개념 설명 전체 · v6.6 / kernel/exit.c
1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/kernel/exit.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 */ 7 8 #include <linux/mm.h> 9 #include <linux/slab.h> 10 #include <linux/sched/autogroup.h> 11 #include <linux/sched/mm.h> 12 #include <linux/sched/stat.h> 13 #include <linux/sched/task.h> 14 #include <linux/sched/task_stack.h> 15 #include <linux/sched/cputime.h> 16 #include <linux/interrupt.h> 17 #include <linux/module.h> 18 #include <linux/capability.h> 19 #include <linux/completion.h> 20 #include <linux/personality.h> 21 #include <linux/tty.h> 22 #include <linux/iocontext.h> 23 #include <linux/key.h> 24 #include <linux/cpu.h> 25 #include <linux/acct.h> 26 #include <linux/tsacct_kern.h> 27 #include <linux/file.h> 28 #include <linux/fdtable.h> 29 #include <linux/freezer.h> 30 #include <linux/binfmts.h> 31 #include <linux/nsproxy.h> 32 #include <linux/pid_namespace.h> 33 #include <linux/ptrace.h> 34 #include <linux/profile.h> 35 #include <linux/mount.h> 36 #include <linux/proc_fs.h> 37 #include <linux/kthread.h> 38 #include <linux/mempolicy.h> 39 #include <linux/taskstats_kern.h> 40 #include <linux/delayacct.h> 41 #include <linux/cgroup.h> 42 #include <linux/syscalls.h> 43 #include <linux/signal.h> 44 #include <linux/posix-timers.h> 45 #include <linux/cn_proc.h> 46 #include <linux/mutex.h> 47 #include <linux/futex.h> 48 #include <linux/pipe_fs_i.h> 49 #include <linux/audit.h> /* for audit_free() */ 50 #include <linux/resource.h> 51 #include <linux/task_io_accounting_ops.h> 52 #include <linux/blkdev.h> 53 #include <linux/task_work.h> 54 #include <linux/fs_struct.h> 55 #include <linux/init_task.h> 56 #include <linux/perf_event.h> 57 #include <trace/events/sched.h> 58 #include <linux/hw_breakpoint.h> 59 #include <linux/oom.h> 60 #include <linux/writeback.h> 61 #include <linux/shm.h> 62 #include <linux/kcov.h> 63 #include <linux/kmsan.h> 64 #include <linux/random.h> 65 #include <linux/rcuwait.h> 66 #include <linux/compat.h> 67 #include <linux/io_uring.h> 68 #include <linux/kprobes.h> 69 #include <linux/rethook.h> 70 #include <linux/sysfs.h> 71 #include <linux/user_events.h> 72 73 #include <linux/uaccess.h> 74 #include <asm/unistd.h> 75 #include <asm/mmu_context.h> 76 77 /* 78 * The default value should be high enough to not crash a system that randomly 79 * crashes its kernel from time to time, but low enough to at least not permit 80 * overflowing 32-bit refcounts or the ldsem writer count. 81 */ 82 static unsigned int oops_limit = 10000; 83 84 #ifdef CONFIG_SYSCTL 85 static struct ctl_table kern_exit_table[] = { 86 { 87 .procname = "oops_limit", 88 .data = &oops_limit, 89 .maxlen = sizeof(oops_limit), 90 .mode = 0644, 91 .proc_handler = proc_douintvec, 92 }, 93 { } 94 }; 95 96 static __init int kernel_exit_sysctls_init(void) 97 { 98 register_sysctl_init("kernel", kern_exit_table); 99 return 0; 100 } 101 late_initcall(kernel_exit_sysctls_init); 102 #endif 103 104 static atomic_t oops_count = ATOMIC_INIT(0); 105 106 #ifdef CONFIG_SYSFS 107 static ssize_t oops_count_show(struct kobject *kobj, struct kobj_attribute *attr, 108 char *page) 109 { 110 return sysfs_emit(page, "%d\n", atomic_read(&oops_count)); 111 } 112 113 static struct kobj_attribute oops_count_attr = __ATTR_RO(oops_count); 114 115 static __init int kernel_exit_sysfs_init(void) 116 { 117 sysfs_add_file_to_group(kernel_kobj, &oops_count_attr.attr, NULL); 118 return 0; 119 } 120 late_initcall(kernel_exit_sysfs_init); 121 #endif 122 123 static void __unhash_process(struct task_struct *p, bool group_dead) 124 { 125 nr_threads--; 126 detach_pid(p, PIDTYPE_PID); 127 if (group_dead) { 128 detach_pid(p, PIDTYPE_TGID); 129 detach_pid(p, PIDTYPE_PGID); 130 detach_pid(p, PIDTYPE_SID); 131 132 list_del_rcu(&p->tasks); 133 list_del_init(&p->sibling); 134 __this_cpu_dec(process_counts); 135 } 136 list_del_rcu(&p->thread_group); 137 list_del_rcu(&p->thread_node); 138 } 139 140 /* 141 * This function expects the tasklist_lock write-locked. 142 */ 143 static void __exit_signal(struct task_struct *tsk) 144 { 145 struct signal_struct *sig = tsk->signal; 146 bool group_dead = thread_group_leader(tsk); 147 struct sighand_struct *sighand; 148 struct tty_struct *tty; 149 u64 utime, stime; 150 151 sighand = rcu_dereference_check(tsk->sighand, 152 lockdep_tasklist_lock_is_held()); 153 spin_lock(&sighand->siglock); 154 155 #ifdef CONFIG_POSIX_TIMERS 156 posix_cpu_timers_exit(tsk); 157 if (group_dead) 158 posix_cpu_timers_exit_group(tsk); 159 #endif 160 161 if (group_dead) { 162 tty = sig->tty; 163 sig->tty = NULL; 164 } else { 165 /* 166 * If there is any task waiting for the group exit 167 * then notify it: 168 */ 169 if (sig->notify_count > 0 && !--sig->notify_count) 170 wake_up_process(sig->group_exec_task); 171 172 if (tsk == sig->curr_target) 173 sig->curr_target = next_thread(tsk); 174 } 175 176 add_device_randomness((const void*) &tsk->se.sum_exec_runtime, 177 sizeof(unsigned long long)); 178 179 /* 180 * Accumulate here the counters for all threads as they die. We could 181 * skip the group leader because it is the last user of signal_struct, 182 * but we want to avoid the race with thread_group_cputime() which can 183 * see the empty ->thread_head list. 184 */ 185 task_cputime(tsk, &utime, &stime); 186 write_seqlock(&sig->stats_lock); 187 sig->utime += utime; 188 sig->stime += stime; 189 sig->gtime += task_gtime(tsk); 190 sig->min_flt += tsk->min_flt; 191 sig->maj_flt += tsk->maj_flt; 192 sig->nvcsw += tsk->nvcsw; 193 sig->nivcsw += tsk->nivcsw; 194 sig->inblock += task_io_get_inblock(tsk); 195 sig->oublock += task_io_get_oublock(tsk); 196 task_io_accounting_add(&sig->ioac, &tsk->ioac); 197 sig->sum_sched_runtime += tsk->se.sum_exec_runtime; 198 sig->nr_threads--; 199 __unhash_process(tsk, group_dead); 200 write_sequnlock(&sig->stats_lock); 201 202 /* 203 * Do this under ->siglock, we can race with another thread 204 * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals. 205 */ 206 flush_sigqueue(&tsk->pending); 207 tsk->sighand = NULL; 208 spin_unlock(&sighand->siglock); 209 210 __cleanup_sighand(sighand); 211 clear_tsk_thread_flag(tsk, TIF_SIGPENDING); 212 if (group_dead) { 213 flush_sigqueue(&sig->shared_pending); 214 tty_kref_put(tty); 215 } 216 } 217 218 static void delayed_put_task_struct(struct rcu_head *rhp) 219 { 220 struct task_struct *tsk = container_of(rhp, struct task_struct, rcu); 221 222 kprobe_flush_task(tsk); 223 rethook_flush_task(tsk); 224 perf_event_delayed_put(tsk); 225 trace_sched_process_free(tsk); 226 put_task_struct(tsk); 227 } 228 229 void put_task_struct_rcu_user(struct task_struct *task) 230 { 231 if (refcount_dec_and_test(&task->rcu_users)) 232 call_rcu(&task->rcu, delayed_put_task_struct); 233 } 234 235 void __weak release_thread(struct task_struct *dead_task) 236 { 237 } 238 239 void release_task(struct task_struct *p) 240 { 241 struct task_struct *leader; 242 struct pid *thread_pid; 243 int zap_leader; 244 repeat: 245 /* don't need to get the RCU readlock here - the process is dead and 246 * can't be modifying its own credentials. But shut RCU-lockdep up */ 247 rcu_read_lock(); 248 dec_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1); 249 rcu_read_unlock(); 250 251 cgroup_release(p); 252 253 write_lock_irq(&tasklist_lock); 254 ptrace_release_task(p); 255 thread_pid = get_pid(p->thread_pid); 256 __exit_signal(p); 257 258 /* 259 * If we are the last non-leader member of the thread 260 * group, and the leader is zombie, then notify the 261 * group leader's parent process. (if it wants notification.) 