LCOV - code coverage report
Current view: top level - kernel - exit.c (source / functions) Hit Total Coverage
Test: coverage.info Lines: 206 673 30.6 %
Date: 2023-07-19 18:55:55 Functions: 18 49 36.7 %

          Line data    Source code
       1             : // SPDX-License-Identifier: GPL-2.0-only
       2             : /*
       3             :  *  linux/kernel/exit.c
       4             :  *
       5             :  *  Copyright (C) 1991, 1992  Linus Torvalds
       6             :  */
       7             : 
       8             : #include <linux/mm.h>
       9             : #include <linux/slab.h>
      10             : #include <linux/sched/autogroup.h>
      11             : #include <linux/sched/mm.h>
      12             : #include <linux/sched/stat.h>
      13             : #include <linux/sched/task.h>
      14             : #include <linux/sched/task_stack.h>
      15             : #include <linux/sched/cputime.h>
      16             : #include <linux/interrupt.h>
      17             : #include <linux/module.h>
      18             : #include <linux/capability.h>
      19             : #include <linux/completion.h>
      20             : #include <linux/personality.h>
      21             : #include <linux/tty.h>
      22             : #include <linux/iocontext.h>
      23             : #include <linux/key.h>
      24             : #include <linux/cpu.h>
      25             : #include <linux/acct.h>
      26             : #include <linux/tsacct_kern.h>
      27             : #include <linux/file.h>
      28             : #include <linux/fdtable.h>
      29             : #include <linux/freezer.h>
      30             : #include <linux/binfmts.h>
      31             : #include <linux/nsproxy.h>
      32             : #include <linux/pid_namespace.h>
      33             : #include <linux/ptrace.h>
      34             : #include <linux/profile.h>
      35             : #include <linux/mount.h>
      36             : #include <linux/proc_fs.h>
      37             : #include <linux/kthread.h>
      38             : #include <linux/mempolicy.h>
      39             : #include <linux/taskstats_kern.h>
      40             : #include <linux/delayacct.h>
      41             : #include <linux/cgroup.h>
      42             : #include <linux/syscalls.h>
      43             : #include <linux/signal.h>
      44             : #include <linux/posix-timers.h>
      45             : #include <linux/cn_proc.h>
      46             : #include <linux/mutex.h>
      47             : #include <linux/futex.h>
      48             : #include <linux/pipe_fs_i.h>
      49             : #include <linux/audit.h> /* for audit_free() */
      50             : #include <linux/resource.h>
      51             : #include <linux/task_io_accounting_ops.h>
      52             : #include <linux/blkdev.h>
      53             : #include <linux/task_work.h>
      54             : #include <linux/fs_struct.h>
      55             : #include <linux/init_task.h>
      56             : #include <linux/perf_event.h>
      57             : #include <trace/events/sched.h>
      58             : #include <linux/hw_breakpoint.h>
      59             : #include <linux/oom.h>
      60             : #include <linux/writeback.h>
      61             : #include <linux/shm.h>
      62             : #include <linux/kcov.h>
      63             : #include <linux/kmsan.h>
      64             : #include <linux/random.h>
      65             : #include <linux/rcuwait.h>
      66             : #include <linux/compat.h>
      67             : #include <linux/io_uring.h>
      68             : #include <linux/kprobes.h>
      69             : #include <linux/rethook.h>
      70             : #include <linux/sysfs.h>
      71             : #include <linux/user_events.h>
      72             : 
      73             : #include <linux/uaccess.h>
      74             : #include <asm/unistd.h>
      75             : #include <asm/mmu_context.h>
      76             : 
      77             : /*
      78             :  * The default value should be high enough to not crash a system that randomly
      79             :  * crashes its kernel from time to time, but low enough to at least not permit
      80             :  * overflowing 32-bit refcounts or the ldsem writer count.
      81             :  */
      82             : static unsigned int oops_limit = 10000;
      83             : 
      84             : #ifdef CONFIG_SYSCTL
      85             : static struct ctl_table kern_exit_table[] = {
      86             :         {
      87             :                 .procname       = "oops_limit",
      88             :                 .data           = &oops_limit,
      89             :                 .maxlen         = sizeof(oops_limit),
      90             :                 .mode           = 0644,
      91             :                 .proc_handler   = proc_douintvec,
      92             :         },
      93             :         { }
      94             : };
      95             : 
      96           1 : static __init int kernel_exit_sysctls_init(void)
      97             : {
      98           1 :         register_sysctl_init("kernel", kern_exit_table);
      99           1 :         return 0;
     100             : }
     101             : late_initcall(kernel_exit_sysctls_init);
     102             : #endif
     103             : 
     104             : static atomic_t oops_count = ATOMIC_INIT(0);
     105             : 
     106             : #ifdef CONFIG_SYSFS
     107           0 : static ssize_t oops_count_show(struct kobject *kobj, struct kobj_attribute *attr,
     108             :                                char *page)
     109             : {
     110           0 :         return sysfs_emit(page, "%d\n", atomic_read(&oops_count));
     111             : }
     112             : 
     113             : static struct kobj_attribute oops_count_attr = __ATTR_RO(oops_count);
     114             : 
     115           1 : static __init int kernel_exit_sysfs_init(void)
     116             : {
     117           1 :         sysfs_add_file_to_group(kernel_kobj, &oops_count_attr.attr, NULL);
     118           1 :         return 0;
     119             : }
     120             : late_initcall(kernel_exit_sysfs_init);
     121             : #endif
     122             : 
     123         367 : static void __unhash_process(struct task_struct *p, bool group_dead)
     124             : {
     125         367 :         nr_threads--;
     126         367 :         detach_pid(p, PIDTYPE_PID);
     127         367 :         if (group_dead) {
     128         367 :                 detach_pid(p, PIDTYPE_TGID);
     129         367 :                 detach_pid(p, PIDTYPE_PGID);
     130         367 :                 detach_pid(p, PIDTYPE_SID);
     131             : 
     132         734 :                 list_del_rcu(&p->tasks);
     133         734 :                 list_del_init(&p->sibling);
     134         367 :                 __this_cpu_dec(process_counts);
     135             :         }
     136         734 :         list_del_rcu(&p->thread_group);
     137         734 :         list_del_rcu(&p->thread_node);
     138         367 : }
     139             : 
     140             : /*
     141             :  * This function expects the tasklist_lock write-locked.
     142             :  */
     143         367 : static void __exit_signal(struct task_struct *tsk)
     144             : {
     145         367 :         struct signal_struct *sig = tsk->signal;
     146         734 :         bool group_dead = thread_group_leader(tsk);
     147             :         struct sighand_struct *sighand;
     148             :         struct tty_struct *tty;
     149             :         u64 utime, stime;
     150             : 
     151         367 :         sighand = rcu_dereference_check(tsk->sighand,
     152             :                                         lockdep_tasklist_lock_is_held());
     153         734 :         spin_lock(&sighand->siglock);
     154             : 
     155             : #ifdef CONFIG_POSIX_TIMERS
     156         367 :         posix_cpu_timers_exit(tsk);
     157         367 :         if (group_dead)
     158         367 :                 posix_cpu_timers_exit_group(tsk);
     159             : #endif
     160             : 
     161         367 :         if (group_dead) {
     162         367 :                 tty = sig->tty;
     163         367 :                 sig->tty = NULL;
     164             :         } else {
     165             :                 /*
     166             :                  * If there is any task waiting for the group exit
     167             :                  * then notify it:
     168             :                  */
     169           0 :                 if (sig->notify_count > 0 && !--sig->notify_count)
     170           0 :                         wake_up_process(sig->group_exec_task);
     171             : 
     172           0 :                 if (tsk == sig->curr_target)
     173           0 :                         sig->curr_target = next_thread(tsk);
     174             :         }
     175             : 
     176         367 :         add_device_randomness((const void*) &tsk->se.sum_exec_runtime,
     177             :                               sizeof(unsigned long long));
     178             : 
     179             :         /*
     180             :          * Accumulate here the counters for all threads as they die. We could
     181             :          * skip the group leader because it is the last user of signal_struct,
     182             :          * but we want to avoid the race with thread_group_cputime() which can
     183             :          * see the empty ->thread_head list.
     184             :          */
     185         734 :         task_cputime(tsk, &utime, &stime);
     186         734 :         write_seqlock(&sig->stats_lock);
     187         367 :         sig->utime += utime;
     188         367 :         sig->stime += stime;
     189         367 :         sig->gtime += task_gtime(tsk);
     190         367 :         sig->min_flt += tsk->min_flt;
     191         367 :         sig->maj_flt += tsk->maj_flt;
     192         367 :         sig->nvcsw += tsk->nvcsw;
     193         367 :         sig->nivcsw += tsk->nivcsw;
     194         367 :         sig->inblock += task_io_get_inblock(tsk);
     195         367 :         sig->oublock += task_io_get_oublock(tsk);
     196         367 :         task_io_accounting_add(&sig->ioac, &tsk->ioac);
     197         367 :         sig->sum_sched_runtime += tsk->se.sum_exec_runtime;
     198         367 :         sig->nr_threads--;
     199         367 :         __unhash_process(tsk, group_dead);
     200         734 :         write_sequnlock(&sig->stats_lock);
     201             : 
     202             :         /*
     203             :          * Do this under ->siglock, we can race with another thread
     204             :          * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
     205             :          */
     206         367 :         flush_sigqueue(&tsk->pending);
     207         367 :         tsk->sighand = NULL;
     208         734 :         spin_unlock(&sighand->siglock);
     209             : 
     210         367 :         __cleanup_sighand(sighand);
     211         734 :         clear_tsk_thread_flag(tsk, TIF_SIGPENDING);
     212         367 :         if (group_dead) {
     213         367 :                 flush_sigqueue(&sig->shared_pending);
     214         367 :                 tty_kref_put(tty);
     215             :         }
     216         367 : }
     217             : 
     218         366 : static void delayed_put_task_struct(struct rcu_head *rhp)
     219             : {
     220         366 :         struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
     221             : 
     222         366 :         kprobe_flush_task(tsk);
     223             :         rethook_flush_task(tsk);
     224         366 :         perf_event_delayed_put(tsk);
     225         366 :         trace_sched_process_free(tsk);
     226         366 :         put_task_struct(tsk);
     227         366 : }
     228             : 
     229         734 : void put_task_struct_rcu_user(struct task_struct *task)
     230             : {
     231        1468 :         if (refcount_dec_and_test(&task->rcu_users))
     232         367 :                 call_rcu(&task->rcu, delayed_put_task_struct);
     233         734 : }
     234             : 
     235         367 : void __weak release_thread(struct task_struct *dead_task)
     236             : {
     237         367 : }
     238             : 
     239         367 : void release_task(struct task_struct *p)
     240             : {
     241             :         struct task_struct *leader;
     242             :         struct pid *thread_pid;
     243             :         int zap_leader;
     244             : repeat:
     245             :         /* don't need to get the RCU readlock here - the process is dead and
     246             :          * can't be modifying its own credentials. But shut RCU-lockdep up */
     247             :         rcu_read_lock();
     248         734 :         dec_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1);
     249             :         rcu_read_unlock();
     250             : 
     251         367 :         cgroup_release(p);
     252             : 
     253         367 :         write_lock_irq(&tasklist_lock);
     254         367 :         ptrace_release_task(p);
     255         734 :         thread_pid = get_pid(p->thread_pid);
     256         367 :         __exit_signal(p);
     257             : 
     258             :         /*
     259             :          * If we are the last non-leader member of the thread
     260             :          * group, and the leader is zombie, then notify the
     261             :          * group leader's parent process. (if it wants notification.)
