exit.c 45.6 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7 8
/*
 *  linux/kernel/exit.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

#include <linux/mm.h>
#include <linux/slab.h>
9
#include <linux/sched/autogroup.h>
10
#include <linux/sched/mm.h>
11
#include <linux/sched/stat.h>
12
#include <linux/sched/task.h>
13
#include <linux/sched/task_stack.h>
14
#include <linux/sched/cputime.h>
Linus Torvalds's avatar
Linus Torvalds committed
15 16
#include <linux/interrupt.h>
#include <linux/module.h>
17
#include <linux/capability.h>
Linus Torvalds's avatar
Linus Torvalds committed
18 19 20
#include <linux/completion.h>
#include <linux/personality.h>
#include <linux/tty.h>
21
#include <linux/iocontext.h>
Linus Torvalds's avatar
Linus Torvalds committed
22 23 24
#include <linux/key.h>
#include <linux/cpu.h>
#include <linux/acct.h>
25
#include <linux/tsacct_kern.h>
Linus Torvalds's avatar
Linus Torvalds committed
26
#include <linux/file.h>
Al Viro's avatar
Al Viro committed
27
#include <linux/fdtable.h>
28
#include <linux/freezer.h>
Linus Torvalds's avatar
Linus Torvalds committed
29
#include <linux/binfmts.h>
30
#include <linux/nsproxy.h>
31
#include <linux/pid_namespace.h>
Linus Torvalds's avatar
Linus Torvalds committed
32 33 34 35
#include <linux/ptrace.h>
#include <linux/profile.h>
#include <linux/mount.h>
#include <linux/proc_fs.h>
36
#include <linux/kthread.h>
Linus Torvalds's avatar
Linus Torvalds committed
37
#include <linux/mempolicy.h>
38
#include <linux/taskstats_kern.h>
39
#include <linux/delayacct.h>
40
#include <linux/cgroup.h>
Linus Torvalds's avatar
Linus Torvalds committed
41
#include <linux/syscalls.h>
42
#include <linux/signal.h>
43
#include <linux/posix-timers.h>
44
#include <linux/cn_proc.h>
45
#include <linux/mutex.h>
46
#include <linux/futex.h>
47
#include <linux/pipe_fs_i.h>
48
#include <linux/audit.h> /* for audit_free() */
Adrian Bunk's avatar
Adrian Bunk committed
49
#include <linux/resource.h>
50
#include <linux/blkdev.h>
51
#include <linux/task_io_accounting_ops.h>
Roland McGrath's avatar
Roland McGrath committed
52
#include <linux/tracehook.h>
53
#include <linux/fs_struct.h>
54
#include <linux/userfaultfd_k.h>
55
#include <linux/init_task.h>
56
#include <linux/perf_event.h>
57
#include <trace/events/sched.h>
58
#include <linux/hw_breakpoint.h>
Ying Han's avatar
Ying Han committed
59
#include <linux/oom.h>
60
#include <linux/writeback.h>
Al Viro's avatar
Al Viro committed
61
#include <linux/shm.h>
Dmitry Vyukov's avatar
Dmitry Vyukov committed
62
#include <linux/kcov.h>
63
#include <linux/random.h>
64
#include <linux/rcuwait.h>
65
#include <linux/compat.h>
Linus Torvalds's avatar
Linus Torvalds committed
66

67
#include <linux/uaccess.h>
Linus Torvalds's avatar
Linus Torvalds committed
68 69 70 71
#include <asm/unistd.h>
#include <asm/pgtable.h>
#include <asm/mmu_context.h>

72
static void __unhash_process(struct task_struct *p, bool group_dead)
Linus Torvalds's avatar
Linus Torvalds committed
73 74
{
	nr_threads--;
75
	detach_pid(p, PIDTYPE_PID);
76
	if (group_dead) {
Linus Torvalds's avatar
Linus Torvalds committed
77 78
		detach_pid(p, PIDTYPE_PGID);
		detach_pid(p, PIDTYPE_SID);
79

80
		list_del_rcu(&p->tasks);
81
		list_del_init(&p->sibling);
82
		__this_cpu_dec(process_counts);
Linus Torvalds's avatar
Linus Torvalds committed
83
	}
84
	list_del_rcu(&p->thread_group);
85
	list_del_rcu(&p->thread_node);
Linus Torvalds's avatar
Linus Torvalds committed
86 87
}

88 89 90 91 92 93
/*
 * This function expects the tasklist_lock write-locked.
 */
static void __exit_signal(struct task_struct *tsk)
{
	struct signal_struct *sig = tsk->signal;
94
	bool group_dead = thread_group_leader(tsk);
95
	struct sighand_struct *sighand;
96
	struct tty_struct *uninitialized_var(tty);
97
	u64 utime, stime;
98

99
	sighand = rcu_dereference_check(tsk->sighand,
100
					lockdep_tasklist_lock_is_held());
101 102
	spin_lock(&sighand->siglock);