262 */ 263 zap_leader = 0; 264 leader = p->group_leader; 265 if (leader != p && thread_group_empty(leader) 266 && leader->exit_state == EXIT_ZOMBIE) { 267 /* 268 * If we were the last child thread and the leader has 269 * exited already, and the leader's parent ignores SIGCHLD, 270 * then we are the one who should release the leader. 271 */ 272 zap_leader = do_notify_parent(leader, leader->exit_signal); 273 if (zap_leader) 274 leader->exit_state = EXIT_DEAD; 275 } 276 277 write_unlock_irq(&tasklist_lock); 278 seccomp_filter_release(p); 279 proc_flush_pid(thread_pid); 280 put_pid(thread_pid); 281 release_thread(p); 282 put_task_struct_rcu_user(p); 283 284 p = leader; 285 if (unlikely(zap_leader)) 286 goto repeat; 287 } 288 289 int rcuwait_wake_up(struct rcuwait *w) 290 { 291 int ret = 0; 292 struct task_struct *task; 293 294 rcu_read_lock(); 295 296 /* 297 * Order condition vs @task, such that everything prior to the load 298 * of @task is visible. This is the condition as to why the user called 299 * rcuwait_wake() in the first place. Pairs with set_current_state() 300 * barrier (A) in rcuwait_wait_event(). 301 * 302 * WAIT WAKE 303 * [S] tsk = current [S] cond = true 304 * MB (A) MB (B) 305 * [L] cond [L] tsk 306 */ 307 smp_mb(); /* (B) */ 308 309 task = rcu_dereference(w->task); 310 if (task) 311 ret = wake_up_process(task); 312 rcu_read_unlock(); 313 314 return ret; 315 } 316 EXPORT_SYMBOL_GPL(rcuwait_wake_up); 317 318 /* 319 * Determine if a process group is "orphaned", according to the POSIX 320 * definition in 2.2.2.52. Orphaned process groups are not to be affected 321 * by terminal-generated stop signals. Newly orphaned process groups are 322 * to receive a SIGHUP and a SIGCONT. 323 * 324 * "I ask you, have you ever known what it is to be an orphan?" 325 */ 326 static int will_become_orphaned_pgrp(struct pid *pgrp, 327 struct task_struct *ignored_task) 328 { 329 struct task_struct *p; 330 331 do_each_pid_task(pgrp, PIDTYPE_PGID, p) { 332 if ((p == ignored_task) || 333 (p->exit_state && thread_group_empty(p)) || 334 is_global_init(p->real_parent)) 335 continue; 336 337 if (task_pgrp(p->real_parent) != pgrp && 338 task_session(p->real_parent) == task_session(p)) 339 return 0; 340 } while_each_pid_task(pgrp, PIDTYPE_PGID, p); 341 342 return 1; 343 } 344 345 int is_current_pgrp_orphaned(void) 346 { 347 int retval; 348 349 read_lock(&tasklist_lock); 350 retval = will_become_orphaned_pgrp(task_pgrp(current), NULL); 351 read_unlock(&tasklist_lock); 352 353 return retval; 354 } 355 356 static bool has_stopped_jobs(struct pid *pgrp) 357 { 358 struct task_struct *p; 359 360 do_each_pid_task(pgrp, PIDTYPE_PGID, p) { 361 if (p->signal->flags & SIGNAL_STOP_STOPPED) 362 return true; 363 } while_each_pid_task(pgrp, PIDTYPE_PGID, p); 364 365 return false; 366 } 367 368 /* 369 * Check to see if any process groups have become orphaned as 370 * a result of our exiting, and if they have any stopped jobs, 371 * send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2) 372 */ 373 static void 374 kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent) 375 { 376 struct pid *pgrp = task_pgrp(tsk); 377 struct task_struct *ignored_task = tsk; 378 379 if (!parent) 380 /* exit: our father is in a different pgrp than 381 * we are and we were the only connection outside. 382 */ 383 parent = tsk->real_parent; 384 else 385 /* reparent: our child is in a different pgrp than 386 * we are, and it was the only connection outside. 387 */ 388 ignored_task = NULL; 389 390 if (task_pgrp(parent) != pgrp && 391 task_session(parent) == task_session(tsk) && 392 will_become_orphaned_pgrp(pgrp, ignored_task) && 393 has_stopped_jobs(pgrp)) { 394 __kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp); 395 __kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp); 396 } 397 } 398 399 static void coredump_task_exit(struct task_struct *tsk) 400 { 401 struct core_state *core_state; 402 403 /* 404 * Serialize with any possible pending coredump. 405 * We must hold siglock around checking core_state 406 * and setting PF_POSTCOREDUMP. The core-inducing thread 407 * will increment ->nr_threads for each thread in the 408 * group without PF_POSTCOREDUMP set. 409 */ 410 spin_lock_irq(&tsk->sighand->siglock); 411 tsk->flags |= PF_POSTCOREDUMP; 412 core_state = tsk->signal->core_state; 413 spin_unlock_irq(&tsk->sighand->siglock); 414 415 /* The vhost_worker does not particpate in coredumps */ 416 if (core_state && 417 ((tsk->flags & (PF_IO_WORKER | PF_USER_WORKER)) != PF_USER_WORKER)) { 418 struct core_thread self; 419 420 self.task = current; 421 if (self.task->flags & PF_SIGNALED) 422 self.next = xchg(&core_state->dumper.next, &self); 423 else 424 self.task = NULL; 425 /* 426 * Implies mb(), the result of xchg() must be visible 427 * to core_state->dumper. 428 */ 429 if (atomic_dec_and_test(&core_state->nr_threads)) 430 complete(&core_state->startup); 431 432 for (;;) { 433 set_current_state(TASK_UNINTERRUPTIBLE|TASK_FREEZABLE); 434 if (!self.task) /* see coredump_finish() */ 435 break; 436 schedule(); 437 } 438 __set_current_state(TASK_RUNNING); 439 } 440 } 441 442 #ifdef CONFIG_MEMCG 443 /* 444 * A task is exiting. If it owned this mm, find a new owner for the mm. 445 */ 446 void mm_update_next_owner(struct mm_struct *mm) 447 { 448 struct task_struct *c, *g, *p = current; 449 450 retry: 451 /* 452 * If the exiting or execing task is not the owner, it's 453 * someone else's problem. 454 */ 455 if (mm->owner != p) 456 return; 457 /* 458 * The current owner is exiting/execing and there are no other 459 * candidates. Do not leave the mm pointing to a possibly 460 * freed task structure. 461 */ 462 if (atomic_read(&mm->mm_users) <= 1) { 463 WRITE_ONCE(mm->owner, NULL); 464 return; 465 } 466 467 read_lock(&tasklist_lock); 468 /* 469 * Search in the children 470 */ 471 list_for_each_entry(c, &p->children, sibling) { 472 if (c->mm == mm) 473 goto assign_new_owner; 474 } 475 476 /* 477 * Search in the siblings 478 */ 479 list_for_each_entry(c, &p->real_parent->children, sibling) { 480 if (c->mm == mm) 481 goto assign_new_owner; 482 } 483 484 /* 485 * Search through everything else, we should not get here often. 