1 /* 2 * linux/kernel/fork.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * 'fork.c' contains the help-routines for the 'fork' system call 9 * (see also entry.S and others). 10 * Fork is rather simple, once you get the hang of it, but the memory 11 * management can be a bitch. See 'mm/memory.c': 'copy_page_range()' 12 */ 13 14 #include <linux/slab.h> 15 #include <linux/init.h> 16 #include <linux/unistd.h> 17 #include <linux/module.h> 18 #include <linux/vmalloc.h> 19 #include <linux/completion.h> 20 #include <linux/mnt_namespace.h> 21 #include <linux/personality.h> 22 #include <linux/mempolicy.h> 23 #include <linux/sem.h> 24 #include <linux/file.h> 25 #include <linux/key.h> 26 #include <linux/binfmts.h> 27 #include <linux/mman.h> 28 #include <linux/fs.h> 29 #include <linux/nsproxy.h> 30 #include <linux/capability.h> 31 #include <linux/cpu.h> 32 #include <linux/cpuset.h> 33 #include <linux/security.h> 34 #include <linux/swap.h> 35 #include <linux/syscalls.h> 36 #include <linux/jiffies.h> 37 #include <linux/futex.h> 38 #include <linux/task_io_accounting_ops.h> 39 #include <linux/rcupdate.h> 40 #include <linux/ptrace.h> 41 #include <linux/mount.h> 42 #include <linux/audit.h> 43 #include <linux/profile.h> 44 #include <linux/rmap.h> 45 #include <linux/acct.h> 46 #include <linux/tsacct_kern.h> 47 #include <linux/cn_proc.h> 48 #include <linux/freezer.h> 49 #include <linux/delayacct.h> 50 #include <linux/taskstats_kern.h> 51 #include <linux/random.h> 52 #include <linux/tty.h> 53 54 #include <asm/pgtable.h> 55 #include <asm/pgalloc.h> 56 #include <asm/uaccess.h> 57 #include <asm/mmu_context.h> 58 #include <asm/cacheflush.h> 59 #include <asm/tlbflush.h> 60 61 /* 62 * Protected counters by write_lock_irq(&tasklist_lock) 63 */ 64 unsigned long total_forks; /* Handle normal Linux uptimes. */ 65 int nr_threads; /* The idle threads do not count.. */ 66 67 int max_threads; /* tunable limit on nr_threads */ 68 69 DEFINE_PER_CPU(unsigned long, process_counts) = 0; 70 71 __cacheline_aligned DEFINE_RWLOCK(tasklist_lock); /* outer */ 72 73 int nr_processes(void) 74 { 75 int cpu; 76 int total = 0; 77 78 for_each_online_cpu(cpu) 79 total += per_cpu(process_counts, cpu); 80 81 return total; 82 } 83 84 #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR 85 # define alloc_task_struct() kmem_cache_alloc(task_struct_cachep, GFP_KERNEL) 86 # define free_task_struct(tsk) kmem_cache_free(task_struct_cachep, (tsk)) 87 static struct kmem_cache *task_struct_cachep; 88 #endif 89 90 /* SLAB cache for signal_struct structures (tsk->signal) */ 91 static struct kmem_cache *signal_cachep; 92 93 /* SLAB cache for sighand_struct structures (tsk->sighand) */ 94 struct kmem_cache *sighand_cachep; 95 96 /* SLAB cache for files_struct structures (tsk->files) */ 97 struct kmem_cache *files_cachep; 98 99 /* SLAB cache for fs_struct structures (tsk->fs) */ 100 struct kmem_cache *fs_cachep; 101 102 /* SLAB cache for vm_area_struct structures */ 103 struct kmem_cache *vm_area_cachep; 104 105 /* SLAB cache for mm_struct structures (tsk->mm) */ 106 static struct kmem_cache *mm_cachep; 107 108 void free_task(struct task_struct *tsk) 109 { 110 free_thread_info(tsk->stack); 111 rt_mutex_debug_task_free(tsk); 112 free_task_struct(tsk); 113 } 114 EXPORT_SYMBOL(free_task); 115 116 void __put_task_struct(struct task_struct *tsk) 117 { 118 WARN_ON(!(tsk->exit_state & (EXIT_DEAD | EXIT_ZOMBIE))); 119 WARN_ON(atomic_read(&tsk->usage)); 120 WARN_ON(tsk == current); 121 122 security_task_free(tsk); 123 free_uid(tsk->user); 124 put_group_info(tsk->group_info); 125 delayacct_tsk_free(tsk); 126 127 if (!profile_handoff_task(tsk)) 128 free_task(tsk); 129 } 130 131 void __init fork_init(unsigned long mempages) 132 { 133 #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR 134 #ifndef ARCH_MIN_TASKALIGN 135 #define ARCH_MIN_TASKALIGN L1_CACHE_BYTES 136 #endif 137 /* create a slab on which task_structs can be allocated */ 138 task_struct_cachep = 139 kmem_cache_create("task_struct", sizeof(struct task_struct), 140 ARCH_MIN_TASKALIGN, SLAB_PANIC, NULL, NULL); 141 #endif 142 143 /* 144 * The default maximum number of threads is set to a safe 145 * value: the thread structures can take up at most half 146 * of memory. 147 */ 148 max_threads = mempages / (8 * THREAD_SIZE / PAGE_SIZE); 149 150 /* 151 * we need to allow at least 20 threads to boot a system 152 */ 153 if(max_threads < 20) 154 max_threads = 20; 155 156 init_task.signal->rlim[RLIMIT_NPROC].rlim_cur = max_threads/2; 157 init_task.signal->rlim[RLIMIT_NPROC].rlim_max = max_threads/2; 158 init_task.signal->rlim[RLIMIT_SIGPENDING] = 159 init_task.signal->rlim[RLIMIT_NPROC]; 160 } 161 162 static struct task_struct *dup_task_struct(struct task_struct *orig) 163 { 164 struct task_struct *tsk; 165 struct thread_info *ti; 166 167 prepare_to_copy(orig); 168 169 tsk = alloc_task_struct(); 170 if (!tsk) 171 return NULL; 172 173 ti = alloc_thread_info(tsk); 174 if (!ti) { 175 free_task_struct(tsk); 176 return NULL; 177 } 178 179 *tsk = *orig; 180 tsk->stack = ti; 181 setup_thread_stack(tsk, orig); 182 183 #ifdef CONFIG_CC_STACKPROTECTOR 184 tsk->stack_canary = get_random_int(); 185 #endif 186 187 /* One for us, one for whoever does the "release_task()" (usually parent) */ 188 atomic_set(&tsk->usage,2); 189 atomic_set(&tsk->fs_excl, 0); 190 #ifdef CONFIG_BLK_DEV_IO_TRACE 191 tsk->btrace_seq = 0; 192 #endif 193 tsk->splice_pipe = NULL; 194 return tsk; 195 } 196 197 #ifdef CONFIG_MMU 198 static inline int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) 199 { 200 struct vm_area_struct *mpnt, *tmp, **pprev; 201 struct rb_node **rb_link, *rb_parent; 202 int retval; 203 unsigned long charge; 204 struct mempolicy *pol; 205 206 down_write(&oldmm->mmap_sem); 207 flush_cache_dup_mm(oldmm); 208 /* 209 * Not linked in yet - no deadlock potential: 210 */ 211 down_write_nested(&mm->mmap_sem, SINGLE_DEPTH_NESTING); 