     262             :          */
     263         367 :         zap_leader = 0;
     264         367 :         leader = p->group_leader;
     265         367 :         if (leader != p && thread_group_empty(leader)
     266           0 :                         && leader->exit_state == EXIT_ZOMBIE) {
     267             :                 /*
     268             :                  * If we were the last child thread and the leader has
     269             :                  * exited already, and the leader's parent ignores SIGCHLD,
     270             :                  * then we are the one who should release the leader.
     271             :                  */
     272           0 :                 zap_leader = do_notify_parent(leader, leader->exit_signal);
     273           0 :                 if (zap_leader)
     274           0 :                         leader->exit_state = EXIT_DEAD;
     275             :         }
     276             : 
     277         367 :         write_unlock_irq(&tasklist_lock);
     278         367 :         seccomp_filter_release(p);
     279         367 :         proc_flush_pid(thread_pid);
     280         367 :         put_pid(thread_pid);
     281         367 :         release_thread(p);
     282         367 :         put_task_struct_rcu_user(p);
     283             : 
     284         367 :         p = leader;
     285         367 :         if (unlikely(zap_leader))
     286             :                 goto repeat;
     287         367 : }
     288             : 
     289           2 : int rcuwait_wake_up(struct rcuwait *w)
     290             : {
     291           2 :         int ret = 0;
     292             :         struct task_struct *task;
     293             : 
     294             :         rcu_read_lock();
     295             : 
     296             :         /*
     297             :          * Order condition vs @task, such that everything prior to the load
     298             :          * of @task is visible. This is the condition as to why the user called
     299             :          * rcuwait_wake() in the first place. Pairs with set_current_state()
     300             :          * barrier (A) in rcuwait_wait_event().
     301             :          *
     302             :          *    WAIT                WAKE
     303             :          *    [S] tsk = current   [S] cond = true
     304             :          *        MB (A)              MB (B)
     305             :          *    [L] cond            [L] tsk
     306             :          */
     307           2 :         smp_mb(); /* (B) */
     308             : 
     309           2 :         task = rcu_dereference(w->task);
     310           2 :         if (task)
     311           0 :                 ret = wake_up_process(task);
     312             :         rcu_read_unlock();
     313             : 
     314           2 :         return ret;
     315             : }
     316             : EXPORT_SYMBOL_GPL(rcuwait_wake_up);
     317             : 
     318             : /*
     319             :  * Determine if a process group is "orphaned", according to the POSIX
     320             :  * definition in 2.2.2.52.  Orphaned process groups are not to be affected
     321             :  * by terminal-generated stop signals.  Newly orphaned process groups are
     322             :  * to receive a SIGHUP and a SIGCONT.
     323             :  *
     324             :  * "I ask you, have you ever known what it is to be an orphan?"
     325             :  */
     326           0 : static int will_become_orphaned_pgrp(struct pid *pgrp,
     327             :                                         struct task_struct *ignored_task)
     328             : {
     329             :         struct task_struct *p;
     330             : 
     331           0 :         do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
     332           0 :                 if ((p == ignored_task) ||
     333           0 :                     (p->exit_state && thread_group_empty(p)) ||
     334           0 :                     is_global_init(p->real_parent))
     335           0 :                         continue;
     336             : 
     337           0 :                 if (task_pgrp(p->real_parent) != pgrp &&
     338           0 :                     task_session(p->real_parent) == task_session(p))
     339             :                         return 0;
     340             :         } while_each_pid_task(pgrp, PIDTYPE_PGID, p);
     341             : 
     342             :         return 1;
     343             : }
     344             : 
     345           0 : int is_current_pgrp_orphaned(void)
     346             : {
     347             :         int retval;
     348             : 
     349           0 :         read_lock(&tasklist_lock);
     350           0 :         retval = will_become_orphaned_pgrp(task_pgrp(current), NULL);
     351           0 :         read_unlock(&tasklist_lock);
     352             : 
     353           0 :         return retval;
     354             : }
     355             : 
     356             : static bool has_stopped_jobs(struct pid *pgrp)
     357             : {
     358             :         struct task_struct *p;
     359             : 
     360           0 :         do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
     361           0 :                 if (p->signal->flags & SIGNAL_STOP_STOPPED)
     362             :                         return true;
     363             :         } while_each_pid_task(pgrp, PIDTYPE_PGID, p);
     364             : 
     365             :         return false;
     366             : }
     367             : 
     368             : /*
     369             :  * Check to see if any process groups have become orphaned as
     370             :  * a result of our exiting, and if they have any stopped jobs,
     371             :  * send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2)
     372             :  */
     373             : static void
     374         367 : kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent)
     375             : {
     376         734 :         struct pid *pgrp = task_pgrp(tsk);
     377         367 :         struct task_struct *ignored_task = tsk;
     378             : 
     379         367 :         if (!parent)
     380             :                 /* exit: our father is in a different pgrp than
     381             :                  * we are and we were the only connection outside.
     382             :                  */
     383         367 :                 parent = tsk->real_parent;
     384             :         else
     385             :                 /* reparent: our child is in a different pgrp than
     386             :                  * we are, and it was the only connection outside.
     387             :                  */
     388             :                 ignored_task = NULL;
     389             : 
     390         734 :         if (task_pgrp(parent) != pgrp &&
     391           0 :             task_session(parent) == task_session(tsk) &&
     392           0 :             will_become_orphaned_pgrp(pgrp, ignored_task) &&
     393           0 :             has_stopped_jobs(pgrp)) {
     394           0 :                 __kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp);
     395           0 :                 __kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp);
     396             :         }
     397         367 : }
     398             : 
     399         367 : static void coredump_task_exit(struct task_struct *tsk)
     400             : {
     401             :         struct core_state *core_state;
     402             : 
     403             :         /*
     404             :          * Serialize with any possible pending coredump.
     405             :          * We must hold siglock around checking core_state
     406             :          * and setting PF_POSTCOREDUMP.  The core-inducing thread
     407             :          * will increment ->nr_threads for each thread in the
     408             :          * group without PF_POSTCOREDUMP set.
     409             :          */
     410         734 :         spin_lock_irq(&tsk->sighand->siglock);
     411         367 :         tsk->flags |= PF_POSTCOREDUMP;
     412         367 :         core_state = tsk->signal->core_state;
     413         734 :         spin_unlock_irq(&tsk->sighand->siglock);
     414             : 
     415             :         /* The vhost_worker does not particpate in coredumps */
     416         367 :         if (core_state &&
     417           0 :             ((tsk->flags & (PF_IO_WORKER | PF_USER_WORKER)) != PF_USER_WORKER)) {
     418             :                 struct core_thread self;
     419             : 
     420           0 :                 self.task = current;
     421           0 :                 if (self.task->flags & PF_SIGNALED)
     422           0 :                         self.next = xchg(&core_state->dumper.next, &self);
     423             :                 else
     424           0 :                         self.task = NULL;
     425             :                 /*
     426             :                  * Implies mb(), the result of xchg() must be visible
     427             :                  * to core_state->dumper.
     428             :                  */
     429           0 :                 if (atomic_dec_and_test(&core_state->nr_threads))
     430           0 :                         complete(&core_state->startup);
     431             : 
     432             :                 for (;;) {
     433           0 :                         set_current_state(TASK_UNINTERRUPTIBLE|TASK_FREEZABLE);
     434           0 :                         if (!self.task) /* see coredump_finish() */
     435             :                                 break;
     436           0 :                         schedule();
     437             :                 }
     438           0 :                 __set_current_state(TASK_RUNNING);
     439             :         }
     440         367 : }
     441             : 
     442             : #ifdef CONFIG_MEMCG
     443             : /*
     444             :  * A task is exiting.   If it owned this mm, find a new owner for the mm.
     445             :  */
     446             : void mm_update_next_owner(struct mm_struct *mm)
     447             : {
     448             :         struct task_struct *c, *g, *p = current;
     449             : 
     450             : retry:
     451             :         /*
     452             :          * If the exiting or execing task is not the owner, it's
     453             :          * someone else's problem.
     454             :          */
     455             :         if (mm->owner != p)
     456             :                 return;
     457             :         /*
     458             :          * The current owner is exiting/execing and there are no other
     459             :          * candidates.  Do not leave the mm pointing to a possibly
     460             :          * freed task structure.
     461             :          */
     462             :         if (atomic_read(&mm->mm_users) <= 1) {
     463             :                 WRITE_ONCE(mm->owner, NULL);
     464             :                 return;
     465             :         }
     466             : 
     467             :         read_lock(&tasklist_lock);
     468             :         /*
     469             :          * Search in the children
     470             :          */
     471             :         list_for_each_entry(c, &p->children, sibling) {
     472             :                 if (c->mm == mm)
     473             :                         goto assign_new_owner;
     474             :         }
     475             : 
     476             :         /*
     477             :          * Search in the siblings
     478             :          */
     479             :         list_for_each_entry(c, &p->real_parent->children, sibling) {
     480             :                 if (c->mm == mm)
     481             :                         goto assign_new_owner;
     482             :         }
     483             : 
     484             :         /*
     485             :          * Search through everything else, we should not get here often.
     486             :          */
     487             :         for_each_process(g) {
     488             :                 if (g->flags & PF_KTHREAD)
     489             :                         continue;
     490             :                 for_each_thread(g, c) {
     491             :                         if (c->mm == mm)
     492             :                                 goto assign_new_owner;
     493             :                         if (c->mm)
     494             :                                 break;
     495             :                 }
     496             :         }
     497             :         read_unlock(&tasklist_lock);
     498             :         /*
     499             :          * We found no owner yet mm_users > 1: this implies that we are
     500             :          * most likely racing with swapoff (try_to_unuse()) or /proc or
     501             :          * ptrace or page migration (get_task_mm()).  Mark owner as NULL.
