39
40#include "opt_compat.h"
41#include "opt_kdtrace.h"
42#include "opt_ktrace.h"
43#include "opt_procdesc.h"
44
45#include <sys/param.h>
46#include <sys/systm.h>
47#include <sys/sysproto.h>
48#include <sys/capsicum.h>
49#include <sys/eventhandler.h>
50#include <sys/kernel.h>
51#include <sys/malloc.h>
52#include <sys/lock.h>
53#include <sys/mutex.h>
54#include <sys/proc.h>
55#include <sys/procdesc.h>
56#include <sys/pioctl.h>
57#include <sys/jail.h>
58#include <sys/tty.h>
59#include <sys/wait.h>
60#include <sys/vmmeter.h>
61#include <sys/vnode.h>
62#include <sys/racct.h>
63#include <sys/resourcevar.h>
64#include <sys/sbuf.h>
65#include <sys/signalvar.h>
66#include <sys/sched.h>
67#include <sys/sx.h>
68#include <sys/syscallsubr.h>
69#include <sys/syslog.h>
70#include <sys/ptrace.h>
71#include <sys/acct.h> /* for acct_process() function prototype */
72#include <sys/filedesc.h>
73#include <sys/sdt.h>
74#include <sys/shm.h>
75#include <sys/sem.h>
76#include <sys/umtx.h>
77#ifdef KTRACE
78#include <sys/ktrace.h>
79#endif
80
81#include <security/audit/audit.h>
82#include <security/mac/mac_framework.h>
83
84#include <vm/vm.h>
85#include <vm/vm_extern.h>
86#include <vm/vm_param.h>
87#include <vm/pmap.h>
88#include <vm/vm_map.h>
89#include <vm/vm_page.h>
90#include <vm/uma.h>
91
92#ifdef KDTRACE_HOOKS
93#include <sys/dtrace_bsd.h>
94dtrace_execexit_func_t dtrace_fasttrap_exit;
95#endif
96
97SDT_PROVIDER_DECLARE(proc);
98SDT_PROBE_DEFINE1(proc, kernel, , exit, "int");
99
100/* Hook for NFS teardown procedure. */
101void (*nlminfo_release_p)(struct proc *p);
102
103struct proc *
104proc_realparent(struct proc *child)
105{
106 struct proc *p, *parent;
107
108 sx_assert(&proctree_lock, SX_LOCKED);
109 if ((child->p_treeflag & P_TREE_ORPHANED) == 0) {
110 if (child->p_oppid == 0 ||
111 child->p_pptr->p_pid == child->p_oppid)
112 parent = child->p_pptr;
113 else
114 parent = initproc;
115 return (parent);
116 }
117 for (p = child; (p->p_treeflag & P_TREE_FIRST_ORPHAN) == 0;) {
118 /* Cannot use LIST_PREV(), since the list head is not known. */
119 p = __containerof(p->p_orphan.le_prev, struct proc,
120 p_orphan.le_next);
121 KASSERT((p->p_treeflag & P_TREE_ORPHANED) != 0,
122 ("missing P_ORPHAN %p", p));
123 }
124 parent = __containerof(p->p_orphan.le_prev, struct proc,
125 p_orphans.lh_first);
126 return (parent);
127}
128
129void
130reaper_abandon_children(struct proc *p, bool exiting)
131{
132 struct proc *p1, *p2, *ptmp;
133
134 sx_assert(&proctree_lock, SX_LOCKED);
135 KASSERT(p != initproc, ("reaper_abandon_children for initproc"));
136 if ((p->p_treeflag & P_TREE_REAPER) == 0)
137 return;
138 p1 = p->p_reaper;
139 LIST_FOREACH_SAFE(p2, &p->p_reaplist, p_reapsibling, ptmp) {
140 LIST_REMOVE(p2, p_reapsibling);
141 p2->p_reaper = p1;
142 p2->p_reapsubtree = p->p_reapsubtree;
143 LIST_INSERT_HEAD(&p1->p_reaplist, p2, p_reapsibling);
144 if (exiting && p2->p_pptr == p) {
145 PROC_LOCK(p2);
146 proc_reparent(p2, p1);
147 PROC_UNLOCK(p2);
148 }
149 }
150 KASSERT(LIST_EMPTY(&p->p_reaplist), ("p_reaplist not empty"));
151 p->p_treeflag &= ~P_TREE_REAPER;
152}
153
154static void
155clear_orphan(struct proc *p)
156{
157 struct proc *p1;
158
159 sx_assert(&proctree_lock, SA_XLOCKED);
160 if ((p->p_treeflag & P_TREE_ORPHANED) == 0)
161 return;
162 if ((p->p_treeflag & P_TREE_FIRST_ORPHAN) != 0) {
163 p1 = LIST_NEXT(p, p_orphan);
164 if (p1 != NULL)
165 p1->p_treeflag |= P_TREE_FIRST_ORPHAN;
166 p->p_treeflag &= ~P_TREE_FIRST_ORPHAN;
167 }
168 LIST_REMOVE(p, p_orphan);
169 p->p_treeflag &= ~P_TREE_ORPHANED;
170}
171
172/*
173 * exit -- death of process.
174 */
175void
176sys_sys_exit(struct thread *td, struct sys_exit_args *uap)
177{
178
179 exit1(td, W_EXITCODE(uap->rval, 0));
180 /* NOTREACHED */
181}
182
183/*
184 * Exit: deallocate address space and other resources, change proc state to
185 * zombie, and unlink proc from allproc and parent's lists. Save exit status
186 * and rusage for wait(). Check for child processes and orphan them.
187 */
188void
189exit1(struct thread *td, int rv)
190{
191 struct proc *p, *nq, *q, *t;
192 struct thread *tdt;
193 struct vnode *ttyvp = NULL;
194
195 mtx_assert(&Giant, MA_NOTOWNED);
196
197 p = td->td_proc;
198 /*
199 * XXX in case we're rebooting we just let init die in order to
200 * work around an unsolved stack overflow seen very late during
201 * shutdown on sparc64 when the gmirror worker process exists.
202 */
203 if (p == initproc && rebooting == 0) {
204 printf("init died (signal %d, exit %d)\n",
205 WTERMSIG(rv), WEXITSTATUS(rv));
206 panic("Going nowhere without my init!");
207 }
208
209 /*
210 * Deref SU mp, since the thread does not return to userspace.
211 */
212 if (softdep_ast_cleanup != NULL)
213 softdep_ast_cleanup();
214
215 /*
216 * MUST abort all other threads before proceeding past here.
217 */
218 PROC_LOCK(p);
219 /*
220 * First check if some other thread or external request got
221 * here before us. If so, act appropriately: exit or suspend.
222 * We must ensure that stop requests are handled before we set
223 * P_WEXIT.
224 */
225 thread_suspend_check(0);
226 while (p->p_flag & P_HADTHREADS) {
227 /*
228 * Kill off the other threads. This requires
229 * some co-operation from other parts of the kernel
230 * so it may not be instantaneous. With this state set
231 * any thread entering the kernel from userspace will
232 * thread_exit() in trap(). Any thread attempting to
233 * sleep will return immediately with EINTR or EWOULDBLOCK
234 * which will hopefully force them to back out to userland
235 * freeing resources as they go. Any thread attempting
236 * to return to userland will thread_exit() from userret().
237 * thread_exit() will unsuspend us when the last of the
238 * other threads exits.
239 * If there is already a thread singler after resumption,
240 * calling thread_single will fail; in that case, we just
241 * re-check all suspension request, the thread should
242 * either be suspended there or exit.
243 */
244 if (!thread_single(p, SINGLE_EXIT))
245 /*
246 * All other activity in this process is now
247 * stopped. Threading support has been turned
248 * off.
249 */
250 break;
251 /*
252 * Recheck for new stop or suspend requests which
253 * might appear while process lock was dropped in
254 * thread_single().
255 */
256 thread_suspend_check(0);
257 }
258 KASSERT(p->p_numthreads == 1,
259 ("exit1: proc %p exiting with %d threads", p, p->p_numthreads));
260 racct_sub(p, RACCT_NTHR, 1);
261 /*
262 * Wakeup anyone in procfs' PIOCWAIT. They should have a hold
263 * on our vmspace, so we should block below until they have
264 * released their reference to us. Note that if they have
265 * requested S_EXIT stops we will block here until they ack
266 * via PIOCCONT.
267 */
268 _STOPEVENT(p, S_EXIT, rv);
269
270 /*
271 * Ignore any pending request to stop due to a stop signal.
272 * Once P_WEXIT is set, future requests will be ignored as
273 * well.
274 */
275 p->p_flag &= ~P_STOPPED_SIG;
276 KASSERT(!P_SHOULDSTOP(p), ("exiting process is stopped"));
277
278 /*
279 * Note that we are exiting and do another wakeup of anyone in
280 * PIOCWAIT in case they aren't listening for S_EXIT stops or
281 * decided to wait again after we told them we are exiting.
282 */
283 p->p_flag |= P_WEXIT;
284 wakeup(&p->p_stype);
285
286 /*
287 * Wait for any processes that have a hold on our vmspace to
288 * release their reference.
289 */
290 while (p->p_lock > 0)
291 msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0);
292
293 p->p_xstat = rv; /* Let event handler change exit status */
294 PROC_UNLOCK(p);
295 /* Drain the limit callout while we don't have the proc locked */
296 callout_drain(&p->p_limco);
297
298#ifdef AUDIT
299 /*
300 * The Sun BSM exit token contains two components: an exit status as
301 * passed to exit(), and a return value to indicate what sort of exit
302 * it was. The exit status is WEXITSTATUS(rv), but it's not clear
303 * what the return value is.
304 */
305 AUDIT_ARG_EXIT(WEXITSTATUS(rv), 0);
306 AUDIT_SYSCALL_EXIT(0, td);
307#endif
308
309 /* Are we a task leader? */
310 if (p == p->p_leader) {
311 mtx_lock(&ppeers_lock);
312 q = p->p_peers;
313 while (q != NULL) {
314 PROC_LOCK(q);
315 kern_psignal(q, SIGKILL);
316 PROC_UNLOCK(q);
317 q = q->p_peers;
318 }
319 while (p->p_peers != NULL)
320 msleep(p, &ppeers_lock, PWAIT, "exit1", 0);
321 mtx_unlock(&ppeers_lock);
322 }
323
324 /*
325 * Check if any loadable modules need anything done at process exit.
326 * E.g. SYSV IPC stuff
327 * XXX what if one of these generates an error?
328 */
329 EVENTHANDLER_INVOKE(process_exit, p);
330
331 /*
332 * If parent is waiting for us to exit or exec,
333 * P_PPWAIT is set; we will wakeup the parent below.
334 */
335 PROC_LOCK(p);
336 rv = p->p_xstat; /* Event handler could change exit status */
337 stopprofclock(p);
338 p->p_flag &= ~(P_TRACED | P_PPWAIT | P_PPTRACE);
339
340 /*
341 * Stop the real interval timer. If the handler is currently
342 * executing, prevent it from rearming itself and let it finish.