212 213 mm->locked_vm = 0; 214 mm->mmap = NULL; 215 mm->mmap_cache = NULL; 216 mm->free_area_cache = oldmm->mmap_base; 217 mm->cached_hole_size = ~0UL; 218 mm->map_count = 0; 219 cpus_clear(mm->cpu_vm_mask); 220 mm->mm_rb = RB_ROOT; 221 rb_link = &mm->mm_rb.rb_node; 222 rb_parent = NULL; 223 pprev = &mm->mmap; 224 225 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) { 226 struct file *file; 227 228 if (mpnt->vm_flags & VM_DONTCOPY) { 229 long pages = vma_pages(mpnt); 230 mm->total_vm -= pages; 231 vm_stat_account(mm, mpnt->vm_flags, mpnt->vm_file, 232 -pages); 233 continue; 234 } 235 charge = 0; 236 if (mpnt->vm_flags & VM_ACCOUNT) { 237 unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; 238 if (security_vm_enough_memory(len)) 239 goto fail_nomem; 240 charge = len; 241 } 242 tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); 243 if (!tmp) 244 goto fail_nomem; 245 *tmp = *mpnt; 246 pol = mpol_copy(vma_policy(mpnt)); 247 retval = PTR_ERR(pol); 248 if (IS_ERR(pol)) 249 goto fail_nomem_policy; 250 vma_set_policy(tmp, pol); 251 tmp->vm_flags &= ~VM_LOCKED; 252 tmp->vm_mm = mm; 253 tmp->vm_next = NULL; 254 anon_vma_link(tmp); 255 file = tmp->vm_file; 256 if (file) { 257 struct inode *inode = file->f_path.dentry->d_inode; 258 get_file(file); 259 if (tmp->vm_flags & VM_DENYWRITE) 260 atomic_dec(&inode->i_writecount); 261 262 /* insert tmp into the share list, just after mpnt */ 263 spin_lock(&file->f_mapping->i_mmap_lock); 264 tmp->vm_truncate_count = mpnt->vm_truncate_count; 265 flush_dcache_mmap_lock(file->f_mapping); 266 vma_prio_tree_add(tmp, mpnt); 267 flush_dcache_mmap_unlock(file->f_mapping); 268 spin_unlock(&file->f_mapping->i_mmap_lock); 269 } 270 271 /* 272 * Link in the new vma and copy the page table entries. 273 */ 274 *pprev = tmp; 275 pprev = &tmp->vm_next; 276 277 __vma_link_rb(mm, tmp, rb_link, rb_parent); 278 rb_link = &tmp->vm_rb.rb_right; 279 rb_parent = &tmp->vm_rb; 280 281 mm->map_count++; 282 retval = copy_page_range(mm, oldmm, mpnt); 283 284 if (tmp->vm_ops && tmp->vm_ops->open) 285 tmp->vm_ops->open(tmp); 286 287 if (retval) 288 goto out; 289 } 290 /* a new mm has just been created */ 291 arch_dup_mmap(oldmm, mm); 292 retval = 0; 293 out: 294 up_write(&mm->mmap_sem); 295 flush_tlb_mm(oldmm); 296 up_write(&oldmm->mmap_sem); 297 return retval; 298 fail_nomem_policy: 299 kmem_cache_free(vm_area_cachep, tmp); 300 fail_nomem: 301 retval = -ENOMEM; 302 vm_unacct_memory(charge); 303 goto out; 304 } 305 306 static inline int mm_alloc_pgd(struct mm_struct * mm) 307 { 308 mm->pgd = pgd_alloc(mm); 309 if (unlikely(!mm->pgd)) 310 return -ENOMEM; 311 return 0; 312 } 313 314 static inline void mm_free_pgd(struct mm_struct * mm) 315 { 316 pgd_free(mm->pgd); 317 } 318 #else 319 #define dup_mmap(mm, oldmm) (0) 320 #define mm_alloc_pgd(mm) (0) 321 #define mm_free_pgd(mm) 322 #endif /* CONFIG_MMU */ 323 324 __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); 325 326 #define allocate_mm() (kmem_cache_alloc(mm_cachep, GFP_KERNEL)) 327 #define free_mm(mm) (kmem_cache_free(mm_cachep, (mm))) 328 329 #include <linux/init_task.h> 330 331 static struct mm_struct * mm_init(struct mm_struct * mm) 332 { 333 atomic_set(&mm->mm_users, 1); 334 atomic_set(&mm->mm_count, 1); 335 init_rwsem(&mm->mmap_sem); 336 INIT_LIST_HEAD(&mm->mmlist); 337 mm->core_waiters = 0; 338 mm->nr_ptes = 0; 339 set_mm_counter(mm, file_rss, 0); 340 set_mm_counter(mm, anon_rss, 0); 341 spin_lock_init(&mm->page_table_lock); 342 rwlock_init(&mm->ioctx_list_lock); 343 mm->ioctx_list = NULL; 344 mm->free_area_cache = TASK_UNMAPPED_BASE; 345 mm->cached_hole_size = ~0UL; 346 347 if (likely(!mm_alloc_pgd(mm))) { 348 mm->def_flags = 0; 349 return mm; 350 } 351 free_mm(mm); 352 return NULL; 353 } 354 355 /* 356 * Allocate and initialize an mm_struct. 357 */ 358 struct mm_struct * mm_alloc(void) 359 { 360 struct mm_struct * mm; 361 362 mm = allocate_mm(); 363 if (mm) { 364 memset(mm, 0, sizeof(*mm)); 365 mm = mm_init(mm); 366 } 367 return mm; 368 } 369 370 /* 371 * Called when the last reference to the mm 372 * is dropped: either by a lazy thread or by 373 * mmput. Free the page directory and the mm. 374 */ 375 void fastcall __mmdrop(struct mm_struct *mm) 376 { 377 BUG_ON(mm == &init_mm); 378 mm_free_pgd(mm); 379 destroy_context(mm); 380 free_mm(mm); 381 } 382 383 /* 384 * Decrement the use count and release all resources for an mm. 385 */ 386 void mmput(struct mm_struct *mm) 387 { 388 might_sleep(); 389 390 if (atomic_dec_and_test(&mm->mm_users)) { 391 exit_aio(mm); 392 exit_mmap(mm); 393 if (!list_empty(&mm->mmlist)) { 394 spin_lock(&mmlist_lock); 395 list_del(&mm->mmlist); 396 spin_unlock(&mmlist_lock); 397 } 398 put_swap_token(mm); 399 mmdrop(mm); 400 } 401 } 402 EXPORT_SYMBOL_GPL(mmput); 403 404 /** 405 * get_task_mm - acquire a reference to the task's mm 406 * 407 * Returns %NULL if the task has no mm. Checks PF_BORROWED_MM (meaning 408 * this kernel workthread has transiently adopted a user mm with use_mm, 409 * to do its AIO) is not set and if so returns a reference to it, after 410 * bumping up the use count. User must release the mm via mmput() 411 * after use. Typically used by /proc and ptrace. 412 */ 413 struct mm_struct *get_task_mm(struct task_struct *task) 414 { 415 struct mm_struct *mm; 416 417 task_lock(task); 418 mm = task->mm; 419 if (mm) { 420 if (task->flags & PF_BORROWED_MM) 421 mm = NULL; 422 else 423 atomic_inc(&mm->mm_users); 424 } 425 task_unlock(task); 426 return mm; 427 } 428 EXPORT_SYMBOL_GPL(get_task_mm); 429 430 /* Please note the differences between mmput and mm_release. 431 * mmput is called whenever we stop holding onto a mm_struct, 432 * error success whatever. 433 * 434 * mm_release is called after a mm_struct has been removed 435 * from the current process. 