     502             :          */
     503             :         WRITE_ONCE(mm->owner, NULL);
     504             :         return;
     505             : 
     506             : assign_new_owner:
     507             :         BUG_ON(c == p);
     508             :         get_task_struct(c);
     509             :         /*
     510             :          * The task_lock protects c->mm from changing.
     511             :          * We always want mm->owner->mm == mm
     512             :          */
     513             :         task_lock(c);
     514             :         /*
     515             :          * Delay read_unlock() till we have the task_lock()
     516             :          * to ensure that c does not slip away underneath us
     517             :          */
     518             :         read_unlock(&tasklist_lock);
     519             :         if (c->mm != mm) {
     520             :                 task_unlock(c);
     521             :                 put_task_struct(c);
     522             :                 goto retry;
     523             :         }
     524             :         WRITE_ONCE(mm->owner, c);
     525             :         lru_gen_migrate_mm(mm);
     526             :         task_unlock(c);
     527             :         put_task_struct(c);
     528             : }
     529             : #endif /* CONFIG_MEMCG */
     530             : 
     531             : /*
     532             :  * Turn us into a lazy TLB process if we
     533             :  * aren't already..
     534             :  */
     535         367 : static void exit_mm(void)
     536             : {
     537         367 :         struct mm_struct *mm = current->mm;
     538             : 
     539         367 :         exit_mm_release(current, mm);
     540         367 :         if (!mm)
     541             :                 return;
     542           0 :         sync_mm_rss(mm);
     543           0 :         mmap_read_lock(mm);
     544           0 :         mmgrab_lazy_tlb(mm);
     545           0 :         BUG_ON(mm != current->active_mm);
     546             :         /* more a memory barrier than a real lock */
     547           0 :         task_lock(current);
     548             :         /*
     549             :          * When a thread stops operating on an address space, the loop
     550             :          * in membarrier_private_expedited() may not observe that
     551             :          * tsk->mm, and the loop in membarrier_global_expedited() may
     552             :          * not observe a MEMBARRIER_STATE_GLOBAL_EXPEDITED
     553             :          * rq->membarrier_state, so those would not issue an IPI.
     554             :          * Membarrier requires a memory barrier after accessing
     555             :          * user-space memory, before clearing tsk->mm or the
     556             :          * rq->membarrier_state.
     557             :          */
     558             :         smp_mb__after_spinlock();
     559             :         local_irq_disable();
     560           0 :         current->mm = NULL;
     561           0 :         membarrier_update_current_mm(NULL);
     562           0 :         enter_lazy_tlb(mm, current);
     563             :         local_irq_enable();
     564           0 :         task_unlock(current);
     565           0 :         mmap_read_unlock(mm);
     566           0 :         mm_update_next_owner(mm);
     567           0 :         mmput(mm);
     568           0 :         if (test_thread_flag(TIF_MEMDIE))
     569           0 :                 exit_oom_victim();
     570             : }
     571             : 
     572             : static struct task_struct *find_alive_thread(struct task_struct *p)
     573             : {
     574             :         struct task_struct *t;
     575             : 
     576           0 :         for_each_thread(p, t) {
     577           0 :                 if (!(t->flags & PF_EXITING))
     578             :                         return t;
     579             :         }
     580             :         return NULL;
     581             : }
     582             : 
     583         367 : static struct task_struct *find_child_reaper(struct task_struct *father,
     584             :                                                 struct list_head *dead)
     585             :         __releases(&tasklist_lock)
     586             :         __acquires(&tasklist_lock)
     587             : {
     588         367 :         struct pid_namespace *pid_ns = task_active_pid_ns(father);
     589         367 :         struct task_struct *reaper = pid_ns->child_reaper;
     590             :         struct task_struct *p, *n;
     591             : 
     592         367 :         if (likely(reaper != father))
     593             :                 return reaper;
     594             : 
     595           0 :         reaper = find_alive_thread(father);
     596           0 :         if (reaper) {
     597           0 :                 pid_ns->child_reaper = reaper;
     598           0 :                 return reaper;
     599             :         }
     600             : 
     601           0 :         write_unlock_irq(&tasklist_lock);
     602             : 
     603           0 :         list_for_each_entry_safe(p, n, dead, ptrace_entry) {
     604           0 :                 list_del_init(&p->ptrace_entry);
     605           0 :                 release_task(p);
     606             :         }
     607             : 
     608           0 :         zap_pid_ns_processes(pid_ns);
     609           0 :         write_lock_irq(&tasklist_lock);
     610             : 
     611           0 :         return father;
     612             : }
     613             : 
     614             : /*
     615             :  * When we die, we re-parent all our children, and try to:
     616             :  * 1. give them to another thread in our thread group, if such a member exists
     617             :  * 2. give it to the first ancestor process which prctl'd itself as a
     618             :  *    child_subreaper for its children (like a service manager)
     619             :  * 3. give it to the init process (PID 1) in our pid namespace
     620             :  */
     621           0 : static struct task_struct *find_new_reaper(struct task_struct *father,
     622             :                                            struct task_struct *child_reaper)
     623             : {
     624             :         struct task_struct *thread, *reaper;
     625             : 
     626           0 :         thread = find_alive_thread(father);
     627           0 :         if (thread)
     628             :                 return thread;
     629             : 
     630           0 :         if (father->signal->has_child_subreaper) {
     631           0 :                 unsigned int ns_level = task_pid(father)->level;
     632             :                 /*
     633             :                  * Find the first ->is_child_subreaper ancestor in our pid_ns.
     634             :                  * We can't check reaper != child_reaper to ensure we do not
     635             :                  * cross the namespaces, the exiting parent could be injected
     636             :                  * by setns() + fork().
     637             :                  * We check pid->level, this is slightly more efficient than
     638             :                  * task_active_pid_ns(reaper) != task_active_pid_ns(father).
     639             :                  */
     640           0 :                 for (reaper = father->real_parent;
     641           0 :                      task_pid(reaper)->level == ns_level;
     642           0 :                      reaper = reaper->real_parent) {
     643           0 :                         if (reaper == &init_task)
     644             :                                 break;
     645           0 :                         if (!reaper->signal->is_child_subreaper)
     646           0 :                                 continue;
     647           0 :                         thread = find_alive_thread(reaper);
     648           0 :                         if (thread)
     649             :                                 return thread;
     650             :                 }
     651             :         }
     652             : 
     653             :         return child_reaper;
     654             : }
     655             : 
     656             : /*
     657             : * Any that need to be release_task'd are put on the @dead list.
     658             :  */
     659           0 : static void reparent_leader(struct task_struct *father, struct task_struct *p,
     660             :                                 struct list_head *dead)
     661             : {
     662           0 :         if (unlikely(p->exit_state == EXIT_DEAD))
     663             :                 return;
     664             : 
     665             :         /* We don't want people slaying init. */
     666           0 :         p->exit_signal = SIGCHLD;
     667             : 
     668             :         /* If it has exited notify the new parent about this child's death. */
     669           0 :         if (!p->ptrace &&
     670           0 :             p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
     671           0 :                 if (do_notify_parent(p, p->exit_signal)) {
     672           0 :                         p->exit_state = EXIT_DEAD;
     673           0 :                         list_add(&p->ptrace_entry, dead);
     674             :                 }
     675             :         }
     676             : 
     677           0 :         kill_orphaned_pgrp(p, father);
     678             : }
     679             : 
     680             : /*
     681             :  * This does two things:
     682             :  *
     683             :  * A.  Make init inherit all the child processes
     684             :  * B.  Check to see if any process groups have become orphaned
     685             :  *      as a result of our exiting, and if they have any stopped
     686             :  *      jobs, send them a SIGHUP and then a SIGCONT.  (POSIX 3.2.2.2)
     687             :  */
     688         367 : static void forget_original_parent(struct task_struct *father,
     689             :                                         struct list_head *dead)
     690             : {
     691             :         struct task_struct *p, *t, *reaper;
     692             : 
     693         734 :         if (unlikely(!list_empty(&father->ptraced)))
     694           0 :                 exit_ptrace(father, dead);
     695             : 
     696             :         /* Can drop and reacquire tasklist_lock */
     697         367 :         reaper = find_child_reaper(father, dead);
     698         734 :         if (list_empty(&father->children))
     699             :                 return;
     700             : 
     701           0 :         reaper = find_new_reaper(father, reaper);
     702           0 :         list_for_each_entry(p, &father->children, sibling) {
     703           0 :                 for_each_thread(p, t) {
     704           0 :                         RCU_INIT_POINTER(t->real_parent, reaper);
     705           0 :                         BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father));
     706           0 :                         if (likely(!t->ptrace))
     707           0 :                                 t->parent = t->real_parent;
     708           0 :                         if (t->pdeath_signal)
     709           0 :                                 group_send_sig_info(t->pdeath_signal,
     710             :                                                     SEND_SIG_NOINFO, t,
     711             :                                                     PIDTYPE_TGID);
     712             :                 }
     713             :                 /*
     714             :                  * If this is a threaded reparent there is no need to
     715             :                  * notify anyone anything has happened.
     716             :                  */
     717           0 :                 if (!same_thread_group(reaper, father))
     718           0 :                         reparent_leader(father, p, dead);
     719             :         }
     720           0 :         list_splice_tail_init(&father->children, &reaper->children);
     721             : }
     722             : 
     723             : /*
     724             :  * Send signals to all our closest relatives so that they know
     725             :  * to properly mourn us..
     726             :  */
     727         367 : static void exit_notify(struct task_struct *tsk, int group_dead)
     728             : {
     729             :         bool autoreap;
     730             :         struct task_struct *p, *n;
     731         367 :         LIST_HEAD(dead);
     732             : 
     733         367 :         write_lock_irq(&tasklist_lock);
     734         367 :         forget_original_parent(tsk, &dead);
     735             : 
     736         367 :         if (group_dead)
     737         367 :                 kill_orphaned_pgrp(tsk->group_leader, NULL);
     738             : 
     739         367 :         tsk->exit_state = EXIT_ZOMBIE;
     740         367 :         if (unlikely(tsk->ptrace)) {
     741           0 :                 int sig = thread_group_leader(tsk) &&
     742           0 :                                 thread_group_empty(tsk) &&
     743           0 :                                 !ptrace_reparented(tsk) ?