103
#ifdef CONFIG_POSIX_TIMERS
104
	posix_cpu_timers_exit(tsk);
105
	if (group_dead) {
106
		posix_cpu_timers_exit_group(tsk);
107
	} else {
108 109 110 111 112 113 114
		/*
		 * This can only happen if the caller is de_thread().
		 * FIXME: this is the temporary hack, we should teach
		 * posix-cpu-timers to handle this case correctly.
		 */
		if (unlikely(has_group_leader_pid(tsk)))
			posix_cpu_timers_exit_group(tsk);
115 116
	}
#endif
117

118 119 120 121
	if (group_dead) {
		tty = sig->tty;
		sig->tty = NULL;
	} else {
122 123 124 125
		/*
		 * If there is any task waiting for the group exit
		 * then notify it:
		 */
126
		if (sig->notify_count > 0 && !--sig->notify_count)
127
			wake_up_process(sig->group_exit_task);
128

129 130 131 132
		if (tsk == sig->curr_target)
			sig->curr_target = next_thread(tsk);
	}

133 134 135
	add_device_randomness((const void*) &tsk->se.sum_exec_runtime,
			      sizeof(unsigned long long));

136
	/*
137 138 139 140
	 * Accumulate here the counters for all threads as they die. We could
	 * skip the group leader because it is the last user of signal_struct,
	 * but we want to avoid the race with thread_group_cputime() which can
	 * see the empty ->thread_head list.
141 142
	 */
	task_cputime(tsk, &utime, &stime);
143
	write_seqlock(&sig->stats_lock);
144 145 146 147 148 149 150 151 152 153 154
	sig->utime += utime;
	sig->stime += stime;
	sig->gtime += task_gtime(tsk);
	sig->min_flt += tsk->min_flt;
	sig->maj_flt += tsk->maj_flt;
	sig->nvcsw += tsk->nvcsw;
	sig->nivcsw += tsk->nivcsw;
	sig->inblock += task_io_get_inblock(tsk);
	sig->oublock += task_io_get_oublock(tsk);
	task_io_accounting_add(&sig->ioac, &tsk->ioac);
	sig->sum_sched_runtime += tsk->se.sum_exec_runtime;
155
	sig->nr_threads--;
156
	__unhash_process(tsk, group_dead);
157
	write_sequnlock(&sig->stats_lock);
158

159 160 161 162 163
	/*
	 * Do this under ->siglock, we can race with another thread
	 * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
	 */
	flush_sigqueue(&tsk->pending);
164
	tsk->sighand = NULL;
165 166
	spin_unlock(&sighand->siglock);

167
	__cleanup_sighand(sighand);
168
	clear_tsk_thread_flag(tsk, TIF_SIGPENDING);
169
	if (group_dead) {
170
		flush_sigqueue(&sig->shared_pending);
171
		tty_kref_put(tty);
172 173 174
	}
}

175 176
static void delayed_put_task_struct(struct rcu_head *rhp)
{
177 178
	struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);

179
	perf_event_delayed_put(tsk);
180 181
	trace_sched_process_free(tsk);
	put_task_struct(tsk);
182 183
}

Roland McGrath's avatar
Roland McGrath committed
184

185
void release_task(struct task_struct *p)
Linus Torvalds's avatar
Linus Torvalds committed
186
{
187
	struct task_struct *leader;
Linus Torvalds's avatar
Linus Torvalds committed
188
	int zap_leader;
189
repeat:
190
	/* don't need to get the RCU readlock here - the process is dead and
191 192
	 * can't be modifying its own credentials. But shut RCU-lockdep up */
	rcu_read_lock();
193
	atomic_dec(&__task_cred(p)->user->processes);
194
	rcu_read_unlock();
195

196
	proc_flush_task(p);
197

Linus Torvalds's avatar
Linus Torvalds committed
198
	write_lock_irq(&tasklist_lock);
Tejun Heo's avatar
Tejun Heo committed
199
	ptrace_release_task(p);
Linus Torvalds's avatar
Linus Torvalds committed
200
	__exit_signal(p);
201

Linus Torvalds's avatar
Linus Torvalds committed
202 203 204 205 206 207 208
	/*
	 * If we are the last non-leader member of the thread
	 * group, and the leader is zombie, then notify the
	 * group leader's parent process. (if it wants notification.)
	 */
	zap_leader = 0;
	leader = p->group_leader;
209 210
	if (leader != p && thread_group_empty(leader)
			&& leader->exit_state == EXIT_ZOMBIE) {
Linus Torvalds's avatar
Linus Torvalds committed
211 212 213 214
		/*
		 * If we were the last child thread and the leader has
		 * exited already, and the leader's parent ignores SIGCHLD,
		 * then we are the one who should release the leader.
Roland McGrath's avatar
Roland McGrath committed
215
		 */
216
		zap_leader = do_notify_parent(leader, leader->exit_signal);
Roland McGrath's avatar
Roland McGrath committed
217 218
		if (zap_leader)
			leader->exit_state = EXIT_DEAD;
Linus Torvalds's avatar
Linus Torvalds committed
219 220 221 222
	}

	write_unlock_irq(&tasklist_lock);
	release_thread(p);
223
	call_rcu(&p->rcu, delayed_put_task_struct);
Linus Torvalds's avatar
Linus Torvalds committed
224 225 226 227 228 229

	p = leader;
	if (unlikely(zap_leader))
		goto repeat;
}

230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292
/*
 * Note that if this function returns a valid task_struct pointer (!NULL)
 * task->usage must remain >0 for the duration of the RCU critical section.
 */
struct task_struct *task_rcu_dereference(struct task_struct **ptask)
{
	struct sighand_struct *sighand;
	struct task_struct *task;