436 * 437 * This difference is important for error handling, when we 438 * only half set up a mm_struct for a new process and need to restore 439 * the old one. Because we mmput the new mm_struct before 440 * restoring the old one. . . 441 * Eric Biederman 10 January 1998 442 */ 443 void mm_release(struct task_struct *tsk, struct mm_struct *mm) 444 { 445 struct completion *vfork_done = tsk->vfork_done; 446 447 /* Get rid of any cached register state */ 448 deactivate_mm(tsk, mm); 449 450 /* notify parent sleeping on vfork() */ 451 if (vfork_done) { 452 tsk->vfork_done = NULL; 453 complete(vfork_done); 454 } 455 456 /* 457 * If we're exiting normally, clear a user-space tid field if 458 * requested. We leave this alone when dying by signal, to leave 459 * the value intact in a core dump, and to save the unnecessary 460 * trouble otherwise. Userland only wants this done for a sys_exit. 461 */ 462 if (tsk->clear_child_tid 463 && !(tsk->flags & PF_SIGNALED) 464 && atomic_read(&mm->mm_users) > 1) { 465 u32 __user * tidptr = tsk->clear_child_tid; 466 tsk->clear_child_tid = NULL; 467 468 /* 469 * We don't check the error code - if userspace has 470 * not set up a proper pointer then tough luck. 471 */ 472 put_user(0, tidptr); 473 sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0); 474 } 475 } 476 477 /* 478 * Allocate a new mm structure and copy contents from the 479 * mm structure of the passed in task structure. 480 */ 481 static struct mm_struct *dup_mm(struct task_struct *tsk) 482 { 483 struct mm_struct *mm, *oldmm = current->mm; 484 int err; 485 486 if (!oldmm) 487 return NULL; 488 489 mm = allocate_mm(); 490 if (!mm) 491 goto fail_nomem; 492 493 memcpy(mm, oldmm, sizeof(*mm)); 494 495 /* Initializing for Swap token stuff */ 496 mm->token_priority = 0; 497 mm->last_interval = 0; 498 499 if (!mm_init(mm)) 500 goto fail_nomem; 501 502 if (init_new_context(tsk, mm)) 503 goto fail_nocontext; 504 505 err = dup_mmap(mm, oldmm); 506 if (err) 507 goto free_pt; 508 509 mm->hiwater_rss = get_mm_rss(mm); 510 mm->hiwater_vm = mm->total_vm; 511 512 return mm; 513 514 free_pt: 515 mmput(mm); 516 517 fail_nomem: 518 return NULL; 519 520 fail_nocontext: 521 /* 522 * If init_new_context() failed, we cannot use mmput() to free the mm 523 * because it calls destroy_context() 524 */ 525 mm_free_pgd(mm); 526 free_mm(mm); 527 return NULL; 528 } 529 530 static int copy_mm(unsigned long clone_flags, struct task_struct * tsk) 531 { 532 struct mm_struct * mm, *oldmm; 533 int retval; 534 535 tsk->min_flt = tsk->maj_flt = 0; 536 tsk->nvcsw = tsk->nivcsw = 0; 537 538 tsk->mm = NULL; 539 tsk->active_mm = NULL; 540 541 /* 542 * Are we cloning a kernel thread? 543 * 544 * We need to steal a active VM for that.. 545 */ 546 oldmm = current->mm; 547 if (!oldmm) 548 return 0; 549 550 if (clone_flags & CLONE_VM) { 551 atomic_inc(&oldmm->mm_users); 552 mm = oldmm; 553 goto good_mm; 554 } 555 556 retval = -ENOMEM; 557 mm = dup_mm(tsk); 558 if (!mm) 559 goto fail_nomem; 560 561 good_mm: 562 /* Initializing for Swap token stuff */ 563 mm->token_priority = 0; 564 mm->last_interval = 0; 565 566 tsk->mm = mm; 567 tsk->active_mm = mm; 568 return 0; 569 570 fail_nomem: 571 return retval; 572 } 573 574 static inline struct fs_struct *__copy_fs_struct(struct fs_struct *old) 575 { 576 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL); 577 /* We don't need to lock fs - think why ;-) */ 578 if (fs) { 579 atomic_set(&fs->count, 1); 580 rwlock_init(&fs->lock); 581 fs->umask = old->umask; 582 read_lock(&old->lock); 583 fs->rootmnt = mntget(old->rootmnt); 584 fs->root = dget(old->root); 585 fs->pwdmnt = mntget(old->pwdmnt); 586 fs->pwd = dget(old->pwd); 587 if (old->altroot) { 588 fs->altrootmnt = mntget(old->altrootmnt); 589 fs->altroot = dget(old->altroot); 590 } else { 591 fs->altrootmnt = NULL; 592 fs->altroot = NULL; 593 } 594 read_unlock(&old->lock); 595 } 596 return fs; 597 } 598 599 struct fs_struct *copy_fs_struct(struct fs_struct *old) 600 { 601 return __copy_fs_struct(old); 602 } 603 604 EXPORT_SYMBOL_GPL(copy_fs_struct); 605 606 static inline int copy_fs(unsigned long clone_flags, struct task_struct * tsk) 607 { 608 if (clone_flags & CLONE_FS) { 609 atomic_inc(¤t->fs->count); 610 return 0; 611 } 612 tsk->fs = __copy_fs_struct(current->fs); 613 if (!tsk->fs) 614 return -ENOMEM; 615 return 0; 616 } 617 618 static int count_open_files(struct fdtable *fdt) 619 { 620 int size = fdt->max_fds; 621 int i; 622 623 /* Find the last open fd */ 624 for (i = size/(8*sizeof(long)); i > 0; ) { 625 if (fdt->open_fds->fds_bits[--i]) 626 break; 627 } 628 i = (i+1) * 8 * sizeof(long); 629 return i; 630 } 631 632 static struct files_struct *alloc_files(void) 633 { 634 struct files_struct *newf; 635 struct fdtable *fdt; 636 637 newf = kmem_cache_alloc(files_cachep, GFP_KERNEL); 638 if (!newf) 639 goto out; 640 641 atomic_set(&newf->count, 1); 642 643 spin_lock_init(&newf->file_lock); 644 newf->next_fd = 0; 645 fdt = &newf->fdtab; 646 fdt->max_fds = NR_OPEN_DEFAULT; 647 fdt->close_on_exec = (fd_set *)&newf->close_on_exec_init; 648 fdt->open_fds = (fd_set *)&newf->open_fds_init; 649 fdt->fd = &newf->fd_array[0]; 650 INIT_RCU_HEAD(&fdt->rcu); 651 fdt->next = NULL; 652 rcu_assign_pointer(newf->fdt, fdt); 653 out: 654 return newf; 655 } 656 657 /* 658 * Allocate a new files structure and copy contents from the 659 * passed in files structure. 660 * errorp will be valid only when the returned files_struct is NULL. 661 */ 662 static struct files_struct *dup_fd(struct files_struct *oldf, int *errorp) 663 { 664 struct files_struct *newf; 665 struct file **old_fds, **new_fds; 666 int open_files, size, i; 667 struct fdtable *old_fdt, *new_fdt; 668 669 *errorp = -ENOMEM; 670 newf = alloc_files(); 671 if (!newf) 672 goto out; 673 674 spin_lock(&oldf->file_lock); 675 old_fdt = files_fdtable(oldf); 676 new_fdt = files_fdtable(newf); 677 open_files = count_open_files(old_fdt); 678 679 /* 680 * Check whether we need to allocate a larger fd array and fd set. 681 * Note: we're not a clone task, so the open count won't change. 