343 */
344 if (timevalisset(&p->p_realtimer.it_value) &&
345 callout_stop(&p->p_itcallout) == 0) {
346 timevalclear(&p->p_realtimer.it_interval);
347 msleep(&p->p_itcallout, &p->p_mtx, PWAIT, "ritwait", 0);
348 KASSERT(!timevalisset(&p->p_realtimer.it_value),
349 ("realtime timer is still armed"));
350 }
351 PROC_UNLOCK(p);
352
353 /*
354 * Reset any sigio structures pointing to us as a result of
355 * F_SETOWN with our pid.
356 */
357 funsetownlst(&p->p_sigiolst);
358
359 /*
360 * If this process has an nlminfo data area (for lockd), release it
361 */
362 if (nlminfo_release_p != NULL && p->p_nlminfo != NULL)
363 (*nlminfo_release_p)(p);
364
365 /*
366 * Close open files and release open-file table.
367 * This may block!
368 */
369 fdescfree(td);
370
371 /*
372 * If this thread tickled GEOM, we need to wait for the giggling to
373 * stop before we return to userland
374 */
375 if (td->td_pflags & TDP_GEOM)
376 g_waitidle();
377
378 /*
379 * Remove ourself from our leader's peer list and wake our leader.
380 */
381 mtx_lock(&ppeers_lock);
382 if (p->p_leader->p_peers) {
383 q = p->p_leader;
384 while (q->p_peers != p)
385 q = q->p_peers;
386 q->p_peers = p->p_peers;
387 wakeup(p->p_leader);
388 }
389 mtx_unlock(&ppeers_lock);
390
391 vmspace_exit(td);
392
393 sx_xlock(&proctree_lock);
394 if (SESS_LEADER(p)) {
395 struct session *sp = p->p_session;
396 struct tty *tp;
397
398 /*
399 * s_ttyp is not zero'd; we use this to indicate that
400 * the session once had a controlling terminal. (for
401 * logging and informational purposes)
402 */
403 SESS_LOCK(sp);
404 ttyvp = sp->s_ttyvp;
405 tp = sp->s_ttyp;
406 sp->s_ttyvp = NULL;
407 sp->s_ttydp = NULL;
408 sp->s_leader = NULL;
409 SESS_UNLOCK(sp);
410
411 /*
412 * Signal foreground pgrp and revoke access to
413 * controlling terminal if it has not been revoked
414 * already.
415 *
416 * Because the TTY may have been revoked in the mean
417 * time and could already have a new session associated
418 * with it, make sure we don't send a SIGHUP to a
419 * foreground process group that does not belong to this
420 * session.
421 */
422
423 if (tp != NULL) {
424 tty_lock(tp);
425 if (tp->t_session == sp)
426 tty_signal_pgrp(tp, SIGHUP);
427 tty_unlock(tp);
428 }
429
430 if (ttyvp != NULL) {
431 sx_xunlock(&proctree_lock);
432 if (vn_lock(ttyvp, LK_EXCLUSIVE) == 0) {
433 VOP_REVOKE(ttyvp, REVOKEALL);
434 VOP_UNLOCK(ttyvp, 0);
435 }
436 sx_xlock(&proctree_lock);
437 }
438 }
439 fixjobc(p, p->p_pgrp, 0);
440 sx_xunlock(&proctree_lock);
441 (void)acct_process(td);
442
443 /* Release the TTY now we've unlocked everything. */
444 if (ttyvp != NULL)
445 vrele(ttyvp);
446#ifdef KTRACE
447 ktrprocexit(td);
448#endif
449 /*
450 * Release reference to text vnode
451 */
452 if (p->p_textvp != NULL) {
453 vrele(p->p_textvp);
454 p->p_textvp = NULL;
455 }
456
457 /*
458 * Release our limits structure.
459 */
460 lim_free(p->p_limit);
461 p->p_limit = NULL;
462
463 tidhash_remove(td);
464
465 /*
466 * Remove proc from allproc queue and pidhash chain.
467 * Place onto zombproc. Unlink from parent's child list.
468 */
469 sx_xlock(&allproc_lock);
470 LIST_REMOVE(p, p_list);
471 LIST_INSERT_HEAD(&zombproc, p, p_list);
472 LIST_REMOVE(p, p_hash);
473 sx_xunlock(&allproc_lock);
474
475 /*
476 * Call machine-dependent code to release any
477 * machine-dependent resources other than the address space.
478 * The address space is released by "vmspace_exitfree(p)" in
479 * vm_waitproc().
480 */
481 cpu_exit(td);
482
483 WITNESS_WARN(WARN_PANIC, NULL, "process (pid %d) exiting", p->p_pid);
484
485 /*
486 * Reparent all children processes:
487 * - traced ones to the original parent (or init if we are that parent)
488 * - the rest to init
489 */
490 sx_xlock(&proctree_lock);
491 q = LIST_FIRST(&p->p_children);
492 if (q != NULL) /* only need this if any child is S_ZOMB */
493 wakeup(q->p_reaper);
494 for (; q != NULL; q = nq) {
495 nq = LIST_NEXT(q, p_sibling);
496 PROC_LOCK(q);
497 q->p_sigparent = SIGCHLD;
498
499 if (!(q->p_flag & P_TRACED)) {
500 proc_reparent(q, q->p_reaper);
501 } else {
502 /*
503 * Traced processes are killed since their existence
504 * means someone is screwing up.
505 */
506 t = proc_realparent(q);
507 if (t == p) {
508 proc_reparent(q, q->p_reaper);
509 } else {
510 PROC_LOCK(t);
511 proc_reparent(q, t);
512 PROC_UNLOCK(t);
513 }
514 /*
515 * Since q was found on our children list, the
516 * proc_reparent() call moved q to the orphan
517 * list due to present P_TRACED flag. Clear
518 * orphan link for q now while q is locked.
519 */
520 clear_orphan(q);
521 q->p_flag &= ~(P_TRACED | P_STOPPED_TRACE);
522 FOREACH_THREAD_IN_PROC(q, tdt)
523 tdt->td_dbgflags &= ~TDB_SUSPEND;
524 kern_psignal(q, SIGKILL);
525 }
526 PROC_UNLOCK(q);
527 }
528
529 /*
530 * Also get rid of our orphans.
531 */
532 while ((q = LIST_FIRST(&p->p_orphans)) != NULL) {
533 PROC_LOCK(q);
534 CTR2(KTR_PTRACE, "exit: pid %d, clearing orphan %d", p->p_pid,
535 q->p_pid);
536 clear_orphan(q);
537 PROC_UNLOCK(q);
538 }
539
540 /* Save exit status. */
541 PROC_LOCK(p);
542 p->p_xthread = td;
543
544 /* Tell the prison that we are gone. */
545 prison_proc_free(p->p_ucred->cr_prison);
546
547#ifdef KDTRACE_HOOKS
548 /*
549 * Tell the DTrace fasttrap provider about the exit if it
550 * has declared an interest.
551 */
552 if (dtrace_fasttrap_exit)
553 dtrace_fasttrap_exit(p);
554#endif
555
556 /*
557 * Notify interested parties of our demise.
558 */
559 KNOTE_LOCKED(&p->p_klist, NOTE_EXIT);
560
561#ifdef KDTRACE_HOOKS
562 int reason = CLD_EXITED;
563 if (WCOREDUMP(rv))
564 reason = CLD_DUMPED;
565 else if (WIFSIGNALED(rv))
566 reason = CLD_KILLED;
567 SDT_PROBE(proc, kernel, , exit, reason, 0, 0, 0, 0);
568#endif
569
570 /*
571 * Just delete all entries in the p_klist. At this point we won't
572 * report any more events, and there are nasty race conditions that
573 * can beat us if we don't.
574 */
575 knlist_clear(&p->p_klist, 1);
576
577 /*
578 * If this is a process with a descriptor, we may not need to deliver
579 * a signal to the parent. proctree_lock is held over
580 * procdesc_exit() to serialize concurrent calls to close() and
581 * exit().
582 */
583#ifdef PROCDESC
584 if (p->p_procdesc == NULL || procdesc_exit(p)) {
585#endif
586 /*
587 * Notify parent that we're gone. If parent has the
588 * PS_NOCLDWAIT flag set, or if the handler is set to SIG_IGN,
589 * notify process 1 instead (and hope it will handle this
590 * situation).
591 */
592 PROC_LOCK(p->p_pptr);
593 mtx_lock(&p->p_pptr->p_sigacts->ps_mtx);
594 if (p->p_pptr->p_sigacts->ps_flag &
595 (PS_NOCLDWAIT | PS_CLDSIGIGN)) {
596 struct proc *pp;
597
598 mtx_unlock(&p->p_pptr->p_sigacts->ps_mtx);
599 pp = p->p_pptr;
600 PROC_UNLOCK(pp);
601 proc_reparent(p, p->p_reaper);
602 p->p_sigparent = SIGCHLD;
603 PROC_LOCK(p->p_pptr);
604
605 /*
606 * Notify parent, so in case he was wait(2)ing or
607 * executing waitpid(2) with our pid, he will
608 * continue.
609 */
610 wakeup(pp);
611 } else
612 mtx_unlock(&p->p_pptr->p_sigacts->ps_mtx);
613
614 if (p->p_pptr == p->p_reaper || p->p_pptr == initproc)
615 childproc_exited(p);
616 else if (p->p_sigparent != 0) {
617 if (p->p_sigparent == SIGCHLD)
618 childproc_exited(p);
619 else /* LINUX thread */
620 kern_psignal(p->p_pptr, p->p_sigparent);
621 }
622#ifdef PROCDESC
623 } else
624 PROC_LOCK(p->p_pptr);
625#endif
626 sx_xunlock(&proctree_lock);
627
628 /*
629 * The state PRS_ZOMBIE prevents other proesses from sending
630 * signal to the process, to avoid memory leak, we free memory
631 * for signal queue at the time when the state is set.
632 */
633 sigqueue_flush(&p->p_sigqueue);
634 sigqueue_flush(&td->td_sigqueue);
635
636 /*
637 * We have to wait until after acquiring all locks before
638 * changing p_state. We need to avoid all possible context
639 * switches (including ones from blocking on a mutex) while
640 * marked as a zombie. We also have to set the zombie state
641 * before we release the parent process' proc lock to avoid
642 * a lost wakeup. So, we first call wakeup, then we grab the
643 * sched lock, update the state, and release the parent process'
644 * proc lock.
645 */
646 wakeup(p->p_pptr);
647 cv_broadcast(&p->p_pwait);
648 sched_exit(p->p_pptr, td);
649 umtx_thread_exit(td);
650 PROC_SLOCK(p);
651 p->p_state = PRS_ZOMBIE;
652 PROC_UNLOCK(p->p_pptr);
653
654 /*
655 * Hopefully no one will try to deliver a signal to the process this
656 * late in the game.