     744           0 :                         tsk->exit_signal : SIGCHLD;
     745           0 :                 autoreap = do_notify_parent(tsk, sig);
     746         367 :         } else if (thread_group_leader(tsk)) {
     747         734 :                 autoreap = thread_group_empty(tsk) &&
     748         367 :                         do_notify_parent(tsk, tsk->exit_signal);
     749             :         } else {
     750             :                 autoreap = true;
     751             :         }
     752             : 
     753         367 :         if (autoreap) {
     754         367 :                 tsk->exit_state = EXIT_DEAD;
     755         367 :                 list_add(&tsk->ptrace_entry, &dead);
     756             :         }
     757             : 
     758             :         /* mt-exec, de_thread() is waiting for group leader */
     759         367 :         if (unlikely(tsk->signal->notify_count < 0))
     760           0 :                 wake_up_process(tsk->signal->group_exec_task);
     761         367 :         write_unlock_irq(&tasklist_lock);
     762             : 
     763         734 :         list_for_each_entry_safe(p, n, &dead, ptrace_entry) {
     764         734 :                 list_del_init(&p->ptrace_entry);
     765         367 :                 release_task(p);
     766             :         }
     767         367 : }
     768             : 
     769             : #ifdef CONFIG_DEBUG_STACK_USAGE
     770             : static void check_stack_usage(void)
     771             : {
     772             :         static DEFINE_SPINLOCK(low_water_lock);
     773             :         static int lowest_to_date = THREAD_SIZE;
     774             :         unsigned long free;
     775             : 
     776             :         free = stack_not_used(current);
     777             : 
     778             :         if (free >= lowest_to_date)
     779             :                 return;
     780             : 
     781             :         spin_lock(&low_water_lock);
     782             :         if (free < lowest_to_date) {
     783             :                 pr_info("%s (%d) used greatest stack depth: %lu bytes left\n",
     784             :                         current->comm, task_pid_nr(current), free);
     785             :                 lowest_to_date = free;
     786             :         }
     787             :         spin_unlock(&low_water_lock);
     788             : }
     789             : #else
     790             : static inline void check_stack_usage(void) {}
     791             : #endif
     792             : 
     793         367 : static void synchronize_group_exit(struct task_struct *tsk, long code)
     794             : {
     795         367 :         struct sighand_struct *sighand = tsk->sighand;
     796         367 :         struct signal_struct *signal = tsk->signal;
     797             : 
     798         734 :         spin_lock_irq(&sighand->siglock);
     799         367 :         signal->quick_threads--;
     800         734 :         if ((signal->quick_threads == 0) &&
     801         367 :             !(signal->flags & SIGNAL_GROUP_EXIT)) {
     802         367 :                 signal->flags = SIGNAL_GROUP_EXIT;
     803         367 :                 signal->group_exit_code = code;
     804         367 :                 signal->group_stop_count = 0;
     805             :         }
     806         734 :         spin_unlock_irq(&sighand->siglock);
     807         367 : }
     808             : 
     809         367 : void __noreturn do_exit(long code)
     810             : {
     811         367 :         struct task_struct *tsk = current;
     812             :         int group_dead;
     813             : 
     814         734 :         WARN_ON(irqs_disabled());
     815             : 
     816         367 :         synchronize_group_exit(tsk, code);
     817             : 
     818         367 :         WARN_ON(tsk->plug);
     819             : 
     820         367 :         kcov_task_exit(tsk);
     821         367 :         kmsan_task_exit(tsk);
     822             : 
     823         367 :         coredump_task_exit(tsk);
     824         367 :         ptrace_event(PTRACE_EVENT_EXIT, code);
     825         367 :         user_events_exit(tsk);
     826             : 
     827         367 :         validate_creds_for_do_exit(tsk);
     828             : 
     829         367 :         io_uring_files_cancel();
     830         367 :         exit_signals(tsk);  /* sets PF_EXITING */
     831             : 
     832             :         /* sync mm's RSS info before statistics gathering */
     833             :         if (tsk->mm)
     834             :                 sync_mm_rss(tsk->mm);
     835         367 :         acct_update_integrals(tsk);
     836         734 :         group_dead = atomic_dec_and_test(&tsk->signal->live);
     837         367 :         if (group_dead) {
     838             :                 /*
     839             :                  * If the last thread of global init has exited, panic
     840             :                  * immediately to get a useable coredump.
     841             :                  */
     842         367 :                 if (unlikely(is_global_init(tsk)))
     843           0 :                         panic("Attempted to kill init! exitcode=0x%08x\n",
     844           0 :                                 tsk->signal->group_exit_code ?: (int)code);
     845             : 
     846             : #ifdef CONFIG_POSIX_TIMERS
     847         367 :                 hrtimer_cancel(&tsk->signal->real_timer);
     848         367 :                 exit_itimers(tsk);
     849             : #endif
     850         367 :                 if (tsk->mm)
     851           0 :                         setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
     852             :         }
     853             :         acct_collect(code, group_dead);
     854             :         if (group_dead)
     855             :                 tty_audit_exit();
     856         367 :         audit_free(tsk);
     857             : 
     858         367 :         tsk->exit_code = code;
     859         367 :         taskstats_exit(tsk, group_dead);
     860             : 
     861         367 :         exit_mm();
     862             : 
     863             :         if (group_dead)
     864             :                 acct_process();
     865         367 :         trace_sched_process_exit(tsk);
     866             : 
     867         367 :         exit_sem(tsk);
     868         367 :         exit_shm(tsk);
     869         367 :         exit_files(tsk);
     870         367 :         exit_fs(tsk);
     871         367 :         if (group_dead)
     872         367 :                 disassociate_ctty(1);
     873         367 :         exit_task_namespaces(tsk);
     874         367 :         exit_task_work(tsk);
     875         367 :         exit_thread(tsk);
     876             : 
     877             :         /*
     878             :          * Flush inherited counters to the parent - before the parent
     879             :          * gets woken up by child-exit notifications.
     880             :          *
     881             :          * because of cgroup mode, must be called before cgroup_exit()
     882             :          */
     883         367 :         perf_event_exit_task(tsk);
     884             : 
     885         367 :         sched_autogroup_exit_task(tsk);
     886         367 :         cgroup_exit(tsk);
     887             : 
     888             :         /*
     889             :          * FIXME: do that only when needed, using sched_exit tracepoint
     890             :          */
     891         367 :         flush_ptrace_hw_breakpoint(tsk);
     892             : 
     893             :         exit_tasks_rcu_start();
     894         367 :         exit_notify(tsk, group_dead);
     895         367 :         proc_exit_connector(tsk);
     896         367 :         mpol_put_task_policy(tsk);
     897             : #ifdef CONFIG_FUTEX
     898         367 :         if (unlikely(current->pi_state_cache))
     899           0 :                 kfree(current->pi_state_cache);
     900             : #endif
     901             :         /*
     902             :          * Make sure we are holding no locks:
     903             :          */
     904             :         debug_check_no_locks_held();
     905             : 
     906         367 :         if (tsk->io_context)
     907           0 :                 exit_io_context(tsk);
     908             : 
     909         367 :         if (tsk->splice_pipe)
     910           0 :                 free_pipe_info(tsk->splice_pipe);
     911             : 
     912         367 :         if (tsk->task_frag.page)
     913           0 :                 put_page(tsk->task_frag.page);
     914             : 
     915         367 :         validate_creds_for_do_exit(tsk);
     916         367 :         exit_task_stack_account(tsk);
     917             : 
     918             :         check_stack_usage();
     919         367 :         preempt_disable();
     920         367 :         if (tsk->nr_dirtied)
     921           0 :                 __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);
     922             :         exit_rcu();
     923             :         exit_tasks_rcu_finish();
     924             : 
     925         367 :         lockdep_free_task(tsk);
     926         367 :         do_task_dead();
     927             : }
     928             : 
     929           0 : void __noreturn make_task_dead(int signr)
     930             : {
     931             :         /*
     932             :          * Take the task off the cpu after something catastrophic has
     933             :          * happened.
     934             :          *
     935             :          * We can get here from a kernel oops, sometimes with preemption off.
     936             :          * Start by checking for critical errors.
     937             :          * Then fix up important state like USER_DS and preemption.
     938             :          * Then do everything else.
     939             :          */
     940           0 :         struct task_struct *tsk = current;
     941             :         unsigned int limit;
     942             : 
     943           0 :         if (unlikely(in_interrupt()))
     944           0 :                 panic("Aiee, killing interrupt handler!");
     945           0 :         if (unlikely(!tsk->pid))
     946           0 :                 panic("Attempted to kill the idle task!");
     947             : 
     948           0 :         if (unlikely(irqs_disabled())) {
     949           0 :                 pr_info("note: %s[%d] exited with irqs disabled\n",
     950             :                         current->comm, task_pid_nr(current));
     951             :                 local_irq_enable();
     952             :         }
     953           0 :         if (unlikely(in_atomic())) {
     954           0 :                 pr_info("note: %s[%d] exited with preempt_count %d\n",
     955             :                         current->comm, task_pid_nr(current),
     956             :                         preempt_count());
     957             :                 preempt_count_set(PREEMPT_ENABLED);
     958             :         }
     959             : 
     960             :         /*
     961             :          * Every time the system oopses, if the oops happens while a reference
     962             :          * to an object was held, the reference leaks.
     963             :          * If the oops doesn't also leak memory, repeated oopsing can cause
     964             :          * reference counters to wrap around (if they're not using refcount_t).
     965             :          * This means that repeated oopsing can make unexploitable-looking bugs
     966             :          * exploitable through repeated oopsing.
     967             :          * To make sure this can't happen, place an upper bound on how often the
     968             :          * kernel may oops without panic().
     969             :          */
     970           0 :         limit = READ_ONCE(oops_limit);
     971           0 :         if (atomic_inc_return(&oops_count) >= limit && limit)
     972           0 :                 panic("Oopsed too often (kernel.oops_limit is %d)", limit);
     973             : 
     974             :         /*
     975             :          * We're taking recursive faults here in make_task_dead. Safest is to just
     976             :          * leave this task alone and wait for reboot.
     977             :          */
     978           0 :         if (unlikely(tsk->flags & PF_EXITING)) {
     979           0 :                 pr_alert("Fixing recursive fault but reboot is needed!\n");
     980           0 :                 futex_exit_recursive(tsk);
     981           0 :                 tsk->exit_state = EXIT_DEAD;
     982           0 :                 refcount_inc(&tsk->rcu_users);
     983           0 :                 do_task_dead();
     984             :         }
     985             : 
     986           0 :         do_exit(signr);
     987             : }
     988             : 
     989           0 : SYSCALL_DEFINE1(exit, int, error_code)
     990             : {
     991           0 :         do_exit((error_code&0xff)<<8);
     992             : }
     993             : 
     994             : /*
     995             :  * Take down every thread in the group.  This is called by fatal signals
     996             :  * as well as by sys_exit_group (below).