486 */ 487 for_each_process(g) { 488 if (g->flags & PF_KTHREAD) 489 continue; 490 for_each_thread(g, c) { 491 if (c->mm == mm) 492 goto assign_new_owner; 493 if (c->mm) 494 break; 495 } 496 } 497 read_unlock(&tasklist_lock); 498 /* 499 * We found no owner yet mm_users > 1: this implies that we are 500 * most likely racing with swapoff (try_to_unuse()) or /proc or 501 * ptrace or page migration (get_task_mm()). Mark owner as NULL. 502 */ 503 WRITE_ONCE(mm->owner, NULL); 504 return; 505 506 assign_new_owner: 507 BUG_ON(c == p); 508 get_task_struct(c); 509 /* 510 * The task_lock protects c->mm from changing. 511 * We always want mm->owner->mm == mm 512 */ 513 task_lock(c); 514 /* 515 * Delay read_unlock() till we have the task_lock() 516 * to ensure that c does not slip away underneath us 517 */ 518 read_unlock(&tasklist_lock); 519 if (c->mm != mm) { 520 task_unlock(c); 521 put_task_struct(c); 522 goto retry; 523 } 524 WRITE_ONCE(mm->owner, c); 525 lru_gen_migrate_mm(mm); 526 task_unlock(c); 527 put_task_struct(c); 528 } 529 #endif /* CONFIG_MEMCG */ 530 531 /* 532 * Turn us into a lazy TLB process if we 533 * aren't already.. 534 */ 535 static void exit_mm(void) 536 { 537 struct mm_struct *mm = current->mm; 538 539 exit_mm_release(current, mm); 540 if (!mm) 541 return; 542 sync_mm_rss(mm); 543 mmap_read_lock(mm); 544 mmgrab_lazy_tlb(mm); 545 BUG_ON(mm != current->active_mm); 546 /* more a memory barrier than a real lock */ 547 task_lock(current); 548 /* 549 * When a thread stops operating on an address space, the loop 550 * in membarrier_private_expedited() may not observe that 551 * tsk->mm, and the loop in membarrier_global_expedited() may 552 * not observe a MEMBARRIER_STATE_GLOBAL_EXPEDITED 553 * rq->membarrier_state, so those would not issue an IPI. 554 * Membarrier requires a memory barrier after accessing 555 * user-space memory, before clearing tsk->mm or the 556 * rq->membarrier_state. 557 */ 558 smp_mb__after_spinlock(); 559 local_irq_disable(); 560 current->mm = NULL; 561 membarrier_update_current_mm(NULL); 562 enter_lazy_tlb(mm, current); 563 local_irq_enable(); 564 task_unlock(current); 565 mmap_read_unlock(mm); 566 mm_update_next_owner(mm); 567 mmput(mm); 568 if (test_thread_flag(TIF_MEMDIE)) 569 exit_oom_victim(); 570 } 571 572 static struct task_struct *find_alive_thread(struct task_struct *p) 573 { 574 struct task_struct *t; 575 576 for_each_thread(p, t) { 577 if (!(t->flags & PF_EXITING)) 578 return t; 579 } 580 return NULL; 581 } 582 583 static struct task_struct *find_child_reaper(struct task_struct *father, 584 struct list_head *dead) 585 __releases(&tasklist_lock) 586 __acquires(&tasklist_lock) 587 { 588 struct pid_namespace *pid_ns = task_active_pid_ns(father); 589 struct task_struct *reaper = pid_ns->child_reaper; 590 struct task_struct *p, *n; 591 592 if (likely(reaper != father)) 593 return reaper; 594 595 reaper = find_alive_thread(father); 596 if (reaper) { 597 pid_ns->child_reaper = reaper; 598 return reaper; 599 } 600 601 write_unlock_irq(&tasklist_lock); 602 603 list_for_each_entry_safe(p, n, dead, ptrace_entry) { 604 list_del_init(&p->ptrace_entry); 605 release_task(p); 606 } 607 608 zap_pid_ns_processes(pid_ns); 609 write_lock_irq(&tasklist_lock); 610 611 return father; 612 } 613 614 /* 615 * When we die, we re-parent all our children, and try to: 616 * 1. give them to another thread in our thread group, if such a member exists 617 * 2. give it to the first ancestor process which prctl'd itself as a 618 * child_subreaper for its children (like a service manager) 619 * 3. give it to the init process (PID 1) in our pid namespace 620 */ 621 static struct task_struct *find_new_reaper(struct task_struct *father, 622 struct task_struct *child_reaper) 623 { 624 struct task_struct *thread, *reaper; 625 626 thread = find_alive_thread(father); 627 if (thread) 628 return thread; 629 630 if (father->signal->has_child_subreaper) { 631 unsigned int ns_level = task_pid(father)->level; 632 /* 633 * Find the first ->is_child_subreaper ancestor in our pid_ns. 634 * We can't check reaper != child_reaper to ensure we do not 635 * cross the namespaces, the exiting parent could be injected 636 * by setns() + fork(). 637 * We check pid->level, this is slightly more efficient than 638 * task_active_pid_ns(reaper) != task_active_pid_ns(father). 639 */ 640 for (reaper = father->real_parent; 641 task_pid(reaper)->level == ns_level; 642 reaper = reaper->real_parent) { 643 if (reaper == &init_task) 644 break; 645 if (!reaper->signal->is_child_subreaper) 646 continue; 647 thread = find_alive_thread(reaper); 648 if (thread) 649 return thread; 650 } 651 } 652 653 return child_reaper; 654 } 655 656 /* 657 * Any that need to be release_task'd are put on the @dead list. 658 */ 659 static void reparent_leader(struct task_struct *father, struct task_struct *p, 660 struct list_head *dead) 661 { 662 if (unlikely(p->exit_state == EXIT_DEAD)) 663 return; 664 665 /* We don't want people slaying init. */ 666 p->exit_signal = SIGCHLD; 667 668 /* If it has exited notify the new parent about this child's death. */ 669 if (!p->ptrace && 670 p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) { 671 if (do_notify_parent(p, p->exit_signal)) { 672 p->exit_state = EXIT_DEAD; 673 list_add(&p->ptrace_entry, dead); 674 } 675 } 676 677 kill_orphaned_pgrp(p, father); 678 } 679 680 /* 681 * This does two things: 682 * 683 * A. Make init inherit all the child processes 684 * B. Check to see if any process groups have become orphaned 685 * as a result of our exiting, and if they have any stopped 686 * jobs, send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2) 687 */ 688 static void forget_original_parent(struct task_struct *father, 689 struct list_head *dead) 690 { 691 struct task_struct *p, *t, *reaper; 692 693 if (unlikely(!list_empty(&father->ptraced))) 694 exit_ptrace(father, dead); 695 696 /* Can drop and reacquire tasklist_lock */ 697 reaper = find_child_reaper(father, dead); 698 if (list_empty(&father->children)) 699 return; 700 701 reaper = find_new_reaper(father, reaper); 702 list_for_each_entry(p, &father->children, sibling) { 703 for_each_thread(p, t) { 704 RCU_INIT_POINTER(t->real_parent, reaper); 705 BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father)); 706 if (likely(!t->ptrace)) 707 t->parent = t->real_parent; 708 if (t->pdeath_signal) 709 group_send_sig_info(t->pdeath_signal, 710 SEND_SIG_NOINFO, t, 711 PIDTYPE_TGID); 712 } 713 /* 714 * If this is a threaded reparent there is no need to 715 * notify anyone anything has happened. 