->nvcsw + sig->cnvcsw; 1072 psig->cnivcsw += 1073 p->nivcsw + sig->nivcsw + sig->cnivcsw; 1074 psig->cinblock += 1075 task_io_get_inblock(p) + 1076 sig->inblock + sig->cinblock; 1077 psig->coublock += 1078 task_io_get_oublock(p) + 1079 sig->oublock + sig->coublock; 1080 maxrss = max(sig->maxrss, sig->cmaxrss); 1081 if (psig->cmaxrss < maxrss) 1082 psig->cmaxrss = maxrss; 1083 task_io_accounting_add(&psig->ioac, &p->ioac); 1084 task_io_accounting_add(&psig->ioac, &sig->ioac); 1085 write_sequnlock(&psig->stats_lock); 1086 spin_unlock_irq(¤t->sighand->siglock); 1087 } 1088 1089 if (wo->wo_rusage) 1090 getrusage(p, RUSAGE_BOTH, wo->wo_rusage); 1091 status = (p->signal->flags & SIGNAL_GROUP_EXIT) 1092 ? p->signal->group_exit_code : p->exit_code; 1093 wo->wo_stat = status; 1094 1095 if (state == EXIT_TRACE) { 1096 write_lock_irq(&tasklist_lock); 1097 /* We dropped tasklist, ptracer could die and untrace */ 1098 ptrace_unlink(p); 1099 1100 /* If parent wants a zombie, don't release it now */ 1101 state = EXIT_ZOMBIE; 1102 if (do_notify_parent(p, p->exit_signal)) 1103 state = EXIT_DEAD; 1104 p->exit_state = state; 1105 write_unlock_irq(&tasklist_lock); 1106 } 1107 if (state == EXIT_DEAD) 1108 release_task(p); 1109 1110 out_info: 1111 infop = wo->wo_info; 1112 if (infop) { 1113 if ((status & 0x7f) == 0) { 1114 infop->cause = CLD_EXITED; 1115 infop->status = status >> 8; 1116 } else { 1117 infop->cause = (status & 0x80) ? CLD_DUMPED : CLD_KILLED; 1118 infop->status = status & 0x7f; 1119 } 1120 infop->pid = pid; 1121 infop->uid = uid; 1122 } 1123 1124 return pid; 1125 } 1126 1127 static int *task_stopped_code(struct task_struct *p, bool ptrace) 1128 { 1129 if (ptrace) { 1130 if (task_is_traced(p) && !(p->jobctl & JOBCTL_LISTENING)) 1131 return &p->exit_code; 1132 } else { 1133 if (p->signal->flags & SIGNAL_STOP_STOPPED) 1134 return &p->signal->group_exit_code; 1135 } 1136 return NULL; 1137 } 1138 1139 /** 1140 * wait_task_stopped - Wait for %TASK_STOPPED or %TASK_TRACED 1141 * @wo: wait options 1142 * @ptrace: is the wait for ptrace 1143 * @p: task to wait for 1144 * 1145 * Handle sys_wait4() work for %p in state %TASK_STOPPED or %TASK_TRACED. 1146 * 1147 * CONTEXT: 1148 * read_lock(&tasklist_lock), which is released if return value is 1149 * non-zero. Also, grabs and releases @p->sighand->siglock. 1150 * 1151 * RETURNS: 1152 * 0 if wait condition didn't exist and search for other wait conditions 1153 * should continue. Non-zero return, -errno on failure and @p's pid on 1154 * success, implies that tasklist_lock is released and wait condition 1155 * search should terminate. 1156 */ 1157 static int wait_task_stopped(struct wait_opts *wo, 1158 int ptrace, struct task_struct *p) 1159 { 1160 struct waitid_info *infop; 1161 int exit_code, *p_code, why; 1162 uid_t uid = 0; /* unneeded, required by compiler */ 1163 pid_t pid; 1164 1165 /* 1166 * Traditionally we see ptrace'd stopped tasks regardless of options. 1167 */ 1168 if (!ptrace && !