682 */ 683 if (open_files > new_fdt->max_fds) { 684 new_fdt->max_fds = 0; 685 spin_unlock(&oldf->file_lock); 686 spin_lock(&newf->file_lock); 687 *errorp = expand_files(newf, open_files-1); 688 spin_unlock(&newf->file_lock); 689 if (*errorp < 0) 690 goto out_release; 691 new_fdt = files_fdtable(newf); 692 /* 693 * Reacquire the oldf lock and a pointer to its fd table 694 * who knows it may have a new bigger fd table. We need 695 * the latest pointer. 696 */ 697 spin_lock(&oldf->file_lock); 698 old_fdt = files_fdtable(oldf); 699 } 700 701 old_fds = old_fdt->fd; 702 new_fds = new_fdt->fd; 703 704 memcpy(new_fdt->open_fds->fds_bits, 705 old_fdt->open_fds->fds_bits, open_files/8); 706 memcpy(new_fdt->close_on_exec->fds_bits, 707 old_fdt->close_on_exec->fds_bits, open_files/8); 708 709 for (i = open_files; i != 0; i--) { 710 struct file *f = *old_fds++; 711 if (f) { 712 get_file(f); 713 } else { 714 /* 715 * The fd may be claimed in the fd bitmap but not yet 716 * instantiated in the files array if a sibling thread 717 * is partway through open(). So make sure that this 718 * fd is available to the new process. 719 */ 720 FD_CLR(open_files - i, new_fdt->open_fds); 721 } 722 rcu_assign_pointer(*new_fds++, f); 723 } 724 spin_unlock(&oldf->file_lock); 725 726 /* compute the remainder to be cleared */ 727 size = (new_fdt->max_fds - open_files) * sizeof(struct file *); 728 729 /* This is long word aligned thus could use a optimized version */ 730 memset(new_fds, 0, size); 731 732 if (new_fdt->max_fds > open_files) { 733 int left = (new_fdt->max_fds-open_files)/8; 734 int start = open_files / (8 * sizeof(unsigned long)); 735 736 memset(&new_fdt->open_fds->fds_bits[start], 0, left); 737 memset(&new_fdt->close_on_exec->fds_bits[start], 0, left); 738 } 739 740 return newf; 741 742 out_release: 743 kmem_cache_free(files_cachep, newf); 744 out: 745 return NULL; 746 } 747 748 static int copy_files(unsigned long clone_flags, struct task_struct * tsk) 749 { 750 struct files_struct *oldf, *newf; 751 int error = 0; 752 753 /* 754 * A background process may not have any files ... 755 */ 756 oldf = current->files; 757 if (!oldf) 758 goto out; 759 760 if (clone_flags & CLONE_FILES) { 761 atomic_inc(&oldf->count); 762 goto out; 763 } 764 765 /* 766 * Note: we may be using current for both targets (See exec.c) 767 * This works because we cache current->files (old) as oldf. Don't 768 * break this. 769 */ 770 tsk->files = NULL; 771 newf = dup_fd(oldf, &error); 772 if (!newf) 773 goto out; 774 775 tsk->files = newf; 776 error = 0; 777 out: 778 return error; 779 } 780 781 /* 782 * Helper to unshare the files of the current task. 783 * We don't want to expose copy_files internals to 784 * the exec layer of the kernel. 785 */ 786 787 int unshare_files(void) 788 { 789 struct files_struct *files = current->files; 790 int rc; 791 792 BUG_ON(!files); 793 794 /* This can race but the race causes us to copy when we don't 795 need to and drop the copy */ 796 if(atomic_read(&files->count) == 1) 797 { 798 atomic_inc(&files->count); 799 return 0; 800 } 801 rc = copy_files(0, current); 802 if(rc) 803 current->files = files; 804 return rc; 805 } 806 807 EXPORT_SYMBOL(unshare_files); 808 809 static inline int copy_sighand(unsigned long clone_flags, struct task_struct * tsk) 810 { 811 struct sighand_struct *sig; 812 813 if (clone_flags & (CLONE_SIGHAND | CLONE_THREAD)) { 814 atomic_inc(¤t->sighand->count); 815 return 0; 816 } 817 sig = kmem_cache_alloc(sighand_cachep, GFP_KERNEL); 818 rcu_assign_pointer(tsk->sighand, sig); 819 if (!sig) 820 return -ENOMEM; 821 atomic_set(&sig->count, 1); 822 memcpy(sig->action, current->sighand->action, sizeof(sig->action)); 823 return 0; 824 } 825 826 void __cleanup_sighand(struct sighand_struct *sighand) 827 { 828 if (atomic_dec_and_test(&sighand->count)) 829 kmem_cache_free(sighand_cachep, sighand); 830 } 831 832 static inline int copy_signal(unsigned long clone_flags, struct task_struct * tsk) 833 { 834 struct signal_struct *sig; 835 int ret; 836 837 if (clone_flags & CLONE_THREAD) { 838 atomic_inc(¤t->signal->count); 839 atomic_inc(¤t->signal->live); 840 return 0; 841 } 842 sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL); 843 tsk->signal = sig; 844 if (!sig) 845 return -ENOMEM; 846 847 ret = copy_thread_group_keys(tsk); 848 if (ret < 0) { 849 kmem_cache_free(signal_cachep, sig); 850 return ret; 851 } 852 853 atomic_set(&sig->count, 1); 854 atomic_set(&sig->live, 1); 855 init_waitqueue_head(&sig->wait_chldexit); 856 sig->flags = 0; 857 sig->group_exit_code = 0; 858 sig->group_exit_task = NULL; 859 sig->group_stop_count = 0; 860 sig->curr_target = NULL; 861 init_sigpending(&sig->shared_pending); 862 INIT_LIST_HEAD(&sig->posix_timers); 863 864 hrtimer_init(&sig->real_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); 865 sig->it_real_incr.tv64 = 0; 866 sig->real_timer.function = it_real_fn; 867 sig->tsk = tsk; 868 869 sig->it_virt_expires = cputime_zero; 870 sig->it_virt_incr = cputime_zero; 871 sig->it_prof_expires = cputime_zero; 872 sig->it_prof_incr = cputime_zero; 873 874 sig->leader = 0; /* session leadership doesn't inherit */ 875 sig->tty_old_pgrp = NULL; 876 877 sig->utime = sig->stime = sig->cutime = sig->cstime = cputime_zero; 878 sig->nvcsw = sig->nivcsw = sig->cnvcsw = sig->cnivcsw = 0; 879 sig->min_flt = sig->maj_flt = sig->cmin_flt = sig->cmaj_flt = 0; 880 sig->inblock = sig->oublock = sig->cinblock = sig->coublock = 0; 881 sig->sum_sched_runtime = 0; 882 INIT_LIST_HEAD(&sig->cpu_timers[0]); 883 INIT_LIST_HEAD(&sig->cpu_timers[1]); 884 INIT_LIST_HEAD(&sig->cpu_timers[2]); 885 taskstats_tgid_init(sig); 886 887 task_lock(current->group_leader); 888 memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim); 889 task_unlock(current->group_leader); 890 891 if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) { 892 /* 893 * New sole thread in the process gets an expiry time 894 * of the whole CPU time limit. 