716 */ 717 if (!same_thread_group(reaper, father)) 718 reparent_leader(father, p, dead); 719 } 720 list_splice_tail_init(&father->children, &reaper->children); 721 } 722 723 /* 724 * Send signals to all our closest relatives so that they know 725 * to properly mourn us.. 726 */ 727 static void exit_notify(struct task_struct *tsk, int group_dead) 728 { 729 bool autoreap; 730 struct task_struct *p, *n; 731 LIST_HEAD(dead); 732 733 write_lock_irq(&tasklist_lock); 734 forget_original_parent(tsk, &dead); 735 736 if (group_dead) 737 kill_orphaned_pgrp(tsk->group_leader, NULL); 738 739 tsk->exit_state = EXIT_ZOMBIE; 740 if (unlikely(tsk->ptrace)) { 741 int sig = thread_group_leader(tsk) && 742 thread_group_empty(tsk) && 743 !ptrace_reparented(tsk) ? 744 tsk->exit_signal : SIGCHLD; 745 autoreap = do_notify_parent(tsk, sig); 746 } else if (thread_group_leader(tsk)) { 747 autoreap = thread_group_empty(tsk) && 748 do_notify_parent(tsk, tsk->exit_signal); 749 } else { 750 autoreap = true; 751 } 752 753 if (autoreap) { 754 tsk->exit_state = EXIT_DEAD; 755 list_add(&tsk->ptrace_entry, &dead); 756 } 757 758 /* mt-exec, de_thread() is waiting for group leader */ 759 if (unlikely(tsk->signal->notify_count < 0)) 760 wake_up_process(tsk->signal->group_exec_task); 761 write_unlock_irq(&tasklist_lock); 762 763 list_for_each_entry_safe(p, n, &dead, ptrace_entry) { 764 list_del_init(&p->ptrace_entry); 765 release_task(p); 766 } 767 } 768 769 #ifdef CONFIG_DEBUG_STACK_USAGE 770 static void check_stack_usage(void) 771 { 772 static DEFINE_SPINLOCK(low_water_lock); 773 static int lowest_to_date = THREAD_SIZE; 774 unsigned long free; 775 776 free = stack_not_used(current); 777 778 if (free >= lowest_to_date) 779 return; 780 781 spin_lock(&low_water_lock); 782 if (free < lowest_to_date) { 783 pr_info("%s (%d) used greatest stack depth: %lu bytes left\n", 784 current->comm, task_pid_nr(current), free); 785 lowest_to_date = free; 786 } 787 spin_unlock(&low_water_lock); 788 } 789 #else 790 static inline void check_stack_usage(void) {} 791 #endif 792 793 static void synchronize_group_exit(struct task_struct *tsk, long code) 794 { 795 struct sighand_struct *sighand = tsk->sighand; 796 struct signal_struct *signal = tsk->signal; 797 798 spin_lock_irq(&sighand->siglock); 799 signal->quick_threads--; 800 if ((signal->quick_threads == 0) && 801 !(signal->flags & SIGNAL_GROUP_EXIT)) { 802 signal->flags = SIGNAL_GROUP_EXIT; 803 signal->group_exit_code = code; 804 signal->group_stop_count = 0; 805 } 806 spin_unlock_irq(&sighand->siglock); 807 } 808 809 void __noreturn do_exit(long code) 810 { 811 struct task_struct *tsk = current; 812 int group_dead; 813 814 WARN_ON(irqs_disabled()); 815 816 synchronize_group_exit(tsk, code); 817 818 WARN_ON(tsk->plug); 819 820 kcov_task_exit(tsk); 821 kmsan_task_exit(tsk); 822 823 coredump_task_exit(tsk); 824 ptrace_event(PTRACE_EVENT_EXIT, code); 825 user_events_exit(tsk); 826 827 validate_creds_for_do_exit(tsk); 828 829 io_uring_files_cancel(); 830 exit_signals(tsk); /* sets PF_EXITING */ 831 832 /* sync mm's RSS info before statistics gathering */ 833 if (tsk->mm) 834 sync_mm_rss(tsk->mm); 835 acct_update_integrals(tsk); 836 group_dead = atomic_dec_and_test(&tsk->signal->live); 837 if (group_dead) { 838 /* 839 * If the last thread of global init has exited, panic 840 * immediately to get a useable coredump. 841 */ 842 if (unlikely(is_global_init(tsk))) 843 panic("Attempted to kill init! exitcode=0x%08x\n", 844 tsk->signal->group_exit_code ?: (int)code); 845 846 #ifdef CONFIG_POSIX_TIMERS 847 hrtimer_cancel(&tsk->signal->real_timer); 848 exit_itimers(tsk); 849 #endif 850 if (tsk->mm) 851 setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm); 852 } 853 acct_collect(code, group_dead); 854 if (group_dead) 855 tty_audit_exit(); 856 audit_free(tsk); 857 858 tsk->exit_code = code; 859 taskstats_exit(tsk, group_dead); 860 861 exit_mm(); 862 863 if (group_dead) 864 acct_process(); 865 trace_sched_process_exit(tsk); 866 867 exit_sem(tsk); 868 exit_shm(tsk); 869 exit_files(tsk); 870 exit_fs(tsk); 871 if (group_dead) 872 disassociate_ctty(1); 873 exit_task_namespaces(tsk); 874 exit_task_work(tsk); 875 exit_thread(tsk); 876 877 /* 878 * Flush inherited counters to the parent - before the parent 879 * gets woken up by child-exit notifications. 880 * 881 * because of cgroup mode, must be called before cgroup_exit() 882 */ 883 perf_event_exit_task(tsk); 884 885 sched_autogroup_exit_task(tsk); 886 cgroup_exit(tsk); 887 888 /* 889 * FIXME: do that only when needed, using sched_exit tracepoint 890 */ 891 flush_ptrace_hw_breakpoint(tsk); 892 893 exit_tasks_rcu_start(); 894 exit_notify(tsk, group_dead); 895 proc_exit_connector(tsk); 896 mpol_put_task_policy(tsk); 897 #ifdef CONFIG_FUTEX 898 if (unlikely(current->pi_state_cache)) 899 kfree(current->pi_state_cache); 900 #endif 901 /* 902 * Make sure we are holding no locks: 903 */ 904 debug_check_no_locks_held(); 905 906 if (tsk->io_context) 907 exit_io_context(tsk); 908 909 if (tsk->splice_pipe) 910 free_pipe_info(tsk->splice_pipe); 911 912 if (tsk->task_frag.page) 913 put_page(tsk->task_frag.page); 914 915 validate_creds_for_do_exit(tsk); 916 exit_task_stack_account(tsk); 917 918 check_stack_usage(); 919 preempt_disable(); 920 if (tsk->nr_dirtied) 921 __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied); 922 exit_rcu(); 923 exit_tasks_rcu_finish(); 924 925 lockdep_free_task(tsk); 926 do_task_dead(); 927 } 928 929 void __noreturn make_task_dead(int signr) 930 { 931 /* 932 * Take the task off the cpu after something catastrophic has 933 * happened. 934 * 935 * We can get here from a kernel oops, sometimes with preemption off. 936 * Start by checking for critical errors. 937 * Then fix up important state like USER_DS and preemption. 938 * Then do everything else. 939 */ 940 struct task_struct *tsk = current; 941 unsigned int limit; 942 943 if (unlikely(in_interrupt())) 944 panic("Aiee, killing interrupt handler!"); 945 if (unlikely(!tsk->pid)) 946 panic("Attempted to kill the idle task!"); 947 948 if (unlikely(irqs_disabled())) { 949 pr_info("note: %s[%d] exited with irqs disabled\n", 950 current->comm, task_pid_nr(current)); 951 local_irq_enable(); 952 } 953 if (unlikely(in_atomic())) { 954 pr_info("note: %s[%d] exited with preempt_count %d\n", 955 current->comm, task_pid_nr(current), 956 preempt_count()); 957 preempt_count_set(PREEMPT_ENABLED); 958 } 959 960 /* 961 * Every time the system oopses, if the oops happens while a reference 962 * to an object was held, the reference leaks. 963 * If the oops doesn't also leak memory, repeated oopsing can cause 964 * reference counters to wrap around (if they're not using refcount_t). 965 * This means that repeated oopsing can make unexploitable-looking bugs 966 * exploitable through repeated oopsing. 967 * To make sure this can't happen, place an upper bound on how often the 968 * kernel may oops without panic(). 969 */ 970 limit = READ_ONCE(oops_limit); 971 if (atomic_inc_return(&oops_count) >= limit && limit) 972 panic("Oopsed too often (kernel.oops_limit is %d)", limit); 973 974 /* 975 * We're taking recursive faults here in make_task_dead. Safest is to just 976 * leave this task alone and wait for reboot. 