1 /* 2 * linux/kernel/fork.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * 'fork.c' contains the help-routines for the 'fork' system call 9 * (see also entry.S and others). 10 * Fork is rather simple, once you get the hang of it, but the memory 11 * management can be a bitch. See 'mm/memory.c': 'copy_page_range()' 12 */ 13 14 #include <linux/slab.h> 15 #include <linux/init.h> 16 #include <linux/unistd.h> 17 #include <linux/module.h> 18 #include <linux/vmalloc.h> 19 #include <linux/completion.h> 20 #include <linux/personality.h> 21 #include <linux/mempolicy.h> 22 #include <linux/sem.h> 23 #include <linux/file.h> 24 #include <linux/fdtable.h> 25 #include <linux/iocontext.h> 26 #include <linux/key.h> 27 #include <linux/binfmts.h> 28 #include <linux/mman.h> 29 #include <linux/mmu_notifier.h> 30 #include <linux/fs.h> 31 #include <linux/nsproxy.h> 32 #include <linux/capability.h> 33 #include <linux/cpu.h> 34 #include <linux/cgroup.h> 35 #include <linux/security.h> 36 #include <linux/hugetlb.h> 37 #include <linux/swap.h> 38 #include <linux/syscalls.h> 39 #include <linux/jiffies.h> 40 #include <linux/tracehook.h> 41 #include <linux/futex.h> 42 #include <linux/compat.h> 43 #include <linux/task_io_accounting_ops.h> 44 #include <linux/rcupdate.h> 45 #include <linux/ptrace.h> 46 #include <linux/mount.h> 47 #include <linux/audit.h> 48 #include <linux/memcontrol.h> 49 #include <linux/ftrace.h> 50 #include <linux/profile.h> 51 #include <linux/rmap.h> 52 #include <linux/ksm.h> 53 #include <linux/acct.h> 54 #include <linux/tsacct_kern.h> 55 #include <linux/cn_proc.h> 56 #include <linux/freezer.h> 57 #include <linux/delayacct.h> 58 #include <linux/taskstats_kern.h> 59 #include <linux/random.h> 60 #include <linux/tty.h> 61 #include <linux/proc_fs.h> 62 #include <linux/blkdev.h> 63 #include <linux/fs_struct.h> 64 #include <linux/magic.h> 65 #include <linux/perf_event.h> 66 #include <linux/posix-timers.h> 67 #include <linux/user-return-notifier.h> 68 69 #include <asm/pgtable.h> 70 #include <asm/pgalloc.h> 71 #include <asm/uaccess.h> 72 #include <asm/mmu_context.h> 73 #include <asm/cacheflush.h> 74 #include <asm/tlbflush.h> 75 76 #include <trace/events/sched.h> 77 78 /* 79 * Protected counters by write_lock_irq(&tasklist_lock) 80 */ 81 unsigned long total_forks; /* Handle normal Linux uptimes. */ 82 int nr_threads; /* The idle threads do not count.. */ 83 84 int max_threads; /* tunable limit on nr_threads */ 85 86 DEFINE_PER_CPU(unsigned long, process_counts) = 0; 87 88 __cacheline_aligned DEFINE_RWLOCK(tasklist_lock); /* outer */ 89 90 #ifdef CONFIG_PROVE_RCU 91 int lockdep_tasklist_lock_is_held(void) 92 { 93 return lockdep_is_held(&tasklist_lock); 94 } 95 EXPORT_SYMBOL_GPL(lockdep_tasklist_lock_is_held); 96 #endif /* #ifdef CONFIG_PROVE_RCU */ 97 98 int nr_processes(void) 99 { 100 int cpu; 101 int total = 0; 102 103 for_each_possible_cpu(cpu) 104 total += per_cpu(process_counts, cpu); 105 106 return total; 107 } 108 109 #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR 110 # define alloc_task_struct() kmem_cache_alloc(task_struct_cachep, GFP_KERNEL) 111 # define free_task_struct(tsk) kmem_cache_free(task_struct_cachep, (tsk)) 112 static struct kmem_cache *task_struct_cachep; 113 #endif 114 115 #ifndef __HAVE_ARCH_THREAD_INFO_ALLOCATOR 116 static inline struct thread_info *alloc_thread_info(struct task_struct *tsk) 117 { 118 #ifdef CONFIG_DEBUG_STACK_USAGE 119 gfp_t mask = GFP_KERNEL | __GFP_ZERO; 120 #else 121 gfp_t mask = GFP_KERNEL; 122 #endif 123 return (struct thread_info *)__get_free_pages(mask, THREAD_SIZE_ORDER); 124 } 125 126 static inline void free_thread_info(struct thread_info *ti) 127 { 128 free_pages((unsigned long)ti, THREAD_SIZE_ORDER); 129 } 130 #endif 131 132 /* SLAB cache for signal_struct structures (tsk->signal) */ 133 static struct kmem_cache *signal_cachep; 134 135 /* SLAB cache for sighand_struct structures (tsk->sighand) */ 136 struct kmem_cache *sighand_cachep; 137 138 /* SLAB cache for files_struct structures (tsk->files) */ 139 struct kmem_cache *files_cachep; 140 141 /* SLAB cache for fs_struct structures (tsk->fs) */ 142 struct kmem_cache *fs_cachep; 143 144 /* SLAB cache for vm_area_struct structures */ 145 struct kmem_cache *vm_area_cachep; 146 147 /* SLAB cache for mm_struct structures (tsk->mm) */ 148 static struct kmem_cache *mm_cachep; 149 150 static void account_kernel_stack(struct thread_info *ti, int account) 151 { 152 struct zone *zone = page_zone(virt_to_page(ti)); 153 154 mod_zone_page_state(zone, NR_KERNEL_STACK, account); 155 } 156 157 void free_task(struct task_struct *tsk) 158 { 159 prop_local_destroy_single(&tsk->dirties); 160 account_kernel_stack(tsk->stack, -1); 161 free_thread_info(tsk->stack); 162 rt_mutex_debug_task_free(tsk); 163 ftrace_graph_exit_task(tsk); 164 free_task_struct(tsk); 165 } 166 EXPORT_SYMBOL(free_task); 167 168 static inline void free_signal_struct(struct signal_struct *sig) 169 { 170 taskstats_tgid_free(sig); 171 kmem_cache_free(signal_cachep, sig); 172 } 173 174 static inline void put_signal_struct(struct signal_struct *sig) 175 { 176 if (atomic_dec_and_test(&sig->sigcnt)) 177 free_signal_struct(sig); 178 } 179 180 void __put_task_struct(struct task_struct *tsk) 181 { 182 WARN_ON(!tsk->exit_state); 183 WARN_ON(atomic_read(&tsk->usage)); 184 WARN_ON(tsk == current); 185 186 exit_creds(tsk); 187 delayacct_tsk_free(tsk); 188 put_signal_struct(tsk->signal); 189 190 if (!profile_handoff_task(tsk)) 191 free_task(tsk); 192 } 193 194 /* 195 * macro override instead of weak attribute alias, to workaround 196 * gcc 4.1.0 and 4.1.1 bugs with weak attribute and empty functions. 197 */ 198 #ifndef arch_task_cache_init 199 #define arch_task_cache_init() 200 #endif 201 202 void __init fork_init(unsigned long mempages) 203 { 204 #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR 205 #ifndef ARCH_MIN_TASKALIGN 206 #define ARCH_MIN_TASKALIGN L1_CACHE_BYTES 207 #endif 208 /* create a slab on which task_structs can be allocated */ 209 task_struct_cachep = 210 kmem_cache_create("task_struct", sizeof(struct task_struct), 211 ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL); 212 #endif 213 214 /* do the arch specific task caches init */ 215 arch_task_cache_init(); 216 217 /* 218 * The default maximum number of threads is set to a safe 219 * value: the thread structures can take up at most half 220 * of memory. 