657 */
658 knlist_destroy(&p->p_klist);
659
660 /*
661 * Save our children's rusage information in our exit rusage.
662 */
663 ruadd(&p->p_ru, &p->p_rux, &p->p_stats->p_cru, &p->p_crux);
664
665 /*
666 * Make sure the scheduler takes this thread out of its tables etc.
667 * This will also release this thread's reference to the ucred.
668 * Other thread parts to release include pcb bits and such.
669 */
670 thread_exit();
671}
672
673
674#ifndef _SYS_SYSPROTO_H_
675struct abort2_args {
676 char *why;
677 int nargs;
678 void **args;
679};
680#endif
681
682int
683sys_abort2(struct thread *td, struct abort2_args *uap)
684{
685 struct proc *p = td->td_proc;
686 struct sbuf *sb;
687 void *uargs[16];
688 int error, i, sig;
689
690 /*
691 * Do it right now so we can log either proper call of abort2(), or
692 * note, that invalid argument was passed. 512 is big enough to
693 * handle 16 arguments' descriptions with additional comments.
694 */
695 sb = sbuf_new(NULL, NULL, 512, SBUF_FIXEDLEN);
696 sbuf_clear(sb);
697 sbuf_printf(sb, "%s(pid %d uid %d) aborted: ",
698 p->p_comm, p->p_pid, td->td_ucred->cr_uid);
699 /*
700 * Since we can't return from abort2(), send SIGKILL in cases, where
701 * abort2() was called improperly
702 */
703 sig = SIGKILL;
704 /* Prevent from DoSes from user-space. */
705 if (uap->nargs < 0 || uap->nargs > 16)
706 goto out;
707 if (uap->nargs > 0) {
708 if (uap->args == NULL)
709 goto out;
710 error = copyin(uap->args, uargs, uap->nargs * sizeof(void *));
711 if (error != 0)
712 goto out;
713 }
714 /*
715 * Limit size of 'reason' string to 128. Will fit even when
716 * maximal number of arguments was chosen to be logged.
717 */
718 if (uap->why != NULL) {
719 error = sbuf_copyin(sb, uap->why, 128);
720 if (error < 0)
721 goto out;
722 } else {
723 sbuf_printf(sb, "(null)");
724 }
725 if (uap->nargs > 0) {
726 sbuf_printf(sb, "(");
727 for (i = 0;i < uap->nargs; i++)
728 sbuf_printf(sb, "%s%p", i == 0 ? "" : ", ", uargs[i]);
729 sbuf_printf(sb, ")");
730 }
731 /*
732 * Final stage: arguments were proper, string has been
733 * successfully copied from userspace, and copying pointers
734 * from user-space succeed.
735 */
736 sig = SIGABRT;
737out:
738 if (sig == SIGKILL) {
739 sbuf_trim(sb);
740 sbuf_printf(sb, " (Reason text inaccessible)");
741 }
742 sbuf_cat(sb, "\n");
743 sbuf_finish(sb);
744 log(LOG_INFO, "%s", sbuf_data(sb));
745 sbuf_delete(sb);
746 exit1(td, W_EXITCODE(0, sig));
747 return (0);
748}
749
750
751#ifdef COMPAT_43
752/*
753 * The dirty work is handled by kern_wait().
754 */
755int
756owait(struct thread *td, struct owait_args *uap __unused)
757{
758 int error, status;
759
760 error = kern_wait(td, WAIT_ANY, &status, 0, NULL);
761 if (error == 0)
762 td->td_retval[1] = status;
763 return (error);
764}
765#endif /* COMPAT_43 */
766
767/*
768 * The dirty work is handled by kern_wait().
769 */
770int
771sys_wait4(struct thread *td, struct wait4_args *uap)
772{
773 struct rusage ru, *rup;
774 int error, status;
775
776 if (uap->rusage != NULL)
777 rup = &ru;
778 else
779 rup = NULL;
780 error = kern_wait(td, uap->pid, &status, uap->options, rup);
781 if (uap->status != NULL && error == 0)
782 error = copyout(&status, uap->status, sizeof(status));
783 if (uap->rusage != NULL && error == 0)
784 error = copyout(&ru, uap->rusage, sizeof(struct rusage));
785 return (error);
786}
787
788int
789sys_wait6(struct thread *td, struct wait6_args *uap)
790{
791 struct __wrusage wru, *wrup;
792 siginfo_t si, *sip;
793 idtype_t idtype;
794 id_t id;
795 int error, status;
796
797 idtype = uap->idtype;
798 id = uap->id;
799
800 if (uap->wrusage != NULL)
801 wrup = &wru;
802 else
803 wrup = NULL;
804
805 if (uap->info != NULL) {
806 sip = &si;
807 bzero(sip, sizeof(*sip));
808 } else
809 sip = NULL;
810
811 /*
812 * We expect all callers of wait6() to know about WEXITED and
813 * WTRAPPED.
814 */
815 error = kern_wait6(td, idtype, id, &status, uap->options, wrup, sip);
816
817 if (uap->status != NULL && error == 0)
818 error = copyout(&status, uap->status, sizeof(status));
819 if (uap->wrusage != NULL && error == 0)
820 error = copyout(&wru, uap->wrusage, sizeof(wru));
821 if (uap->info != NULL && error == 0)
822 error = copyout(&si, uap->info, sizeof(si));
823 return (error);
824}
825
826/*
827 * Reap the remains of a zombie process and optionally return status and
828 * rusage. Asserts and will release both the proctree_lock and the process
829 * lock as part of its work.
830 */
831void
832proc_reap(struct thread *td, struct proc *p, int *status, int options)
833{
834 struct proc *q, *t;
835
836 sx_assert(&proctree_lock, SA_XLOCKED);
837 PROC_LOCK_ASSERT(p, MA_OWNED);
838 PROC_SLOCK_ASSERT(p, MA_OWNED);
839 KASSERT(p->p_state == PRS_ZOMBIE, ("proc_reap: !PRS_ZOMBIE"));
840
841 q = td->td_proc;
842
843 PROC_SUNLOCK(p);
844 td->td_retval[0] = p->p_pid;
845 if (status)
846 *status = p->p_xstat; /* convert to int */
847 if (options & WNOWAIT) {
848 /*
849 * Only poll, returning the status. Caller does not wish to
850 * release the proc struct just yet.
851 */
852 PROC_UNLOCK(p);
853 sx_xunlock(&proctree_lock);
854 return;
855 }
856
857 PROC_LOCK(q);
858 sigqueue_take(p->p_ksi);
859 PROC_UNLOCK(q);
860 PROC_UNLOCK(p);
861
862 /*
863 * If we got the child via a ptrace 'attach', we need to give it back
864 * to the old parent.
865 */
866 if (p->p_oppid != 0) {
867 t = proc_realparent(p);
868 PROC_LOCK(t);
869 PROC_LOCK(p);
870 CTR2(KTR_PTRACE,
871 "wait: traced child %d moved back to parent %d", p->p_pid,
872 t->p_pid);
873 proc_reparent(p, t);
874 p->p_oppid = 0;
875 PROC_UNLOCK(p);
876 pksignal(t, SIGCHLD, p->p_ksi);
877 wakeup(t);
878 cv_broadcast(&p->p_pwait);
879 PROC_UNLOCK(t);
880 sx_xunlock(&proctree_lock);
881 return;
882 }
883
884 /*
885 * Remove other references to this process to ensure we have an
886 * exclusive reference.
887 */
888 sx_xlock(&allproc_lock);
889 LIST_REMOVE(p, p_list); /* off zombproc */
890 sx_xunlock(&allproc_lock);
891 LIST_REMOVE(p, p_sibling);
892 reaper_abandon_children(p, true);
893 LIST_REMOVE(p, p_reapsibling);
894 PROC_LOCK(p);
895 clear_orphan(p);
896 PROC_UNLOCK(p);
897 leavepgrp(p);
898#ifdef PROCDESC
899 if (p->p_procdesc != NULL)
900 procdesc_reap(p);
901#endif
902 sx_xunlock(&proctree_lock);
903
904 /*
905 * As a side effect of this lock, we know that all other writes to
906 * this proc are visible now, so no more locking is needed for p.
907 */
908 PROC_LOCK(p);
909 p->p_xstat = 0; /* XXX: why? */
910 PROC_UNLOCK(p);
911 PROC_LOCK(q);
912 ruadd(&q->p_stats->p_cru, &q->p_crux, &p->p_ru, &p->p_rux);
913 PROC_UNLOCK(q);
914
915 /*
916 * Decrement the count of procs running with this uid.
917 */
918 (void)chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
919
920 /*
921 * Destroy resource accounting information associated with the process.