(wo->wo_flags & WUNTRACED)) 1169 return 0; 1170 1171 if (!task_stopped_code(p, ptrace)) 1172 return 0; 1173 1174 exit_code = 0; 1175 spin_lock_irq(&p->sighand->siglock); 1176 1177 p_code = task_stopped_code(p, ptrace); 1178 if (unlikely(!p_code)) 1179 goto unlock_sig; 1180 1181 exit_code = *p_code; 1182 if (!exit_code) 1183 goto unlock_sig; 1184 1185 if (!unlikely(wo->wo_flags & WNOWAIT)) 1186 *p_code = 0; 1187 1188 uid = from_kuid_munged(current_user_ns(), task_uid(p)); 1189 unlock_sig: 1190 spin_unlock_irq(&p->sighand->siglock); 1191 if (!exit_code) 1192 return 0; 1193 1194 /* 1195 * Now we are pretty sure this task is interesting. 1196 * Make sure it doesn't get reaped out from under us while we 1197 * give up the lock and then examine it below. We don't want to 1198 * keep holding onto the tasklist_lock while we call getrusage and 1199 * possibly take page faults for user memory. 1200 */ 1201 get_task_struct(p); 1202 pid = task_pid_vnr(p); 1203 why = ptrace ? CLD_TRAPPED : CLD_STOPPED; 1204 read_unlock(&tasklist_lock); 1205 sched_annotate_sleep(); 1206 if (wo->wo_rusage) 1207 getrusage(p, RUSAGE_BOTH, wo->wo_rusage); 1208 put_task_struct(p); 1209 1210 if (likely(!(wo->wo_flags & WNOWAIT))) 1211 wo->wo_stat = (exit_code << 8) | 0x7f; 1212 1213 infop = wo->wo_info; 1214 if (infop) { 1215 infop->cause = why; 1216 infop->status = exit_code; 1217 infop->pid = pid; 1218 infop->uid = uid; 1219 } 1220 return pid; 1221 } 1222 1223 /* 1224 * Handle do_wait work for one task in a live, non-stopped state. 1225 * read_lock(&tasklist_lock) on entry. If we return zero, we still hold 1226 * the lock and this task is uninteresting. If we return nonzero, we have 1227 * released the lock and the system call should return. 1228 */ 1229 static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) 1230 { 1231 struct waitid_info *infop; 1232 pid_t pid; 1233 uid_t uid; 1234 1235 if (!unlikely(wo->wo_flags & WCONTINUED)) 1236 return 0; 1237 1238 if (!(p->signal->flags & SIGNAL_STOP_CONTINUED)) 1239 return 0; 1240 1241 spin_lock_irq(&p->sighand->siglock); 1242 /* Re-check with the lock held. */ 1243 if (!(p->signal->flags & SIGNAL_STOP_CONTINUED)) { 1244 spin_unlock_irq(&p->sighand->siglock); 1245 return 0; 1246 } 1247 if (!unlikely(wo->wo_flags & WNOWAIT)) 1248 p->signal->flags &= ~SIGNAL_STOP_CONTINUED; 1249 uid = from_kuid_munged(current_user_ns(), task_uid(p)); 1250 spin_unlock_irq(&p->sighand->siglock); 1251 1252 pid = task_pid_vnr(p); 1253 get_task_struct(p); 1254 read_unlock(&tasklist_lock); 1255 sched_annotate_sleep(); 1256 if (wo->wo_rusage) 1257 getrusage(p, RUSAGE_BOTH, wo->wo_rusage); 1258 put_task_struct(p); 1259 1260 infop = wo->wo_info; 1261 if (!infop) { 1262 wo->wo_stat = 0xffff; 1263 } else { 1264 infop->cause = CLD_CONTINUED; 1265 infop->pid = pid; 1266 infop->uid = uid; 1267 infop->status = SIGCONT; 1268 } 1269 return pid; 1270 } 1271 1272 /* 1273 * Consider @p for a wait by @parent. 