221 */ 222 max_threads = mempages / (8 * THREAD_SIZE / PAGE_SIZE); 223 224 /* 225 * we need to allow at least 20 threads to boot a system 226 */ 227 if(max_threads < 20) 228 max_threads = 20; 229 230 init_task.signal->rlim[RLIMIT_NPROC].rlim_cur = max_threads/2; 231 init_task.signal->rlim[RLIMIT_NPROC].rlim_max = max_threads/2; 232 init_task.signal->rlim[RLIMIT_SIGPENDING] = 233 init_task.signal->rlim[RLIMIT_NPROC]; 234 } 235 236 int __attribute__((weak)) arch_dup_task_struct(struct task_struct *dst, 237 struct task_struct *src) 238 { 239 *dst = *src; 240 return 0; 241 } 242 243 static struct task_struct *dup_task_struct(struct task_struct *orig) 244 { 245 struct task_struct *tsk; 246 struct thread_info *ti; 247 unsigned long *stackend; 248 249 int err; 250 251 prepare_to_copy(orig); 252 253 tsk = alloc_task_struct(); 254 if (!tsk) 255 return NULL; 256 257 ti = alloc_thread_info(tsk); 258 if (!ti) { 259 free_task_struct(tsk); 260 return NULL; 261 } 262 263 err = arch_dup_task_struct(tsk, orig); 264 if (err) 265 goto out; 266 267 tsk->stack = ti; 268 269 err = prop_local_init_single(&tsk->dirties); 270 if (err) 271 goto out; 272 273 setup_thread_stack(tsk, orig); 274 clear_user_return_notifier(tsk); 275 stackend = end_of_stack(tsk); 276 *stackend = STACK_END_MAGIC; /* for overflow detection */ 277 278 #ifdef CONFIG_CC_STACKPROTECTOR 279 tsk->stack_canary = get_random_int(); 280 #endif 281 282 /* One for us, one for whoever does the "release_task()" (usually parent) */ 283 atomic_set(&tsk->usage,2); 284 atomic_set(&tsk->fs_excl, 0); 285 #ifdef CONFIG_BLK_DEV_IO_TRACE 286 tsk->btrace_seq = 0; 287 #endif 288 tsk->splice_pipe = NULL; 289 290 account_kernel_stack(ti, 1); 291 292 return tsk; 293 294 out: 295 free_thread_info(ti); 296 free_task_struct(tsk); 297 return NULL; 298 } 299 300 #ifdef CONFIG_MMU 301 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) 302 { 303 struct vm_area_struct *mpnt, *tmp, *prev, **pprev; 304 struct rb_node **rb_link, *rb_parent; 305 int retval; 306 unsigned long charge; 307 struct mempolicy *pol; 308 309 down_write(&oldmm->mmap_sem); 310 flush_cache_dup_mm(oldmm); 311 /* 312 * Not linked in yet - no deadlock potential: 313 */ 314 down_write_nested(&mm->mmap_sem, SINGLE_DEPTH_NESTING); 315 316 mm->locked_vm = 0; 317 mm->mmap = NULL; 318 mm->mmap_cache = NULL; 319 mm->free_area_cache = oldmm->mmap_base; 320 mm->cached_hole_size = ~0UL; 321 mm->map_count = 0; 322 cpumask_clear(mm_cpumask(mm)); 323 mm->mm_rb = RB_ROOT; 324 rb_link = &mm->mm_rb.rb_node; 325 rb_parent = NULL; 326 pprev = &mm->mmap; 327 retval = ksm_fork(mm, oldmm); 328 if (retval) 329 goto out; 330 331 prev = NULL; 332 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) { 333 struct file *file; 334 335 if (mpnt->vm_flags & VM_DONTCOPY) { 336 long pages = vma_pages(mpnt); 337 mm->total_vm -= pages; 338 vm_stat_account(mm, mpnt->vm_flags, mpnt->vm_file, 339 -pages); 340 continue; 341 } 342 charge = 0; 343 if (mpnt->vm_flags & VM_ACCOUNT) { 344 unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; 345 if (security_vm_enough_memory(len)) 346 goto fail_nomem; 347 charge = len; 348 } 349 tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); 350 if (!tmp) 351 goto fail_nomem; 352 *tmp = *mpnt; 353 INIT_LIST_HEAD(&tmp->anon_vma_chain); 354 pol = mpol_dup(vma_policy(mpnt)); 355 retval = PTR_ERR(pol); 356 if (IS_ERR(pol)) 357 goto fail_nomem_policy; 358 vma_set_policy(tmp, pol); 359 tmp->vm_mm = mm; 360 if (anon_vma_fork(tmp, mpnt)) 361 goto fail_nomem_anon_vma_fork; 362 tmp->vm_flags &= ~VM_LOCKED; 363 tmp->vm_next = tmp->vm_prev = NULL; 364 file = tmp->vm_file; 365 if (file) { 366 struct inode *inode = file->f_path.dentry->d_inode; 367 struct address_space *mapping = file->f_mapping; 368 369 get_file(file); 370 if (tmp->vm_flags & VM_DENYWRITE) 371 atomic_dec(&inode->i_writecount); 372 spin_lock(&mapping->i_mmap_lock); 373 if (tmp->vm_flags & VM_SHARED) 374 mapping->i_mmap_writable++; 375 tmp->vm_truncate_count = mpnt->vm_truncate_count; 376 flush_dcache_mmap_lock(mapping); 377 /* insert tmp into the share list, just after mpnt */ 378 vma_prio_tree_add(tmp, mpnt); 379 flush_dcache_mmap_unlock(mapping); 380 spin_unlock(&mapping->i_mmap_lock); 381 } 382 383 /* 384 * Clear hugetlb-related page reserves for children. This only 385 * affects MAP_PRIVATE mappings. Faults generated by the child 386 * are not guaranteed to succeed, even if read-only 387 */ 388 if (is_vm_hugetlb_page(tmp)) 389 reset_vma_resv_huge_pages(tmp); 390 391 /* 392 * Link in the new vma and copy the page table entries. 393 */ 394 *pprev = tmp; 395 pprev = &tmp->vm_next; 396 tmp->vm_prev = prev; 397 prev = tmp; 398 399 __vma_link_rb(mm, tmp, rb_link, rb_parent); 400 rb_link = &tmp->vm_rb.rb_right; 401 rb_parent = &tmp->vm_rb; 402 403 mm->map_count++; 404 retval = copy_page_range(mm, oldmm, mpnt); 405 406 if (tmp->vm_ops && tmp->vm_ops->open) 407 tmp->vm_ops->open(tmp); 408 409 if (retval) 410 goto out; 411 } 412 /* a new mm has just been created */ 413 arch_dup_mmap(oldmm, mm); 414 retval = 0; 415 out: 416 up_write(&mm->mmap_sem); 417 flush_tlb_mm(oldmm); 418 up_write(&oldmm->mmap_sem); 419 return retval; 420 fail_nomem_anon_vma_fork: 421 mpol_put(pol); 422 fail_nomem_policy: 423 kmem_cache_free(vm_area_cachep, tmp); 424 fail_nomem: 425 retval = -ENOMEM; 426 vm_unacct_memory(charge); 427 goto out; 428 } 429 430 static inline int mm_alloc_pgd(struct mm_struct * mm) 431 { 432 mm->pgd = pgd_alloc(mm); 433 if (unlikely(!mm->pgd)) 434 return -ENOMEM; 435 return 0; 436 } 437 438 static inline void mm_free_pgd(struct mm_struct * mm) 439 { 440 pgd_free(mm, mm->pgd); 441 } 442 #else 443 #define