895 */ 896 tsk->it_prof_expires = 897 secs_to_cputime(sig->rlim[RLIMIT_CPU].rlim_cur); 898 } 899 acct_init_pacct(&sig->pacct); 900 901 tty_audit_fork(sig); 902 903 return 0; 904 } 905 906 void __cleanup_signal(struct signal_struct *sig) 907 { 908 exit_thread_group_keys(sig); 909 kmem_cache_free(signal_cachep, sig); 910 } 911 912 static inline void cleanup_signal(struct task_struct *tsk) 913 { 914 struct signal_struct *sig = tsk->signal; 915 916 atomic_dec(&sig->live); 917 918 if (atomic_dec_and_test(&sig->count)) 919 __cleanup_signal(sig); 920 } 921 922 static inline void copy_flags(unsigned long clone_flags, struct task_struct *p) 923 { 924 unsigned long new_flags = p->flags; 925 926 new_flags &= ~PF_SUPERPRIV; 927 new_flags |= PF_FORKNOEXEC; 928 if (!(clone_flags & CLONE_PTRACE)) 929 p->ptrace = 0; 930 p->flags = new_flags; 931 } 932 933 asmlinkage long sys_set_tid_address(int __user *tidptr) 934 { 935 current->clear_child_tid = tidptr; 936 937 return current->pid; 938 } 939 940 static inline void rt_mutex_init_task(struct task_struct *p) 941 { 942 spin_lock_init(&p->pi_lock); 943 #ifdef CONFIG_RT_MUTEXES 944 plist_head_init(&p->pi_waiters, &p->pi_lock); 945 p->pi_blocked_on = NULL; 946 #endif 947 } 948 949 /* 950 * This creates a new process as a copy of the old one, 951 * but does not actually start it yet. 952 * 953 * It copies the registers, and all the appropriate 954 * parts of the process environment (as per the clone 955 * flags). The actual kick-off is left to the caller. 956 */ 957 static struct task_struct *copy_process(unsigned long clone_flags, 958 unsigned long stack_start, 959 struct pt_regs *regs, 960 unsigned long stack_size, 961 int __user *parent_tidptr, 962 int __user *child_tidptr, 963 struct pid *pid) 964 { 965 int retval; 966 struct task_struct *p = NULL; 967 968 if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS)) 969 return ERR_PTR(-EINVAL); 970 971 /* 972 * Thread groups must share signals as well, and detached threads 973 * can only be started up within the thread group. 974 */ 975 if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND)) 976 return ERR_PTR(-EINVAL); 977 978 /* 979 * Shared signal handlers imply shared VM. By way of the above, 980 * thread groups also imply shared VM. Blocking this case allows 981 * for various simplifications in other code. 982 */ 983 if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM)) 984 return ERR_PTR(-EINVAL); 985 986 retval = security_task_create(clone_flags); 987 if (retval) 988 goto fork_out; 989 990 retval = -ENOMEM; 991 p = dup_task_struct(current); 992 if (!p) 993 goto fork_out; 994 995 rt_mutex_init_task(p); 996 997 #ifdef CONFIG_TRACE_IRQFLAGS 998 DEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled); 999 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled); 1000 #endif 1001 retval = -EAGAIN; 1002 if (atomic_read(&p->user->processes) >= 1003 p->signal->rlim[RLIMIT_NPROC].rlim_cur) { 1004 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && 1005 p->user != current->nsproxy->user_ns->root_user) 1006 goto bad_fork_free; 1007 } 1008 1009 atomic_inc(&p->user->__count); 1010 atomic_inc(&p->user->processes); 1011 get_group_info(p->group_info); 1012 1013 /* 1014 * If multiple threads are within copy_process(), then this check 1015 * triggers too late. This doesn't hurt, the check is only there 1016 * to stop root fork bombs. 1017 */ 1018 if (nr_threads >= max_threads) 1019 goto bad_fork_cleanup_count; 1020 1021 if (!try_module_get(task_thread_info(p)->exec_domain->module)) 1022 goto bad_fork_cleanup_count; 1023 1024 if (p->binfmt && !try_module_get(p->binfmt->module)) 1025 goto bad_fork_cleanup_put_domain; 1026 1027 p->did_exec = 0; 1028 delayacct_tsk_init(p); /* Must remain after dup_task_struct() */ 1029 copy_flags(clone_flags, p); 1030 p->pid = pid_nr(pid); 1031 retval = -EFAULT; 1032 if (clone_flags & CLONE_PARENT_SETTID) 1033 if (put_user(p->pid, parent_tidptr)) 1034 goto bad_fork_cleanup_delays_binfmt; 1035 1036 INIT_LIST_HEAD(&p->children); 1037 INIT_LIST_HEAD(&p->sibling); 1038 p->vfork_done = NULL; 1039 spin_lock_init(&p->alloc_lock); 1040 1041 clear_tsk_thread_flag(p, TIF_SIGPENDING); 1042 init_sigpending(&p->pending); 1043 1044 p->utime = cputime_zero; 1045 p->stime = cputime_zero; 1046 1047 #ifdef CONFIG_TASK_XACCT 1048 p->rchar = 0; /* I/O counter: bytes read */ 1049 p->wchar = 0; /* I/O counter: bytes written */ 1050 p->syscr = 0; /* I/O counter: read syscalls */ 1051 p->syscw = 0; /* I/O counter: write syscalls */ 1052 #endif 1053 task_io_accounting_init(p); 1054 acct_clear_integrals(p); 1055 1056 p->it_virt_expires = cputime_zero; 1057 p->it_prof_expires = cputime_zero; 1058 p->it_sched_expires = 0; 1059 INIT_LIST_HEAD(&p->cpu_timers[0]); 1060 INIT_LIST_HEAD(&p->cpu_timers[1]); 1061 INIT_LIST_HEAD(&p->cpu_timers[2]); 1062 1063 p->lock_depth = -1; /* -1 = no lock */ 1064 do_posix_clock_monotonic_gettime(&p->start_time); 1065 p->real_start_time = p->start_time; 1066 monotonic_to_bootbased(&p->real_start_time); 1067 p->security = NULL; 1068 p->io_context = NULL; 1069 p->io_wait = NULL; 1070 p->audit_context = NULL; 1071 cpuset_fork(p); 1072 #ifdef CONFIG_NUMA 1073 p->mempolicy = mpol_copy(p->mempolicy); 1074 if (IS_ERR(p->mempolicy)) { 1075 retval = PTR_ERR(p->mempolicy); 1076 p->mempolicy = NULL; 1077 goto bad_fork_cleanup_cpuset; 1078 } 1079 mpol_fix_fork_child_flag(p); 1080 #endif 1081 #ifdef CONFIG_TRACE_IRQFLAGS 1082 p->irq_events = 0; 1083 #ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW 1084 p->hardirqs_enabled = 1; 1085 #else 1086 p->hardirqs_enabled = 0; 1087 #endif 1088 p->hardirq_enable_ip = 0; 1089 p->hardirq_enable_event = 0; 1090 p->hardirq_disable_ip = _THIS_IP_; 1091 p->hardirq_disable_event = 0; 1092 p->softirqs_enabled = 1; 1093 p->softirq_enable_ip = _THIS_IP_; 1094 p->softirq_enable_event = 0; 1095 p->softirq_disable_ip = 0; 1096 p->softirq_disable_event = 0; 1097 p->hardirq_context = 0; 1098 p->softirq_context = 0; 1099 #endif 1100 #ifdef CONFIG_LOCKDEP 1101 p->lockdep_depth = 0; /* no locks held yet */ 1102 p->curr_chain_key = 0; 1103 p->lockdep_recursion = 0; 1104 #endif 1105 1106 #ifdef CONFIG_DEBUG_MUTEXES 1107 p->blocked_on = NULL; /* not blocked yet */ 1108 #endif 1109 1110 p->tgid = p->pid; 1111 if (clone_flags & CLONE_THREAD) 1112 p->tgid = current->tgid; 1113 1114 if ((retval = security_task_alloc(p))) 1115 goto bad_fork_cleanup_policy; 1116 if ((retval = audit_alloc(p))) 1117 goto bad_fork_cleanup_security; 1118 /* copy all the process information */ 1119 if ((retval = copy_semundo(clone_flags, p))) 1120 goto bad_fork_cleanup_audit; 1121 if ((retval = copy_files(clone_flags, p))) 1122 goto bad_fork_cleanup_semundo; 1123 if ((retval = copy_fs(clone_flags, p))) 1124 goto bad_fork_cleanup_files; 1125 if ((retval = copy_sighand(clone_flags, p))) 1126 goto bad_fork_cleanup_fs; 1127 if ((retval = copy_signal(clone_flags, p))) 1128 goto bad_fork_cleanup_sighand; 1129 if ((retval = copy_mm(clone_flags, p))) 1130 goto bad_fork_cleanup_signal; 1131 if ((retval = copy_keys(clone_flags, p))) 1132 goto bad_fork_cleanup_mm; 1133 if ((retval = copy_namespaces(clone_flags, p))) 1134 goto bad_fork_cleanup_keys; 1135 retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs); 1136 if (retval) 1137 goto bad_fork_cleanup_namespaces; 1138 1139 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; 1140 /* 1141 * Clear TID on mm_release()? 1142 */ 1143 p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr: NULL; 1144 p->robust_list = NULL; 1145 #ifdef CONFIG_COMPAT 1146 p->compat_robust_list = NULL; 1147 #endif 1148 INIT_LIST_HEAD(&p->pi_state_list); 1149 p->pi_state_cache = NULL; 1150 1151 /* 1152 * sigaltstack should be cleared when sharing the same VM 1153 */ 1154 if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM) 1155 p->sas_ss_sp = p->sas_ss_size = 0; 1156 1157 /* 1158 * Syscall tracing should be turned off in the child regardless 1159 * of CLONE_PTRACE. 1160 */ 1161 clear_tsk_thread_flag(p, TIF_SYSCALL_TRACE); 1162 #ifdef TIF_SYSCALL_EMU 1163 clear_tsk_thread_flag(p, TIF_SYSCALL_EMU); 1164 #endif 1165 1166 /* Our parent execution domain becomes current domain 1167 These must match for thread signalling to apply */ 1168 p->parent_exec_id = p->self_exec_id; 1169 1170 /* ok, now we should be set up.. */ 1171 p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL); 1172 p->pdeath_signal = 0; 1173 p->exit_state = 0; 1174 1175 /* 1176 * Ok, make it visible to the rest of the system. 1177 * We dont wake it up yet. 1178 */ 1179 p->group_leader = p; 1180 INIT_LIST_HEAD(&p->thread_group); 1181 INIT_LIST_HEAD(&p->ptrace_children); 1182 INIT_LIST_HEAD(&p->ptrace_list); 1183 1184 /* Perform scheduler related setup. Assign this task to a CPU. */ 1185 sched_fork(p, clone_flags); 1186 1187 /* Need tasklist lock for parent etc handling! */ 1188 write_lock_irq(&tasklist_lock); 1189 1190 /* for sys_ioprio_set(IOPRIO_WHO_PGRP) */ 1191 p->ioprio = current->ioprio; 1192 1193 /* 1194 * The task hasn't been attached yet, so its cpus_allowed mask will 1195 * not be changed, nor will its assigned CPU. 1196 * 1197 * The cpus_allowed mask of the parent may have changed after it was 1198 * copied first time - so re-copy it here, then check the child's CPU 1199 * to ensure it is on a valid CPU (and if not, just force it back to 1200 * parent's CPU). This avoids alot of nasty races. 1201 */ 1202 p->cpus_allowed = current->cpus_allowed; 1203 if (unlikely(!cpu_isset(task_cpu(p), p->cpus_allowed) || 1204 !cpu_online(task_cpu(p)))) 1205 set_task_cpu(p, smp_processor_id()); 1206 1207 /* CLONE_PARENT re-uses the old parent */ 1208 if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) 1209 p->real_parent = current->real_parent; 1210 else 1211 p->real_parent = current; 1212 p->parent = p->real_parent; 1213 1214 spin_lock(¤t->sighand->siglock); 1215 1216 /* 1217 * Process group and session signals need to be delivered to just the 1218 * parent before the fork or both the parent and the child after the 1219 * fork. Restart if a signal comes in before we add the new process to 1220 * it's process group. 1221 * A fatal signal pending means that current will exit, so the new 1222 * thread can't slip out of an OOM kill (or normal SIGKILL). 1223 */ 1224 recalc_sigpending(); 1225 if (signal_pending(current)) { 1226 spin_unlock(¤t->sighand->siglock); 1227 write_unlock_irq(&tasklist_lock); 1228 retval = -ERESTARTNOINTR; 1229 goto bad_fork_cleanup_namespaces; 1230 } 1231 1232 if (clone_flags & CLONE_THREAD) { 1233 p->group_leader = current->group_leader; 1234 list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group); 1235 1236 if (!cputime_eq(current->signal->it_virt_expires, 1237 cputime_zero) || 1238 !cputime_eq(current->signal->it_prof_expires, 1239 cputime_zero) || 1240 current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY || 1241 !list_empty(¤t->signal->cpu_timers[0]) || 1242 !list_empty(¤t->signal->cpu_timers[1]) || 1243 !list_empty(¤t->signal->cpu_timers[2])) { 1244 /* 1245 * Have child wake up on its first tick to check 1246 * for process CPU timers. 