922 */
923#ifdef RACCT
| 39
40#include "opt_compat.h"
41#include "opt_kdtrace.h"
42#include "opt_ktrace.h"
43#include "opt_procdesc.h"
44
45#include <sys/param.h>
46#include <sys/systm.h>
47#include <sys/sysproto.h>
48#include <sys/capsicum.h>
49#include <sys/eventhandler.h>
50#include <sys/kernel.h>
51#include <sys/malloc.h>
52#include <sys/lock.h>
53#include <sys/mutex.h>
54#include <sys/proc.h>
55#include <sys/procdesc.h>
56#include <sys/pioctl.h>
57#include <sys/jail.h>
58#include <sys/tty.h>
59#include <sys/wait.h>
60#include <sys/vmmeter.h>
61#include <sys/vnode.h>
62#include <sys/racct.h>
63#include <sys/resourcevar.h>
64#include <sys/sbuf.h>
65#include <sys/signalvar.h>
66#include <sys/sched.h>
67#include <sys/sx.h>
68#include <sys/syscallsubr.h>
69#include <sys/syslog.h>
70#include <sys/ptrace.h>
71#include <sys/acct.h> /* for acct_process() function prototype */
72#include <sys/filedesc.h>
73#include <sys/sdt.h>
74#include <sys/shm.h>
75#include <sys/sem.h>
76#include <sys/umtx.h>
77#ifdef KTRACE
78#include <sys/ktrace.h>
79#endif
80
81#include <security/audit/audit.h>
82#include <security/mac/mac_framework.h>
83
84#include <vm/vm.h>
85#include <vm/vm_extern.h>
86#include <vm/vm_param.h>
87#include <vm/pmap.h>
88#include <vm/vm_map.h>
89#include <vm/vm_page.h>
90#include <vm/uma.h>
91
92#ifdef KDTRACE_HOOKS
93#include <sys/dtrace_bsd.h>
94dtrace_execexit_func_t dtrace_fasttrap_exit;
95#endif
96
97SDT_PROVIDER_DECLARE(proc);
98SDT_PROBE_DEFINE1(proc, kernel, , exit, "int");
99
100/* Hook for NFS teardown procedure. */
101void (*nlminfo_release_p)(struct proc *p);
102
103struct proc *
104proc_realparent(struct proc *child)
105{
106 struct proc *p, *parent;
107
108 sx_assert(&proctree_lock, SX_LOCKED);
109 if ((child->p_treeflag & P_TREE_ORPHANED) == 0) {
110 if (child->p_oppid == 0 ||
111 child->p_pptr->p_pid == child->p_oppid)
112 parent = child->p_pptr;
113 else
114 parent = initproc;
115 return (parent);
116 }
117 for (p = child; (p->p_treeflag & P_TREE_FIRST_ORPHAN) == 0;) {
118 /* Cannot use LIST_PREV(), since the list head is not known. */
119 p = __containerof(p->p_orphan.le_prev, struct proc,
120 p_orphan.le_next);
121 KASSERT((p->p_treeflag & P_TREE_ORPHANED) != 0,
122 ("missing P_ORPHAN %p", p));
123 }
124 parent = __containerof(p->p_orphan.le_prev, struct proc,
125 p_orphans.lh_first);
126 return (parent);
127}
128
129void
130reaper_abandon_children(struct proc *p, bool exiting)
131{
132 struct proc *p1, *p2, *ptmp;
133
134 sx_assert(&proctree_lock, SX_LOCKED);
135 KASSERT(p != initproc, ("reaper_abandon_children for initproc"));
136 if ((p->p_treeflag & P_TREE_REAPER) == 0)
137 return;
138 p1 = p->p_reaper;
139 LIST_FOREACH_SAFE(p2, &p->p_reaplist, p_reapsibling, ptmp) {
140 LIST_REMOVE(p2, p_reapsibling);
141 p2->p_reaper = p1;
142 p2->p_reapsubtree = p->p_reapsubtree;
143 LIST_INSERT_HEAD(&p1->p_reaplist, p2, p_reapsibling);
144 if (exiting && p2->p_pptr == p) {
145 PROC_LOCK(p2);
146 proc_reparent(p2, p1);
147 PROC_UNLOCK(p2);
148 }
149 }
150 KASSERT(LIST_EMPTY(&p->p_reaplist), ("p_reaplist not empty"));
151 p->p_treeflag &= ~P_TREE_REAPER;
152}
153
154static void
155clear_orphan(struct proc *p)
156{
157 struct proc *p1;
158
159 sx_assert(&proctree_lock, SA_XLOCKED);
160 if ((p->p_treeflag & P_TREE_ORPHANED) == 0)
161 return;
162 if ((p->p_treeflag & P_TREE_FIRST_ORPHAN) != 0) {
163 p1 = LIST_NEXT(p, p_orphan);
164 if (p1 != NULL)
165 p1->p_treeflag |= P_TREE_FIRST_ORPHAN;
166 p->p_treeflag &= ~P_TREE_FIRST_ORPHAN;
167 }
168 LIST_REMOVE(p, p_orphan);
169 p->p_treeflag &= ~P_TREE_ORPHANED;
170}
171
172/*
173 * exit -- death of process.
174 */
175void
176sys_sys_exit(struct thread *td, struct sys_exit_args *uap)
177{
178
179 exit1(td, W_EXITCODE(uap->rval, 0));
180 /* NOTREACHED */
181}
182
183/*
184 * Exit: deallocate address space and other resources, change proc state to
185 * zombie, and unlink proc from allproc and parent's lists. Save exit status
186 * and rusage for wait(). Check for child processes and orphan them.
187 */
188void
189exit1(struct thread *td, int rv)
190{
191 struct proc *p, *nq, *q, *t;
192 struct thread *tdt;
193 struct vnode *ttyvp = NULL;
194
195 mtx_assert(&Giant, MA_NOTOWNED);
196
197 p = td->td_proc;
198 /*
199 * XXX in case we're rebooting we just let init die in order to
200 * work around an unsolved stack overflow seen very late during
201 * shutdown on sparc64 when the gmirror worker process exists.
202 */
203 if (p == initproc && rebooting == 0) {
204 printf("init died (signal %d, exit %d)\n",
205 WTERMSIG(rv), WEXITSTATUS(rv));
206 panic("Going nowhere without my init!");
207 }
208
209 /*
210 * Deref SU mp, since the thread does not return to userspace.
211 */
212 if (softdep_ast_cleanup != NULL)
213 softdep_ast_cleanup();
214
215 /*
216 * MUST abort all other threads before proceeding past here.
217 */
218 PROC_LOCK(p);
219 /*
220 * First check if some other thread or external request got
221 * here before us. If so, act appropriately: exit or suspend.
222 * We must ensure that stop requests are handled before we set
223 * P_WEXIT.
224 */
225 thread_suspend_check(0);
226 while (p->p_flag & P_HADTHREADS) {
227 /*
228 * Kill off the other threads. This requires
229 * some co-operation from other parts of the kernel
230 * so it may not be instantaneous. With this state set
231 * any thread entering the kernel from userspace will
232 * thread_exit() in trap(). Any thread attempting to
233 * sleep will return immediately with EINTR or EWOULDBLOCK
234 * which will hopefully force them to back out to userland
235 * freeing resources as they go. Any thread attempting
236 * to return to userland will thread_exit() from userret().
237 * thread_exit() will unsuspend us when the last of the
238 * other threads exits.
239 * If there is already a thread singler after resumption,
240 * calling thread_single will fail; in that case, we just
241 * re-check all suspension request, the thread should
242 * either be suspended there or exit.
243 */
244 if (!thread_single(p, SINGLE_EXIT))
245 /*
246 * All other activity in this process is now
247 * stopped. Threading support has been turned
248 * off.
249 */
250 break;
251 /*
252 * Recheck for new stop or suspend requests which
253 * might appear while process lock was dropped in
254 * thread_single().
255 */
256 thread_suspend_check(0);
257 }
258 KASSERT(p->p_numthreads == 1,
259 ("exit1: proc %p exiting with %d threads", p, p->p_numthreads));
260 racct_sub(p, RACCT_NTHR, 1);
261 /*
262 * Wakeup anyone in procfs' PIOCWAIT. They should have a hold
263 * on our vmspace, so we should block below until they have
264 * released their reference to us. Note that if they have
265 * requested S_EXIT stops we will block here until they ack
266 * via PIOCCONT.
267 */
268 _STOPEVENT(p, S_EXIT, rv);
269
270 /*
271 * Ignore any pending request to stop due to a stop signal.
272 * Once P_WEXIT is set, future requests will be ignored as
273 * well.
274 */
275 p->p_flag &= ~P_STOPPED_SIG;
276 KASSERT(!P_SHOULDSTOP(p), ("exiting process is stopped"));
277
278 /*
279 * Note that we are exiting and do another wakeup of anyone in
280 * PIOCWAIT in case they aren't listening for S_EXIT stops or
281 * decided to wait again after we told them we are exiting.
282 */
283 p->p_flag |= P_WEXIT;
284 wakeup(&p->p_stype);
285
286 /*
287 * Wait for any processes that have a hold on our vmspace to
288 * release their reference.
289 */
290 while (p->p_lock > 0)
291 msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0);
292
293 p->p_xstat = rv; /* Let event handler change exit status */
294 PROC_UNLOCK(p);
295 /* Drain the limit callout while we don't have the proc locked */
296 callout_drain(&p->p_limco);
297
298#ifdef AUDIT
299 /*
300 * The Sun BSM exit token contains two components: an exit status as
301 * passed to exit(), and a return value to indicate what sort of exit
302 * it was. The exit status is WEXITSTATUS(rv), but it's not clear
303 * what the return value is.
304 */
305 AUDIT_ARG_EXIT(WEXITSTATUS(rv), 0);
306 AUDIT_SYSCALL_EXIT(0, td);
307#endif
308
309 /* Are we a task leader? */
310 if (p == p->p_leader) {
311 mtx_lock(&ppeers_lock);
312 q = p->p_peers;
313 while (q != NULL) {
314 PROC_LOCK(q);
315 kern_psignal(q, SIGKILL);
316 PROC_UNLOCK(q);
317 q = q->p_peers;
318 }
319 while (p->p_peers != NULL)
320 msleep(p, &ppeers_lock, PWAIT, "exit1", 0);
321 mtx_unlock(&ppeers_lock);
322 }
323
324 /*
325 * Check if any loadable modules need anything done at process exit.
326 * E.g. SYSV IPC stuff
327 * XXX what if one of these generates an error?
328 */
329 EVENTHANDLER_INVOKE(process_exit, p);
330
331 /*
332 * If parent is waiting for us to exit or exec,
333 * P_PPWAIT is set; we will wakeup the parent below.
334 */
335 PROC_LOCK(p);
336 rv = p->p_xstat; /* Event handler could change exit status */
337 stopprofclock(p);
338 p->p_flag &= ~(P_TRACED | P_PPWAIT | P_PPTRACE);
339
340 /*
341 * Stop the real interval timer. If the handler is currently
342 * executing, prevent it from rearming itself and let it finish.
343 */
344 if (timevalisset(&p->p_realtimer.it_value) &&
345 callout_stop(&p->p_itcallout) == 0) {
346 timevalclear(&p->p_realtimer.it_interval);
347 msleep(&p->p_itcallout, &p->p_mtx, PWAIT, "ritwait", 0);
348 KASSERT(!timevalisset(&p->p_realtimer.it_value),
349 ("realtime timer is still armed"));
350 }
351 PROC_UNLOCK(p);
352
353 /*
354 * Reset any sigio structures pointing to us as a result of
355 * F_SETOWN with our pid.
356 */
357 funsetownlst(&p->p_sigiolst);
358
359 /*
360 * If this process has an nlminfo data area (for lockd), release it
361 */
362 if (nlminfo_release_p != NULL && p->p_nlminfo != NULL)
363 (*nlminfo_release_p)(p);
364
365 /*
366 * Close open files and release open-file table.
367 * This may block!
368 */
369 fdescfree(td);
370
371 /*
372 * If this thread tickled GEOM, we need to wait for the giggling to
373 * stop before we return to userland
374 */
375 if (td->td_pflags & TDP_GEOM)
376 g_waitidle();
377
378 /*
379 * Remove ourself from our leader's peer list and wake our leader.
380 */
381 mtx_lock(&ppeers_lock);
382 if (p->p_leader->p_peers) {
383 q = p->p_leader;
384 while (q->p_peers != p)
385 q = q->p_peers;
386 q->p_peers = p->p_peers;
387 wakeup(p->p_leader);
388 }
389 mtx_unlock(&ppeers_lock);
390
391 vmspace_exit(td);
392
393 sx_xlock(&proctree_lock);
394 if (SESS_LEADER(p)) {
395 struct session *sp = p->p_session;
396 struct tty *tp;
397
398 /*
399 * s_ttyp is not zero'd; we use this to indicate that
400 * the session once had a controlling terminal. (for
401 * logging and informational purposes)
402 */
403 SESS_LOCK(sp);
404 ttyvp = sp->s_ttyvp;
405 tp = sp->s_ttyp;
406 sp->s_ttyvp = NULL;
407 sp->s_ttydp = NULL;
408 sp->s_leader = NULL;
409 SESS_UNLOCK(sp);
410
411 /*
412 * Signal foreground pgrp and revoke access to
413 * controlling terminal if it has not been revoked
414 * already.