dup_mmap(mm, oldmm) (0) 444 #define mm_alloc_pgd(mm) (0) 445 #define mm_free_pgd(mm) 446 #endif /* CONFIG_MMU */ 447 448 __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); 449 450 #define allocate_mm() (kmem_cache_alloc(mm_cachep, GFP_KERNEL)) 451 #define free_mm(mm) (kmem_cache_free(mm_cachep, (mm))) 452 453 static unsigned long default_dump_filter = MMF_DUMP_FILTER_DEFAULT; 454 455 static int __init coredump_filter_setup(char *s) 456 { 457 default_dump_filter = 458 (simple_strtoul(s, NULL, 0) << MMF_DUMP_FILTER_SHIFT) & 459 MMF_DUMP_FILTER_MASK; 460 return 1; 461 } 462 463 __setup("coredump_filter=", coredump_filter_setup); 464 465 #include <linux/init_task.h> 466 467 static void mm_init_aio(struct mm_struct *mm) 468 { 469 #ifdef CONFIG_AIO 470 spin_lock_init(&mm->ioctx_lock); 471 INIT_HLIST_HEAD(&mm->ioctx_list); 472 #endif 473 } 474 475 static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p) 476 { 477 atomic_set(&mm->mm_users, 1); 478 atomic_set(&mm->mm_count, 1); 479 init_rwsem(&mm->mmap_sem); 480 INIT_LIST_HEAD(&mm->mmlist); 481 mm->flags = (current->mm) ? 482 (current->mm->flags & MMF_INIT_MASK) : default_dump_filter; 483 mm->core_state = NULL; 484 mm->nr_ptes = 0; 485 memset(&mm->rss_stat, 0, sizeof(mm->rss_stat)); 486 spin_lock_init(&mm->page_table_lock); 487 mm->free_area_cache = TASK_UNMAPPED_BASE; 488 mm->cached_hole_size = ~0UL; 489 mm_init_aio(mm); 490 mm_init_owner(mm, p); 491 492 if (likely(!mm_alloc_pgd(mm))) { 493 mm->def_flags = 0; 494 mmu_notifier_mm_init(mm); 495 return mm; 496 } 497 498 free_mm(mm); 499 return NULL; 500 } 501 502 /* 503 * Allocate and initialize an mm_struct. 504 */ 505 struct mm_struct * mm_alloc(void) 506 { 507 struct mm_struct * mm; 508 509 mm = allocate_mm(); 510 if (mm) { 511 memset(mm, 0, sizeof(*mm)); 512 mm = mm_init(mm, current); 513 } 514 return mm; 515 } 516 517 /* 518 * Called when the last reference to the mm 519 * is dropped: either by a lazy thread or by 520 * mmput. Free the page directory and the mm. 521 */ 522 void __mmdrop(struct mm_struct *mm) 523 { 524 BUG_ON(mm == &init_mm); 525 mm_free_pgd(mm); 526 destroy_context(mm); 527 mmu_notifier_mm_destroy(mm); 528 free_mm(mm); 529 } 530 EXPORT_SYMBOL_GPL(__mmdrop); 531 532 /* 533 * Decrement the use count and release all resources for an mm. 534 */ 535 void mmput(struct mm_struct *mm) 536 { 537 might_sleep(); 538 539 if (atomic_dec_and_test(&mm->mm_users)) { 540 exit_aio(mm); 541 ksm_exit(mm); 542 exit_mmap(mm); 543 set_mm_exe_file(mm, NULL); 544 if (!list_empty(&mm->mmlist)) { 545 spin_lock(&mmlist_lock); 546 list_del(&mm->mmlist); 547 spin_unlock(&mmlist_lock); 548 } 549 put_swap_token(mm); 550 if (mm->binfmt) 551 module_put(mm->binfmt->module); 552 mmdrop(mm); 553 } 554 } 555 EXPORT_SYMBOL_GPL(mmput); 556 557 /** 558 * get_task_mm - acquire a reference to the task's mm 559 * 560 * Returns %NULL if the task has no mm. Checks PF_KTHREAD (meaning 561 * this kernel workthread has transiently adopted a user mm with use_mm, 562 * to do its AIO) is not set and if so returns a reference to it, after 563 * bumping up the use count. User must release the mm via mmput() 564 * after use. Typically used by /proc and ptrace. 565 */ 566 struct mm_struct *get_task_mm(struct task_struct *task) 567 { 568 struct mm_struct *mm; 569 570 task_lock(task); 571 mm = task->mm; 572 if (mm) { 573 if (task->flags & PF_KTHREAD) 574 mm = NULL; 575 else 576 atomic_inc(&mm->mm_users); 577 } 578 task_unlock(task); 579 return mm; 580 } 581 EXPORT_SYMBOL_GPL(get_task_mm); 582 583 /* Please note the differences between mmput and mm_release. 584 * mmput is called whenever we stop holding onto a mm_struct, 585 * error success whatever. 586 * 587 * mm_release is called after a mm_struct has been removed 588 * from the current process. 589 * 590 * This difference is important for error handling, when we 591 * only half set up a mm_struct for a new process and need to restore 592 * the old one. Because we mmput the new mm_struct before 593 * restoring the old one. . . 594 * Eric Biederman 10 January 1998 595 */ 596 void mm_release(struct task_struct *tsk, struct mm_struct *mm) 597 { 598 struct completion *vfork_done = tsk->vfork_done; 599 600 /* Get rid of any futexes when releasing the mm */ 601 #ifdef CONFIG_FUTEX 602 if (unlikely(tsk->robust_list)) { 603 exit_robust_list(tsk); 604 tsk->robust_list = NULL; 605 } 606 #ifdef CONFIG_COMPAT 607 if (unlikely(tsk->compat_robust_list)) { 608 compat_exit_robust_list(tsk); 609 tsk->compat_robust_list = NULL; 610 } 611 #endif 612 if (unlikely(!list_empty(&tsk->pi_state_list))) 613 exit_pi_state_list(tsk); 614 #endif 615 616 /* Get rid of any cached register state */ 617 deactivate_mm(tsk, mm); 618 619 /* notify parent sleeping on vfork() */ 620 if (vfork_done) { 621 tsk->vfork_done = NULL; 622 complete(vfork_done); 623 } 624 625 /* 626 * If we're exiting normally, clear a user-space tid field if 627 * requested. We leave this alone when dying by signal, to leave 628 * the value intact in a core dump, and to save the unnecessary 629 * trouble otherwise. Userland only wants this done for a sys_exit. 630 */ 631 if (tsk->clear_child_tid) { 632 if (!(tsk->flags & PF_SIGNALED) && 633 atomic_read(&mm->mm_users) > 1) { 634 /* 635 * We don't check the error code - if userspace has 636 * not set up a proper pointer then tough luck. 637 */ 638 put_user(0, tsk->clear_child_tid); 639 sys_futex(tsk->clear_child_tid, FUTEX_WAKE, 640 1, NULL, NULL, 0); 641 } 642 tsk->clear_child_tid = NULL; 643 } 644 } 645 646 /* 647 * Allocate a new mm structure and copy contents from the 648 * mm structure of the passed in task structure. 