	/*
	 * We need to verify that release_task() was not called and thus
	 * delayed_put_task_struct() can't run and drop the last reference
	 * before rcu_read_unlock(). We check task->sighand != NULL,
	 * but we can read the already freed and reused memory.
	 */
retry:
	task = rcu_dereference(*ptask);
	if (!task)
		return NULL;

	probe_kernel_address(&task->sighand, sighand);

	/*
	 * Pairs with atomic_dec_and_test() in put_task_struct(). If this task
	 * was already freed we can not miss the preceding update of this
	 * pointer.
	 */
	smp_rmb();
	if (unlikely(task != READ_ONCE(*ptask)))
		goto retry;

	/*
	 * We've re-checked that "task == *ptask", now we have two different
	 * cases:
	 *
	 * 1. This is actually the same task/task_struct. In this case
	 *    sighand != NULL tells us it is still alive.
	 *
	 * 2. This is another task which got the same memory for task_struct.
	 *    We can't know this of course, and we can not trust
	 *    sighand != NULL.
	 *
	 *    In this case we actually return a random value, but this is
	 *    correct.
	 *
	 *    If we return NULL - we can pretend that we actually noticed that
	 *    *ptask was updated when the previous task has exited. Or pretend
	 *    that probe_slab_address(&sighand) reads NULL.
	 *
	 *    If we return the new task (because sighand is not NULL for any
	 *    reason) - this is fine too. This (new) task can't go away before
	 *    another gp pass.
	 *
	 *    And note: We could even eliminate the false positive if re-read
	 *    task->sighand once again to avoid the falsely NULL. But this case
	 *    is very unlikely so we don't care.
	 */
	if (!sighand)
		return NULL;

	return task;
}

293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321
void rcuwait_wake_up(struct rcuwait *w)
{
	struct task_struct *task;

	rcu_read_lock();

	/*
	 * Order condition vs @task, such that everything prior to the load
	 * of @task is visible. This is the condition as to why the user called
	 * rcuwait_trywake() in the first place. Pairs with set_current_state()
	 * barrier (A) in rcuwait_wait_event().
	 *
	 *    WAIT                WAKE
	 *    [S] tsk = current	  [S] cond = true
	 *        MB (A)	      MB (B)
	 *    [L] cond		  [L] tsk
	 */
	smp_rmb(); /* (B) */

	/*
	 * Avoid using task_rcu_dereference() magic as long as we are careful,
	 * see comment in rcuwait_wait_event() regarding ->exit_state.
	 */
	task = rcu_dereference(w->task);
	if (task)
		wake_up_process(task);
	rcu_read_unlock();
}

322 323 324 325 326 327 328 329 330 331 332 333 334
struct task_struct *try_get_task_struct(struct task_struct **ptask)
{
	struct task_struct *task;

	rcu_read_lock();
	task = task_rcu_dereference(ptask);
	if (task)
		get_task_struct(task);
	rcu_read_unlock();

	return task;
}

Linus Torvalds's avatar
Linus Torvalds committed
335 336 337 338 339 340 341 342
/*
 * Determine if a process group is "orphaned", according to the POSIX
 * definition in 2.2.2.52.  Orphaned process groups are not to be affected
 * by terminal-generated stop signals.  Newly orphaned process groups are
 * to receive a SIGHUP and a SIGCONT.
 *
 * "I ask you, have you ever known what it is to be an orphan?"
 */
343 344
static int will_become_orphaned_pgrp(struct pid *pgrp,
					struct task_struct *ignored_task)
Linus Torvalds's avatar
Linus Torvalds committed
345 346 347
{
	struct task_struct *p;

348
	do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
349 350 351
		if ((p == ignored_task) ||
		    (p->exit_state && thread_group_empty(p)) ||
		    is_global_init(p->real_parent))
Linus Torvalds's avatar
Linus Torvalds committed
352
			continue;
353

354
		if (task_pgrp(p->real_parent) != pgrp &&
355 356
		    task_session(p->real_parent) == task_session(p))
			return 0;
357
	} while_each_pid_task(pgrp, PIDTYPE_PGID, p);
358 359

	return 1;
Linus Torvalds's avatar
Linus Torvalds committed
360 361
}

362
int is_current_pgrp_orphaned(void)
Linus Torvalds's avatar
Linus Torvalds committed
363 364 365 366
{
	int retval;

	read_lock(&tasklist_lock);
367
	retval = will_become_orphaned_pgrp(task_pgrp(current), NULL);
Linus Torvalds's avatar
Linus Torvalds committed
368 369 370 371 372
	read_unlock(&tasklist_lock);

	return retval;
}

373
static bool has_stopped_jobs(struct pid *pgrp)
Linus Torvalds's avatar
Linus Torvalds committed
374 375 376
{
	struct task_struct *p;