977 */ 978 if (unlikely(tsk->flags & PF_EXITING)) { 979 pr_alert("Fixing recursive fault but reboot is needed!\n"); 980 futex_exit_recursive(tsk); 981 tsk->exit_state = EXIT_DEAD; 982 refcount_inc(&tsk->rcu_users); 983 do_task_dead(); 984 } 985 986 do_exit(signr); 987 } 988 989 SYSCALL_DEFINE1(exit, int, error_code) 990 { 991 do_exit((error_code&0xff)<<8); 992 } 993 994 /* 995 * Take down every thread in the group. This is called by fatal signals 996 * as well as by sys_exit_group (below). 997 */ 998 void __noreturn 999 do_group_exit(int exit_code) 1000 { 1001 struct signal_struct *sig = current->signal; 1002 1003 if (sig->flags & SIGNAL_GROUP_EXIT) 1004 exit_code = sig->group_exit_code; 1005 else if (sig->group_exec_task) 1006 exit_code = 0; 1007 else { 1008 struct sighand_struct *const sighand = current->sighand; 1009 1010 spin_lock_irq(&sighand->siglock); 1011 if (sig->flags & SIGNAL_GROUP_EXIT) 1012 /* Another thread got here before we took the lock. */ 1013 exit_code = sig->group_exit_code; 1014 else if (sig->group_exec_task) 1015 exit_code = 0; 1016 else { 1017 sig->group_exit_code = exit_code; 1018 sig->flags = SIGNAL_GROUP_EXIT; 1019 zap_other_threads(current); 1020 } 1021 spin_unlock_irq(&sighand->siglock); 1022 } 1023 1024 do_exit(exit_code); 1025 /* NOTREACHED */ 1026 } 1027 1028 /* 1029 * this kills every thread in the thread group. Note that any externally 1030 * wait4()-ing process will get the correct exit code - even if this 1031 * thread is not the thread group leader. 1032 */ 1033 SYSCALL_DEFINE1(exit_group, int, error_code) 1034 { 1035 do_group_exit((error_code & 0xff) << 8); 1036 /* NOTREACHED */ 1037 return 0; 1038 } 1039 1040 struct waitid_info { 1041 pid_t pid; 1042 uid_t uid; 1043 int status; 1044 int cause; 1045 }; 1046 1047 struct wait_opts { 1048 enum pid_type wo_type; 1049 int wo_flags; 1050 struct pid *wo_pid; 1051 1052 struct waitid_info *wo_info; 1053 int wo_stat; 1054 struct rusage *wo_rusage; 1055 1056 wait_queue_entry_t child_wait; 1057 int notask_error; 1058 }; 1059 1060 static int eligible_pid(struct wait_opts *wo, struct task_struct *p) 1061 { 1062 return wo->wo_type == PIDTYPE_MAX || 1063 task_pid_type(p, wo->wo_type) == wo->wo_pid; 1064 } 1065 1066 static int 1067 eligible_child(struct wait_opts *wo, bool ptrace, struct task_struct *p) 1068 { 1069 if (!eligible_pid(wo, p)) 1070 return 0; 1071 1072 /* 1073 * Wait for all children (clone and not) if __WALL is set or 1074 * if it is traced by us. 1075 */ 1076 if (ptrace || (wo->wo_flags & __WALL)) 1077 return 1; 1078 1079 /* 1080 * Otherwise, wait for clone children *only* if __WCLONE is set; 1081 * otherwise, wait for non-clone children *only*. 1082 * 1083 * Note: a "clone" child here is one that reports to its parent 1084 * using a signal other than SIGCHLD, or a non-leader thread which 1085 * we can only see if it is traced by us. 1086 */ 1087 if ((p->exit_signal != SIGCHLD) ^ !!(wo->wo_flags & __WCLONE)) 1088 return 0; 1089 1090 return 1; 1091 } 1092 1093 /* 1094 * Handle sys_wait4 work for one task in state EXIT_ZOMBIE. We hold 1095 * read_lock(&tasklist_lock) on entry. If we return zero, we still hold 1096 * the lock and this task is uninteresting. If we return nonzero, we have 1097 * released the lock and the system call should return. 1098 */ 1099 static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p) 1100 { 1101 int state, status; 1102 pid_t pid = task_pid_vnr(p); 1103 uid_t uid = from_kuid_munged(current_user_ns(), task_uid(p)); 1104 struct waitid_info *infop; 1105 1106 if (!likely(wo->wo_flags & WEXITED)) 1107 return 0; 1108 1109 if (unlikely(wo->wo_flags & WNOWAIT)) { 1110 status = (p->signal->flags & SIGNAL_GROUP_EXIT) 1111 ? p->signal->group_exit_code : p->exit_code; 1112 get_task_struct(p); 1113 read_unlock(&tasklist_lock); 1114 sched_annotate_sleep(); 1115 if (wo->wo_rusage) 1116 getrusage(p, RUSAGE_BOTH, wo->wo_rusage); 1117 put_task_struct(p); 1118 goto out_info; 1119 } 1120 /* 1121 * Move the task's state to DEAD/TRACE, only one thread can do this. 1122 */ 1123 state = (ptrace_reparented(p) && thread_group_leader(p)) ? 1124 EXIT_TRACE : EXIT_DEAD; 1125 if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE) 1126 return 0; 1127 /* 1128 * We own this thread, nobody else can reap it. 1129 */ 1130 read_unlock(&tasklist_lock); 1131 sched_annotate_sleep(); 1132 1133 /* 1134 * Check thread_group_leader() to exclude the traced sub-threads. 1135 */ 1136 if (state == EXIT_DEAD && thread_group_leader(p)) { 1137 struct signal_struct *sig = p->signal; 1138 struct signal_struct *psig = current->signal; 1139 unsigned long maxrss; 1140 u64 tgutime, tgstime; 1141 1142 /* 1143 * The resource counters for the group leader are in its 1144 * own task_struct. Those for dead threads in the group 1145 * are in its signal_struct, as are those for the child 1146 * processes it has previously reaped. All these 1147 * accumulate in the parent's signal_struct c* fields. 1148 * 1149 * We don't bother to take a lock here to protect these 1150 * p->signal fields because the whole thread group is dead 1151 * and nobody can change them. 1152 * 1153 * psig->stats_lock also protects us from our sub-threads 1154 * which can reap other children at the same time. Until 1155 * we change k_getrusage()-like users to rely on this lock 1156 * we have to take ->siglock as well. 1157 * 1158 * We use thread_group_cputime_adjusted() to get times for 1159 * the thread group, which consolidates times for all threads 1160 * in the group including the group leader. 1161 */ 1162 thread_group_cputime_adjusted(p, &tgutime, &tgstime); 1163 spin_lock_irq(¤t->sighand->siglock); 1164 write_seqlock(&psig->stats_lock); 1165 psig->cutime += tgutime + sig->cutime; 1166 psig->cstime += tgstime + sig->cstime; 1167 psig->cgtime += task_gtime(p) + sig->gtime + sig->cgtime; 1168 psig->cmin_flt += 1169 p->min_flt + sig->min_flt + sig->cmin_flt; 1170 psig->cmaj_flt += 1171 p->maj_flt + sig->maj_flt + sig->cmaj_flt; 1172 psig->cnvcsw += 1173 p->nvcsw + sig->nvcsw + sig->cnvcsw; 1174 psig->cnivcsw += 1175 p->nivcsw + sig->nivcsw + sig->cnivcsw; 1176 psig->cinblock += 1177 task_io_get_inblock(p) + 1178 sig->inblock + sig->cinblock; 1179 psig->coublock += 1180 task_io_get_oublock(p) + 1181 sig->oublock + sig->coublock; 1182 maxrss = max(sig->maxrss, sig->cmaxrss); 1183 if (psig->cmaxrss < maxrss) 1184 psig->cmaxrss = maxrss; 1185 task_io_accounting_add(&psig->ioac, &p->ioac); 1186 task_io_accounting_add(&psig->ioac, &sig->ioac); 1187 write_sequnlock(&psig->stats_lock); 1188 spin_unlock_irq(¤t->sighand->siglock); 1189 } 1190 1191 if (wo->wo_rusage) 1192 getrusage(p, RUSAGE_BOTH, wo->wo_rusage); 1193 status = (p->signal->flags & SIGNAL_GROUP_EXIT) 1194 ? p->signal->group_exit_code : p->exit_code; 1195 wo->wo_stat = status; 1196 1197 if (state == EXIT_TRACE) { 1198 write_lock_irq(&tasklist_lock); 1199 /* We dropped tasklist, ptracer could die and untrace */ 1200 ptrace_unlink(p); 1201 1202 /* If parent wants a zombie, don't release it now */ 1203 state = EXIT_ZOMBIE; 1204 if (do_notify_parent(p, p->exit_signal)) 1205 state = EXIT_DEAD; 1206 p->exit_state = state; 1207 write_unlock_irq(&tasklist_lock); 1208 } 1209 if (state == EXIT_DEAD) 1210 release_task(p); 1211 1212 out_info: 1213 infop = wo->wo_info; 1214 if (infop) { 1215 if ((status & 0x7f) == 0) { 1216 infop->cause = CLD_EXITED; 1217 infop->status = status >> 8; 1218 } else { 1219 infop->cause = (status & 0x80) ? CLD_DUMPED : CLD_KILLED; 1220 infop->status = status & 0x7f; 1221 } 1222 infop->pid = pid; 1223 infop->uid = uid; 1224 } 1225 1226 return pid; 1227 } 1228 1229 static int *task_stopped_code(struct task_struct *p, bool ptrace) 1230 { 1231 if (ptrace) { 1232 if (task_is_traced(p) && !(p->jobctl & JOBCTL_LISTENING)) 1233 return &p->exit_code; 1234 } else { 1235 if (p->signal->flags & SIGNAL_STOP_STOPPED) 1236 return &p->signal->group_exit_code; 1237 } 1238 return NULL; 1239 } 1240 1241 /** 1242 * wait_task_stopped - Wait for %TASK_STOPPED or %TASK_TRACED 1243 * @wo: wait options 1244 * @ptrace: is the wait for ptrace 1245 * @p: task to wait for 1246 * 1247 * Handle sys_wait4() work for %p in state %TASK_STOPPED or %TASK_TRACED. 1248 * 1249 * CONTEXT: 1250 * read_lock(&tasklist_lock), which is released if return value is 1251 * non-zero. Also, grabs and releases @p->sighand->siglock. 1252 * 1253 * RETURNS: 1254 * 0 if wait condition didn't exist and search for other wait conditions 1255 * should continue. Non-zero return, -errno on failure and @p's pid on 1256 * success, implies that tasklist_lock is released and wait condition 1257 * search should terminate. 1258 */ 1259 static int wait_task_stopped(struct wait_opts *wo, 1260 int ptrace, struct task_struct *p) 1261 { 1262 struct waitid_info *infop; 1263 int exit_code, *p_code, why; 1264 uid_t uid = 0; /* unneeded, required by compiler */ 1265 pid_t pid; 1266 1267 /* 1268 * Traditionally we see ptrace'd stopped tasks regardless of options. 1269 */ 1270 if (!ptrace && !(wo->wo_flags & WUNTRACED)) 1271 return 0; 1272 1273 if (!task_stopped_code(p, ptrace)) 1274 return 0; 1275 1276 exit_code = 0; 1277 spin_lock_irq(&p->sighand->siglock); 1278 1279 p_code = task_stopped_code(p, ptrace); 1280 if (unlikely(!p_code)) 1281 goto unlock_sig; 1282 1283 exit_code = *p_code; 1284 if (!exit_code) 1285 goto unlock_sig; 1286 1287 if (!unlikely(wo->wo_flags & WNOWAIT)) 1288 *p_code = 0; 1289 1290 uid = from_kuid_munged(current_user_ns(), task_uid(p)); 1291 unlock_sig: 1292 spin_unlock_irq(&p->sighand->siglock); 1293 if (!exit_code) 1294 return 0; 1295 1296 /* 1297 * Now we are pretty sure this task is interesting. 1298 * Make sure it doesn't get reaped out from under us while we 1299 * give up the lock and then examine it below. We don't want to 1300 * keep holding onto the tasklist_lock while we call getrusage and 1301 * possibly take page faults for user memory. 1302 */ 1303 get_task_struct(p); 1304 pid = task_pid_vnr(p); 1305 why = ptrace ? CLD_TRAPPED : CLD_STOPPED; 1306 read_unlock(&tasklist_lock); 1307 sched_annotate_sleep(); 1308 if (wo->wo_rusage) 1309 getrusage(p, RUSAGE_BOTH, wo->wo_rusage); 1310 put_task_struct(p); 1311 1312 if (likely(!(wo->wo_flags & WNOWAIT))) 1313 wo->wo_stat = (exit_code << 8) | 0x7f; 1314 1315 infop = wo->wo_info; 1316 if (infop) { 1317 infop->cause = why; 1318 infop->status = exit_code; 1319 infop->pid = pid; 1320 infop->uid = uid; 1321 } 1322 return pid; 1323 } 1324 1325 /* 1326 * Handle do_wait work for one task in a live, non-stopped state. 1327 * read_lock(&tasklist_lock) on entry. If we return zero, we still hold 1328 * the lock and this task is uninteresting. If we return nonzero, we have 1329 * released the lock and the system call should return. 1330 */ 1331 static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) 1332 { 1333 struct waitid_info *infop; 1334 pid_t pid; 1335 uid_t uid; 1336 1337 if (!unlikely(wo->wo_flags & WCONTINUED)) 1338 return 0; 1339 1340 if (!(p->signal->flags & SIGNAL_STOP_CONTINUED)) 1341 return 0; 1342 1343 spin_lock_irq(&p->sighand->siglock); 1344 /* Re-check with the lock held. */ 1345 if (!(p->signal->flags & SIGNAL_STOP_CONTINUED)) { 1346 spin_unlock_irq(&p->sighand->siglock); 1347 return 0; 1348 } 1349 if (!unlikely(wo->wo_flags & WNOWAIT)) 1350 p->signal->flags &= ~SIGNAL_STOP_CONTINUED; 1351 uid = from_kuid_munged(current_user_ns(), task_uid(p)); 1352 spin_unlock_irq(&p->sighand->siglock); 1353 1354 pid = task_pid_vnr(p); 1355 get_task_struct(p); 1356 read_unlock(&tasklist_lock); 1357 sched_annotate_sleep(); 1358 if (wo->wo_rusage) 1359 getrusage(p, RUSAGE_BOTH, wo->wo_rusage); 1360 put_task_struct(p); 1361 1362 infop = wo->wo_info; 1363 if (!infop) { 1364 wo->wo_stat = 0xffff; 1365 } else { 1366 infop->cause = CLD_CONTINUED; 1367 infop->pid = pid; 1368 infop->uid = uid; 1369 infop->status = SIGCONT; 1370 } 1371 return pid; 1372 } 1373 1374 /* 1375 * Consider @p for a wait by @parent. 1376 * 1377 * -ECHILD should be in ->notask_error before the first call. 1378 * Returns nonzero for a final return, when we have unlocked tasklist_lock. 1379 * Returns zero if the search for a child should continue; 1380 * then ->notask_error is 0 if @p is an eligible child, 1381 * or still -ECHILD. 1382 */ 1383 static int wait_consider_task(struct wait_opts *wo, int ptrace, 1384 struct task_struct *p) 1385 { 1386 /* 1387 * We can race with wait_task_zombie() from another thread. 1388 * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition 1389 * can't confuse the checks below. 1390 */ 1391 int exit_state = READ_ONCE(p->exit_state); 1392 int ret; 1393 1394 if (unlikely(exit_state == EXIT_DEAD)) 1395 return 0; 1396 1397 ret = eligible_child(wo, ptrace, p); 1398 if (!ret) 1399 return ret; 1400 1401 if (unlikely(exit_state == EXIT_TRACE)) { 1402 /* 1403 * ptrace == 0 means we are the natural parent. In this case 1404 * we should clear notask_error, debugger will notify us. 1405 */ 1406 if (likely(!ptrace)) 1407 wo->notask_error = 0; 1408 return 0; 1409 } 1410 1411 if (likely(!ptrace) && unlikely(p->ptrace)) { 1412 /* 1413 * If it is traced by its real parent's group, just pretend 1414 * the caller is ptrace_do_wait() and reap this child if it 1415 * is zombie. 1416 * 1417 * This also hides group stop state from real parent; otherwise 1418 * a single stop can be reported twice as group and ptrace stop. 1419 * If a ptracer wants to distinguish these two events for its 1420 * own children it should create a separate process which takes 1421 * the role of real parent. 