649 */ 650 struct mm_struct *dup_mm(struct task_struct *tsk) 651 { 652 struct mm_struct *mm, *oldmm = current->mm; 653 int err; 654 655 if (!oldmm) 656 return NULL; 657 658 mm = allocate_mm(); 659 if (!mm) 660 goto fail_nomem; 661 662 memcpy(mm, oldmm, sizeof(*mm)); 663 664 /* Initializing for Swap token stuff */ 665 mm->token_priority = 0; 666 mm->last_interval = 0; 667 668 if (!mm_init(mm, tsk)) 669 goto fail_nomem; 670 671 if (init_new_context(tsk, mm)) 672 goto fail_nocontext; 673 674 dup_mm_exe_file(oldmm, mm); 675 676 err = dup_mmap(mm, oldmm); 677 if (err) 678 goto free_pt; 679 680 mm->hiwater_rss = get_mm_rss(mm); 681 mm->hiwater_vm = mm->total_vm; 682 683 if (mm->binfmt && !try_module_get(mm->binfmt->module)) 684 goto free_pt; 685 686 return mm; 687 688 free_pt: 689 /* don't put binfmt in mmput, we haven't got module yet */ 690 mm->binfmt = NULL; 691 mmput(mm); 692 693 fail_nomem: 694 return NULL; 695 696 fail_nocontext: 697 /* 698 * If init_new_context() failed, we cannot use mmput() to free the mm 699 * because it calls destroy_context() 700 */ 701 mm_free_pgd(mm); 702 free_mm(mm); 703 return NULL; 704 } 705 706 static int copy_mm(unsigned long clone_flags, struct task_struct * tsk) 707 { 708 struct mm_struct * mm, *oldmm; 709 int retval; 710 711 tsk->min_flt = tsk->maj_flt = 0; 712 tsk->nvcsw = tsk->nivcsw = 0; 713 #ifdef CONFIG_DETECT_HUNG_TASK 714 tsk->last_switch_count = tsk->nvcsw + tsk->nivcsw; 715 #endif 716 717 tsk->mm = NULL; 718 tsk->active_mm = NULL; 719 720 /* 721 * Are we cloning a kernel thread? 722 * 723 * We need to steal a active VM for that.. 724 */ 725 oldmm = current->mm; 726 if (!oldmm) 727 return 0; 728 729 if (clone_flags & CLONE_VM) { 730 atomic_inc(&oldmm->mm_users); 731 mm = oldmm; 732 goto good_mm; 733 } 734 735 retval = -ENOMEM; 736 mm = dup_mm(tsk); 737 if (!mm) 738 goto fail_nomem; 739 740 good_mm: 741 /* Initializing for Swap token stuff */ 742 mm->token_priority = 0; 743 mm->last_interval = 0; 744 745 tsk->mm = mm; 746 tsk->active_mm = mm; 747 return 0; 748 749 fail_nomem: 750 return retval; 751 } 752 753 static int copy_fs(unsigned long clone_flags, struct task_struct *tsk) 754 { 755 struct fs_struct *fs = current->fs; 756 if (clone_flags & CLONE_FS) { 757 /* tsk->fs is already what we want */ 758 spin_lock(&fs->lock); 759 if (fs->in_exec) { 760 spin_unlock(&fs->lock); 761 return -EAGAIN; 762 } 763 fs->users++; 764 spin_unlock(&fs->lock); 765 return 0; 766 } 767 tsk->fs = copy_fs_struct(fs); 768 if (!tsk->fs) 769 return -ENOMEM; 770 return 0; 771 } 772 773 static int copy_files(unsigned long clone_flags, struct task_struct * tsk) 774 { 775 struct files_struct *oldf, *newf; 776 int error = 0; 777 778 /* 779 * A background process may not have any files ... 780 */ 781 oldf = current->files; 782 if (!oldf) 783 goto out; 784 785 if (clone_flags & CLONE_FILES) { 786 atomic_inc(&oldf->count); 787 goto out; 788 } 789 790 newf = dup_fd(oldf, &error); 791 if (!newf) 792 goto out; 793 794 tsk->files = newf; 795 error = 0; 796 out: 797 return error; 798 } 799 800 static int copy_io(unsigned long clone_flags, struct task_struct *tsk) 801 { 802 #ifdef CONFIG_BLOCK 803 struct io_context *ioc = current->io_context; 804 805 if (!ioc) 806 return 0; 807 /* 808 * Share io context with parent, if CLONE_IO is set 809 */ 810 if (clone_flags & CLONE_IO) { 811 tsk->io_context = ioc_task_link(ioc); 812 if (unlikely(!tsk->io_context)) 813 return -ENOMEM; 814 } else if (ioprio_valid(ioc->ioprio)) { 815 tsk->io_context = alloc_io_context(GFP_KERNEL, -1); 816 if (unlikely(!tsk->io_context)) 817 return -ENOMEM; 818 819 tsk->io_context->ioprio = ioc->ioprio; 820 } 821 #endif 822 return 0; 823 } 824 825 static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk) 826 { 827 struct sighand_struct *sig; 828 829 if (clone_flags & CLONE_SIGHAND) { 830 atomic_inc(¤t->sighand->count); 831 return 0; 832 } 833 sig = kmem_cache_alloc(sighand_cachep, GFP_KERNEL); 834 rcu_assign_pointer(tsk->sighand, sig); 835 if (!sig) 836 return -ENOMEM; 837 atomic_set(&sig->count, 1); 838 memcpy(sig->action, current->sighand->action, sizeof(sig->action)); 839 return 0; 840 } 841 842 void __cleanup_sighand(struct sighand_struct *sighand) 843 { 844 if (atomic_dec_and_test(&sighand->count)) 845 kmem_cache_free(sighand_cachep, sighand); 846 } 847 848 849 /* 850 * Initialize POSIX timer handling for a thread group. 851 */ 852 static void posix_cpu_timers_init_group(struct signal_struct *sig) 853 { 854 unsigned long cpu_limit; 855 856 /* Thread group counters. */ 857 thread_group_cputime_init(sig); 858 859 cpu_limit = ACCESS_ONCE(sig->rlim[RLIMIT_CPU].rlim_cur); 860 if (cpu_limit != RLIM_INFINITY) { 861 sig->cputime_expires.prof_exp = secs_to_cputime(cpu_limit); 862 sig->cputimer.running = 1; 863 } 864 865 /* The timer lists. */ 866 INIT_LIST_HEAD(&sig->cpu_timers[0]); 867 INIT_LIST_HEAD(&sig->cpu_timers[1]); 868 INIT_LIST_HEAD(&sig->cpu_timers[2]); 869 } 870 871 static int copy_signal(unsigned long clone_flags, struct task_struct *tsk) 872 { 873 struct signal_struct *sig; 874 875 if (clone_flags & CLONE_THREAD) 876 return 0; 877 878 sig = kmem_cache_zalloc(signal_cachep, GFP_KERNEL); 879 tsk->signal = sig; 880 if (!sig) 881 return -ENOMEM; 882 883 sig->nr_threads = 1; 884 atomic_set(&sig->live, 1); 885 atomic_set(&sig->sigcnt, 1); 886 init_waitqueue_head(&sig->wait_chldexit); 887 if (clone_flags & CLONE_NEWPID) 888 sig->flags |= SIGNAL_UNKILLABLE; 889 sig->curr_target = tsk; 890 init_sigpending(&sig->shared_pending); 891 INIT_LIST_HEAD(&sig->posix_timers); 892 893 hrtimer_init(&sig->real_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); 894 sig->real_timer.function = it_real_fn; 895 896 task_lock(current->group_leader); 897 memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim); 898 task_unlock(current->group_leader); 899 900 posix_cpu_timers_init_group(sig); 901 902 tty_audit_fork(sig); 903 904 sig->oom_adj = current->signal->oom_adj; 905 sig->oom_score_adj = current->signal->oom_score_adj; 906 907 return 0; 908 } 909 910 static void copy_flags(unsigned long clone_flags, struct task_struct *p) 911 { 912 unsigned long new_flags = p->flags; 913 914 new_flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER); 915 new_flags |= PF_FORKNOEXEC; 916 new_flags |= PF_STARTING; 917 p->flags = new_flags; 918 clear_freeze_flag(p); 919 } 920 921 SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr) 922 { 923 