     997             :  */
     998             : void __noreturn
     999           0 : do_group_exit(int exit_code)
    1000             : {
    1001           0 :         struct signal_struct *sig = current->signal;
    1002             : 
    1003           0 :         if (sig->flags & SIGNAL_GROUP_EXIT)
    1004           0 :                 exit_code = sig->group_exit_code;
    1005           0 :         else if (sig->group_exec_task)
    1006             :                 exit_code = 0;
    1007             :         else {
    1008           0 :                 struct sighand_struct *const sighand = current->sighand;
    1009             : 
    1010           0 :                 spin_lock_irq(&sighand->siglock);
    1011           0 :                 if (sig->flags & SIGNAL_GROUP_EXIT)
    1012             :                         /* Another thread got here before we took the lock.  */
    1013           0 :                         exit_code = sig->group_exit_code;
    1014           0 :                 else if (sig->group_exec_task)
    1015             :                         exit_code = 0;
    1016             :                 else {
    1017           0 :                         sig->group_exit_code = exit_code;
    1018           0 :                         sig->flags = SIGNAL_GROUP_EXIT;
    1019           0 :                         zap_other_threads(current);
    1020             :                 }
    1021           0 :                 spin_unlock_irq(&sighand->siglock);
    1022             :         }
    1023             : 
    1024           0 :         do_exit(exit_code);
    1025             :         /* NOTREACHED */
    1026             : }
    1027             : 
    1028             : /*
    1029             :  * this kills every thread in the thread group. Note that any externally
    1030             :  * wait4()-ing process will get the correct exit code - even if this
    1031             :  * thread is not the thread group leader.
    1032             :  */
    1033           0 : SYSCALL_DEFINE1(exit_group, int, error_code)
    1034             : {
    1035           0 :         do_group_exit((error_code & 0xff) << 8);
    1036             :         /* NOTREACHED */
    1037             :         return 0;
    1038             : }
    1039             : 
    1040             : struct waitid_info {
    1041             :         pid_t pid;
    1042             :         uid_t uid;
    1043             :         int status;
    1044             :         int cause;
    1045             : };
    1046             : 
    1047             : struct wait_opts {
    1048             :         enum pid_type           wo_type;
    1049             :         int                     wo_flags;
    1050             :         struct pid              *wo_pid;
    1051             : 
    1052             :         struct waitid_info      *wo_info;
    1053             :         int                     wo_stat;
    1054             :         struct rusage           *wo_rusage;
    1055             : 
    1056             :         wait_queue_entry_t              child_wait;
    1057             :         int                     notask_error;
    1058             : };
    1059             : 
    1060             : static int eligible_pid(struct wait_opts *wo, struct task_struct *p)
    1061             : {
    1062           0 :         return  wo->wo_type == PIDTYPE_MAX ||
    1063           0 :                 task_pid_type(p, wo->wo_type) == wo->wo_pid;
    1064             : }
    1065             : 
    1066             : static int
    1067           0 : eligible_child(struct wait_opts *wo, bool ptrace, struct task_struct *p)
    1068             : {
    1069           0 :         if (!eligible_pid(wo, p))
    1070             :                 return 0;
    1071             : 
    1072             :         /*
    1073             :          * Wait for all children (clone and not) if __WALL is set or
    1074             :          * if it is traced by us.
    1075             :          */
    1076           0 :         if (ptrace || (wo->wo_flags & __WALL))
    1077             :                 return 1;
    1078             : 
    1079             :         /*
    1080             :          * Otherwise, wait for clone children *only* if __WCLONE is set;
    1081             :          * otherwise, wait for non-clone children *only*.
    1082             :          *
    1083             :          * Note: a "clone" child here is one that reports to its parent
    1084             :          * using a signal other than SIGCHLD, or a non-leader thread which
    1085             :          * we can only see if it is traced by us.
    1086             :          */
    1087           0 :         if ((p->exit_signal != SIGCHLD) ^ !!(wo->wo_flags & __WCLONE))
    1088             :                 return 0;
    1089             : 
    1090           0 :         return 1;
    1091             : }
    1092             : 
    1093             : /*
    1094             :  * Handle sys_wait4 work for one task in state EXIT_ZOMBIE.  We hold
    1095             :  * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
    1096             :  * the lock and this task is uninteresting.  If we return nonzero, we have
    1097             :  * released the lock and the system call should return.
    1098             :  */
    1099           0 : static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
    1100             : {
    1101             :         int state, status;
    1102           0 :         pid_t pid = task_pid_vnr(p);
    1103           0 :         uid_t uid = from_kuid_munged(current_user_ns(), task_uid(p));
    1104             :         struct waitid_info *infop;
    1105             : 
    1106           0 :         if (!likely(wo->wo_flags & WEXITED))
    1107             :                 return 0;
    1108             : 
    1109           0 :         if (unlikely(wo->wo_flags & WNOWAIT)) {
    1110           0 :                 status = (p->signal->flags & SIGNAL_GROUP_EXIT)
    1111           0 :                         ? p->signal->group_exit_code : p->exit_code;
    1112           0 :                 get_task_struct(p);
    1113           0 :                 read_unlock(&tasklist_lock);
    1114             :                 sched_annotate_sleep();
    1115           0 :                 if (wo->wo_rusage)
    1116           0 :                         getrusage(p, RUSAGE_BOTH, wo->wo_rusage);
    1117           0 :                 put_task_struct(p);
    1118           0 :                 goto out_info;
    1119             :         }
    1120             :         /*
    1121             :          * Move the task's state to DEAD/TRACE, only one thread can do this.
    1122             :          */
    1123           0 :         state = (ptrace_reparented(p) && thread_group_leader(p)) ?
    1124           0 :                 EXIT_TRACE : EXIT_DEAD;
    1125           0 :         if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE)
    1126             :                 return 0;
    1127             :         /*
    1128             :          * We own this thread, nobody else can reap it.
    1129             :          */
    1130           0 :         read_unlock(&tasklist_lock);
    1131             :         sched_annotate_sleep();
    1132             : 
    1133             :         /*
    1134             :          * Check thread_group_leader() to exclude the traced sub-threads.
    1135             :          */
    1136           0 :         if (state == EXIT_DEAD && thread_group_leader(p)) {
    1137           0 :                 struct signal_struct *sig = p->signal;
    1138           0 :                 struct signal_struct *psig = current->signal;
    1139             :                 unsigned long maxrss;
    1140             :                 u64 tgutime, tgstime;
    1141             : 
    1142             :                 /*
    1143             :                  * The resource counters for the group leader are in its
    1144             :                  * own task_struct.  Those for dead threads in the group
    1145             :                  * are in its signal_struct, as are those for the child
    1146             :                  * processes it has previously reaped.  All these
    1147             :                  * accumulate in the parent's signal_struct c* fields.
    1148             :                  *
    1149             :                  * We don't bother to take a lock here to protect these
    1150             :                  * p->signal fields because the whole thread group is dead
    1151             :                  * and nobody can change them.
    1152             :                  *
    1153             :                  * psig->stats_lock also protects us from our sub-threads
    1154             :                  * which can reap other children at the same time. Until
    1155             :                  * we change k_getrusage()-like users to rely on this lock
    1156             :                  * we have to take ->siglock as well.
    1157             :                  *
    1158             :                  * We use thread_group_cputime_adjusted() to get times for
    1159             :                  * the thread group, which consolidates times for all threads
    1160             :                  * in the group including the group leader.
    1161             :                  */
    1162           0 :                 thread_group_cputime_adjusted(p, &tgutime, &tgstime);
    1163           0 :                 spin_lock_irq(&current->sighand->siglock);
    1164           0 :                 write_seqlock(&psig->stats_lock);
    1165           0 :                 psig->cutime += tgutime + sig->cutime;
    1166           0 :                 psig->cstime += tgstime + sig->cstime;
    1167           0 :                 psig->cgtime += task_gtime(p) + sig->gtime + sig->cgtime;
    1168           0 :                 psig->cmin_flt +=
    1169           0 :                         p->min_flt + sig->min_flt + sig->cmin_flt;
    1170           0 :                 psig->cmaj_flt +=
    1171           0 :                         p->maj_flt + sig->maj_flt + sig->cmaj_flt;
    1172           0 :                 psig->cnvcsw +=
    1173           0 :                         p->nvcsw + sig->nvcsw + sig->cnvcsw;
    1174           0 :                 psig->cnivcsw +=
    1175           0 :                         p->nivcsw + sig->nivcsw + sig->cnivcsw;
    1176           0 :                 psig->cinblock +=
    1177           0 :                         task_io_get_inblock(p) +
    1178           0 :                         sig->inblock + sig->cinblock;
    1179           0 :                 psig->coublock +=
    1180           0 :                         task_io_get_oublock(p) +
    1181           0 :                         sig->oublock + sig->coublock;
    1182           0 :                 maxrss = max(sig->maxrss, sig->cmaxrss);
    1183           0 :                 if (psig->cmaxrss < maxrss)
    1184           0 :                         psig->cmaxrss = maxrss;
    1185           0 :                 task_io_accounting_add(&psig->ioac, &p->ioac);
    1186           0 :                 task_io_accounting_add(&psig->ioac, &sig->ioac);
    1187           0 :                 write_sequnlock(&psig->stats_lock);
    1188           0 :                 spin_unlock_irq(&current->sighand->siglock);
    1189             :         }
    1190             : 
    1191           0 :         if (wo->wo_rusage)
    1192           0 :                 getrusage(p, RUSAGE_BOTH, wo->wo_rusage);
    1193           0 :         status = (p->signal->flags & SIGNAL_GROUP_EXIT)
    1194           0 :                 ? p->signal->group_exit_code : p->exit_code;
    1195           0 :         wo->wo_stat = status;
    1196             : 
    1197           0 :         if (state == EXIT_TRACE) {
    1198           0 :                 write_lock_irq(&tasklist_lock);
    1199             :                 /* We dropped tasklist, ptracer could die and untrace */
    1200           0 :                 ptrace_unlink(p);
    1201             : 
    1202             :                 /* If parent wants a zombie, don't release it now */
    1203           0 :                 state = EXIT_ZOMBIE;
    1204           0 :                 if (do_notify_parent(p, p->exit_signal))
    1205           0 :                         state = EXIT_DEAD;
    1206           0 :                 p->exit_state = state;
    1207           0 :                 write_unlock_irq(&tasklist_lock);
    1208             :         }
    1209           0 :         if (state == EXIT_DEAD)
    1210           0 :                 release_task(p);
    1211             : 
    1212             : out_info:
    1213           0 :         infop = wo->wo_info;
    1214           0 :         if (infop) {
    1215           0 :                 if ((status & 0x7f) == 0) {
    1216           0 :                         infop->cause = CLD_EXITED;
    1217           0 :                         infop->status = status >> 8;
    1218             :                 } else {
    1219           0 :                         infop->cause = (status & 0x80) ? CLD_DUMPED : CLD_KILLED;
    1220           0 :                         infop->status = status & 0x7f;
    1221             :                 }
    1222           0 :                 infop->pid = pid;
    1223           0 :                 infop->uid = uid;
    1224             :         }
    1225             : 
    1226             :         return pid;
    1227             : }
    1228             : 
    1229             : static int *task_stopped_code(struct task_struct *p, bool ptrace)
    1230             : {
    1231           0 :         if (ptrace) {
    1232           0 :                 if (task_is_traced(p) && !(p->jobctl & JOBCTL_LISTENING))
    1233           0 :                         return &p->exit_code;
    1234             :         } else {
    1235           0 :                 if (p->signal->flags & SIGNAL_STOP_STOPPED)
    1236           0 :                         return &p->signal->group_exit_code;
    1237             :         }
    1238             :         return NULL;
    1239             : }
    1240             : 
    1241             : /**
    1242             :  * wait_task_stopped - Wait for %TASK_STOPPED or %TASK_TRACED
    1243             :  * @wo: wait options
    1244             :  * @ptrace: is the wait for ptrace
    1245             :  * @p: task to wait for
    1246             :  *
    1247             :  * Handle sys_wait4() work for %p in state %TASK_STOPPED or %TASK_TRACED.