377
	do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
378 379
		if (p->signal->flags & SIGNAL_STOP_STOPPED)
			return true;
380
	} while_each_pid_task(pgrp, PIDTYPE_PGID, p);
381 382

	return false;
Linus Torvalds's avatar
Linus Torvalds committed
383 384
}

385 386 387 388 389 390 391 392 393 394 395 396
/*
 * Check to see if any process groups have become orphaned as
 * a result of our exiting, and if they have any stopped jobs,
 * send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2)
 */
static void
kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent)
{
	struct pid *pgrp = task_pgrp(tsk);
	struct task_struct *ignored_task = tsk;

	if (!parent)
397 398 399
		/* exit: our father is in a different pgrp than
		 * we are and we were the only connection outside.
		 */
400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415
		parent = tsk->real_parent;
	else
		/* reparent: our child is in a different pgrp than
		 * we are, and it was the only connection outside.
		 */
		ignored_task = NULL;

	if (task_pgrp(parent) != pgrp &&
	    task_session(parent) == task_session(tsk) &&
	    will_become_orphaned_pgrp(pgrp, ignored_task) &&
	    has_stopped_jobs(pgrp)) {
		__kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp);
		__kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp);
	}
}

Oleg Nesterov's avatar
Oleg Nesterov committed
416
#ifdef CONFIG_MEMCG
417
/*
418
 * A task is exiting.   If it owned this mm, find a new owner for the mm.
419 420 421 422 423 424
 */
void mm_update_next_owner(struct mm_struct *mm)
{
	struct task_struct *c, *g, *p = current;

retry:
425 426 427 428 429
	/*
	 * If the exiting or execing task is not the owner, it's
	 * someone else's problem.
	 */
	if (mm->owner != p)
430
		return;
431 432 433 434 435 436 437 438 439
	/*
	 * The current owner is exiting/execing and there are no other
	 * candidates.  Do not leave the mm pointing to a possibly
	 * freed task structure.
	 */
	if (atomic_read(&mm->mm_users) <= 1) {
		mm->owner = NULL;
		return;
	}
440 441 442 443 444 445 446 447 448 449 450 451 452

	read_lock(&tasklist_lock);
	/*
	 * Search in the children
	 */
	list_for_each_entry(c, &p->children, sibling) {
		if (c->mm == mm)
			goto assign_new_owner;
	}

	/*
	 * Search in the siblings
	 */
453
	list_for_each_entry(c, &p->real_parent->children, sibling) {
454 455 456 457 458
		if (c->mm == mm)
			goto assign_new_owner;
	}

	/*
459
	 * Search through everything else, we should not get here often.
460
	 */
461 462 463 464 465 466 467 468 469
	for_each_process(g) {
		if (g->flags & PF_KTHREAD)
			continue;
		for_each_thread(g, c) {
			if (c->mm == mm)
				goto assign_new_owner;
			if (c->mm)
				break;
		}
470
	}
471
	read_unlock(&tasklist_lock);
472 473 474
	/*
	 * We found no owner yet mm_users > 1: this implies that we are
	 * most likely racing with swapoff (try_to_unuse()) or /proc or
475
	 * ptrace or page migration (get_task_mm()).  Mark owner as NULL.
476 477
	 */
	mm->owner = NULL;
478 479 480 481 482 483 484 485 486 487
	return;

assign_new_owner:
	BUG_ON(c == p);
	get_task_struct(c);
	/*
	 * The task_lock protects c->mm from changing.
	 * We always want mm->owner->mm == mm
	 */
	task_lock(c);
488 489 490 491 492
	/*
	 * Delay read_unlock() till we have the task_lock()
	 * to ensure that c does not slip away underneath us
	 */
	read_unlock(&tasklist_lock);
493 494 495 496 497 498 499 500 501
	if (c->mm != mm) {
		task_unlock(c);
		put_task_struct(c);
		goto retry;
	}
	mm->owner = c;
	task_unlock(c);
	put_task_struct(c);
}
Oleg Nesterov's avatar
Oleg Nesterov committed
502
#endif /* CONFIG_MEMCG */
503

Linus Torvalds's avatar
Linus Torvalds committed
504 505 506 507
/*
 * Turn us into a lazy TLB process if we
 * aren't already..
 */
508
static void exit_mm(void)
Linus Torvalds's avatar
Linus Torvalds committed
509
{
510
	struct mm_struct *mm = current->mm;
511
	struct core_state *core_state;
Linus Torvalds's avatar
Linus Torvalds committed
512

513
	mm_release(current, mm);
Linus Torvalds's avatar
Linus Torvalds committed
514 515
	if (!mm)
		return;
516
	sync_mm_rss(mm);
Linus Torvalds's avatar
Linus Torvalds committed
517 518
	/*
	 * Serialize with any possible pending coredump.
519
	 * We must hold mmap_sem around checking core_state
Linus Torvalds's avatar
Linus Torvalds committed
520
	 * and clearing tsk->mm.  The core-inducing thread
521
	 * will increment ->nr_threads for each thread in the
Linus Torvalds's avatar
Linus Torvalds committed
522 523 524
	 * group with ->mm != NULL.
	 */
	down_read(&mm->mmap_sem);
525 526 527
	core_state = mm->core_state;
	if (core_state) {
		struct core_thread self;
528