415 *
416 * Because the TTY may have been revoked in the mean
417 * time and could already have a new session associated
418 * with it, make sure we don't send a SIGHUP to a
419 * foreground process group that does not belong to this
420 * session.
421 */
422
423 if (tp != NULL) {
424 tty_lock(tp);
425 if (tp->t_session == sp)
426 tty_signal_pgrp(tp, SIGHUP);
427 tty_unlock(tp);
428 }
429
430 if (ttyvp != NULL) {
431 sx_xunlock(&proctree_lock);
432 if (vn_lock(ttyvp, LK_EXCLUSIVE) == 0) {
433 VOP_REVOKE(ttyvp, REVOKEALL);
434 VOP_UNLOCK(ttyvp, 0);
435 }
436 sx_xlock(&proctree_lock);
437 }
438 }
439 fixjobc(p, p->p_pgrp, 0);
440 sx_xunlock(&proctree_lock);
441 (void)acct_process(td);
442
443 /* Release the TTY now we've unlocked everything. */
444 if (ttyvp != NULL)
445 vrele(ttyvp);
446#ifdef KTRACE
447 ktrprocexit(td);
448#endif
449 /*
450 * Release reference to text vnode
451 */
452 if (p->p_textvp != NULL) {
453 vrele(p->p_textvp);
454 p->p_textvp = NULL;
455 }
456
457 /*
458 * Release our limits structure.
459 */
460 lim_free(p->p_limit);
461 p->p_limit = NULL;
462
463 tidhash_remove(td);
464
465 /*
466 * Remove proc from allproc queue and pidhash chain.
467 * Place onto zombproc. Unlink from parent's child list.
468 */
469 sx_xlock(&allproc_lock);
470 LIST_REMOVE(p, p_list);
471 LIST_INSERT_HEAD(&zombproc, p, p_list);
472 LIST_REMOVE(p, p_hash);
473 sx_xunlock(&allproc_lock);
474
475 /*
476 * Call machine-dependent code to release any
477 * machine-dependent resources other than the address space.
478 * The address space is released by "vmspace_exitfree(p)" in
479 * vm_waitproc().
480 */
481 cpu_exit(td);
482
483 WITNESS_WARN(WARN_PANIC, NULL, "process (pid %d) exiting", p->p_pid);
484
485 /*
486 * Reparent all children processes:
487 * - traced ones to the original parent (or init if we are that parent)
488 * - the rest to init
489 */
490 sx_xlock(&proctree_lock);
491 q = LIST_FIRST(&p->p_children);
492 if (q != NULL) /* only need this if any child is S_ZOMB */
493 wakeup(q->p_reaper);
494 for (; q != NULL; q = nq) {
495 nq = LIST_NEXT(q, p_sibling);
496 PROC_LOCK(q);
497 q->p_sigparent = SIGCHLD;
498
499 if (!(q->p_flag & P_TRACED)) {
500 proc_reparent(q, q->p_reaper);
501 } else {
502 /*
503 * Traced processes are killed since their existence
504 * means someone is screwing up.
505 */
506 t = proc_realparent(q);
507 if (t == p) {
508 proc_reparent(q, q->p_reaper);
509 } else {
510 PROC_LOCK(t);
511 proc_reparent(q, t);
512 PROC_UNLOCK(t);
513 }
514 /*
515 * Since q was found on our children list, the
516 * proc_reparent() call moved q to the orphan
517 * list due to present P_TRACED flag. Clear
518 * orphan link for q now while q is locked.
519 */
520 clear_orphan(q);
521 q->p_flag &= ~(P_TRACED | P_STOPPED_TRACE);
522 FOREACH_THREAD_IN_PROC(q, tdt)
523 tdt->td_dbgflags &= ~TDB_SUSPEND;
524 kern_psignal(q, SIGKILL);
525 }
526 PROC_UNLOCK(q);
527 }
528
529 /*
530 * Also get rid of our orphans.
531 */
532 while ((q = LIST_FIRST(&p->p_orphans)) != NULL) {
533 PROC_LOCK(q);
534 CTR2(KTR_PTRACE, "exit: pid %d, clearing orphan %d", p->p_pid,
535 q->p_pid);
536 clear_orphan(q);
537 PROC_UNLOCK(q);
538 }
539
540 /* Save exit status. */
541 PROC_LOCK(p);
542 p->p_xthread = td;
543
544 /* Tell the prison that we are gone. */
545 prison_proc_free(p->p_ucred->cr_prison);
546
547#ifdef KDTRACE_HOOKS
548 /*
549 * Tell the DTrace fasttrap provider about the exit if it
550 * has declared an interest.
551 */
552 if (dtrace_fasttrap_exit)
553 dtrace_fasttrap_exit(p);
554#endif
555
556 /*
557 * Notify interested parties of our demise.
558 */
559 KNOTE_LOCKED(&p->p_klist, NOTE_EXIT);
560
561#ifdef KDTRACE_HOOKS
562 int reason = CLD_EXITED;
563 if (WCOREDUMP(rv))
564 reason = CLD_DUMPED;
565 else if (WIFSIGNALED(rv))
566 reason = CLD_KILLED;
567 SDT_PROBE(proc, kernel, , exit, reason, 0, 0, 0, 0);
568#endif
569
570 /*
571 * Just delete all entries in the p_klist. At this point we won't
572 * report any more events, and there are nasty race conditions that
573 * can beat us if we don't.
574 */
575 knlist_clear(&p->p_klist, 1);
576
577 /*
578 * If this is a process with a descriptor, we may not need to deliver
579 * a signal to the parent. proctree_lock is held over
580 * procdesc_exit() to serialize concurrent calls to close() and
581 * exit().
582 */
583#ifdef PROCDESC
584 if (p->p_procdesc == NULL || procdesc_exit(p)) {
585#endif
586 /*
587 * Notify parent that we're gone. If parent has the
588 * PS_NOCLDWAIT flag set, or if the handler is set to SIG_IGN,
589 * notify process 1 instead (and hope it will handle this
590 * situation).
591 */
592 PROC_LOCK(p->p_pptr);
593 mtx_lock(&p->p_pptr->p_sigacts->ps_mtx);
594 if (p->p_pptr->p_sigacts->ps_flag &
595 (PS_NOCLDWAIT | PS_CLDSIGIGN)) {
596 struct proc *pp;
597
598 mtx_unlock(&p->p_pptr->p_sigacts->ps_mtx);
599 pp = p->p_pptr;
600 PROC_UNLOCK(pp);
601 proc_reparent(p, p->p_reaper);
602 p->p_sigparent = SIGCHLD;
603 PROC_LOCK(p->p_pptr);
604
605 /*
606 * Notify parent, so in case he was wait(2)ing or
607 * executing waitpid(2) with our pid, he will
608 * continue.
609 */
610 wakeup(pp);
611 } else
612 mtx_unlock(&p->p_pptr->p_sigacts->ps_mtx);
613
614 if (p->p_pptr == p->p_reaper || p->p_pptr == initproc)
615 childproc_exited(p);
616 else if (p->p_sigparent != 0) {
617 if (p->p_sigparent == SIGCHLD)
618 childproc_exited(p);
619 else /* LINUX thread */
620 kern_psignal(p->p_pptr, p->p_sigparent);
621 }
622#ifdef PROCDESC
623 } else
624 PROC_LOCK(p->p_pptr);
625#endif
626 sx_xunlock(&proctree_lock);
627
628 /*
629 * The state PRS_ZOMBIE prevents other proesses from sending
630 * signal to the process, to avoid memory leak, we free memory
631 * for signal queue at the time when the state is set.
632 */
633 sigqueue_flush(&p->p_sigqueue);
634 sigqueue_flush(&td->td_sigqueue);
635
636 /*
637 * We have to wait until after acquiring all locks before
638 * changing p_state. We need to avoid all possible context
639 * switches (including ones from blocking on a mutex) while
640 * marked as a zombie. We also have to set the zombie state
641 * before we release the parent process' proc lock to avoid
642 * a lost wakeup. So, we first call wakeup, then we grab the
643 * sched lock, update the state, and release the parent process'
644 * proc lock.
645 */
646 wakeup(p->p_pptr);
647 cv_broadcast(&p->p_pwait);
648 sched_exit(p->p_pptr, td);
649 umtx_thread_exit(td);
650 PROC_SLOCK(p);
651 p->p_state = PRS_ZOMBIE;
652 PROC_UNLOCK(p->p_pptr);
653
654 /*
655 * Hopefully no one will try to deliver a signal to the process this
656 * late in the game.
657 */
658 knlist_destroy(&p->p_klist);
659
660 /*
661 * Save our children's rusage information in our exit rusage.
662 */
663 ruadd(&p->p_ru, &p->p_rux, &p->p_stats->p_cru, &p->p_crux);
664
665 /*
666 * Make sure the scheduler takes this thread out of its tables etc.
667 * This will also release this thread's reference to the ucred.
668 * Other thread parts to release include pcb bits and such.
669 */
670 thread_exit();
671}
672
673
674#ifndef _SYS_SYSPROTO_H_
675struct abort2_args {
676 char *why;
677 int nargs;
678 void **args;
679};
680#endif
681
682int
683sys_abort2(struct thread *td, struct abort2_args *uap)
684{
685 struct proc *p = td->td_proc;
686 struct sbuf *sb;
687 void *uargs[16];
688 int error, i, sig;
689
690 /*
691 * Do it right now so we can log either proper call of abort2(), or
692 * note, that invalid argument was passed. 512 is big enough to
693 * handle 16 arguments' descriptions with additional comments.
694 */
695 sb = sbuf_new(NULL, NULL, 512, SBUF_FIXEDLEN);
696 sbuf_clear(sb);
697 sbuf_printf(sb, "%s(pid %d uid %d) aborted: ",
698 p->p_comm, p->p_pid, td->td_ucred->cr_uid);
699 /*
700 * Since we can't return from abort2(), send SIGKILL in cases, where
701 * abort2() was called improperly
702 */
703 sig = SIGKILL;
704 /* Prevent from DoSes from user-space. */
705 if (uap->nargs < 0 || uap->nargs > 16)
706 goto out;
707 if (uap->nargs > 0) {
708 if (uap->args == NULL)
709 goto out;
710 error = copyin(uap->args, uargs, uap->nargs * sizeof(void *));
711 if (error != 0)
712 goto out;
713 }
714 /*
715 * Limit size of 'reason' string to 128. Will fit even when
716 * maximal number of arguments was chosen to be logged.
717 */
718 if (uap->why != NULL) {
719 error = sbuf_copyin(sb, uap->why, 128);
720 if (error < 0)
721 goto out;
722 } else {
723 sbuf_printf(sb, "(null)");
724 }
725 if (uap->nargs > 0) {
726 sbuf_printf(sb, "(");
727 for (i = 0;i < uap->nargs; i++)
728 sbuf_printf(sb, "%s%p", i == 0 ? "" : ", ", uargs[i]);
729 sbuf_printf(sb, ")");
730 }
731 /*
732 * Final stage: arguments were proper, string has been
733 * successfully copied from userspace, and copying pointers
734 * from user-space succeed.