    1248             :  *
    1249             :  * CONTEXT:
    1250             :  * read_lock(&tasklist_lock), which is released if return value is
    1251             :  * non-zero.  Also, grabs and releases @p->sighand->siglock.
    1252             :  *
    1253             :  * RETURNS:
    1254             :  * 0 if wait condition didn't exist and search for other wait conditions
    1255             :  * should continue.  Non-zero return, -errno on failure and @p's pid on
    1256             :  * success, implies that tasklist_lock is released and wait condition
    1257             :  * search should terminate.
    1258             :  */
    1259           0 : static int wait_task_stopped(struct wait_opts *wo,
    1260             :                                 int ptrace, struct task_struct *p)
    1261             : {
    1262             :         struct waitid_info *infop;
    1263             :         int exit_code, *p_code, why;
    1264           0 :         uid_t uid = 0; /* unneeded, required by compiler */
    1265             :         pid_t pid;
    1266             : 
    1267             :         /*
    1268             :          * Traditionally we see ptrace'd stopped tasks regardless of options.
    1269             :          */
    1270           0 :         if (!ptrace && !(wo->wo_flags & WUNTRACED))
    1271             :                 return 0;
    1272             : 
    1273           0 :         if (!task_stopped_code(p, ptrace))
    1274             :                 return 0;
    1275             : 
    1276           0 :         exit_code = 0;
    1277           0 :         spin_lock_irq(&p->sighand->siglock);
    1278             : 
    1279           0 :         p_code = task_stopped_code(p, ptrace);
    1280           0 :         if (unlikely(!p_code))
    1281             :                 goto unlock_sig;
    1282             : 
    1283           0 :         exit_code = *p_code;
    1284           0 :         if (!exit_code)
    1285             :                 goto unlock_sig;
    1286             : 
    1287           0 :         if (!unlikely(wo->wo_flags & WNOWAIT))
    1288           0 :                 *p_code = 0;
    1289             : 
    1290           0 :         uid = from_kuid_munged(current_user_ns(), task_uid(p));
    1291             : unlock_sig:
    1292           0 :         spin_unlock_irq(&p->sighand->siglock);
    1293           0 :         if (!exit_code)
    1294             :                 return 0;
    1295             : 
    1296             :         /*
    1297             :          * Now we are pretty sure this task is interesting.
    1298             :          * Make sure it doesn't get reaped out from under us while we
    1299             :          * give up the lock and then examine it below.  We don't want to
    1300             :          * keep holding onto the tasklist_lock while we call getrusage and
    1301             :          * possibly take page faults for user memory.
    1302             :          */
    1303           0 :         get_task_struct(p);
    1304           0 :         pid = task_pid_vnr(p);
    1305           0 :         why = ptrace ? CLD_TRAPPED : CLD_STOPPED;
    1306           0 :         read_unlock(&tasklist_lock);
    1307             :         sched_annotate_sleep();
    1308           0 :         if (wo->wo_rusage)
    1309           0 :                 getrusage(p, RUSAGE_BOTH, wo->wo_rusage);
    1310           0 :         put_task_struct(p);
    1311             : 
    1312           0 :         if (likely(!(wo->wo_flags & WNOWAIT)))
    1313           0 :                 wo->wo_stat = (exit_code << 8) | 0x7f;
    1314             : 
    1315           0 :         infop = wo->wo_info;
    1316           0 :         if (infop) {
    1317           0 :                 infop->cause = why;
    1318           0 :                 infop->status = exit_code;
    1319           0 :                 infop->pid = pid;
    1320           0 :                 infop->uid = uid;
    1321             :         }
    1322             :         return pid;
    1323             : }
    1324             : 
    1325             : /*
    1326             :  * Handle do_wait work for one task in a live, non-stopped state.
    1327             :  * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
    1328             :  * the lock and this task is uninteresting.  If we return nonzero, we have
    1329             :  * released the lock and the system call should return.
    1330             :  */
    1331           0 : static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
    1332             : {
    1333             :         struct waitid_info *infop;
    1334             :         pid_t pid;
    1335             :         uid_t uid;
    1336             : 
    1337           0 :         if (!unlikely(wo->wo_flags & WCONTINUED))
    1338             :                 return 0;
    1339             : 
    1340           0 :         if (!(p->signal->flags & SIGNAL_STOP_CONTINUED))
    1341             :                 return 0;
    1342             : 
    1343           0 :         spin_lock_irq(&p->sighand->siglock);
    1344             :         /* Re-check with the lock held.  */
    1345           0 :         if (!(p->signal->flags & SIGNAL_STOP_CONTINUED)) {
    1346           0 :                 spin_unlock_irq(&p->sighand->siglock);
    1347           0 :                 return 0;
    1348             :         }
    1349           0 :         if (!unlikely(wo->wo_flags & WNOWAIT))
    1350           0 :                 p->signal->flags &= ~SIGNAL_STOP_CONTINUED;
    1351           0 :         uid = from_kuid_munged(current_user_ns(), task_uid(p));
    1352           0 :         spin_unlock_irq(&p->sighand->siglock);
    1353             : 
    1354           0 :         pid = task_pid_vnr(p);
    1355           0 :         get_task_struct(p);
    1356           0 :         read_unlock(&tasklist_lock);
    1357             :         sched_annotate_sleep();
    1358           0 :         if (wo->wo_rusage)
    1359           0 :                 getrusage(p, RUSAGE_BOTH, wo->wo_rusage);
    1360           0 :         put_task_struct(p);
    1361             : 
    1362           0 :         infop = wo->wo_info;
    1363           0 :         if (!infop) {
    1364           0 :                 wo->wo_stat = 0xffff;
    1365             :         } else {
    1366           0 :                 infop->cause = CLD_CONTINUED;
    1367           0 :                 infop->pid = pid;
    1368           0 :                 infop->uid = uid;
    1369           0 :                 infop->status = SIGCONT;
    1370             :         }
    1371             :         return pid;
    1372             : }
    1373             : 
    1374             : /*
    1375             :  * Consider @p for a wait by @parent.
    1376             :  *
    1377             :  * -ECHILD should be in ->notask_error before the first call.
    1378             :  * Returns nonzero for a final return, when we have unlocked tasklist_lock.
    1379             :  * Returns zero if the search for a child should continue;
    1380             :  * then ->notask_error is 0 if @p is an eligible child,
    1381             :  * or still -ECHILD.
    1382             :  */
    1383           0 : static int wait_consider_task(struct wait_opts *wo, int ptrace,
    1384             :                                 struct task_struct *p)
    1385             : {
    1386             :         /*
    1387             :          * We can race with wait_task_zombie() from another thread.
    1388             :          * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition
    1389             :          * can't confuse the checks below.
    1390             :          */
    1391           0 :         int exit_state = READ_ONCE(p->exit_state);
    1392             :         int ret;
    1393             : 
    1394           0 :         if (unlikely(exit_state == EXIT_DEAD))
    1395             :                 return 0;
    1396             : 
    1397           0 :         ret = eligible_child(wo, ptrace, p);
    1398           0 :         if (!ret)
    1399             :                 return ret;
    1400             : 
    1401           0 :         if (unlikely(exit_state == EXIT_TRACE)) {
    1402             :                 /*
    1403             :                  * ptrace == 0 means we are the natural parent. In this case
    1404             :                  * we should clear notask_error, debugger will notify us.
    1405             :                  */
    1406           0 :                 if (likely(!ptrace))
    1407           0 :                         wo->notask_error = 0;
    1408             :                 return 0;
    1409             :         }
    1410             : 
    1411           0 :         if (likely(!ptrace) && unlikely(p->ptrace)) {
    1412             :                 /*
    1413             :                  * If it is traced by its real parent's group, just pretend
    1414             :                  * the caller is ptrace_do_wait() and reap this child if it
    1415             :                  * is zombie.
    1416             :                  *
    1417             :                  * This also hides group stop state from real parent; otherwise
    1418             :                  * a single stop can be reported twice as group and ptrace stop.
    1419             :                  * If a ptracer wants to distinguish these two events for its
    1420             :                  * own children it should create a separate process which takes
    1421             :                  * the role of real parent.
    1422             :                  */
    1423           0 :                 if (!ptrace_reparented(p))
    1424           0 :                         ptrace = 1;
    1425             :         }
    1426             : 
    1427             :         /* slay zombie? */
    1428           0 :         if (exit_state == EXIT_ZOMBIE) {
    1429             :                 /* we don't reap group leaders with subthreads */
    1430           0 :                 if (!delay_group_leader(p)) {
    1431             :                         /*
    1432             :                          * A zombie ptracee is only visible to its ptracer.
    1433             :                          * Notification and reaping will be cascaded to the
    1434             :                          * real parent when the ptracer detaches.
    1435             :                          */
    1436           0 :                         if (unlikely(ptrace) || likely(!p->ptrace))
    1437           0 :                                 return wait_task_zombie(wo, p);
    1438             :                 }
    1439             : 
    1440             :                 /*
    1441             :                  * Allow access to stopped/continued state via zombie by
    1442             :                  * falling through.  Clearing of notask_error is complex.