1422 */ 1423 if (!ptrace_reparented(p)) 1424 ptrace = 1; 1425 } 1426 1427 /* slay zombie? */ 1428 if (exit_state == EXIT_ZOMBIE) { 1429 /* we don't reap group leaders with subthreads */ 1430 if (!delay_group_leader(p)) { 1431 /* 1432 * A zombie ptracee is only visible to its ptracer. 1433 * Notification and reaping will be cascaded to the 1434 * real parent when the ptracer detaches. 1435 */ 1436 if (unlikely(ptrace) || likely(!p->ptrace)) 1437 return wait_task_zombie(wo, p); 1438 } 1439 1440 /* 1441 * Allow access to stopped/continued state via zombie by 1442 * falling through. Clearing of notask_error is complex. 1443 * 1444 * When !@ptrace: 1445 * 1446 * If WEXITED is set, notask_error should naturally be 1447 * cleared. If not, subset of WSTOPPED|WCONTINUED is set, 1448 * so, if there are live subthreads, there are events to 1449 * wait for. If all subthreads are dead, it's still safe 1450 * to clear - this function will be called again in finite 1451 * amount time once all the subthreads are released and 1452 * will then return without clearing. 1453 * 1454 * When @ptrace: 1455 * 1456 * Stopped state is per-task and thus can't change once the 1457 * target task dies. Only continued and exited can happen. 1458 * Clear notask_error if WCONTINUED | WEXITED. 1459 */ 1460 if (likely(!ptrace) || (wo->wo_flags & (WCONTINUED | WEXITED))) 1461 wo->notask_error = 0; 1462 } else { 1463 /* 1464 * @p is alive and it's gonna stop, continue or exit, so 1465 * there always is something to wait for. 1466 */ 1467 wo->notask_error = 0; 1468 } 1469 1470 /* 1471 * Wait for stopped. Depending on @ptrace, different stopped state 1472 * is used and the two don't interact with each other. 1473 */ 1474 ret = wait_task_stopped(wo, ptrace, p); 1475 if (ret) 1476 return ret; 1477 1478 /* 1479 * Wait for continued. There's only one continued state and the 1480 * ptracer can consume it which can confuse the real parent. Don't 1481 * use WCONTINUED from ptracer. You don't need or want it. 1482 */ 1483 return wait_task_continued(wo, p); 1484 } 1485 1486 /* 1487 * Do the work of do_wait() for one thread in the group, @tsk. 1488 * 1489 * -ECHILD should be in ->notask_error before the first call. 1490 * Returns nonzero for a final return, when we have unlocked tasklist_lock. 1491 * Returns zero if the search for a child should continue; then 1492 * ->notask_error is 0 if there were any eligible children, 1493 * or still -ECHILD. 1494 */ 1495 static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk) 1496 { 1497 struct task_struct *p; 1498 1499 list_for_each_entry(p, &tsk->children, sibling) { 1500 int ret = wait_consider_task(wo, 0, p); 1501 1502 if (ret) 1503 return ret; 1504 } 1505 1506 return 0; 1507 } 1508 1509 static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk) 1510 { 1511 struct task_struct *p; 1512 1513 list_for_each_entry(p, &tsk->ptraced, ptrace_entry) { 1514 int ret = wait_consider_task(wo, 1, p); 1515 1516 if (ret) 1517 return ret; 1518 } 1519 1520 return 0; 1521 } 1522 1523 static int child_wait_callback(wait_queue_entry_t *wait, unsigned mode, 1524 int sync, void *key) 1525 { 1526 struct wait_opts *wo = container_of(wait, struct wait_opts, 1527 child_wait); 1528 struct task_struct *p = key; 1529 1530 if (!eligible_pid(wo, p)) 1531 return 0; 1532 1533 if ((wo->wo_flags & __WNOTHREAD) && wait->private != p->parent) 1534 return 0; 1535 1536 return default_wake_function(wait, mode, sync, key); 1537 } 1538 1539 void __wake_up_parent(struct task_struct *p, struct task_struct *parent) 1540 { 1541 __wake_up_sync_key(&parent->signal->wait_chldexit, 1542 TASK_INTERRUPTIBLE, p); 1543 } 1544 1545 static bool is_effectively_child(struct wait_opts *wo, bool ptrace, 1546 struct task_struct *target) 1547 { 1548 struct task_struct *parent = 1549 !ptrace ? target->real_parent : target->parent; 1550 1551 return current == parent || (!(wo->wo_flags & __WNOTHREAD) && 1552 same_thread_group(current, parent)); 1553 } 1554 1555 /* 1556 * Optimization for waiting on PIDTYPE_PID. No need to iterate through child 1557 * and tracee lists to find the target task. 1558 */ 1559 static int do_wait_pid(struct wait_opts *wo) 1560 { 1561 bool ptrace; 1562 struct task_struct *target; 1563 int retval; 1564 1565 ptrace = false; 1566 target = pid_task(wo->wo_pid, PIDTYPE_TGID); 1567 if (target && is_effectively_child(wo, ptrace, target)) { 1568 retval = wait_consider_task(wo, ptrace, target); 1569 if (retval) 1570 return retval; 1571 } 1572 1573 ptrace = true; 1574 target = pid_task(wo->wo_pid, PIDTYPE_PID); 1575 if (target && target->ptrace && 1576 is_effectively_child(wo, ptrace, target)) { 1577 retval = wait_consider_task(wo, ptrace, target); 1578 if (retval) 1579 return retval; 1580 } 1581 1582 return 0; 1583 } 1584 1585 static long do_wait(struct wait_opts *wo) 1586 { 1587 int retval; 1588 1589 trace_sched_process_wait(wo->wo_pid); 1590 1591 init_waitqueue_func_entry(&wo->child_wait, child_wait_callback); 1592 wo->child_wait.private = current; 1593 add_wait_queue(¤t->signal->wait_chldexit, &wo->child_wait); 1594 repeat: 1595 /* 1596 * If there is nothing that can match our criteria, just get out. 1597 * We will clear ->notask_error to zero if we see any child that 1598 * might later match our criteria, even if we are not able to reap 1599 * it yet. 1600 */ 1601 wo->notask_error = -ECHILD; 1602 if ((wo->wo_type < PIDTYPE_MAX) && 1603 (!wo->wo_pid || !pid_has_task(wo->wo_pid, wo->wo_type))) 1604 goto notask; 1605 1606 set_current_state(TASK_INTERRUPTIBLE); 1607 read_lock(&tasklist_lock); 1608 1609 if (wo->wo_type == PIDTYPE_PID) { 1610 retval = do_wait_pid(wo); 1611 if (retval) 1612 goto end; 1613 } else { 1614 struct task_struct *tsk = current; 1615 1616 do { 1617 retval = do_wait_thread(wo, tsk); 1618 if (retval) 1619 goto end; 1620 1621 retval = ptrace_do_wait(wo, tsk); 1622 if (retval) 1623 goto end; 1624 1625 if (wo->wo_flags & __WNOTHREAD) 1626 break; 1627 } while_each_thread(current, tsk); 1628 } 1629 read_unlock(&tasklist_lock); 1630 1631 notask: 1632 retval = wo->notask_error; 1633 if (!retval && !(wo->wo_flags & WNOHANG)) { 1634 retval = -ERESTARTSYS; 1635 if (!signal_pending(current)) { 1636 schedule(); 1637 goto repeat; 1638 } 1639 } 1640 end: 1641 __set_current_state(TASK_RUNNING); 1642 remove_wait_queue(¤t->signal->wait_chldexit, &wo->child_wait); 1643 return retval; 1644 } 1645 1646 static long kernel_waitid(int which, pid_t upid, struct waitid_info *infop, 1647 int options, struct rusage *ru) 1648 { 1649 struct wait_opts wo; 1650 struct pid *pid = NULL; 1651 enum pid_type type; 1652 long ret; 1653 unsigned int f_flags = 0; 1654 1655 if (options & ~(WNOHANG|WNOWAIT|WEXITED|WSTOPPED|WCONTINUED| 1656 __WNOTHREAD|__WCLONE|__WALL)) 1657 return -EINVAL; 1658 if (!