1274 * 1275 * -ECHILD should be in ->notask_error before the first call. 1276 * Returns nonzero for a final return, when we have unlocked tasklist_lock. 1277 * Returns zero if the search for a child should continue; 1278 * then ->notask_error is 0 if @p is an eligible child, 1279 * or still -ECHILD. 1280 */ 1281 static int wait_consider_task(struct wait_opts *wo, int ptrace, 1282 struct task_struct *p) 1283 { 1284 /* 1285 * We can race with wait_task_zombie() from another thread. 1286 * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition 1287 * can't confuse the checks below. 1288 */ 1289 int exit_state = READ_ONCE(p->exit_state); 1290 int ret; 1291 1292 if (unlikely(exit_state == EXIT_DEAD)) 1293 return 0; 1294 1295 ret = eligible_child(wo, ptrace, p); 1296 if (!ret) 1297 return ret; 1298 1299 if (unlikely(exit_state == EXIT_TRACE)) { 1300 /* 1301 * ptrace == 0 means we are the natural parent. In this case 1302 * we should clear notask_error, debugger will notify us. 1303 */ 1304 if (likely(!ptrace)) 1305 wo->notask_error = 0; 1306 return 0; 1307 } 1308 1309 if (likely(!ptrace) && unlikely(p->ptrace)) { 1310 /* 1311 * If it is traced by its real parent's group, just pretend 1312 * the caller is ptrace_do_wait() and reap this child if it 1313 * is zombie. 1314 * 1315 * This also hides group stop state from real parent; otherwise 1316 * a single stop can be reported twice as group and ptrace stop. 1317 * If a ptracer wants to distinguish these two events for its 1318 * own children it should create a separate process which takes 1319 * the role of real parent. 1320 */ 1321 if (!ptrace_reparented(p)) 1322 ptrace = 1; 1323 } 1324 1325 /* slay zombie? */ 1326 if (exit_state == EXIT_ZOMBIE) { 1327 /* we don't reap group leaders with subthreads */ 1328 if (!delay_group_leader(p)) { 1329 /* 1330 * A zombie ptracee is only visible to its ptracer. 1331 * Notification and reaping will be cascaded to the 1332 * real parent when the ptracer detaches. 1333 */ 1334 if (unlikely(ptrace) || likely(!p->ptrace)) 1335 return wait_task_zombie(wo, p); 1336 } 1337 1338 /* 1339 * Allow access to stopped/continued state via zombie by 1340 * falling through. Clearing of notask_error is complex. 1341 * 1342 * When !@ptrace: 1343 * 1344 * If WEXITED is set, notask_error should naturally be 1345 * cleared. If not, subset of WSTOPPED|WCONTINUED is set, 1346 * so, if there are live subthreads, there are events to 1347 * wait for. If all subthreads are dead, it's still safe 1348 * to clear - this function will be called again in finite 1349 * amount time once all the subthreads are released and 1350 * will then return without clearing. 1351 * 1352 * When @ptrace: 1353 * 1354 * Stopped state is per-task and thus can't change once the 1355 * target task dies. Only continued and exited can happen. 1356 * Clear notask_error if WCONTINUED | WEXITED. 