735 */
736 sig = SIGABRT;
737out:
738 if (sig == SIGKILL) {
739 sbuf_trim(sb);
740 sbuf_printf(sb, " (Reason text inaccessible)");
741 }
742 sbuf_cat(sb, "\n");
743 sbuf_finish(sb);
744 log(LOG_INFO, "%s", sbuf_data(sb));
745 sbuf_delete(sb);
746 exit1(td, W_EXITCODE(0, sig));
747 return (0);
748}
749
750
751#ifdef COMPAT_43
752/*
753 * The dirty work is handled by kern_wait().
754 */
755int
756owait(struct thread *td, struct owait_args *uap __unused)
757{
758 int error, status;
759
760 error = kern_wait(td, WAIT_ANY, &status, 0, NULL);
761 if (error == 0)
762 td->td_retval[1] = status;
763 return (error);
764}
765#endif /* COMPAT_43 */
766
767/*
768 * The dirty work is handled by kern_wait().
769 */
770int
771sys_wait4(struct thread *td, struct wait4_args *uap)
772{
773 struct rusage ru, *rup;
774 int error, status;
775
776 if (uap->rusage != NULL)
777 rup = &ru;
778 else
779 rup = NULL;
780 error = kern_wait(td, uap->pid, &status, uap->options, rup);
781 if (uap->status != NULL && error == 0)
782 error = copyout(&status, uap->status, sizeof(status));
783 if (uap->rusage != NULL && error == 0)
784 error = copyout(&ru, uap->rusage, sizeof(struct rusage));
785 return (error);
786}
787
788int
789sys_wait6(struct thread *td, struct wait6_args *uap)
790{
791 struct __wrusage wru, *wrup;
792 siginfo_t si, *sip;
793 idtype_t idtype;
794 id_t id;
795 int error, status;
796
797 idtype = uap->idtype;
798 id = uap->id;
799
800 if (uap->wrusage != NULL)
801 wrup = &wru;
802 else
803 wrup = NULL;
804
805 if (uap->info != NULL) {
806 sip = &si;
807 bzero(sip, sizeof(*sip));
808 } else
809 sip = NULL;
810
811 /*
812 * We expect all callers of wait6() to know about WEXITED and
813 * WTRAPPED.
814 */
815 error = kern_wait6(td, idtype, id, &status, uap->options, wrup, sip);
816
817 if (uap->status != NULL && error == 0)
818 error = copyout(&status, uap->status, sizeof(status));
819 if (uap->wrusage != NULL && error == 0)
820 error = copyout(&wru, uap->wrusage, sizeof(wru));
821 if (uap->info != NULL && error == 0)
822 error = copyout(&si, uap->info, sizeof(si));
823 return (error);
824}
825
826/*
827 * Reap the remains of a zombie process and optionally return status and
828 * rusage. Asserts and will release both the proctree_lock and the process
829 * lock as part of its work.
830 */
831void
832proc_reap(struct thread *td, struct proc *p, int *status, int options)
833{
834 struct proc *q, *t;
835
836 sx_assert(&proctree_lock, SA_XLOCKED);
837 PROC_LOCK_ASSERT(p, MA_OWNED);
838 PROC_SLOCK_ASSERT(p, MA_OWNED);
839 KASSERT(p->p_state == PRS_ZOMBIE, ("proc_reap: !PRS_ZOMBIE"));
840
841 q = td->td_proc;
842
843 PROC_SUNLOCK(p);
844 td->td_retval[0] = p->p_pid;
845 if (status)
846 *status = p->p_xstat; /* convert to int */
847 if (options & WNOWAIT) {
848 /*
849 * Only poll, returning the status. Caller does not wish to
850 * release the proc struct just yet.
851 */
852 PROC_UNLOCK(p);
853 sx_xunlock(&proctree_lock);
854 return;
855 }
856
857 PROC_LOCK(q);
858 sigqueue_take(p->p_ksi);
859 PROC_UNLOCK(q);
860 PROC_UNLOCK(p);
861
862 /*
863 * If we got the child via a ptrace 'attach', we need to give it back
864 * to the old parent.
865 */
866 if (p->p_oppid != 0) {
867 t = proc_realparent(p);
868 PROC_LOCK(t);
869 PROC_LOCK(p);
870 CTR2(KTR_PTRACE,
871 "wait: traced child %d moved back to parent %d", p->p_pid,
872 t->p_pid);
873 proc_reparent(p, t);
874 p->p_oppid = 0;
875 PROC_UNLOCK(p);
876 pksignal(t, SIGCHLD, p->p_ksi);
877 wakeup(t);
878 cv_broadcast(&p->p_pwait);
879 PROC_UNLOCK(t);
880 sx_xunlock(&proctree_lock);
881 return;
882 }
883
884 /*
885 * Remove other references to this process to ensure we have an
886 * exclusive reference.
887 */
888 sx_xlock(&allproc_lock);
889 LIST_REMOVE(p, p_list); /* off zombproc */
890 sx_xunlock(&allproc_lock);
891 LIST_REMOVE(p, p_sibling);
892 reaper_abandon_children(p, true);
893 LIST_REMOVE(p, p_reapsibling);
894 PROC_LOCK(p);
895 clear_orphan(p);
896 PROC_UNLOCK(p);
897 leavepgrp(p);
898#ifdef PROCDESC
899 if (p->p_procdesc != NULL)
900 procdesc_reap(p);
901#endif
902 sx_xunlock(&proctree_lock);
903
904 /*
905 * As a side effect of this lock, we know that all other writes to
906 * this proc are visible now, so no more locking is needed for p.
907 */
908 PROC_LOCK(p);
909 p->p_xstat = 0; /* XXX: why? */
910 PROC_UNLOCK(p);
911 PROC_LOCK(q);
912 ruadd(&q->p_stats->p_cru, &q->p_crux, &p->p_ru, &p->p_rux);
913 PROC_UNLOCK(q);
914
915 /*
916 * Decrement the count of procs running with this uid.
917 */
918 (void)chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0);
919
920 /*
921 * Destroy resource accounting information associated with the process.
922 */
923#ifdef RACCT
|
927#endif
928 racct_proc_exit(p);
929
930 /*
931 * Free credentials, arguments, and sigacts.
932 */
933 crfree(p->p_ucred);
934 p->p_ucred = NULL;
935 pargs_drop(p->p_args);
936 p->p_args = NULL;
937 sigacts_free(p->p_sigacts);
938 p->p_sigacts = NULL;
939
940 /*
941 * Do any thread-system specific cleanups.
942 */
943 thread_wait(p);
944
945 /*
946 * Give vm and machine-dependent layer a chance to free anything that
947 * cpu_exit couldn't release while still running in process context.
948 */
949 vm_waitproc(p);
950#ifdef MAC
951 mac_proc_destroy(p);
952#endif
953 KASSERT(FIRST_THREAD_IN_PROC(p),
954 ("proc_reap: no residual thread!"));
955 uma_zfree(proc_zone, p);
956 sx_xlock(&allproc_lock);
957 nprocs--;
958 sx_xunlock(&allproc_lock);
959}
960
961static int
962proc_to_reap(struct thread *td, struct proc *p, idtype_t idtype, id_t id,
963 int *status, int options, struct __wrusage *wrusage, siginfo_t *siginfo)
964{
965 struct rusage *rup;
966
967 sx_assert(&proctree_lock, SA_XLOCKED);
968
969 PROC_LOCK(p);
970
971 switch (idtype) {
972 case P_ALL:
973 break;
974 case P_PID:
975 if (p->p_pid != (pid_t)id) {
976 PROC_UNLOCK(p);
977 return (0);
978 }
979 break;
980 case P_PGID:
981 if (p->p_pgid != (pid_t)id) {
982 PROC_UNLOCK(p);
983 return (0);
984 }
985 break;
986 case P_SID:
987 if (p->p_session->s_sid != (pid_t)id) {
988 PROC_UNLOCK(p);
989 return (0);
990 }
991 break;
992 case P_UID:
993 if (p->p_ucred->cr_uid != (uid_t)id) {
994 PROC_UNLOCK(p);
995 return (0);
996 }
997 break;
998 case P_GID:
999 if (p->p_ucred->cr_gid != (gid_t)id) {
1000 PROC_UNLOCK(p);
1001 return (0);
1002 }
1003 break;
1004 case P_JAILID:
1005 if (p->p_ucred->cr_prison->pr_id != (int)id) {
1006 PROC_UNLOCK(p);
1007 return (0);
1008 }
1009 break;
1010 /*
1011 * It seems that the thread structures get zeroed out
1012 * at process exit. This makes it impossible to
1013 * support P_SETID, P_CID or P_CPUID.
1014 */
1015 default:
1016 PROC_UNLOCK(p);
1017 return (0);
1018 }
1019
1020 if (p_canwait(td, p)) {
1021 PROC_UNLOCK(p);
1022 return (0);
1023 }
1024
1025 if (((options & WEXITED) == 0) && (p->p_state == PRS_ZOMBIE)) {
1026 PROC_UNLOCK(p);
1027 return (0);
1028 }
1029
1030 /*
1031 * This special case handles a kthread spawned by linux_clone
1032 * (see linux_misc.c). The linux_wait4 and linux_waitpid
1033 * functions need to be able to distinguish between waiting
1034 * on a process and waiting on a thread. It is a thread if
1035 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
1036 * signifies we want to wait for threads and not processes.
1037 */
1038 if ((p->p_sigparent != SIGCHLD) ^
1039 ((options & WLINUXCLONE) != 0)) {
1040 PROC_UNLOCK(p);
1041 return (0);
1042 }
1043
1044 PROC_SLOCK(p);
1045
1046 if (siginfo != NULL) {
1047 bzero(siginfo, sizeof(*siginfo));
1048 siginfo->si_errno = 0;
1049
1050 /*
1051 * SUSv4 requires that the si_signo value is always
1052 * SIGCHLD. Obey it despite the rfork(2) interface
1053 * allows to request other signal for child exit
1054 * notification.
1055 */
1056 siginfo->si_signo = SIGCHLD;
1057
1058 /*
1059 * This is still a rough estimate. We will fix the
1060 * cases TRAPPED, STOPPED, and CONTINUED later.
1061 */
1062 if (WCOREDUMP(p->p_xstat)) {
1063 siginfo->si_code = CLD_DUMPED;
1064 siginfo->si_status = WTERMSIG(p->p_xstat);
1065 } else if (WIFSIGNALED(p->p_xstat)) {
1066 siginfo->si_code = CLD_KILLED;
1067 siginfo->si_status = WTERMSIG(p->p_xstat);
1068 } else {
1069 siginfo->si_code = CLD_EXITED;
1070 siginfo->si_status = WEXITSTATUS(p->p_xstat);
1071 }
1072
1073 siginfo->si_pid = p->p_pid;
1074 siginfo->si_uid = p->p_ucred->cr_uid;
1075
1076 /*
1077 * The si_addr field would be useful additional
1078 * detail, but apparently the PC value may be lost
1079 * when we reach this point. bzero() above sets
1080 * siginfo->si_addr to NULL.