Linus Torvalds's avatar
Linus Torvalds committed
529 530
		up_read(&mm->mmap_sem);

531
		self.task = current;
532 533 534 535 536 537 538
		self.next = xchg(&core_state->dumper.next, &self);
		/*
		 * Implies mb(), the result of xchg() must be visible
		 * to core_state->dumper.
		 */
		if (atomic_dec_and_test(&core_state->nr_threads))
			complete(&core_state->startup);
Linus Torvalds's avatar
Linus Torvalds committed
539

Oleg Nesterov's avatar
Oleg Nesterov committed
540
		for (;;) {
541
			set_current_state(TASK_UNINTERRUPTIBLE);
Oleg Nesterov's avatar
Oleg Nesterov committed
542 543
			if (!self.task) /* see coredump_finish() */
				break;
544
			freezable_schedule();
Oleg Nesterov's avatar
Oleg Nesterov committed
545
		}
546
		__set_current_state(TASK_RUNNING);
Linus Torvalds's avatar
Linus Torvalds committed
547 548
		down_read(&mm->mmap_sem);
	}
Vegard Nossum's avatar
Vegard Nossum committed
549
	mmgrab(mm);
550
	BUG_ON(mm != current->active_mm);
Linus Torvalds's avatar
Linus Torvalds committed
551
	/* more a memory barrier than a real lock */
552 553
	task_lock(current);
	current->mm = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
554 555
	up_read(&mm->mmap_sem);
	enter_lazy_tlb(mm, current);
556
	task_unlock(current);
557
	mm_update_next_owner(mm);
Linus Torvalds's avatar
Linus Torvalds committed
558
	mmput(mm);
559
	if (test_thread_flag(TIF_MEMDIE))
560
		exit_oom_victim();
Linus Torvalds's avatar
Linus Torvalds committed
561 562
}

563 564 565 566 567 568 569 570 571 572 573
static struct task_struct *find_alive_thread(struct task_struct *p)
{
	struct task_struct *t;

	for_each_thread(p, t) {
		if (!(t->flags & PF_EXITING))
			return t;
	}
	return NULL;
}

574 575 576 577 578 579 580 581 582 583
static struct task_struct *find_child_reaper(struct task_struct *father)
	__releases(&tasklist_lock)
	__acquires(&tasklist_lock)
{
	struct pid_namespace *pid_ns = task_active_pid_ns(father);
	struct task_struct *reaper = pid_ns->child_reaper;

	if (likely(reaper != father))
		return reaper;

584 585
	reaper = find_alive_thread(father);
	if (reaper) {
586 587 588 589 590 591 592 593 594 595 596 597 598 599 600
		pid_ns->child_reaper = reaper;
		return reaper;
	}

	write_unlock_irq(&tasklist_lock);
	if (unlikely(pid_ns == &init_pid_ns)) {
		panic("Attempted to kill init! exitcode=0x%08x\n",
			father->signal->group_exit_code ?: father->exit_code);
	}
	zap_pid_ns_processes(pid_ns);
	write_lock_irq(&tasklist_lock);

	return father;
}

Linus Torvalds's avatar
Linus Torvalds committed
601
/*
602 603 604 605 606
 * When we die, we re-parent all our children, and try to:
 * 1. give them to another thread in our thread group, if such a member exists
 * 2. give it to the first ancestor process which prctl'd itself as a
 *    child_subreaper for its children (like a service manager)
 * 3. give it to the init process (PID 1) in our pid namespace
Linus Torvalds's avatar
Linus Torvalds committed
607
 */
608 609
static struct task_struct *find_new_reaper(struct task_struct *father,
					   struct task_struct *child_reaper)
Linus Torvalds's avatar
Linus Torvalds committed
610
{
611
	struct task_struct *thread, *reaper;
Linus Torvalds's avatar
Linus Torvalds committed
612

613 614
	thread = find_alive_thread(father);
	if (thread)
615
		return thread;
Linus Torvalds's avatar
Linus Torvalds committed
616

617
	if (father->signal->has_child_subreaper) {
618
		unsigned int ns_level = task_pid(father)->level;
619
		/*
620
		 * Find the first ->is_child_subreaper ancestor in our pid_ns.
621 622 623 624 625
		 * We can't check reaper != child_reaper to ensure we do not
		 * cross the namespaces, the exiting parent could be injected
		 * by setns() + fork().
		 * We check pid->level, this is slightly more efficient than
		 * task_active_pid_ns(reaper) != task_active_pid_ns(father).
626
		 */
627 628
		for (reaper = father->real_parent;
		     task_pid(reaper)->level == ns_level;
629
		     reaper = reaper->real_parent) {
630
			if (reaper == &init_task)
631 632 633
				break;
			if (!reaper->signal->is_child_subreaper)
				continue;
634 635 636
			thread = find_alive_thread(reaper);
			if (thread)
				return thread;
637
		}
Linus Torvalds's avatar
Linus Torvalds committed
638
	}
639

640
	return child_reaper;
641 642
}

643 644 645
/*
* Any that need to be release_task'd are put on the @dead list.
 */
646
static void reparent_leader(struct task_struct *father, struct task_struct *p,
647 648
				struct list_head *dead)
{
649
	if (unlikely(p->exit_state == EXIT_DEAD))
650 651
		return;