    1443             :                  *
    1444             :                  * When !@ptrace:
    1445             :                  *
    1446             :                  * If WEXITED is set, notask_error should naturally be
    1447             :                  * cleared.  If not, subset of WSTOPPED|WCONTINUED is set,
    1448             :                  * so, if there are live subthreads, there are events to
    1449             :                  * wait for.  If all subthreads are dead, it's still safe
    1450             :                  * to clear - this function will be called again in finite
    1451             :                  * amount time once all the subthreads are released and
    1452             :                  * will then return without clearing.
    1453             :                  *
    1454             :                  * When @ptrace:
    1455             :                  *
    1456             :                  * Stopped state is per-task and thus can't change once the
    1457             :                  * target task dies.  Only continued and exited can happen.
    1458             :                  * Clear notask_error if WCONTINUED | WEXITED.
    1459             :                  */
    1460           0 :                 if (likely(!ptrace) || (wo->wo_flags & (WCONTINUED | WEXITED)))
    1461           0 :                         wo->notask_error = 0;
    1462             :         } else {
    1463             :                 /*
    1464             :                  * @p is alive and it's gonna stop, continue or exit, so
    1465             :                  * there always is something to wait for.
    1466             :                  */
    1467           0 :                 wo->notask_error = 0;
    1468             :         }
    1469             : 
    1470             :         /*
    1471             :          * Wait for stopped.  Depending on @ptrace, different stopped state
    1472             :          * is used and the two don't interact with each other.
    1473             :          */
    1474           0 :         ret = wait_task_stopped(wo, ptrace, p);
    1475           0 :         if (ret)
    1476             :                 return ret;
    1477             : 
    1478             :         /*
    1479             :          * Wait for continued.  There's only one continued state and the
    1480             :          * ptracer can consume it which can confuse the real parent.  Don't
    1481             :          * use WCONTINUED from ptracer.  You don't need or want it.
    1482             :          */
    1483           0 :         return wait_task_continued(wo, p);
    1484             : }
    1485             : 
    1486             : /*
    1487             :  * Do the work of do_wait() for one thread in the group, @tsk.
    1488             :  *
    1489             :  * -ECHILD should be in ->notask_error before the first call.
    1490             :  * Returns nonzero for a final return, when we have unlocked tasklist_lock.
    1491             :  * Returns zero if the search for a child should continue; then
    1492             :  * ->notask_error is 0 if there were any eligible children,
    1493             :  * or still -ECHILD.
    1494             :  */
    1495           0 : static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
    1496             : {
    1497             :         struct task_struct *p;
    1498             : 
    1499           0 :         list_for_each_entry(p, &tsk->children, sibling) {
    1500           0 :                 int ret = wait_consider_task(wo, 0, p);
    1501             : 
    1502           0 :                 if (ret)
    1503             :                         return ret;
    1504             :         }
    1505             : 
    1506             :         return 0;
    1507             : }
    1508             : 
    1509           0 : static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk)
    1510             : {
    1511             :         struct task_struct *p;
    1512             : 
    1513           0 :         list_for_each_entry(p, &tsk->ptraced, ptrace_entry) {
    1514           0 :                 int ret = wait_consider_task(wo, 1, p);
    1515             : 
    1516           0 :                 if (ret)
    1517             :                         return ret;
    1518             :         }
    1519             : 
    1520             :         return 0;
    1521             : }
    1522             : 
    1523           0 : static int child_wait_callback(wait_queue_entry_t *wait, unsigned mode,
    1524             :                                 int sync, void *key)
    1525             : {
    1526           0 :         struct wait_opts *wo = container_of(wait, struct wait_opts,
    1527             :                                                 child_wait);
    1528           0 :         struct task_struct *p = key;
    1529             : 
    1530           0 :         if (!eligible_pid(wo, p))
    1531             :                 return 0;
    1532             : 
    1533           0 :         if ((wo->wo_flags & __WNOTHREAD) && wait->private != p->parent)
    1534             :                 return 0;
    1535             : 
    1536           0 :         return default_wake_function(wait, mode, sync, key);
    1537             : }
    1538             : 
    1539         367 : void __wake_up_parent(struct task_struct *p, struct task_struct *parent)
    1540             : {
    1541         367 :         __wake_up_sync_key(&parent->signal->wait_chldexit,
    1542             :                            TASK_INTERRUPTIBLE, p);
    1543         367 : }
    1544             : 
    1545             : static bool is_effectively_child(struct wait_opts *wo, bool ptrace,
    1546             :                                  struct task_struct *target)
    1547             : {
    1548           0 :         struct task_struct *parent =
    1549           0 :                 !ptrace ? target->real_parent : target->parent;
    1550             : 
    1551           0 :         return current == parent || (!(wo->wo_flags & __WNOTHREAD) &&
    1552           0 :                                      same_thread_group(current, parent));
    1553             : }
    1554             : 
    1555             : /*
    1556             :  * Optimization for waiting on PIDTYPE_PID. No need to iterate through child
    1557             :  * and tracee lists to find the target task.
    1558             :  */
    1559           0 : static int do_wait_pid(struct wait_opts *wo)
    1560             : {
    1561             :         bool ptrace;
    1562             :         struct task_struct *target;
    1563             :         int retval;
    1564             : 
    1565           0 :         ptrace = false;
    1566           0 :         target = pid_task(wo->wo_pid, PIDTYPE_TGID);
    1567           0 :         if (target && is_effectively_child(wo, ptrace, target)) {
    1568           0 :                 retval = wait_consider_task(wo, ptrace, target);
    1569           0 :                 if (retval)
    1570             :                         return retval;
    1571             :         }
    1572             : 
    1573           0 :         ptrace = true;
    1574           0 :         target = pid_task(wo->wo_pid, PIDTYPE_PID);
    1575           0 :         if (target && target->ptrace &&
    1576           0 :             is_effectively_child(wo, ptrace, target)) {
    1577           0 :                 retval = wait_consider_task(wo, ptrace, target);
    1578           0 :                 if (retval)
    1579             :                         return retval;
    1580             :         }
    1581             : 
    1582             :         return 0;
    1583             : }
    1584             : 
    1585           0 : static long do_wait(struct wait_opts *wo)
    1586             : {
    1587             :         int retval;
    1588             : 
    1589           0 :         trace_sched_process_wait(wo->wo_pid);
    1590             : 
    1591           0 :         init_waitqueue_func_entry(&wo->child_wait, child_wait_callback);
    1592           0 :         wo->child_wait.private = current;
    1593           0 :         add_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
    1594             : repeat:
    1595             :         /*
    1596             :          * If there is nothing that can match our criteria, just get out.
    1597             :          * We will clear ->notask_error to zero if we see any child that
    1598             :          * might later match our criteria, even if we are not able to reap
    1599             :          * it yet.
    1600             :          */
    1601           0 :         wo->notask_error = -ECHILD;
    1602           0 :         if ((wo->wo_type < PIDTYPE_MAX) &&
    1603           0 :            (!wo->wo_pid || !pid_has_task(wo->wo_pid, wo->wo_type)))
    1604             :                 goto notask;
    1605             : 
    1606           0 :         set_current_state(TASK_INTERRUPTIBLE);
    1607           0 :         read_lock(&tasklist_lock);
    1608             : 
    1609           0 :         if (wo->wo_type == PIDTYPE_PID) {
    1610           0 :                 retval = do_wait_pid(wo);
    1611           0 :                 if (retval)
    1612             :                         goto end;
    1613             :         } else {
    1614           0 :                 struct task_struct *tsk = current;
    1615             : 
    1616             :                 do {
    1617           0 :                         retval = do_wait_thread(wo, tsk);
    1618           0 :                         if (retval)
    1619             :                                 goto end;
    1620             : 
    1621           0 :                         retval = ptrace_do_wait(wo, tsk);
    1622           0 :                         if (retval)
    1623             :                                 goto end;
    1624             : 
    1625           0 :                         if (wo->wo_flags & __WNOTHREAD)
    1626             :                                 break;
    1627           0 :                 } while_each_thread(current, tsk);
    1628             :         }
    1629           0 :         read_unlock(&tasklist_lock);
    1630             : 
    1631             : notask:
    1632           0 :         retval = wo->notask_error;
    1633           0 :         if (!retval && !(wo->wo_flags & WNOHANG)) {
    1634           0 :                 retval = -ERESTARTSYS;
    1635           0 :                 if (!signal_pending(current)) {
    1636           0 :                         schedule();
    1637           0 :                         goto repeat;
    1638             :                 }
    1639             :         }
    1640             : end:
    1641           0 :         __set_current_state(TASK_RUNNING);
    1642           0 :         remove_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
    1643           0 :         return retval;
    1644             : }
    1645             : 
    1646           0 : static long kernel_waitid(int which, pid_t upid, struct waitid_info *infop,
    1647             :                           int options, struct rusage *ru)
    1648             : {
    1649             :         struct wait_opts wo;
    1650           0 :         struct pid *pid = NULL;
    1651             :         enum pid_type type;
    1652             :         long ret;
    1653           0 :         unsigned int f_flags = 0;
    1654             : 
    1655           0 :         if (options & ~(WNOHANG|WNOWAIT|WEXITED|WSTOPPED|WCONTINUED|
    1656             :                         __WNOTHREAD|__WCLONE|__WALL))
    1657             :                 return -EINVAL;
    1658           0 :         if (!(options & (WEXITED|WSTOPPED|WCONTINUED)))
    1659             :                 return -EINVAL;
    1660             : 
    1661           0 :         switch (which) {
    1662             :         case P_ALL:
    1663             :                 type = PIDTYPE_MAX;
    1664             :                 break;
    1665             :         case P_PID:
    1666           0 :                 type = PIDTYPE_PID;
    1667           0 :                 if (upid <= 0)
    1668             :                         return -EINVAL;
    1669             : 
    1670           0 :                 pid = find_get_pid(upid);
    1671           0 :                 break;
    1672             :         case P_PGID:
    1673           0 :                 type = PIDTYPE_PGID;
    1674           0 :                 if (upid < 0)
    1675             :                         return -EINVAL;
    1676             : 
    1677           0 :                 if (upid)
    1678           0 :                         pid = find_get_pid(upid);