1081 */
1082 }
1083
1084 /*
1085 * There should be no reason to limit resources usage info to
1086 * exited processes only. A snapshot about any resources used
1087 * by a stopped process may be exactly what is needed.
1088 */
1089 if (wrusage != NULL) {
1090 rup = &wrusage->wru_self;
1091 *rup = p->p_ru;
1092 calcru(p, &rup->ru_utime, &rup->ru_stime);
1093
1094 rup = &wrusage->wru_children;
1095 *rup = p->p_stats->p_cru;
1096 calccru(p, &rup->ru_utime, &rup->ru_stime);
1097 }
1098
1099 if (p->p_state == PRS_ZOMBIE) {
1100 proc_reap(td, p, status, options);
1101 return (-1);
1102 }
1103 PROC_SUNLOCK(p);
1104 PROC_UNLOCK(p);
1105 return (1);
1106}
1107
1108int
1109kern_wait(struct thread *td, pid_t pid, int *status, int options,
1110 struct rusage *rusage)
1111{
1112 struct __wrusage wru, *wrup;
1113 idtype_t idtype;
1114 id_t id;
1115 int ret;
1116
1117 /*
1118 * Translate the special pid values into the (idtype, pid)
1119 * pair for kern_wait6. The WAIT_MYPGRP case is handled by
1120 * kern_wait6() on its own.
1121 */
1122 if (pid == WAIT_ANY) {
1123 idtype = P_ALL;
1124 id = 0;
1125 } else if (pid < 0) {
1126 idtype = P_PGID;
1127 id = (id_t)-pid;
1128 } else {
1129 idtype = P_PID;
1130 id = (id_t)pid;
1131 }
1132
1133 if (rusage != NULL)
1134 wrup = &wru;
1135 else
1136 wrup = NULL;
1137
1138 /*
1139 * For backward compatibility we implicitly add flags WEXITED
1140 * and WTRAPPED here.
1141 */
1142 options |= WEXITED | WTRAPPED;
1143 ret = kern_wait6(td, idtype, id, status, options, wrup, NULL);
1144 if (rusage != NULL)
1145 *rusage = wru.wru_self;
1146 return (ret);
1147}
1148
1149int
1150kern_wait6(struct thread *td, idtype_t idtype, id_t id, int *status,
1151 int options, struct __wrusage *wrusage, siginfo_t *siginfo)
1152{
1153 struct proc *p, *q;
1154 int error, nfound, ret;
1155
1156 AUDIT_ARG_VALUE((int)idtype); /* XXX - This is likely wrong! */
1157 AUDIT_ARG_PID((pid_t)id); /* XXX - This may be wrong! */
1158 AUDIT_ARG_VALUE(options);
1159
1160 q = td->td_proc;
1161
1162 if ((pid_t)id == WAIT_MYPGRP && (idtype == P_PID || idtype == P_PGID)) {
1163 PROC_LOCK(q);
1164 id = (id_t)q->p_pgid;
1165 PROC_UNLOCK(q);
1166 idtype = P_PGID;
1167 }
1168
1169 /* If we don't know the option, just return. */
1170 if ((options & ~(WUNTRACED | WNOHANG | WCONTINUED | WNOWAIT |
1171 WEXITED | WTRAPPED | WLINUXCLONE)) != 0)
1172 return (EINVAL);
1173 if ((options & (WEXITED | WUNTRACED | WCONTINUED | WTRAPPED)) == 0) {
1174 /*
1175 * We will be unable to find any matching processes,
1176 * because there are no known events to look for.
1177 * Prefer to return error instead of blocking
1178 * indefinitely.
1179 */
1180 return (EINVAL);
1181 }
1182
1183loop:
1184 if (q->p_flag & P_STATCHILD) {
1185 PROC_LOCK(q);
1186 q->p_flag &= ~P_STATCHILD;
1187 PROC_UNLOCK(q);
1188 }
1189 nfound = 0;
1190 sx_xlock(&proctree_lock);
1191 LIST_FOREACH(p, &q->p_children, p_sibling) {
1192 ret = proc_to_reap(td, p, idtype, id, status, options,
1193 wrusage, siginfo);
1194 if (ret == 0)
1195 continue;
1196 else if (ret == 1)
1197 nfound++;
1198 else
1199 return (0);
1200
1201 PROC_LOCK(p);
1202 PROC_SLOCK(p);
1203
1204 if ((options & WTRAPPED) != 0 &&
1205 (p->p_flag & P_TRACED) != 0 &&
1206 (p->p_flag & (P_STOPPED_TRACE | P_STOPPED_SIG)) != 0 &&
1207 (p->p_suspcount == p->p_numthreads) &&
1208 ((p->p_flag & P_WAITED) == 0)) {
1209 PROC_SUNLOCK(p);
1210 if ((options & WNOWAIT) == 0)
1211 p->p_flag |= P_WAITED;
1212 sx_xunlock(&proctree_lock);
1213 td->td_retval[0] = p->p_pid;
1214
1215 if (status != NULL)
1216 *status = W_STOPCODE(p->p_xstat);
1217 if (siginfo != NULL) {
1218 siginfo->si_status = p->p_xstat;
1219 siginfo->si_code = CLD_TRAPPED;
1220 }
1221 if ((options & WNOWAIT) == 0) {
1222 PROC_LOCK(q);
1223 sigqueue_take(p->p_ksi);
1224 PROC_UNLOCK(q);
1225 }
1226
1227 CTR4(KTR_PTRACE,
1228 "wait: returning trapped pid %d status %#x (xstat %d) xthread %d",
1229 p->p_pid, W_STOPCODE(p->p_xstat), p->p_xstat,
1230 p->p_xthread != NULL ? p->p_xthread->td_tid : -1);
1231 PROC_UNLOCK(p);
1232 return (0);
1233 }
1234 if ((options & WUNTRACED) != 0 &&
1235 (p->p_flag & P_STOPPED_SIG) != 0 &&
1236 (p->p_suspcount == p->p_numthreads) &&
1237 ((p->p_flag & P_WAITED) == 0)) {
1238 PROC_SUNLOCK(p);
1239 if ((options & WNOWAIT) == 0)
1240 p->p_flag |= P_WAITED;
1241 sx_xunlock(&proctree_lock);
1242 td->td_retval[0] = p->p_pid;
1243
1244 if (status != NULL)
1245 *status = W_STOPCODE(p->p_xstat);
1246 if (siginfo != NULL) {
1247 siginfo->si_status = p->p_xstat;
1248 siginfo->si_code = CLD_STOPPED;
1249 }
1250 if ((options & WNOWAIT) == 0) {
1251 PROC_LOCK(q);
1252 sigqueue_take(p->p_ksi);
1253 PROC_UNLOCK(q);
1254 }
1255
1256 PROC_UNLOCK(p);
1257 return (0);
1258 }
1259 PROC_SUNLOCK(p);
1260 if ((options & WCONTINUED) != 0 &&
1261 (p->p_flag & P_CONTINUED) != 0) {
1262 sx_xunlock(&proctree_lock);
1263 td->td_retval[0] = p->p_pid;
1264 if ((options & WNOWAIT) == 0) {
1265 p->p_flag &= ~P_CONTINUED;
1266 PROC_LOCK(q);
1267 sigqueue_take(p->p_ksi);
1268 PROC_UNLOCK(q);
1269 }
1270 PROC_UNLOCK(p);
1271
1272 if (status != NULL)
1273 *status = SIGCONT;
1274 if (siginfo != NULL) {
1275 siginfo->si_status = SIGCONT;
1276 siginfo->si_code = CLD_CONTINUED;
1277 }
1278 return (0);
1279 }
1280 PROC_UNLOCK(p);
1281 }
1282
1283 /*
1284 * Look in the orphans list too, to allow the parent to
1285 * collect it's child exit status even if child is being
1286 * debugged.
1287 *
1288 * Debugger detaches from the parent upon successful
1289 * switch-over from parent to child. At this point due to
1290 * re-parenting the parent loses the child to debugger and a
1291 * wait4(2) call would report that it has no children to wait
1292 * for. By maintaining a list of orphans we allow the parent
1293 * to successfully wait until the child becomes a zombie.
1294 */
1295 LIST_FOREACH(p, &q->p_orphans, p_orphan) {
1296 ret = proc_to_reap(td, p, idtype, id, status, options,
1297 wrusage, siginfo);
1298 if (ret == 0)
1299 continue;
1300 else if (ret == 1)
1301 nfound++;
1302 else
1303 return (0);
1304 }
1305 if (nfound == 0) {
1306 sx_xunlock(&proctree_lock);
1307 return (ECHILD);
1308 }
1309 if (options & WNOHANG) {
1310 sx_xunlock(&proctree_lock);
1311 td->td_retval[0] = 0;
1312 return (0);
1313 }
1314 PROC_LOCK(q);
1315 sx_xunlock(&proctree_lock);
1316 if (q->p_flag & P_STATCHILD) {
1317 q->p_flag &= ~P_STATCHILD;
1318 error = 0;
1319 } else
1320 error = msleep(q, &q->p_mtx, PWAIT | PCATCH, "wait", 0);
1321 PROC_UNLOCK(q);
1322 if (error)
1323 return (error);
1324 goto loop;
1325}
1326
1327/*
1328 * Make process 'parent' the new parent of process 'child'.
1329 * Must be called with an exclusive hold of proctree lock.
1330 */
1331void
1332proc_reparent(struct proc *child, struct proc *parent)
1333{
1334
1335 sx_assert(&proctree_lock, SX_XLOCKED);
1336 PROC_LOCK_ASSERT(child, MA_OWNED);
1337 if (child->p_pptr == parent)
1338 return;
1339
1340 PROC_LOCK(child->p_pptr);
1341 sigqueue_take(child->p_ksi);
1342 PROC_UNLOCK(child->p_pptr);
1343 LIST_REMOVE(child, p_sibling);
1344 LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
1345
1346 clear_orphan(child);
1347 if (child->p_flag & P_TRACED) {
1348 if (LIST_EMPTY(&child->p_pptr->p_orphans)) {
1349 child->p_treeflag |= P_TREE_FIRST_ORPHAN;
1350 LIST_INSERT_HEAD(&child->p_pptr->p_orphans, child,
1351 p_orphan);
1352 } else {
1353 LIST_INSERT_AFTER(LIST_FIRST(&child->p_pptr->p_orphans),
1354 child, p_orphan);
1355 }
1356 child->p_treeflag |= P_TREE_ORPHANED;
1357 }
1358
1359 child->p_pptr = parent;
1360}
| 929#endif
930 racct_proc_exit(p);
931
932 /*
933 * Free credentials, arguments, and sigacts.