652
	/* We don't want people slaying init. */
653 654 655
	p->exit_signal = SIGCHLD;

	/* If it has exited notify the new parent about this child's death. */
Tejun Heo's avatar
Tejun Heo committed
656
	if (!p->ptrace &&
657
	    p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
658
		if (do_notify_parent(p, p->exit_signal)) {
659
			p->exit_state = EXIT_DEAD;
660
			list_add(&p->ptrace_entry, dead);
661 662 663 664 665 666
		}
	}

	kill_orphaned_pgrp(p, father);
}

667 668 669 670 671 672 673 674 675 676
/*
 * This does two things:
 *
 * A.  Make init inherit all the child processes
 * B.  Check to see if any process groups have become orphaned
 *	as a result of our exiting, and if they have any stopped
 *	jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2)
 */
static void forget_original_parent(struct task_struct *father,
					struct list_head *dead)
Linus Torvalds's avatar
Linus Torvalds committed
677
{
678
	struct task_struct *p, *t, *reaper;
679

680
	if (unlikely(!list_empty(&father->ptraced)))
681
		exit_ptrace(father, dead);
Roland McGrath's avatar
Roland McGrath committed
682

683
	/* Can drop and reacquire tasklist_lock */
684
	reaper = find_child_reaper(father);
685
	if (list_empty(&father->children))
686
		return;
687 688

	reaper = find_new_reaper(father, reaper);
689
	list_for_each_entry(p, &father->children, sibling) {
690
		for_each_thread(p, t) {
691
			t->real_parent = reaper;
692 693
			BUG_ON((!t->ptrace) != (t->parent == father));
			if (likely(!t->ptrace))
694 695 696 697
				t->parent = t->real_parent;
			if (t->pdeath_signal)
				group_send_sig_info(t->pdeath_signal,
						    SEND_SIG_NOINFO, t);
698
		}
699 700 701 702 703
		/*
		 * If this is a threaded reparent there is no need to
		 * notify anyone anything has happened.
		 */
		if (!same_thread_group(reaper, father))
704
			reparent_leader(father, p, dead);
Linus Torvalds's avatar
Linus Torvalds committed
705
	}
706
	list_splice_tail_init(&father->children, &reaper->children);
Linus Torvalds's avatar
Linus Torvalds committed
707 708 709 710 711 712
}

/*
 * Send signals to all our closest relatives so that they know
 * to properly mourn us..
 */
713
static void exit_notify(struct task_struct *tsk, int group_dead)
Linus Torvalds's avatar
Linus Torvalds committed
714
{
715
	bool autoreap;
716 717
	struct task_struct *p, *n;
	LIST_HEAD(dead);
Linus Torvalds's avatar
Linus Torvalds committed
718

719
	write_lock_irq(&tasklist_lock);
720 721
	forget_original_parent(tsk, &dead);

722 723
	if (group_dead)
		kill_orphaned_pgrp(tsk->group_leader, NULL);
Linus Torvalds's avatar
Linus Torvalds committed
724

Oleg Nesterov's avatar
Oleg Nesterov committed
725 726 727 728 729 730 731 732 733 734 735 736
	if (unlikely(tsk->ptrace)) {
		int sig = thread_group_leader(tsk) &&
				thread_group_empty(tsk) &&
				!ptrace_reparented(tsk) ?
			tsk->exit_signal : SIGCHLD;
		autoreap = do_notify_parent(tsk, sig);
	} else if (thread_group_leader(tsk)) {
		autoreap = thread_group_empty(tsk) &&
			do_notify_parent(tsk, tsk->exit_signal);
	} else {
		autoreap = true;
	}
Linus Torvalds's avatar
Linus Torvalds committed
737

738
	tsk->exit_state = autoreap ? EXIT_DEAD : EXIT_ZOMBIE;
739 740
	if (tsk->exit_state == EXIT_DEAD)
		list_add(&tsk->ptrace_entry, &dead);
Linus Torvalds's avatar
Linus Torvalds committed
741

742 743
	/* mt-exec, de_thread() is waiting for group leader */
	if (unlikely(tsk->signal->notify_count < 0))
744
		wake_up_process(tsk->signal->group_exit_task);
Linus Torvalds's avatar
Linus Torvalds committed
745 746
	write_unlock_irq(&tasklist_lock);

747 748 749 750
	list_for_each_entry_safe(p, n, &dead, ptrace_entry) {
		list_del_init(&p->ptrace_entry);
		release_task(p);
	}
Linus Torvalds's avatar
Linus Torvalds committed
751 752
}

753 754 755 756 757 758 759
#ifdef CONFIG_DEBUG_STACK_USAGE
static void check_stack_usage(void)
{
	static DEFINE_SPINLOCK(low_water_lock);
	static int lowest_to_date = THREAD_SIZE;
	unsigned long free;