1357 */ 1358 if (likely(!ptrace) || (wo->wo_flags & (WCONTINUED | WEXITED))) 1359 wo->notask_error = 0; 1360 } else { 1361 /* 1362 * @p is alive and it's gonna stop, continue or exit, so 1363 * there always is something to wait for. 1364 */ 1365 wo->notask_error = 0; 1366 } 1367 1368 /* 1369 * Wait for stopped. Depending on @ptrace, different stopped state 1370 * is used and the two don't interact with each other. 1371 */ 1372 ret = wait_task_stopped(wo, ptrace, p); 1373 if (ret) 1374 return ret; 1375 1376 /* 1377 * Wait for continued. There's only one continued state and the 1378 * ptracer can consume it which can confuse the real parent. Don't 1379 * use WCONTINUED from ptracer. You don't need or want it. 1380 */ 1381 return wait_task_continued(wo, p); 1382 } 1383 1384 /* 1385 * Do the work of do_wait() for one thread in the group, @tsk. 1386 * 1387 * -ECHILD should be in ->notask_error before the first call. 1388 * Returns nonzero for a final return, when we have unlocked tasklist_lock. 1389 * Returns zero if the search for a child should continue; then 1390 * ->notask_error is 0 if there were any eligible children, 1391 * or still -ECHILD. 1392 */ 1393 static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk) 1394 { 1395 struct task_struct *p; 1396 1397 list_for_each_entry(p, &tsk->children, sibling) { 1398 int ret = wait_consider_task(wo, 0, p); 1399 1400 if (ret) 1401 return ret; 1402 } 1403 1404 return 0; 1405 } 1406 1407 static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk) 1408 { 1409 struct task_struct *p; 1410 1411 list_for_each_entry(p, &tsk->ptraced, ptrace_entry) { 1412 int ret = wait_consider_task(wo, 1, p); 1413 1414 if (ret) 1415 return ret; 1416 } 1417 1418 return 0; 1419 } 1420 1421 static int child_wait_callback(wait_queue_entry_t *wait, unsigned mode, 1422 int sync, void *key) 1423 { 1424 struct wait_opts *wo = container_of(wait, struct wait_opts, 1425 child_wait); 1426 struct task_struct *p = key; 1427 1428 if (!eligible_pid(wo, p)) 1429 return 0; 1430 1431 if ((wo->wo_flags & __WNOTHREAD) && wait->private != p->parent) 1432 return 0; 1433 1434 return default_wake_function(wait, mode, sync, key); 1435 } 1436 1437 void __wake_up_parent(struct task_struct *p, struct task_struct *parent) 1438 { 1439 __wake_up_sync_key(&parent->signal->wait_chldexit, 1440 TASK_INTERRUPTIBLE, p); 1441 } 1442 1443 static bool is_effectively_child(struct wait_opts *wo, bool ptrace, 1444 struct task_struct *target) 1445 { 1446 struct task_struct *parent = 1447 !ptrace ? target->real_parent : target->parent; 1448 1449 return current == parent || (!(wo->wo_flags & __WNOTHREAD) && 1450 same_thread_group(current, parent)); 1451 } 1452 1453 /* 1454 * Optimization for waiting on PIDTYPE_PID. No need to iterate through child 1455 * and tracee lists to find the target task. 1456 */ 1457 static int do_wait_pid(struct wait_opts *wo) 1458 { 1459 bool ptrace; 1460 struct task_struct *target; 1461 int retval; 1462 1463 ptrace = false; 1464 target = pid_task(wo->wo_pid, PIDTYPE_TGID); 1465 if (target && is_effectively_child(wo, ptrace, target)) { 1466 retval = wait_consider_task(wo, ptrace, target); 1467 if (retval) 1468 return retval; 1469 } 1470 1471 ptrace = true; 1472 target = pid_task(wo->wo_pid, PIDTYPE_PID); 1473 if (target && target->ptrace && 1474 is_effectively_child(wo, ptrace, target)) { 1475 retval = wait_consider_task(wo, ptrace, target); 1476 if (retval) 1477 return retval; 1478 } 1479 1480 return 0; 1481 } 1482 1483 static long do_wait(struct wait_opts *wo) 1484 { 1485 int retval; 1486 1487 trace_sched_process_wait(wo->wo_pid); 1488 1489 init_waitqueue_func_entry(&wo->child_wait, child_wait_callback); 1490 wo->child_wait.private = current; 1491 add_wait_queue(¤t->signal->wait_chldexit, &wo->child_wait); 1492 repeat: 1493 /* 1494 * If there is nothing that can match our criteria, just get out. 1495 * We will clear ->notask_error to zero if we see any child that 1496 * might later match our criteria, even if we are not able to reap 1497 * it yet. 1498 */ 1499 wo->notask_error = -ECHILD; 1500 if ((wo->wo_type < PIDTYPE_MAX) && 1501 (!wo->wo_pid || !pid_has_task(wo->wo_pid, wo->wo_type))) 1502 goto notask; 1503 1504 set_current_state(TASK_INTERRUPTIBLE); 1505 read_lock(&tasklist_lock); 1506 1507 if (wo->wo_type == PIDTYPE_PID) { 1508 retval = do_wait_pid(wo); 1509 if (retval) 1510 goto end; 1511 } else { 1512 struct task_struct *tsk = current; 1513 1514 do { 1515 retval = do_wait_thread(wo, tsk); 1516 if (retval) 1517 goto end; 1518 1519 retval = ptrace_do_wait(wo, tsk); 1520 if (retval) 1521 goto end; 1522 1523 if (wo->wo_flags & __WNOTHREAD) 1524 break; 1525 } while_each_thread(current, tsk); 1526 } 1527 read_unlock(&tasklist_lock); 1528 1529 notask: 1530 retval = wo->notask_error; 1531 if (!retval && !(wo->wo_flags & WNOHANG)) { 1532 retval = -ERESTARTSYS; 1533 if (!signal_pending(current)) { 1534 schedule(); 1535 goto repeat; 1536 } 1537 } 1538 end: 1539 __set_current_state(TASK_RUNNING); 1540 remove_wait_queue(¤t->signal->wait_chldexit, &wo->child_wait); 1541 return retval; 1542 } 1543 1544 static long kernel_waitid(int which, pid_t upid, struct waitid_info *infop, 1545 int options, struct rusage *ru) 1546 { 1547 struct wait_opts wo; 1548 struct pid *pid = NULL; 1549 enum pid_type type; 1550 long ret; 1551 unsigned int f_flags = 0; 1552 1553 if (options & ~(WNOHANG|WNOWAIT|WEXITED|WSTOPPED|WCONTINUED| 1554 __WNOTHREAD|__WCLONE|__WALL)) 1555 return -EINVAL; 1556 if (!(options & (WEXITED|WSTOPPED|WCONTINUED))) 1557 return -EINVAL; 1558 1559 switch (which) { 1560 case P_ALL: 1561 type = PIDTYPE_MAX; 1562 break; 1563 case P_PID: 1564 type = PIDTYPE_PID; 1565 if (upid <= 0) 1566 return -EINVAL; 1567 1568 pid = find_get_pid(upid); 1569 break; 1570 case P_PGID: 1571 type = PIDTYPE_PGID; 1572 if (upid < 0) 1573 return -EINVAL; 1574 1575 if (upid) 1576 pid = find_get_pid(upid); 1577 else 1578 pid = get_task_pid(current, PIDTYPE_PGID); 1579 break; 1580 case P_PIDFD: 1581 type = PIDTYPE_PID; 1582 if (upid < 0) 1583 return -EINVAL; 1584 1585 pid = pidfd_get_pid(upid, &f_flags); 1586 if (IS_ERR(pid)) 1587 return PTR_ERR(pid); 1588 1589 break; 1590 default: 1591 return -EINVAL; 1592 } 1593 1594 wo.wo_type = type; 1595 wo.wo_pid = pid; 1596 wo.wo_flags = options; 1597 wo.wo_info = infop; 1598 wo.wo_rusage = ru; 1599 if (f_flags & O_NONBLOCK) 1600 wo.wo_flags |= WNOHANG; 1601 1602 ret = do_wait(&wo); 1603 if (!ret && !