current->clear_child_tid = tidptr; 924 925 return task_pid_vnr(current); 926 } 927 928 static void rt_mutex_init_task(struct task_struct *p) 929 { 930 raw_spin_lock_init(&p->pi_lock); 931 #ifdef CONFIG_RT_MUTEXES 932 plist_head_init_raw(&p->pi_waiters, &p->pi_lock); 933 p->pi_blocked_on = NULL; 934 #endif 935 } 936 937 #ifdef CONFIG_MM_OWNER 938 void mm_init_owner(struct mm_struct *mm, struct task_struct *p) 939 { 940 mm->owner = p; 941 } 942 #endif /* CONFIG_MM_OWNER */ 943 944 /* 945 * Initialize POSIX timer handling for a single task. 946 */ 947 static void posix_cpu_timers_init(struct task_struct *tsk) 948 { 949 tsk->cputime_expires.prof_exp = cputime_zero; 950 tsk->cputime_expires.virt_exp = cputime_zero; 951 tsk->cputime_expires.sched_exp = 0; 952 INIT_LIST_HEAD(&tsk->cpu_timers[0]); 953 INIT_LIST_HEAD(&tsk->cpu_timers[1]); 954 INIT_LIST_HEAD(&tsk->cpu_timers[2]); 955 } 956 957 /* 958 * This creates a new process as a copy of the old one, 959 * but does not actually start it yet. 960 * 961 * It copies the registers, and all the appropriate 962 * parts of the process environment (as per the clone 963 * flags). The actual kick-off is left to the caller. 964 */ 965 static struct task_struct *copy_process(unsigned long clone_flags, 966 unsigned long stack_start, 967 struct pt_regs *regs, 968 unsigned long stack_size, 969 int __user *child_tidptr, 970 struct pid *pid, 971 int trace) 972 { 973 int retval; 974 struct task_struct *p; 975 int cgroup_callbacks_done = 0; 976 977 if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS)) 978 return ERR_PTR(-EINVAL); 979 980 /* 981 * Thread groups must share signals as well, and detached threads 982 * can only be started up within the thread group. 983 */ 984 if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND)) 985 return ERR_PTR(-EINVAL); 986 987 /* 988 * Shared signal handlers imply shared VM. By way of the above, 989 * thread groups also imply shared VM. Blocking this case allows 990 * for various simplifications in other code. 991 */ 992 if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM)) 993 return ERR_PTR(-EINVAL); 994 995 /* 996 * Siblings of global init remain as zombies on exit since they are 997 * not reaped by their parent (swapper). To solve this and to avoid 998 * multi-rooted process trees, prevent global and container-inits 999 * from creating siblings. 1000 */ 1001 if ((clone_flags & CLONE_PARENT) && 1002 current->signal->flags & SIGNAL_UNKILLABLE) 1003 return ERR_PTR(-EINVAL); 1004 1005 retval = security_task_create(clone_flags); 1006 if (retval) 1007 goto fork_out; 1008 1009 retval = -ENOMEM; 1010 p = dup_task_struct(current); 1011 if (!p) 1012 goto fork_out; 1013 1014 ftrace_graph_init_task(p); 1015 1016 rt_mutex_init_task(p); 1017 1018 #ifdef CONFIG_PROVE_LOCKING 1019 DEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled); 1020 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled); 1021 #endif 1022 retval = -EAGAIN; 1023 if (atomic_read(&p->real_cred->user->processes) >= 1024 task_rlimit(p, RLIMIT_NPROC)) { 1025 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && 1026 p->real_cred->user != INIT_USER) 1027 goto bad_fork_free; 1028 } 1029 1030 retval = copy_creds(p, clone_flags); 1031 if (retval < 0) 1032 goto bad_fork_free; 1033 1034 /* 1035 * If multiple threads are within copy_process(), then this check 1036 * triggers too late. This doesn't hurt, the check is only there 1037 * to stop root fork bombs. 1038 */ 1039 retval = -EAGAIN; 1040 if (nr_threads >= max_threads) 1041 goto bad_fork_cleanup_count; 1042 1043 if (!try_module_get(task_thread_info(p)->exec_domain->module)) 1044 goto bad_fork_cleanup_count; 1045 1046 p->did_exec = 0; 1047 delayacct_tsk_init(p); /* Must remain after dup_task_struct() */ 1048 copy_flags(clone_flags, p); 1049 INIT_LIST_HEAD(&p->children); 1050 INIT_LIST_HEAD(&p->sibling); 1051 rcu_copy_process(p); 1052 p->vfork_done = NULL; 1053 spin_lock_init(&p->alloc_lock); 1054 1055 init_sigpending(&p->pending); 1056 1057 p->utime = cputime_zero; 1058 p->stime = cputime_zero; 1059 p->gtime = cputime_zero; 1060 p->utimescaled = cputime_zero; 1061 p->stimescaled = cputime_zero; 1062 #ifndef CONFIG_VIRT_CPU_ACCOUNTING 1063 p->prev_utime = cputime_zero; 1064 p->prev_stime = cputime_zero; 1065 #endif 1066 #if defined(SPLIT_RSS_COUNTING) 1067 memset(&p->rss_stat, 0, sizeof(p->rss_stat)); 1068 #endif 1069 1070 p->default_timer_slack_ns = current->timer_slack_ns; 1071 1072 task_io_accounting_init(&p->ioac); 1073 acct_clear_integrals(p); 1074 1075 posix_cpu_timers_init(p); 1076 1077 p->lock_depth = -1; /* -1 = no lock */ 1078 do_posix_clock_monotonic_gettime(&p->start_time); 1079 p->real_start_time = p->start_time; 1080 monotonic_to_bootbased(&p->real_start_time); 1081 p->io_context = NULL; 1082 p->audit_context = NULL; 1083 cgroup_fork(p); 1084 #ifdef CONFIG_NUMA 1085 p->mempolicy = mpol_dup(p->mempolicy); 1086 if (IS_ERR(p->mempolicy)) { 1087 retval = PTR_ERR(p->mempolicy); 1088 p->mempolicy = NULL; 1089 goto bad_fork_cleanup_cgroup; 1090 } 1091 mpol_fix_fork_child_flag(p); 1092 #endif 1093 #ifdef CONFIG_TRACE_IRQFLAGS 1094 p->irq_events = 0; 1095 #ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW 1096 p->hardirqs_enabled = 1; 1097 #else 1098 p->hardirqs_enabled = 0; 1099 #endif 1100 p->hardirq_enable_ip = 0; 1101 p->hardirq_enable_event = 0; 1102 p->hardirq_disable_ip = _THIS_IP_; 1103 p->hardirq_disable_event = 0; 1104 p->softirqs_enabled = 1; 1105 p->softirq_enable_ip = _THIS_IP_; 1106 p->softirq_enable_event = 0; 1107 p->softirq_disable_ip = 0; 1108 p->softirq_disable_event = 0; 1109 p->hardirq_context = 0; 1110 p->softirq_context = 0; 1111 #endif 1112 #ifdef CONFIG_LOCKDEP 1113 p->lockdep_depth = 0; /* no locks held yet */ 1114 p->curr_chain_key = 0; 1115 p->lockdep_recursion = 0; 1116 #endif 1117 1118 #ifdef CONFIG_DEBUG_MUTEXES 1119 p->blocked_on = NULL; /* not blocked yet */ 1120 #endif 1121 #ifdef CONFIG_CGROUP_MEM_RES_CTLR 1122 p->memcg_batch.do_batch = 0; 1123 p->memcg_batch.memcg = NULL; 1124 #endif 1125 1126 /* Perform scheduler related setup. Assign this task to a CPU. */ 1127 sched_fork(p, clone_flags); 1128 1129 retval = perf_event_init_task(p); 1130 if (retval) 1131 goto bad_fork_cleanup_policy; 1132 1133 if ((retval = audit_alloc(p))) 1134 goto bad_fork_cleanup_policy; 1135 /* copy all the process information */ 1136 if ((retval = copy_semundo(clone_flags, p))) 1137 goto bad_fork_cleanup_audit; 1138 if ((retval = copy_files(clone_flags, p))) 1139 goto bad_fork_cleanup_semundo; 1140 if ((retval = copy_fs(clone_flags, p))) 1141 goto bad_fork_cleanup_files; 1142 if ((retval = copy_sighand(clone_flags, p))) 1143 goto bad_fork_cleanup_fs; 1144 if ((retval = copy_signal(clone_flags, p))) 1145 goto bad_fork_cleanup_sighand; 1146 if ((retval = copy_mm(clone_flags, p))) 1147 goto bad_fork_cleanup_signal; 1148 if ((retval = copy_namespaces(clone_flags, p))) 1149 goto bad_fork_cleanup_mm; 1150 if ((retval = copy_io(clone_flags, p))) 1151 goto bad_fork_cleanup_namespaces; 1152 retval = copy_thread(clone_flags, stack_start, stack_size, p, regs); 1153 if (retval) 1154 goto bad_fork_cleanup_io; 1155 1156 if (pid != &init_struct_pid) { 1157 retval = -ENOMEM; 1158 pid = alloc_pid(p->nsproxy->pid_ns); 1159 if (!pid) 1160 goto bad_fork_cleanup_io; 1161 1162 if (clone_flags & CLONE_NEWPID) { 1163 retval = pid_ns_prepare_proc(p->nsproxy->pid_ns); 1164 if (retval < 0) 1165 goto bad_fork_free_pid; 1166 } 1167 } 1168 1169 p->pid = pid_nr(pid); 1170 p->tgid = p->pid; 1171 if (clone_flags & CLONE_THREAD) 1172 p->tgid = current->tgid; 1173 1174 if (current->nsproxy != p->nsproxy) { 1175 retval = ns_cgroup_clone(p, pid); 1176 if (retval) 1177 goto bad_fork_free_pid; 1178 } 1179 1180 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; 1181 /* 1182 * Clear TID on mm_release()? 1183 */ 1184 p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr: NULL; 1185 #ifdef CONFIG_FUTEX 1186 p->robust_list = NULL; 1187 #ifdef CONFIG_COMPAT 1188 p->compat_robust_list = NULL; 1189 #endif 1190 INIT_LIST_HEAD(&p->pi_state_list); 1191 p->pi_state_cache = NULL; 1192 #endif 1193 /* 1194 * sigaltstack should be cleared when sharing the same VM 1195 */ 1196 if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM) 1197 p->sas_ss_sp = p->sas_ss_size = 0; 1198 1199 /* 1200 * Syscall tracing and stepping should be turned off in the 1201 * child regardless of CLONE_PTRACE. 1202 */ 1203 user_disable_single_step(p); 1204 clear_tsk_thread_flag(p, TIF_SYSCALL_TRACE); 1205 #ifdef TIF_SYSCALL_EMU 1206 clear_tsk_thread_flag(p, TIF_SYSCALL_EMU); 1207 #endif 1208 clear_all_latency_tracing(p); 1209 1210 /* ok, now we should be set up.. */ 1211 p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL); 1212 p->pdeath_signal = 0; 1213 p->exit_state = 0; 1214 1215 /* 1216 * Ok, make it visible to the rest of the system. 1217 * We dont wake it up yet. 1218 */ 1219 p->group_leader = p; 1220 INIT_LIST_HEAD(&p->thread_group); 1221 1222 /* Now that the task is set up, run cgroup callbacks if 1223 * necessary. We need to run them before the task is visible 1224 * on the tasklist. */ 1225 cgroup_fork_callbacks(p); 1226 cgroup_callbacks_done = 1; 1227 1228 /* Need tasklist lock for parent etc handling! */ 1229 write_lock_irq(&tasklist_lock); 1230 1231 /* CLONE_PARENT re-uses the old parent */ 1232 if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { 1233 p->real_parent = current->real_parent; 1234 p->parent_exec_id = current->parent_exec_id; 1235 } else { 1236 p->real_parent = current; 1237 p->parent_exec_id = current->self_exec_id; 1238 } 1239 1240 spin_lock(¤t->sighand->siglock); 1241 1242 /* 1243 * Process group and session signals need to be delivered to just the 1244 * parent before the fork or both the parent and the child after the 1245 * fork. Restart if a signal comes in before we add the new process to 1246 * it's process group. 1247 * A fatal signal pending means that current will exit, so the new 1248 * thread can't slip out of an OOM kill (or normal SIGKILL). 1249 */ 1250 recalc_sigpending(); 1251 if (signal_pending(current)) { 1252 spin_unlock(¤t->sighand->siglock); 1253 write_unlock_irq(&tasklist_lock); 1254 retval = -ERESTARTNOINTR; 1255 goto bad_fork_free_pid; 1256 } 1257 1258 if (clone_flags & CLONE_THREAD) { 1259 current->signal->nr_threads++; 1260 atomic_inc(¤t->signal->live); 1261 atomic_inc(¤t->signal->sigcnt); 1262 p->group_leader = current->group_leader; 1263 list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group); 1264 } 1265 1266 if (likely(p->pid)) { 1267 tracehook_finish_clone(p, clone_flags, trace); 1268 1269 if (thread_group_leader(p)) { 1270 if (clone_flags & CLONE_NEWPID) 1271 p->nsproxy->pid_ns->child_reaper = p; 1272 1273 p->signal->leader_pid = pid; 1274 p->signal->tty = tty_kref_get(current->signal->tty); 1275 attach_pid(p, PIDTYPE_PGID, task_pgrp(current)); 1276 attach_pid(p, PIDTYPE_SID, task_session(current)); 1277 list_add_tail(&p->sibling, &p->real_parent->children); 1278 list_add_tail_rcu(&p->tasks, &init_task.tasks); 1279 __get_cpu_var(process_counts)++; 1280 } 1281 attach_pid(p, PIDTYPE_PID, pid); 1282 nr_threads++; 1283 } 1284 1285 total_forks++; 1286 spin_unlock(¤t->sighand->siglock); 1287 write_unlock_irq(&tasklist_lock); 1288 proc_fork_connector(p); 1289 cgroup_post_fork(p); 1290 perf_event_fork(p); 1291 return p; 1292 1293 bad_fork_free_pid: 1294 if (pid != &init_struct_pid) 1295 free_pid(pid); 1296 bad_fork_cleanup_io: 1297 if (p->io_context) 1298 exit_io_context(p); 1299 bad_fork_cleanup_namespaces: 1300 exit_task_namespaces(p); 1301 bad_fork_cleanup_mm: 1302 if (p->mm) 1303 mmput(p->mm); 1304 bad_fork_cleanup_signal: 1305 if (!