1247 */ 1248 p->it_prof_expires = jiffies_to_cputime(1); 1249 } 1250 } 1251 1252 if (likely(p->pid)) { 1253 add_parent(p); 1254 if (unlikely(p->ptrace & PT_PTRACED)) 1255 __ptrace_link(p, current->parent); 1256 1257 if (thread_group_leader(p)) { 1258 p->signal->tty = current->signal->tty; 1259 p->signal->pgrp = process_group(current); 1260 set_signal_session(p->signal, process_session(current)); 1261 attach_pid(p, PIDTYPE_PGID, task_pgrp(current)); 1262 attach_pid(p, PIDTYPE_SID, task_session(current)); 1263 1264 list_add_tail_rcu(&p->tasks, &init_task.tasks); 1265 __get_cpu_var(process_counts)++; 1266 } 1267 attach_pid(p, PIDTYPE_PID, pid); 1268 nr_threads++; 1269 } 1270 1271 total_forks++; 1272 spin_unlock(¤t->sighand->siglock); 1273 write_unlock_irq(&tasklist_lock); 1274 proc_fork_connector(p); 1275 return p; 1276 1277 bad_fork_cleanup_namespaces: 1278 exit_task_namespaces(p); 1279 bad_fork_cleanup_keys: 1280 exit_keys(p); 1281 bad_fork_cleanup_mm: 1282 if (p->mm) 1283 mmput(p->mm); 1284 bad_fork_cleanup_signal: 1285 cleanup_signal(p); 1286 bad_fork_cleanup_sighand: 1287 __cleanup_sighand(p->sighand); 1288 bad_fork_cleanup_fs: 1289 exit_fs(p); /* blocking */ 1290 bad_fork_cleanup_files: 1291 exit_files(p); /* blocking */ 1292 bad_fork_cleanup_semundo: 1293 exit_sem(p); 1294 bad_fork_cleanup_audit: 1295 audit_free(p); 1296 bad_fork_cleanup_security: 1297 security_task_free(p); 1298 bad_fork_cleanup_policy: 1299 #ifdef CONFIG_NUMA 1300 mpol_free(p->mempolicy); 1301 bad_fork_cleanup_cpuset: 1302 #endif 1303 cpuset_exit(p); 1304 bad_fork_cleanup_delays_binfmt: 1305 delayacct_tsk_free(p); 1306 if (p->binfmt) 1307 module_put(p->binfmt->module); 1308 bad_fork_cleanup_put_domain: 1309 module_put(task_thread_info(p)->exec_domain->module); 1310 bad_fork_cleanup_count: 1311 put_group_info(p->group_info); 1312 atomic_dec(&p->user->processes); 1313 free_uid(p->user); 1314 bad_fork_free: 1315 free_task(p); 1316 fork_out: 1317 return ERR_PTR(retval); 1318 } 1319 1320 noinline struct pt_regs * __devinit __attribute__((weak)) idle_regs(struct pt_regs *regs) 1321 { 1322 memset(regs, 0, sizeof(struct pt_regs)); 1323 return regs; 1324 } 1325 1326 struct task_struct * __cpuinit fork_idle(int cpu) 1327 { 1328 struct task_struct *task; 1329 struct pt_regs regs; 1330 1331 task = copy_process(CLONE_VM, 0, idle_regs(®s), 0, NULL, NULL, 1332 &init_struct_pid); 1333 if (!IS_ERR(task)) 1334 init_idle(task, cpu); 1335 1336 return task; 1337 } 1338 1339 static inline int fork_traceflag (unsigned clone_flags) 1340 { 1341 if (clone_flags & CLONE_UNTRACED) 1342 return 0; 1343 else if (clone_flags & CLONE_VFORK) { 1344 if (current->ptrace & PT_TRACE_VFORK) 1345 return PTRACE_EVENT_VFORK; 1346 } else if ((clone_flags & CSIGNAL) != SIGCHLD) { 1347 if (current->ptrace & PT_TRACE_CLONE) 1348 return PTRACE_EVENT_CLONE; 1349 } else if (current->ptrace & PT_TRACE_FORK) 1350 return PTRACE_EVENT_FORK; 1351 1352 return 0; 1353 } 1354 1355 /* 1356 * Ok, this is the main fork-routine. 1357 * 1358 * It copies the process, and if successful kick-starts 1359 * it and waits for it to finish using the VM if required. 1360 */ 1361 long do_fork(unsigned long clone_flags, 1362 unsigned long stack_start, 1363 struct pt_regs *regs, 1364 unsigned long stack_size, 1365 int __user *parent_tidptr, 1366 int __user *child_tidptr) 1367 { 1368 struct task_struct *p; 1369 int trace = 0; 1370 struct pid *pid = alloc_pid(); 1371 long nr; 1372 1373 if (!pid) 1374 return -EAGAIN; 1375 nr = pid->nr; 1376 if (unlikely(current->ptrace)) { 1377 trace = fork_traceflag (clone_flags); 1378 if (trace) 1379 clone_flags |= CLONE_PTRACE; 1380 } 1381 1382 p = copy_process(clone_flags, stack_start, regs, stack_size, parent_tidptr, child_tidptr, pid); 1383 /* 1384 * Do this prior waking up the new thread - the thread pointer 1385 * might get invalid after that point, if the thread exits quickly. 1386 */ 1387 if (!IS_ERR(p)) { 1388 struct completion vfork; 1389 1390 if (clone_flags & CLONE_VFORK) { 1391 p->vfork_done = &vfork; 1392 init_completion(&vfork); 1393 } 1394 1395 if ((p->ptrace & PT_PTRACED) || (clone_flags & CLONE_STOPPED)) { 1396 /* 1397 * We'll start up with an immediate SIGSTOP. 1398 */ 1399 sigaddset(&p->pending.signal, SIGSTOP); 1400 set_tsk_thread_flag(p, TIF_SIGPENDING); 1401 } 1402 1403 if (!(clone_flags & CLONE_STOPPED)) 1404 wake_up_new_task(p, clone_flags); 1405 else 1406 p->state = TASK_STOPPED; 1407 1408 if (unlikely (trace)) { 1409 current->ptrace_message = nr; 1410 ptrace_notify ((trace << 8) | SIGTRAP); 1411 } 1412 1413 if (clone_flags & CLONE_VFORK) { 1414 freezer_do_not_count(); 1415 wait_for_completion(&vfork); 1416 freezer_count(); 1417 if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE)) { 1418 current->ptrace_message = nr; 1419 ptrace_notify ((PTRACE_EVENT_VFORK_DONE << 8) | SIGTRAP); 1420 } 1421 } 1422 } else { 1423 free_pid(pid); 1424 nr = PTR_ERR(p); 1425 } 1426 return nr; 1427 } 1428 1429 #ifndef ARCH_MIN_MMSTRUCT_ALIGN 1430 #define ARCH_MIN_MMSTRUCT_ALIGN 0 1431 #endif 1432 1433 static void sighand_ctor(void *data, struct kmem_cache *cachep, 1434 unsigned long flags) 1435 { 1436 struct sighand_struct *sighand = data; 1437 1438 spin_lock_init(&sighand->siglock); 1439 INIT_LIST_HEAD(&sighand->signalfd_list); 1440 } 1441 1442 void __init proc_caches_init(void) 1443 { 1444 sighand_cachep = kmem_cache_create("sighand_cache", 1445 sizeof(struct sighand_struct), 0, 1446 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_DESTROY_BY_RCU, 1447 sighand_ctor, NULL); 1448 signal_cachep = kmem_cache_create("signal_cache", 1449 sizeof(struct signal_struct), 0, 1450 SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL); 1451 files_cachep = kmem_cache_create("files_cache", 1452 sizeof(struct files_struct), 0, 1453 SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL); 1454 fs_cachep = kmem_cache_create("fs_cache", 1455 sizeof(struct fs_struct), 0, 1456 SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL); 1457 vm_area_cachep = kmem_cache_create("vm_area_struct", 1458 sizeof(struct vm_area_struct), 0, 1459 SLAB_PANIC, NULL, NULL); 1460 mm_cachep = kmem_cache_create("mm_struct", 1461 sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN, 1462 SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL); 1463 } 1464 1465 /* 1466 * Check constraints on flags passed to the unshare system call and 1467 * force unsharing of additional process context as appropriate. 