    1679             :                 else
    1680           0 :                         pid = get_task_pid(current, PIDTYPE_PGID);
    1681             :                 break;
    1682             :         case P_PIDFD:
    1683           0 :                 type = PIDTYPE_PID;
    1684           0 :                 if (upid < 0)
    1685             :                         return -EINVAL;
    1686             : 
    1687           0 :                 pid = pidfd_get_pid(upid, &f_flags);
    1688           0 :                 if (IS_ERR(pid))
    1689           0 :                         return PTR_ERR(pid);
    1690             : 
    1691             :                 break;
    1692             :         default:
    1693             :                 return -EINVAL;
    1694             :         }
    1695             : 
    1696           0 :         wo.wo_type      = type;
    1697           0 :         wo.wo_pid       = pid;
    1698           0 :         wo.wo_flags     = options;
    1699           0 :         wo.wo_info      = infop;
    1700           0 :         wo.wo_rusage    = ru;
    1701           0 :         if (f_flags & O_NONBLOCK)
    1702           0 :                 wo.wo_flags |= WNOHANG;
    1703             : 
    1704           0 :         ret = do_wait(&wo);
    1705           0 :         if (!ret && !(options & WNOHANG) && (f_flags & O_NONBLOCK))
    1706           0 :                 ret = -EAGAIN;
    1707             : 
    1708           0 :         put_pid(pid);
    1709           0 :         return ret;
    1710             : }
    1711             : 
    1712           0 : SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
    1713             :                 infop, int, options, struct rusage __user *, ru)
    1714             : {
    1715             :         struct rusage r;
    1716           0 :         struct waitid_info info = {.status = 0};
    1717           0 :         long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL);
    1718           0 :         int signo = 0;
    1719             : 
    1720           0 :         if (err > 0) {
    1721           0 :                 signo = SIGCHLD;
    1722           0 :                 err = 0;
    1723           0 :                 if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
    1724             :                         return -EFAULT;
    1725             :         }
    1726           0 :         if (!infop)
    1727             :                 return err;
    1728             : 
    1729           0 :         if (!user_write_access_begin(infop, sizeof(*infop)))
    1730             :                 return -EFAULT;
    1731             : 
    1732           0 :         unsafe_put_user(signo, &infop->si_signo, Efault);
    1733           0 :         unsafe_put_user(0, &infop->si_errno, Efault);
    1734           0 :         unsafe_put_user(info.cause, &infop->si_code, Efault);
    1735           0 :         unsafe_put_user(info.pid, &infop->si_pid, Efault);
    1736           0 :         unsafe_put_user(info.uid, &infop->si_uid, Efault);
    1737           0 :         unsafe_put_user(info.status, &infop->si_status, Efault);
    1738             :         user_write_access_end();
    1739             :         return err;
    1740             : Efault:
    1741             :         user_write_access_end();
    1742             :         return -EFAULT;
    1743             : }
    1744             : 
    1745           0 : long kernel_wait4(pid_t upid, int __user *stat_addr, int options,
    1746             :                   struct rusage *ru)
    1747             : {
    1748             :         struct wait_opts wo;
    1749           0 :         struct pid *pid = NULL;
    1750             :         enum pid_type type;
    1751             :         long ret;
    1752             : 
    1753           0 :         if (options & ~(WNOHANG|WUNTRACED|WCONTINUED|
    1754             :                         __WNOTHREAD|__WCLONE|__WALL))
    1755             :                 return -EINVAL;
    1756             : 
    1757             :         /* -INT_MIN is not defined */
    1758           0 :         if (upid == INT_MIN)
    1759             :                 return -ESRCH;
    1760             : 
    1761           0 :         if (upid == -1)
    1762             :                 type = PIDTYPE_MAX;
    1763           0 :         else if (upid < 0) {
    1764           0 :                 type = PIDTYPE_PGID;
    1765           0 :                 pid = find_get_pid(-upid);
    1766           0 :         } else if (upid == 0) {
    1767           0 :                 type = PIDTYPE_PGID;
    1768           0 :                 pid = get_task_pid(current, PIDTYPE_PGID);
    1769             :         } else /* upid > 0 */ {
    1770           0 :                 type = PIDTYPE_PID;
    1771           0 :                 pid = find_get_pid(upid);
    1772             :         }
    1773             : 
    1774           0 :         wo.wo_type      = type;
    1775           0 :         wo.wo_pid       = pid;
    1776           0 :         wo.wo_flags     = options | WEXITED;
    1777           0 :         wo.wo_info      = NULL;
    1778           0 :         wo.wo_stat      = 0;
    1779           0 :         wo.wo_rusage    = ru;
    1780           0 :         ret = do_wait(&wo);
    1781           0 :         put_pid(pid);
    1782           0 :         if (ret > 0 && stat_addr && put_user(wo.wo_stat, stat_addr))
    1783           0 :                 ret = -EFAULT;
    1784             : 
    1785             :         return ret;
    1786             : }
    1787             : 
    1788           0 : int kernel_wait(pid_t pid, int *stat)
    1789             : {
    1790           0 :         struct wait_opts wo = {
    1791             :                 .wo_type        = PIDTYPE_PID,
    1792           0 :                 .wo_pid         = find_get_pid(pid),
    1793             :                 .wo_flags       = WEXITED,
    1794             :         };
    1795             :         int ret;
    1796             : 
    1797           0 :         ret = do_wait(&wo);
    1798           0 :         if (ret > 0 && wo.wo_stat)
    1799           0 :                 *stat = wo.wo_stat;
    1800           0 :         put_pid(wo.wo_pid);
    1801           0 :         return ret;
    1802             : }
    1803             : 
    1804           0 : SYSCALL_DEFINE4(wait4, pid_t, upid, int __user *, stat_addr,
    1805             :                 int, options, struct rusage __user *, ru)
    1806             : {
    1807             :         struct rusage r;
    1808           0 :         long err = kernel_wait4(upid, stat_addr, options, ru ? &r : NULL);
    1809             : 
    1810           0 :         if (err > 0) {
    1811           0 :                 if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
    1812             :                         return -EFAULT;
    1813             :         }
    1814             :         return err;
    1815             : }
    1816             : 
    1817             : #ifdef __ARCH_WANT_SYS_WAITPID
    1818             : 
    1819             : /*
    1820             :  * sys_waitpid() remains for compatibility. waitpid() should be
    1821             :  * implemented by calling sys_wait4() from libc.a.
    1822             :  */
    1823           0 : SYSCALL_DEFINE3(waitpid, pid_t, pid, int __user *, stat_addr, int, options)
    1824             : {
    1825           0 :         return kernel_wait4(pid, stat_addr, options, NULL);
    1826             : }
    1827             : 
    1828             : #endif
    1829             : 
    1830             : #ifdef CONFIG_COMPAT
    1831             : COMPAT_SYSCALL_DEFINE4(wait4,
    1832             :         compat_pid_t, pid,
    1833             :         compat_uint_t __user *, stat_addr,
    1834             :         int, options,
    1835             :         struct compat_rusage __user *, ru)
    1836             : {
    1837             :         struct rusage r;
    1838             :         long err = kernel_wait4(pid, stat_addr, options, ru ? &r : NULL);
    1839             :         if (err > 0) {
    1840             :                 if (ru && put_compat_rusage(&r, ru))
    1841             :                         return -EFAULT;
    1842             :         }
    1843             :         return err;
    1844             : }
    1845             : 
    1846             : COMPAT_SYSCALL_DEFINE5(waitid,
    1847             :                 int, which, compat_pid_t, pid,
    1848             :                 struct compat_siginfo __user *, infop, int, options,
    1849             :                 struct compat_rusage __user *, uru)
    1850             : {
    1851             :         struct rusage ru;
    1852             :         struct waitid_info info = {.status = 0};
    1853             :         long err = kernel_waitid(which, pid, &info, options, uru ? &ru : NULL);
    1854             :         int signo = 0;
    1855             :         if (err > 0) {
    1856             :                 signo = SIGCHLD;
    1857             :                 err = 0;
    1858             :                 if (uru) {
    1859             :                         /* kernel_waitid() overwrites everything in ru */
    1860             :                         if (COMPAT_USE_64BIT_TIME)
    1861             :                                 err = copy_to_user(uru, &ru, sizeof(ru));
    1862             :                         else
    1863             :                                 err = put_compat_rusage(&ru, uru);
    1864             :                         if (err)
    1865             :                                 return -EFAULT;
    1866             :                 }
    1867             :         }
    1868             : 
    1869             :         if (!infop)
    1870             :                 return err;
    1871             : 
    1872             :         if (!user_write_access_begin(infop, sizeof(*infop)))
    1873             :                 return -EFAULT;
    1874             : 
    1875             :         unsafe_put_user(signo, &infop->si_signo, Efault);
    1876             :         unsafe_put_user(0, &infop->si_errno, Efault);
    1877             :         unsafe_put_user(info.cause, &infop->si_code, Efault);
    1878             :         unsafe_put_user(info.pid, &infop->si_pid, Efault);
    1879             :         unsafe_put_user(info.uid, &infop->si_uid, Efault);
    1880             :         unsafe_put_user(info.status, &infop->si_status, Efault);
    1881             :         user_write_access_end();
    1882             :         return err;
    1883             : Efault:
    1884             :         user_write_access_end();
    1885             :         return -EFAULT;
    1886             : }
    1887             : #endif
    1888             : 
    1889             : /**
    1890             :  * thread_group_exited - check that a thread group has exited
    1891             :  * @pid: tgid of thread group to be checked.
    1892             :  *
    1893             :  * Test if the thread group represented by tgid has exited (all
    1894             :  * threads are zombies, dead or completely gone).
    1895             :  *
    1896             :  * Return: true if the thread group has exited. false otherwise.
    1897             :  */
    1898           0 : bool thread_group_exited(struct pid *pid)
    1899             : {
    1900             :         struct task_struct *task;
    1901             :         bool exited;
    1902             : 
    1903             :         rcu_read_lock();
    1904           0 :         task = pid_task(pid, PIDTYPE_PID);
    1905           0 :         exited = !task ||
    1906           0 :                 (READ_ONCE(task->exit_state) && thread_group_empty(task));
    1907             :         rcu_read_unlock();
    1908             : 
    1909           0 :         return exited;
    1910             : }
    1911             : EXPORT_SYMBOL(thread_group_exited);
    1912             : 
    1913             : /*
    1914             :  * This needs to be __function_aligned as GCC implicitly makes any
    1915             :  * implementation of abort() cold and drops alignment specified by
    1916             :  * -falign-functions=N.
    1917             :  *
    1918             :  * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c11
    1919             :  */
    1920           0 : __weak __function_aligned void abort(void)
    1921             : {
    1922           0 :         BUG();
    1923             : 
    1924             :         /* if that doesn't kill us, halt */
    1925             :         panic("Oops failed to kill thread");
    1926             : }
    1927             : EXPORT_SYMBOL(abort);

Generated by: LCOV version 1.14