760
	free = stack_not_used(current);
761 762 763 764 765 766

	if (free >= lowest_to_date)
		return;

	spin_lock(&low_water_lock);
	if (free < lowest_to_date) {
767
		pr_info("%s (%d) used greatest stack depth: %lu bytes left\n",
768
			current->comm, task_pid_nr(current), free);
769 770 771 772 773 774 775 776
		lowest_to_date = free;
	}
	spin_unlock(&low_water_lock);
}
#else
static inline void check_stack_usage(void) {}
#endif

777
void __noreturn do_exit(long code)
Linus Torvalds's avatar
Linus Torvalds committed
778 779 780
{
	struct task_struct *tsk = current;
	int group_dead;
781
	TASKS_RCU(int tasks_rcu_i);
Linus Torvalds's avatar
Linus Torvalds committed
782 783

	profile_task_exit(tsk);
Dmitry Vyukov's avatar
Dmitry Vyukov committed
784
	kcov_task_exit(tsk);
Linus Torvalds's avatar
Linus Torvalds committed
785

786
	WARN_ON(blk_needs_flush_plug(tsk));
787

Linus Torvalds's avatar
Linus Torvalds committed
788 789 790 791 792
	if (unlikely(in_interrupt()))
		panic("Aiee, killing interrupt handler!");
	if (unlikely(!tsk->pid))
		panic("Attempted to kill the idle task!");

793 794 795 796 797 798 799 800 801
	/*
	 * If do_exit is called because this processes oopsed, it's possible
	 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
	 * continuing. Amongst other possible reasons, this is to prevent
	 * mm_release()->clear_child_tid() from writing to a user-controlled
	 * kernel address.
	 */
	set_fs(USER_DS);

Tejun Heo's avatar
Tejun Heo committed
802
	ptrace_event(PTRACE_EVENT_EXIT, code);
Linus Torvalds's avatar
Linus Torvalds committed
803

804 805
	validate_creds_for_do_exit(tsk);

806 807 808 809 810
	/*
	 * We're taking recursive faults here in do_exit. Safest is to just
	 * leave this task alone and wait for reboot.
	 */
	if (unlikely(tsk->flags & PF_EXITING)) {
811
		pr_alert("Fixing recursive fault but reboot is needed!\n");
812 813 814 815 816 817 818 819 820 821
		/*
		 * We can do this unlocked here. The futex code uses
		 * this flag just to verify whether the pi state
		 * cleanup has been done or not. In the worst case it
		 * loops once more. We pretend that the cleanup was
		 * done as there is no way to return. Either the
		 * OWNER_DIED bit is set by now or we push the blocked
		 * task into the wait for ever nirwana as well.
		 */
		tsk->flags |= PF_EXITPIDONE;
822 823 824 825
		set_current_state(TASK_UNINTERRUPTIBLE);
		schedule();
	}

Oleg Nesterov's avatar
Oleg Nesterov committed
826
	exit_signals(tsk);  /* sets PF_EXITING */
827
	/*
828 829
	 * Ensure that all new tsk->pi_lock acquisitions must observe
	 * PF_EXITING. Serializes against futex.c:attach_to_pi_owner().
830
	 */
831
	smp_mb();
832 833 834 835
	/*
	 * Ensure that we must observe the pi_state in exit_mm() ->
	 * mm_release() -> exit_pi_state_list().
	 */
836
	raw_spin_unlock_wait(&tsk->pi_lock);
Linus Torvalds's avatar
Linus Torvalds committed
837

838
	if (unlikely(in_atomic())) {
839 840 841
		pr_info("note: %s[%d] exited with preempt_count %d\n",
			current->comm, task_pid_nr(current),
			preempt_count());
842 843
		preempt_count_set(PREEMPT_ENABLED);
	}
Linus Torvalds's avatar
Linus Torvalds committed
844

845 846 847
	/* sync mm's RSS info before statistics gathering */
	if (tsk->mm)
		sync_mm_rss(tsk->mm);
848
	acct_update_integrals(tsk);
Linus Torvalds's avatar
Linus Torvalds committed
849
	group_dead = atomic_dec_and_test(&tsk->signal->live);
850
	if (group_dead) {
851
#ifdef CONFIG_POSIX_TIMERS
852
		hrtimer_cancel(&tsk->signal->real_timer);
853
		exit_itimers(tsk->signal);
854
#endif
Jiri Pirko's avatar
Jiri Pirko committed
855 856
		if (tsk->mm)
			setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
857
	}
858
	acct_collect(code, group_dead);
Miloslav Trmac's avatar
Miloslav Trmac committed
859 860
	if (group_dead)
		tty_audit_exit();
861
	audit_free(tsk);
862

863
	tsk->exit_code = code;
864
	taskstats_exit(tsk, group_dead);
865

866
	exit_mm();
Linus Torvalds's avatar
Linus Torvalds committed
867

868
	if (group_dead)
869
		acct_process();
870 871
	trace_sched_process_exit(tsk);

Linus Torvalds's avatar
Linus Torvalds committed
872
	exit_sem(tsk);
873
	exit_shm(tsk);
874 875
	exit_files(tsk);
	exit_fs(tsk);
876 877
	if (group_dead)
		disassociate_ctty(1);
878
	exit_task_namespaces(tsk);
879
	exit_task_work(tsk);
880
	exit_thread(tsk);
881 882 883 884 885 886 887 888 889