(options & (WEXITED|WSTOPPED|WCONTINUED))) 1659 return -EINVAL; 1660 1661 switch (which) { 1662 case P_ALL: 1663 type = PIDTYPE_MAX; 1664 break; 1665 case P_PID: 1666 type = PIDTYPE_PID; 1667 if (upid <= 0) 1668 return -EINVAL; 1669 1670 pid = find_get_pid(upid); 1671 break; 1672 case P_PGID: 1673 type = PIDTYPE_PGID; 1674 if (upid < 0) 1675 return -EINVAL; 1676 1677 if (upid) 1678 pid = find_get_pid(upid); 1679 else 1680 pid = get_task_pid(current, PIDTYPE_PGID); 1681 break; 1682 case P_PIDFD: 1683 type = PIDTYPE_PID; 1684 if (upid < 0) 1685 return -EINVAL; 1686 1687 pid = pidfd_get_pid(upid, &f_flags); 1688 if (IS_ERR(pid)) 1689 return PTR_ERR(pid); 1690 1691 break; 1692 default: 1693 return -EINVAL; 1694 } 1695 1696 wo.wo_type = type; 1697 wo.wo_pid = pid; 1698 wo.wo_flags = options; 1699 wo.wo_info = infop; 1700 wo.wo_rusage = ru; 1701 if (f_flags & O_NONBLOCK) 1702 wo.wo_flags |= WNOHANG; 1703 1704 ret = do_wait(&wo); 1705 if (!ret && !(options & WNOHANG) && (f_flags & O_NONBLOCK)) 1706 ret = -EAGAIN; 1707 1708 put_pid(pid); 1709 return ret; 1710 } 1711 1712 SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, 1713 infop, int, options, struct rusage __user *, ru) 1714 { 1715 struct rusage r; 1716 struct waitid_info info = {.status = 0}; 1717 long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL); 1718 int signo = 0; 1719 1720 if (err > 0) { 1721 signo = SIGCHLD; 1722 err = 0; 1723 if (ru && copy_to_user(ru, &r, sizeof(struct rusage))) 1724 return -EFAULT; 1725 } 1726 if (!infop) 1727 return err; 1728 1729 if (!user_write_access_begin(infop, sizeof(*infop))) 1730 return -EFAULT; 1731 1732 unsafe_put_user(signo, &infop->si_signo, Efault); 1733 unsafe_put_user(0, &infop->si_errno, Efault); 1734 unsafe_put_user(info.cause, &infop->si_code, Efault); 1735 unsafe_put_user(info.pid, &infop->si_pid, Efault); 1736 unsafe_put_user(info.uid, &infop->si_uid, Efault); 1737 unsafe_put_user(info.status, &infop->si_status, Efault); 1738 user_write_access_end(); 1739 return err; 1740 Efault: 1741 user_write_access_end(); 1742 return -EFAULT; 1743 } 1744 1745 long kernel_wait4(pid_t upid, int __user *stat_addr, int options, 1746 struct rusage *ru) 1747 { 1748 struct wait_opts wo; 1749 struct pid *pid = NULL; 1750 enum pid_type type; 1751 long ret; 1752 1753 if (options & ~(WNOHANG|WUNTRACED|WCONTINUED| 1754 __WNOTHREAD|__WCLONE|__WALL)) 1755 return -EINVAL; 1756 1757 /* -INT_MIN is not defined */ 1758 if (upid == INT_MIN) 1759 return -ESRCH; 1760 1761 if (upid == -1) 1762 type = PIDTYPE_MAX; 1763 else if (upid < 0) { 1764 type = PIDTYPE_PGID; 1765 pid = find_get_pid(-upid); 1766 } else if (upid == 0) { 1767 type = PIDTYPE_PGID; 1768 pid = get_task_pid(current, PIDTYPE_PGID); 1769 } else /* upid > 0 */ { 1770 type = PIDTYPE_PID; 1771 pid = find_get_pid(upid); 1772 } 1773 1774 wo.wo_type = type; 1775 wo.wo_pid = pid; 1776 wo.wo_flags = options | WEXITED; 1777 wo.wo_info = NULL; 1778 wo.wo_stat = 0; 1779 wo.wo_rusage = ru; 1780 ret = do_wait(&wo); 1781 put_pid(pid); 1782 if (ret > 0 && stat_addr && put_user(wo.wo_stat, stat_addr)) 1783 ret = -EFAULT; 1784 1785 return ret; 1786 } 1787 1788 int kernel_wait(pid_t pid, int *stat) 1789 { 1790 struct wait_opts wo = { 1791 .wo_type = PIDTYPE_PID, 1792 .wo_pid = find_get_pid(pid), 1793 .wo_flags = WEXITED, 1794 }; 1795 int ret; 1796 1797 ret = do_wait(&wo); 1798 if (ret > 0 && wo.wo_stat) 1799 *stat = wo.wo_stat; 1800 put_pid(wo.wo_pid); 1801 return ret; 1802 } 1803 1804 SYSCALL_DEFINE4(wait4, pid_t, upid, int __user *, stat_addr, 1805 int, options, struct rusage __user *, ru) 1806 { 1807 struct rusage r; 1808 long err = kernel_wait4(upid, stat_addr, options, ru ? &r : NULL); 1809 1810 if (err > 0) { 1811 if (ru && copy_to_user(ru, &r, sizeof(struct rusage))) 1812 return -EFAULT; 1813 } 1814 return err; 1815 } 1816 1817 #ifdef __ARCH_WANT_SYS_WAITPID 1818 1819 /* 1820 * sys_waitpid() remains for compatibility. waitpid() should be 1821 * implemented by calling sys_wait4() from libc.a. 1822 */ 1823 SYSCALL_DEFINE3(waitpid, pid_t, pid, int __user *, stat_addr, int, options) 1824 { 1825 return kernel_wait4(pid, stat_addr, options, NULL); 1826 } 1827 1828 #endif 1829 1830 #ifdef CONFIG_COMPAT 1831 COMPAT_SYSCALL_DEFINE4(wait4, 1832 compat_pid_t, pid, 1833 compat_uint_t __user *, stat_addr, 1834 int, options, 1835 struct compat_rusage __user *, ru) 1836 { 1837 struct rusage r; 1838 long err = kernel_wait4(pid, stat_addr, options, ru ? &r : NULL); 1839 if (err > 0) { 1840 if (ru && put_compat_rusage(&r, ru)) 1841 return -EFAULT; 1842 } 1843 return err; 1844 } 1845 1846 COMPAT_SYSCALL_DEFINE5(waitid, 1847 int, which, compat_pid_t, pid, 1848 struct compat_siginfo __user *, infop, int, options, 1849 struct compat_rusage __user *, uru) 1850 { 1851 struct rusage ru; 1852 struct waitid_info info = {.status = 0}; 1853 long err = kernel_waitid(which, pid, &info, options, uru ? &ru : NULL); 1854 int signo = 0; 1855 if (err > 0) { 1856 signo = SIGCHLD; 1857 err = 0; 1858 if (uru) { 1859 /* kernel_waitid() overwrites everything in ru */ 1860 if (COMPAT_USE_64BIT_TIME) 1861 err = copy_to_user(uru, &ru, sizeof(ru)); 1862 else 1863 err = put_compat_rusage(&ru, uru); 1864 if (err) 1865 return -EFAULT; 1866 } 1867 } 1868 1869 if (!infop) 1870 return err; 1871 1872 if (!user_write_access_begin(infop, sizeof(*infop))) 1873 return -EFAULT; 1874 1875 unsafe_put_user(signo, &infop->si_signo, Efault); 1876 unsafe_put_user(0, &infop->si_errno, Efault); 1877 unsafe_put_user(info.cause, &infop->si_code, Efault); 1878 unsafe_put_user(info.pid, &infop->si_pid, Efault); 1879 unsafe_put_user(info.uid, &infop->si_uid, Efault); 1880 unsafe_put_user(info.status, &infop->si_status, Efault); 1881 user_write_access_end(); 1882 return err; 1883 Efault: 1884 user_write_access_end(); 1885 return -EFAULT; 1886 } 1887 #endif 1888 1889 /** 1890 * thread_group_exited - check that a thread group has exited 1891 * @pid: tgid of thread group to be checked. 1892 * 1893 * Test if the thread group represented by tgid has exited (all 1894 * threads are zombies, dead or completely gone). 1895 * 1896 * Return: true if the thread group has exited. false otherwise. 1897 */ 1898 bool thread_group_exited(struct pid *pid) 1899 { 1900 struct task_struct *task; 1901 bool exited; 1902 1903 rcu_read_lock(); 1904 task = pid_task(pid, PIDTYPE_PID); 1905 exited = !task || 1906 (READ_ONCE(task->exit_state) && thread_group_empty(task)); 1907 rcu_read_unlock(); 1908 1909 return exited; 1910 } 1911 EXPORT_SYMBOL(thread_group_exited); 1912 1913 /* 1914 * This needs to be __function_aligned as GCC implicitly makes any 1915 * implementation of abort() cold and drops alignment specified by 1916 * -falign-functions=N. 1917 * 1918 * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c11 1919 */ 1920 __weak __function_aligned void abort(void) 1921 { 1922 BUG(); 1923 1924 /* if that doesn't kill us, halt */ 1925 panic("Oops failed to kill thread"); 1926 } 1927 EXPORT_SYMBOL(abort);