1468 */ 1469 static inline void check_unshare_flags(unsigned long *flags_ptr) 1470 { 1471 /* 1472 * If unsharing a thread from a thread group, must also 1473 * unshare vm. 1474 */ 1475 if (*flags_ptr & CLONE_THREAD) 1476 *flags_ptr |= CLONE_VM; 1477 1478 /* 1479 * If unsharing vm, must also unshare signal handlers. 1480 */ 1481 if (*flags_ptr & CLONE_VM) 1482 *flags_ptr |= CLONE_SIGHAND; 1483 1484 /* 1485 * If unsharing signal handlers and the task was created 1486 * using CLONE_THREAD, then must unshare the thread 1487 */ 1488 if ((*flags_ptr & CLONE_SIGHAND) && 1489 (atomic_read(¤t->signal->count) > 1)) 1490 *flags_ptr |= CLONE_THREAD; 1491 1492 /* 1493 * If unsharing namespace, must also unshare filesystem information. 1494 */ 1495 if (*flags_ptr & CLONE_NEWNS) 1496 *flags_ptr |= CLONE_FS; 1497 } 1498 1499 /* 1500 * Unsharing of tasks created with CLONE_THREAD is not supported yet 1501 */ 1502 static int unshare_thread(unsigned long unshare_flags) 1503 { 1504 if (unshare_flags & CLONE_THREAD) 1505 return -EINVAL; 1506 1507 return 0; 1508 } 1509 1510 /* 1511 * Unshare the filesystem structure if it is being shared 1512 */ 1513 static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) 1514 { 1515 struct fs_struct *fs = current->fs; 1516 1517 if ((unshare_flags & CLONE_FS) && 1518 (fs && atomic_read(&fs->count) > 1)) { 1519 *new_fsp = __copy_fs_struct(current->fs); 1520 if (!*new_fsp) 1521 return -ENOMEM; 1522 } 1523 1524 return 0; 1525 } 1526 1527 /* 1528 * Unsharing of sighand is not supported yet 1529 */ 1530 static int unshare_sighand(unsigned long unshare_flags, struct sighand_struct **new_sighp) 1531 { 1532 struct sighand_struct *sigh = current->sighand; 1533 1534 if ((unshare_flags & CLONE_SIGHAND) && atomic_read(&sigh->count) > 1) 1535 return -EINVAL; 1536 else 1537 return 0; 1538 } 1539 1540 /* 1541 * Unshare vm if it is being shared 1542 */ 1543 static int unshare_vm(unsigned long unshare_flags, struct mm_struct **new_mmp) 1544 { 1545 struct mm_struct *mm = current->mm; 1546 1547 if ((unshare_flags & CLONE_VM) && 1548 (mm && atomic_read(&mm->mm_users) > 1)) { 1549 return -EINVAL; 1550 } 1551 1552 return 0; 1553 } 1554 1555 /* 1556 * Unshare file descriptor table if it is being shared 1557 */ 1558 static int unshare_fd(unsigned long unshare_flags, struct files_struct **new_fdp) 1559 { 1560 struct files_struct *fd = current->files; 1561 int error = 0; 1562 1563 if ((unshare_flags & CLONE_FILES) && 1564 (fd && atomic_read(&fd->count) > 1)) { 1565 *new_fdp = dup_fd(fd, &error); 1566 if (!*new_fdp) 1567 return error; 1568 } 1569 1570 return 0; 1571 } 1572 1573 /* 1574 * Unsharing of semundo for tasks created with CLONE_SYSVSEM is not 1575 * supported yet 1576 */ 1577 static int unshare_semundo(unsigned long unshare_flags, struct sem_undo_list **new_ulistp) 1578 { 1579 if (unshare_flags & CLONE_SYSVSEM) 1580 return -EINVAL; 1581 1582 return 0; 1583 } 1584 1585 /* 1586 * unshare allows a process to 'unshare' part of the process 1587 * context which was originally shared using clone. copy_* 1588 * functions used by do_fork() cannot be used here directly 1589 * because they modify an inactive task_struct that is being 1590 * constructed. Here we are modifying the current, active, 1591 * task_struct. 1592 */ 1593 asmlinkage long sys_unshare(unsigned long unshare_flags) 1594 { 1595 int err = 0; 1596 struct fs_struct *fs, *new_fs = NULL; 1597 struct sighand_struct *new_sigh = NULL; 1598 struct mm_struct *mm, *new_mm = NULL, *active_mm = NULL; 1599 struct files_struct *fd, *new_fd = NULL; 1600 struct sem_undo_list *new_ulist = NULL; 1601 struct nsproxy *new_nsproxy = NULL, *old_nsproxy = NULL; 1602 1603 check_unshare_flags(&unshare_flags); 1604 1605 /* Return -EINVAL for all unsupported flags */ 1606 err = -EINVAL; 1607 if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND| 1608 CLONE_VM|CLONE_FILES|CLONE_SYSVSEM| 1609 CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER)) 1610 goto bad_unshare_out; 1611 1612 if ((err = unshare_thread(unshare_flags))) 1613 goto bad_unshare_out; 1614 if ((err = unshare_fs(unshare_flags, &new_fs))) 1615 goto bad_unshare_cleanup_thread; 1616 if ((err = unshare_sighand(unshare_flags, &new_sigh))) 1617 goto bad_unshare_cleanup_fs; 1618 if ((err = unshare_vm(unshare_flags, &new_mm))) 1619 goto bad_unshare_cleanup_sigh; 1620 if ((err = unshare_fd(unshare_flags, &new_fd))) 1621 goto bad_unshare_cleanup_vm; 1622 if ((err = unshare_semundo(unshare_flags, &new_ulist))) 1623 goto bad_unshare_cleanup_fd; 1624 if ((err = unshare_nsproxy_namespaces(unshare_flags, &new_nsproxy, 1625 new_fs))) 1626 goto bad_unshare_cleanup_semundo; 1627 1628 if (new_fs || new_mm || new_fd || new_ulist || new_nsproxy) { 1629 1630 task_lock(current); 1631 1632 if (new_nsproxy) { 1633 old_nsproxy = current->nsproxy; 1634 current->nsproxy = new_nsproxy; 1635 new_nsproxy = old_nsproxy; 1636 } 1637 1638 if (new_fs) { 1639 fs = current->fs; 1640 current->fs = new_fs; 1641 new_fs = fs; 1642 } 1643 1644 if (new_mm) { 1645 mm = current->mm; 1646 active_mm = current->active_mm; 1647 current->mm = new_mm; 1648 current->active_mm = new_mm; 1649 activate_mm(active_mm, new_mm); 1650 new_mm = mm; 1651 } 1652 1653 if (new_fd) { 1654 fd = current->files; 1655 current->files = new_fd; 1656 new_fd = fd; 1657 } 1658 1659 task_unlock(current); 1660 } 1661 1662 if (new_nsproxy) 1663 put_nsproxy(new_nsproxy); 1664 1665 bad_unshare_cleanup_semundo: 1666 bad_unshare_cleanup_fd: 1667 if (new_fd) 1668 put_files_struct(new_fd); 1669 1670 bad_unshare_cleanup_vm: 1671 if (new_mm) 1672 mmput(new_mm); 1673 1674 bad_unshare_cleanup_sigh: 1675 if (new_sigh) 1676 if (atomic_dec_and_test(&new_sigh->count)) 1677 kmem_cache_free(sighand_cachep, new_sigh); 1678 1679 bad_unshare_cleanup_fs: 1680 if (new_fs) 1681 put_fs_struct(new_fs); 1682 1683 bad_unshare_cleanup_thread: 1684 bad_unshare_out: 1685 return err; 1686 } 1687