(options & WNOHANG) && (f_flags & O_NONBLOCK)) 1604 ret = -EAGAIN; 1605 1606 put_pid(pid); 1607 return ret; 1608 } 1609 1610 SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, 1611 infop, int, options, struct rusage __user *, ru) 1612 { 1613 struct rusage r; 1614 struct waitid_info info = {.status = 0}; 1615 long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL); 1616 int signo = 0; 1617 1618 if (err > 0) { 1619 signo = SIGCHLD; 1620 err = 0; 1621 if (ru && copy_to_user(ru, &r, sizeof(struct rusage))) 1622 return -EFAULT; 1623 } 1624 if (!infop) 1625 return err; 1626 1627 if (!user_write_access_begin(infop, sizeof(*infop))) 1628 return -EFAULT; 1629 1630 unsafe_put_user(signo, &infop->si_signo, Efault); 1631 unsafe_put_user(0, &infop->si_errno, Efault); 1632 unsafe_put_user(info.cause, &infop->si_code, Efault); 1633 unsafe_put_user(info.pid, &infop->si_pid, Efault); 1634 unsafe_put_user(info.uid, &infop->si_uid, Efault); 1635 unsafe_put_user(info.status, &infop->si_status, Efault); 1636 user_write_access_end(); 1637 return err; 1638 Efault: 1639 user_write_access_end(); 1640 return -EFAULT; 1641 } 1642 1643 long kernel_wait4(pid_t upid, int __user *stat_addr, int options, 1644 struct rusage *ru) 1645 { 1646 struct wait_opts wo; 1647 struct pid *pid = NULL; 1648 enum pid_type type; 1649 long ret; 1650 1651 if (options & ~(WNOHANG|WUNTRACED|WCONTINUED| 1652 __WNOTHREAD|__WCLONE|__WALL)) 1653 return -EINVAL; 1654 1655 /* -INT_MIN is not defined */ 1656 if (upid == INT_MIN) 1657 return -ESRCH; 1658 1659 if (upid == -1) 1660 type = PIDTYPE_MAX; 1661 else if (upid < 0) { 1662 type = PIDTYPE_PGID; 1663 pid = find_get_pid(-upid); 1664 } else if (upid == 0) { 1665 type = PIDTYPE_PGID; 1666 pid = get_task_pid(current, PIDTYPE_PGID); 1667 } else /* upid > 0 */ { 1668 type = PIDTYPE_PID; 1669 pid = find_get_pid(upid); 1670 } 1671 1672 wo.wo_type = type; 1673 wo.wo_pid = pid; 1674 wo.wo_flags = options | WEXITED; 1675 wo.wo_info = NULL; 1676 wo.wo_stat = 0; 1677 wo.wo_rusage = ru; 1678 ret = do_wait(&wo); 1679 put_pid(pid); 1680 if (ret > 0 && stat_addr && put_user(wo.wo_stat, stat_addr)) 1681 ret = -EFAULT; 1682 1683 return ret; 1684 } 1685 1686 int kernel_wait(pid_t pid, int *stat) 1687 { 1688 struct wait_opts wo = { 1689 .wo_type = PIDTYPE_PID, 1690 .wo_pid = find_get_pid(pid), 1691 .wo_flags = WEXITED, 1692 }; 1693 int ret; 1694 1695 ret = do_wait(&wo); 1696 if (ret > 0 && wo.wo_stat) 1697 *stat = wo.wo_stat; 1698 put_pid(wo.wo_pid); 1699 return ret; 1700 } 1701 1702 SYSCALL_DEFINE4(wait4, pid_t, upid, int __user *, stat_addr, 1703 int, options, struct rusage __user *, ru) 1704 { 1705 struct rusage r; 1706 long err = kernel_wait4(upid, stat_addr, options, ru ? &r : NULL); 1707 1708 if (err > 0) { 