(clone_flags & CLONE_THREAD)) 1306 free_signal_struct(p->signal); 1307 bad_fork_cleanup_sighand: 1308 __cleanup_sighand(p->sighand); 1309 bad_fork_cleanup_fs: 1310 exit_fs(p); /* blocking */ 1311 bad_fork_cleanup_files: 1312 exit_files(p); /* blocking */ 1313 bad_fork_cleanup_semundo: 1314 exit_sem(p); 1315 bad_fork_cleanup_audit: 1316 audit_free(p); 1317 bad_fork_cleanup_policy: 1318 perf_event_free_task(p); 1319 #ifdef CONFIG_NUMA 1320 mpol_put(p->mempolicy); 1321 bad_fork_cleanup_cgroup: 1322 #endif 1323 cgroup_exit(p, cgroup_callbacks_done); 1324 delayacct_tsk_free(p); 1325 module_put(task_thread_info(p)->exec_domain->module); 1326 bad_fork_cleanup_count: 1327 atomic_dec(&p->cred->user->processes); 1328 exit_creds(p); 1329 bad_fork_free: 1330 free_task(p); 1331 fork_out: 1332 return ERR_PTR(retval); 1333 } 1334 1335 noinline struct pt_regs * __cpuinit __attribute__((weak)) idle_regs(struct pt_regs *regs) 1336 { 1337 memset(regs, 0, sizeof(struct pt_regs)); 1338 return regs; 1339 } 1340 1341 static inline void init_idle_pids(struct pid_link *links) 1342 { 1343 enum pid_type type; 1344 1345 for (type = PIDTYPE_PID; type < PIDTYPE_MAX; ++type) { 1346 INIT_HLIST_NODE(&links[type].node); /* not really needed */ 1347 links[type].pid = &init_struct_pid; 1348 } 1349 } 1350 1351 struct task_struct * __cpuinit fork_idle(int cpu) 1352 { 1353 struct task_struct *task; 1354 struct pt_regs regs; 1355 1356 task = copy_process(CLONE_VM, 0, idle_regs(®s), 0, NULL, 1357 &init_struct_pid, 0); 1358 if (!IS_ERR(task)) { 1359 init_idle_pids(task->pids); 1360 init_idle(task, cpu); 1361 } 1362 1363 return task; 1364 } 1365 1366 /* 1367 * Ok, this is the main fork-routine. 1368 * 1369 * It copies the process, and if successful kick-starts 1370 * it and waits for it to finish using the VM if required. 1371 */ 1372 long do_fork(unsigned long clone_flags, 1373 unsigned long stack_start, 1374 struct pt_regs *regs, 1375 unsigned long stack_size, 1376 int __user *parent_tidptr, 1377 int __user *child_tidptr) 1378 { 1379 struct task_struct *p; 1380 int trace = 0; 1381 long nr; 1382 1383 /* 1384 * Do some preliminary argument and permissions checking before we 1385 * actually start allocating stuff 1386 */ 1387 if (clone_flags & CLONE_NEWUSER) { 1388 if (clone_flags & CLONE_THREAD) 1389 return -EINVAL; 1390 /* hopefully this check will go away when userns support is 1391 * complete 1392 */ 1393 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SETUID) || 1394 !capable(CAP_SETGID)) 1395 return -EPERM; 1396 } 1397 1398 /* 1399 * We hope to recycle these flags after 2.6.26 1400 */ 1401 if (unlikely(clone_flags & CLONE_STOPPED)) { 1402 static int __read_mostly count = 100; 1403 1404 if (count > 0 && printk_ratelimit()) { 1405 char comm[TASK_COMM_LEN]; 1406 1407 count--; 1408 printk(KERN_INFO "fork(): process `%s' used deprecated " 1409 "clone flags 0x%lx\n", 1410 get_task_comm(comm, current), 1411 clone_flags & CLONE_STOPPED); 1412 } 1413 } 1414 1415 /* 1416 * When called from kernel_thread, don't do user tracing stuff. 1417 */ 1418 if (likely(user_mode(regs))) 1419 trace = tracehook_prepare_clone(clone_flags); 1420 1421 p = copy_process(clone_flags, stack_start, regs, stack_size, 1422 child_tidptr, NULL, trace); 1423 /* 1424 * Do this prior waking up the new thread - the thread pointer 1425 * might get invalid after that point, if the thread exits quickly. 1426 */ 1427 if (!IS_ERR(p)) { 1428 struct completion vfork; 1429 1430 trace_sched_process_fork(current, p); 1431 1432 nr = task_pid_vnr(p); 1433 1434 if (clone_flags & CLONE_PARENT_SETTID) 1435 put_user(nr, parent_tidptr); 1436 1437 if (clone_flags & CLONE_VFORK) { 1438 p->vfork_done = &vfork; 1439 init_completion(&vfork); 1440 } 1441 1442 audit_finish_fork(p); 1443 tracehook_report_clone(regs, clone_flags, nr, p); 1444 1445 /* 1446 * We set PF_STARTING at creation in case tracing wants to 1447 * use this to distinguish a fully live task from one that 1448 * hasn't gotten to tracehook_report_clone() yet. Now we 1449 * clear it and set the child going. 1450 */ 1451 p->flags &= ~PF_STARTING; 1452 1453 if (unlikely(clone_flags & CLONE_STOPPED)) { 1454 /* 1455 * We'll start up with an immediate SIGSTOP. 1456 */ 1457 sigaddset(&p->pending.signal, SIGSTOP); 1458 set_tsk_thread_flag(p, TIF_SIGPENDING); 1459 __set_task_state(p, TASK_STOPPED); 1460 } else { 1461 wake_up_new_task(p, clone_flags); 1462 } 1463 1464 tracehook_report_clone_complete(trace, regs, 1465 clone_flags, nr, p); 1466 1467 if (clone_flags & CLONE_VFORK) { 1468 freezer_do_not_count(); 1469 wait_for_completion(&vfork); 1470 freezer_count(); 1471 tracehook_report_vfork_done(p, nr); 1472 } 1473 } else { 1474 nr = PTR_ERR(p); 1475 } 1476 return nr; 1477 } 1478 1479 #ifndef ARCH_MIN_MMSTRUCT_ALIGN 1480 #define ARCH_MIN_MMSTRUCT_ALIGN 0 1481 #endif 1482 1483 static void sighand_ctor(void *data) 1484 { 1485 struct sighand_struct *sighand = data; 1486 1487 spin_lock_init(&sighand->siglock); 1488 init_waitqueue_head(&sighand->signalfd_wqh); 1489 } 1490 1491 void __init proc_caches_init(void) 1492 { 1493 sighand_cachep = kmem_cache_create("sighand_cache", 1494 sizeof(struct sighand_struct), 0, 1495 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_DESTROY_BY_RCU| 1496 SLAB_NOTRACK, sighand_ctor); 1497 signal_cachep = kmem_cache_create("signal_cache", 1498 sizeof(struct signal_struct), 0, 1499 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL); 1500 files_cachep = kmem_cache_create("files_cache", 1501 sizeof(struct files_struct), 0, 1502 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL); 1503 fs_cachep = kmem_cache_create("fs_cache", 1504 sizeof(struct fs_struct), 0, 1505 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL); 1506 mm_cachep = kmem_cache_create("mm_struct", 1507 sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN, 1508 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL); 1509 vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC); 1510 mmap_init(); 1511 } 1512 1513 /* 1514 * Check constraints on flags passed to the unshare system call and 1515 * force unsharing of additional process context as appropriate. 1516 */ 1517 static void check_unshare_flags(unsigned long *flags_ptr) 1518 { 1519 /* 1520 * If unsharing a thread from a thread group, must also 1521 * unshare vm. 1522 */ 1523 if (*flags_ptr & CLONE_THREAD) 1524 *flags_ptr |= CLONE_VM; 1525 1526 /* 1527 * If unsharing vm, must also unshare signal handlers. 