	/*
	 * Flush inherited counters to the parent - before the parent
	 * gets woken up by child-exit notifications.
	 *
	 * because of cgroup mode, must be called before cgroup_exit()
	 */
	perf_event_exit_task(tsk);

890
	sched_autogroup_exit_task(tsk);
891
	cgroup_exit(tsk);
Linus Torvalds's avatar
Linus Torvalds committed
892

893 894 895
	/*
	 * FIXME: do that only when needed, using sched_exit tracepoint
	 */
896
	flush_ptrace_hw_breakpoint(tsk);
897

898
	TASKS_RCU(preempt_disable());
899
	TASKS_RCU(tasks_rcu_i = __srcu_read_lock(&tasks_rcu_exit_srcu));
900
	TASKS_RCU(preempt_enable());
901
	exit_notify(tsk, group_dead);
902
	proc_exit_connector(tsk);
903
	mpol_put_task_policy(tsk);
904
#ifdef CONFIG_FUTEX
905 906
	if (unlikely(current->pi_state_cache))
		kfree(current->pi_state_cache);
907
#endif
908
	/*
909
	 * Make sure we are holding no locks:
910
	 */
911
	debug_check_no_locks_held();
912 913 914 915 916 917
	/*
	 * We can do this unlocked here. The futex code uses this flag
	 * just to verify whether the pi state cleanup has been done
	 * or not. In the worst case it loops once more.
	 */
	tsk->flags |= PF_EXITPIDONE;
Linus Torvalds's avatar
Linus Torvalds committed
918

919
	if (tsk->io_context)
920
		exit_io_context(tsk);
921

922
	if (tsk->splice_pipe)
923
		free_pipe_info(tsk->splice_pipe);
924

925 926 927
	if (tsk->task_frag.page)
		put_page(tsk->task_frag.page);

928 929
	validate_creds_for_do_exit(tsk);

930
	check_stack_usage();
Coywolf Qi Hunt's avatar
Coywolf Qi Hunt committed
931
	preempt_disable();
932 933
	if (tsk->nr_dirtied)
		__this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);
934
	exit_rcu();
935
	TASKS_RCU(__srcu_read_unlock(&tasks_rcu_exit_srcu, tasks_rcu_i));
936

937
	do_task_dead();
Linus Torvalds's avatar
Linus Torvalds committed
938
}
939 940
EXPORT_SYMBOL_GPL(do_exit);

941
void complete_and_exit(struct completion *comp, long code)
Linus Torvalds's avatar
Linus Torvalds committed
942 943 944
{
	if (comp)
		complete(comp);
Oleg Nesterov's avatar
Oleg Nesterov committed
945

Linus Torvalds's avatar
Linus Torvalds committed
946 947 948 949
	do_exit(code);
}
EXPORT_SYMBOL(complete_and_exit);

950
SYSCALL_DEFINE1(exit, int, error_code)
Linus Torvalds's avatar
Linus Torvalds committed
951 952 953 954 955 956 957 958
{
	do_exit((error_code&0xff)<<8);
}

/*
 * Take down every thread in the group.  This is called by fatal signals
 * as well as by sys_exit_group (below).
 */
959
void
Linus Torvalds's avatar
Linus Torvalds committed
960 961
do_group_exit(int exit_code)
{
962 963
	struct signal_struct *sig = current->signal;

Linus Torvalds's avatar
Linus Torvalds committed
964 965
	BUG_ON(exit_code & 0x80); /* core dumps don't get here */

966 967
	if (signal_group_exit(sig))
		exit_code = sig->group_exit_code;
Linus Torvalds's avatar
Linus Torvalds committed
968 969
	else if (!thread_group_empty(current)) {
		struct sighand_struct *const sighand = current->sighand;
970

Linus Torvalds's avatar
Linus Torvalds committed
971
		spin_lock_irq(&sighand->siglock);
972
		if (signal_group_exit(sig))
Linus Torvalds's avatar
Linus Torvalds committed
973 974 975 976
			/* Another thread got here before we took the lock.  */
			exit_code = sig->group_exit_code;
		else {
			sig->group_exit_code = exit_code;
977
			sig->flags = SIGNAL_GROUP_EXIT;
Linus Torvalds's avatar
Linus Torvalds committed
978 979 980 981 982 983 984 985 986 987 988 989 990 991
			zap_other_threads(current);
		}
		spin_unlock_irq(&sighand->siglock);
	}

	do_exit(exit_code);
	/* NOTREACHED */
}

/*
 * this kills every thread in the thread group. Note that any externally
 * wait4()-ing process will get the correct exit code - even if this
 * thread is not the thread group leader.
 */
992
SYSCALL_DEFINE1(exit_group, int, error_code)
Linus Torvalds's avatar
Linus Torvalds committed
993 994
{
	do_group_exit((error_code & 0xff) << 8);
995 996
	/* NOTREACHED */
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
997 998
}

999 1000 1001
struct wait_opts {
	enum pid_type		wo_type;
	int			wo_flags;
1002
	struct pid		*wo_pid;
1003 1004

	struct siginfo __user	*wo_info;
1005
	int			wo_stat;
1006
	struct rusage		*wo_rusage;