1709 if (ru && copy_to_user(ru, &r, sizeof(struct rusage))) 1710 return -EFAULT; 1711 } 1712 return err; 1713 } 1714 1715 #ifdef __ARCH_WANT_SYS_WAITPID 1716 1717 /* 1718 * sys_waitpid() remains for compatibility. waitpid() should be 1719 * implemented by calling sys_wait4() from libc.a. 1720 */ 1721 SYSCALL_DEFINE3(waitpid, pid_t, pid, int __user *, stat_addr, int, options) 1722 { 1723 return kernel_wait4(pid, stat_addr, options, NULL); 1724 } 1725 1726 #endif 1727 1728 #ifdef CONFIG_COMPAT 1729 COMPAT_SYSCALL_DEFINE4(wait4, 1730 compat_pid_t, pid, 1731 compat_uint_t __user *, stat_addr, 1732 int, options, 1733 struct compat_rusage __user *, ru) 1734 { 1735 struct rusage r; 1736 long err = kernel_wait4(pid, stat_addr, options, ru ? &r : NULL); 1737 if (err > 0) { 1738 if (ru && put_compat_rusage(&r, ru)) 1739 return -EFAULT; 1740 } 1741 return err; 1742 } 1743 1744 COMPAT_SYSCALL_DEFINE5(waitid, 1745 int, which, compat_pid_t, pid, 1746 struct compat_siginfo __user *, infop, int, options, 1747 struct compat_rusage __user *, uru) 1748 { 1749 struct rusage ru; 1750 struct waitid_info info = {.status = 0}; 1751 long err = kernel_waitid(which, pid, &info, options, uru ? &ru : NULL); 1752 int signo = 0; 1753 if (err > 0) { 1754 signo = SIGCHLD; 1755 err = 0; 1756 if (uru) { 1757 /* kernel_waitid() overwrites everything in ru */ 1758 if (COMPAT_USE_64BIT_TIME) 1759 err = copy_to_user(uru, &ru, sizeof(ru)); 1760 else 1761 err = put_compat_rusage(&ru, uru); 1762 if (err) 1763 return -EFAULT; 1764 } 1765 } 1766 1767 if (!infop) 1768 return err; 1769 1770 if (!user_write_access_begin(infop, sizeof(*infop))) 1771 return -EFAULT; 1772 1773 unsafe_put_user(signo, &infop->si_signo, Efault); 1774 unsafe_put_user(0, &infop->si_errno, Efault); 1775 unsafe_put_user(info.cause, &infop->si_code, Efault); 1776 unsafe_put_user(info.pid, &infop->si_pid, Efault); 1777 unsafe_put_user(info.uid, &infop->si_uid, Efault); 1778 unsafe_put_user(info.status, &infop->si_status, Efault); 1779 user_write_access_end(); 1780 return err; 1781 Efault: 1782 user_write_access_end(); 1783 return -EFAULT; 1784 } 1785 #endif 1786 1787 /** 1788 * thread_group_exited - check that a thread group has exited 1789 * @pid: tgid of thread group to be checked. 1790 * 1791 * Test if the thread group represented by tgid has exited (all 1792 * threads are zombies, dead or completely gone). 1793 * 1794 * Return: true if the thread group has exited. false otherwise. 1795 */ 1796 bool thread_group_exited(struct pid *pid) 1797 { 1798 struct task_struct *task; 1799 bool exited; 1800 1801 rcu_read_lock(); 1802 task = pid_task(pid, PIDTYPE_PID); 1803 exited = !task || 1804 (READ_ONCE(task->exit_state) && thread_group_empty(task)); 1805 rcu_read_unlock(); 1806 1807 return exited; 1808 } 1809 EXPORT_SYMBOL(thread_group_exited); 1810 1811 __weak void abort(void) 1812 { 1813 BUG(); 1814 1815 /* if that doesn't kill us, halt */ 1816 panic("Oops failed to kill thread"); 1817 } 1818 EXPORT_SYMBOL(abort); 1819