1528 */ 1529 if (*flags_ptr & CLONE_VM) 1530 *flags_ptr |= CLONE_SIGHAND; 1531 1532 /* 1533 * If unsharing namespace, must also unshare filesystem information. 1534 */ 1535 if (*flags_ptr & CLONE_NEWNS) 1536 *flags_ptr |= CLONE_FS; 1537 } 1538 1539 /* 1540 * Unsharing of tasks created with CLONE_THREAD is not supported yet 1541 */ 1542 static int unshare_thread(unsigned long unshare_flags) 1543 { 1544 if (unshare_flags & CLONE_THREAD) 1545 return -EINVAL; 1546 1547 return 0; 1548 } 1549 1550 /* 1551 * Unshare the filesystem structure if it is being shared 1552 */ 1553 static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) 1554 { 1555 struct fs_struct *fs = current->fs; 1556 1557 if (!(unshare_flags & CLONE_FS) || !fs) 1558 return 0; 1559 1560 /* don't need lock here; in the worst case we'll do useless copy */ 1561 if (fs->users == 1) 1562 return 0; 1563 1564 *new_fsp = copy_fs_struct(fs); 1565 if (!*new_fsp) 1566 return -ENOMEM; 1567 1568 return 0; 1569 } 1570 1571 /* 1572 * Unsharing of sighand is not supported yet 1573 */ 1574 static int unshare_sighand(unsigned long unshare_flags, struct sighand_struct **new_sighp) 1575 { 1576 struct sighand_struct *sigh = current->sighand; 1577 1578 if ((unshare_flags & CLONE_SIGHAND) && atomic_read(&sigh->count) > 1) 1579 return -EINVAL; 1580 else 1581 return 0; 1582 } 1583 1584 /* 1585 * Unshare vm if it is being shared 1586 */ 1587 static int unshare_vm(unsigned long unshare_flags, struct mm_struct **new_mmp) 1588 { 1589 struct mm_struct *mm = current->mm; 1590 1591 if ((unshare_flags & CLONE_VM) && 1592 (mm && atomic_read(&mm->mm_users) > 1)) { 1593 return -EINVAL; 1594 } 1595 1596 return 0; 1597 } 1598 1599 /* 1600 * Unshare file descriptor table if it is being shared 1601 */ 1602 static int unshare_fd(unsigned long unshare_flags, struct files_struct **new_fdp) 1603 { 1604 struct files_struct *fd = current->files; 1605 int error = 0; 1606 1607 if ((unshare_flags & CLONE_FILES) && 1608 (fd && atomic_read(&fd->count) > 1)) { 1609 *new_fdp = dup_fd(fd, &error); 1610 if (!*new_fdp) 1611 return error; 1612 } 1613 1614 return 0; 1615 } 1616 1617 /* 1618 * unshare allows a process to 'unshare' part of the process 1619 * context which was originally shared using clone. copy_* 1620 * functions used by do_fork() cannot be used here directly 1621 * because they modify an inactive task_struct that is being 1622 * constructed. Here we are modifying the current, active, 1623 * task_struct. 1624 */ 1625 SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) 1626 { 1627 int err = 0; 1628 struct fs_struct *fs, *new_fs = NULL; 1629 struct sighand_struct *new_sigh = NULL; 1630 struct mm_struct *mm, *new_mm = NULL, *active_mm = NULL; 1631 struct files_struct *fd, *new_fd = NULL; 1632 struct nsproxy *new_nsproxy = NULL; 1633 int do_sysvsem = 0; 1634 1635 check_unshare_flags(&unshare_flags); 1636 1637 /* Return -EINVAL for all unsupported flags */ 1638 err = -EINVAL; 1639 if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND| 1640 CLONE_VM|CLONE_FILES|CLONE_SYSVSEM| 1641 CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET)) 1642 goto bad_unshare_out; 1643 1644 /* 1645 * CLONE_NEWIPC must also detach from the undolist: after switching 1646 * to a new ipc namespace, the semaphore arrays from the old 1647 * namespace are unreachable. 1648 */ 1649 if (unshare_flags & (CLONE_NEWIPC|CLONE_SYSVSEM)) 1650 do_sysvsem = 1; 1651 if ((err = unshare_thread(unshare_flags))) 1652 goto bad_unshare_out; 1653 if ((err = unshare_fs(unshare_flags, &new_fs))) 1654 goto bad_unshare_cleanup_thread; 1655 if ((err = unshare_sighand(unshare_flags, &new_sigh))) 1656 goto bad_unshare_cleanup_fs; 1657 if ((err = unshare_vm(unshare_flags, &new_mm))) 1658 goto bad_unshare_cleanup_sigh; 1659 if ((err = unshare_fd(unshare_flags, &new_fd))) 1660 goto bad_unshare_cleanup_vm; 1661 if ((err = unshare_nsproxy_namespaces(unshare_flags, &new_nsproxy, 1662 new_fs))) 1663 goto bad_unshare_cleanup_fd; 1664 1665 if (new_fs || new_mm || new_fd || do_sysvsem || new_nsproxy) { 1666 if (do_sysvsem) { 1667 /* 1668 * CLONE_SYSVSEM is equivalent to sys_exit(). 1669 */ 1670 exit_sem(current); 1671 } 1672 1673 if (new_nsproxy) { 1674 switch_task_namespaces(current, new_nsproxy); 1675 new_nsproxy = NULL; 1676 } 1677 1678 task_lock(current); 1679 1680 if (new_fs) { 1681 fs = current->fs; 1682 spin_lock(&fs->lock); 1683 current->fs = new_fs; 1684 if (--fs->users) 1685 new_fs = NULL; 1686 else 1687 new_fs = fs; 1688 spin_unlock(&fs->lock); 1689 } 1690 1691 if (new_mm) { 1692 mm = current->mm; 1693 active_mm = current->active_mm; 1694 current->mm = new_mm; 1695 current->active_mm = new_mm; 1696 activate_mm(active_mm, new_mm); 1697 new_mm = mm; 1698 } 1699 1700 if (new_fd) { 1701 fd = current->files; 1702 current->files = new_fd; 1703 new_fd = fd; 1704 } 1705 1706 task_unlock(current); 1707 } 1708 1709 if (new_nsproxy) 1710 put_nsproxy(new_nsproxy); 1711 1712 bad_unshare_cleanup_fd: 1713 if (new_fd) 1714 put_files_struct(new_fd); 1715 1716 bad_unshare_cleanup_vm: 1717 if (new_mm) 1718 mmput(new_mm); 1719 1720 bad_unshare_cleanup_sigh: 1721 if (new_sigh) 1722 if (atomic_dec_and_test(&new_sigh->count)) 1723 kmem_cache_free(sighand_cachep, new_sigh); 1724 1725 bad_unshare_cleanup_fs: 1726 if (new_fs) 1727 free_fs_struct(new_fs); 1728 1729 bad_unshare_cleanup_thread: 1730 bad_unshare_out: 1731 return err; 1732 } 1733 1734 /* 1735 * Helper to unshare the files of the current task. 1736 * We don't want to expose copy_files internals to 1737 * the exec layer of the kernel. 1738 */ 1739 1740 int unshare_files(struct files_struct **displaced) 1741 { 1742 struct task_struct *task = current; 1743 struct files_struct *copy = NULL; 1744 int error; 1745 1746 error = unshare_fd(CLONE_FILES, ©); 1747 if (error || !copy) { 1748 *displaced = NULL; 1749 return error; 1750 } 1751 *displaced = task->files; 1752 task_lock(task); 1753 task->files = copy; 1754 task_unlock(task); 1755 return 0; 1756 } 1757