934 */
935 crfree(p->p_ucred);
936 p->p_ucred = NULL;
937 pargs_drop(p->p_args);
938 p->p_args = NULL;
939 sigacts_free(p->p_sigacts);
940 p->p_sigacts = NULL;
941
942 /*
943 * Do any thread-system specific cleanups.
944 */
945 thread_wait(p);
946
947 /*
948 * Give vm and machine-dependent layer a chance to free anything that
949 * cpu_exit couldn't release while still running in process context.
950 */
951 vm_waitproc(p);
952#ifdef MAC
953 mac_proc_destroy(p);
954#endif
955 KASSERT(FIRST_THREAD_IN_PROC(p),
956 ("proc_reap: no residual thread!"));
957 uma_zfree(proc_zone, p);
958 sx_xlock(&allproc_lock);
959 nprocs--;
960 sx_xunlock(&allproc_lock);
961}
962
963static int
964proc_to_reap(struct thread *td, struct proc *p, idtype_t idtype, id_t id,
965 int *status, int options, struct __wrusage *wrusage, siginfo_t *siginfo)
966{
967 struct rusage *rup;
968
969 sx_assert(&proctree_lock, SA_XLOCKED);
970
971 PROC_LOCK(p);
972
973 switch (idtype) {
974 case P_ALL:
975 break;
976 case P_PID:
977 if (p->p_pid != (pid_t)id) {
978 PROC_UNLOCK(p);
979 return (0);
980 }
981 break;
982 case P_PGID:
983 if (p->p_pgid != (pid_t)id) {
984 PROC_UNLOCK(p);
985 return (0);
986 }
987 break;
988 case P_SID:
989 if (p->p_session->s_sid != (pid_t)id) {
990 PROC_UNLOCK(p);
991 return (0);
992 }
993 break;
994 case P_UID:
995 if (p->p_ucred->cr_uid != (uid_t)id) {
996 PROC_UNLOCK(p);
997 return (0);
998 }
999 break;
1000 case P_GID:
1001 if (p->p_ucred->cr_gid != (gid_t)id) {
1002 PROC_UNLOCK(p);
1003 return (0);
1004 }
1005 break;
1006 case P_JAILID:
1007 if (p->p_ucred->cr_prison->pr_id != (int)id) {
1008 PROC_UNLOCK(p);
1009 return (0);
1010 }
1011 break;
1012 /*
1013 * It seems that the thread structures get zeroed out
1014 * at process exit. This makes it impossible to
1015 * support P_SETID, P_CID or P_CPUID.
1016 */
1017 default:
1018 PROC_UNLOCK(p);
1019 return (0);
1020 }
1021
1022 if (p_canwait(td, p)) {
1023 PROC_UNLOCK(p);
1024 return (0);
1025 }
1026
1027 if (((options & WEXITED) == 0) && (p->p_state == PRS_ZOMBIE)) {
1028 PROC_UNLOCK(p);
1029 return (0);
1030 }
1031
1032 /*
1033 * This special case handles a kthread spawned by linux_clone
1034 * (see linux_misc.c). The linux_wait4 and linux_waitpid
1035 * functions need to be able to distinguish between waiting
1036 * on a process and waiting on a thread. It is a thread if
1037 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option
1038 * signifies we want to wait for threads and not processes.
1039 */
1040 if ((p->p_sigparent != SIGCHLD) ^
1041 ((options & WLINUXCLONE) != 0)) {
1042 PROC_UNLOCK(p);
1043 return (0);
1044 }
1045
1046 PROC_SLOCK(p);
1047
1048 if (siginfo != NULL) {
1049 bzero(siginfo, sizeof(*siginfo));
1050 siginfo->si_errno = 0;
1051
1052 /*
1053 * SUSv4 requires that the si_signo value is always
1054 * SIGCHLD. Obey it despite the rfork(2) interface
1055 * allows to request other signal for child exit
1056 * notification.
1057 */
1058 siginfo->si_signo = SIGCHLD;
1059
1060 /*
1061 * This is still a rough estimate. We will fix the
1062 * cases TRAPPED, STOPPED, and CONTINUED later.
1063 */
1064 if (WCOREDUMP(p->p_xstat)) {
1065 siginfo->si_code = CLD_DUMPED;
1066 siginfo->si_status = WTERMSIG(p->p_xstat);
1067 } else if (WIFSIGNALED(p->p_xstat)) {
1068 siginfo->si_code = CLD_KILLED;
1069 siginfo->si_status = WTERMSIG(p->p_xstat);
1070 } else {
1071 siginfo->si_code = CLD_EXITED;
1072 siginfo->si_status = WEXITSTATUS(p->p_xstat);
1073 }
1074
1075 siginfo->si_pid = p->p_pid;
1076 siginfo->si_uid = p->p_ucred->cr_uid;
1077
1078 /*
1079 * The si_addr field would be useful additional
1080 * detail, but apparently the PC value may be lost
1081 * when we reach this point. bzero() above sets
1082 * siginfo->si_addr to NULL.
1083 */
1084 }
1085
1086 /*
1087 * There should be no reason to limit resources usage info to
1088 * exited processes only. A snapshot about any resources used
1089 * by a stopped process may be exactly what is needed.
1090 */
1091 if (wrusage != NULL) {
1092 rup = &wrusage->wru_self;
1093 *rup = p->p_ru;
1094 calcru(p, &rup->ru_utime, &rup->ru_stime);
1095
1096 rup = &wrusage->wru_children;
1097 *rup = p->p_stats->p_cru;
1098 calccru(p, &rup->ru_utime, &rup->ru_stime);
1099 }
1100
1101 if (p->p_state == PRS_ZOMBIE) {
1102 proc_reap(td, p, status, options);
1103 return (-1);
1104 }
1105 PROC_SUNLOCK(p);
1106 PROC_UNLOCK(p);
1107 return (1);
1108}
1109
1110int
1111kern_wait(struct thread *td, pid_t pid, int *status, int options,
1112 struct rusage *rusage)
1113{
1114 struct __wrusage wru, *wrup;
1115 idtype_t idtype;
1116 id_t id;
1117 int ret;
1118
1119 /*
1120 * Translate the special pid values into the (idtype, pid)
1121 * pair for kern_wait6. The WAIT_MYPGRP case is handled by
1122 * kern_wait6() on its own.
1123 */
1124 if (pid == WAIT_ANY) {
1125 idtype = P_ALL;
1126 id = 0;
1127 } else if (pid < 0) {
1128 idtype = P_PGID;
1129 id = (id_t)-pid;
1130 } else {
1131 idtype = P_PID;
1132 id = (id_t)pid;
1133 }
1134
1135 if (rusage != NULL)
1136 wrup = &wru;
1137 else
1138 wrup = NULL;
1139
1140 /*
1141 * For backward compatibility we implicitly add flags WEXITED
1142 * and WTRAPPED here.
1143 */
1144 options |= WEXITED | WTRAPPED;
1145 ret = kern_wait6(td, idtype, id, status, options, wrup, NULL);
1146 if (rusage != NULL)
1147 *rusage = wru.wru_self;
1148 return (ret);
1149}
1150
1151int
1152kern_wait6(struct thread *td, idtype_t idtype, id_t id, int *status,
1153 int options, struct __wrusage *wrusage, siginfo_t *siginfo)
1154{
1155 struct proc *p, *q;
1156 int error, nfound, ret;
1157
1158 AUDIT_ARG_VALUE((int)idtype); /* XXX - This is likely wrong! */
1159 AUDIT_ARG_PID((pid_t)id); /* XXX - This may be wrong! */
1160 AUDIT_ARG_VALUE(options);
1161
1162 q = td->td_proc;
1163
1164 if ((pid_t)id == WAIT_MYPGRP && (idtype == P_PID || idtype == P_PGID)) {
1165 PROC_LOCK(q);
1166 id = (id_t)q->p_pgid;
1167 PROC_UNLOCK(q);
1168 idtype = P_PGID;
1169 }
1170
1171 /* If we don't know the option, just return. */
1172 if ((options & ~(WUNTRACED | WNOHANG | WCONTINUED | WNOWAIT |
1173 WEXITED | WTRAPPED | WLINUXCLONE)) != 0)
1174 return (EINVAL);
1175 if ((options & (WEXITED | WUNTRACED | WCONTINUED | WTRAPPED)) == 0) {
1176 /*
1177 * We will be unable to find any matching processes,
1178 * because there are no known events to look for.
1179 * Prefer to return error instead of blocking
1180 * indefinitely.
1181 */
1182 return (EINVAL);
1183 }
1184
1185loop:
1186 if (q->p_flag & P_STATCHILD) {
1187 PROC_LOCK(q);
1188 q->p_flag &= ~P_STATCHILD;
1189 PROC_UNLOCK(q);
1190 }
1191 nfound = 0;
1192 sx_xlock(&proctree_lock);
1193 LIST_FOREACH(p, &q->p_children, p_sibling) {
1194 ret = proc_to_reap(td, p, idtype, id, status, options,
1195 wrusage, siginfo);
1196 if (ret == 0)
1197 continue;
1198 else if (ret == 1)
1199 nfound++;
1200 else
1201 return (0);
1202
1203 PROC_LOCK(p);
1204 PROC_SLOCK(p);
1205
1206 if ((options & WTRAPPED) != 0 &&
1207 (p->p_flag & P_TRACED) != 0 &&
1208 (p->p_flag & (P_STOPPED_TRACE | P_STOPPED_SIG)) != 0 &&
1209 (p->p_suspcount == p->p_numthreads) &&
1210 ((p->p_flag & P_WAITED) == 0)) {
1211 PROC_SUNLOCK(p);
1212 if ((options & WNOWAIT) == 0)
1213 p->p_flag |= P_WAITED;
1214 sx_xunlock(&proctree_lock);
1215 td->td_retval[0] = p->p_pid;
1216
1217 if (status != NULL)
1218 *status = W_STOPCODE(p->p_xstat);
1219 if (siginfo != NULL) {
1220 siginfo->si_status = p->p_xstat;
1221 siginfo->si_code = CLD_TRAPPED;
1222 }
1223 if ((options & WNOWAIT) == 0) {
1224 PROC_LOCK(q);
1225 sigqueue_take(p->p_ksi);
1226 PROC_UNLOCK(q);
1227 }
1228
1229 CTR4(KTR_PTRACE,
1230 "wait: returning trapped pid %d status %#x (xstat %d) xthread %d",
1231 p->p_pid, W_STOPCODE(p->p_xstat), p->p_xstat,
1232 p->p_xthread != NULL ? p->p_xthread->td_tid : -1);
1233 PROC_UNLOCK(p);
1234 return (0);
1235 }
1236 if ((options & WUNTRACED) != 0 &&
1237 (p->p_flag & P_STOPPED_SIG) != 0 &&
1238 (p->p_suspcount == p->p_numthreads) &&
1239 ((p->p_flag & P_WAITED) == 0)) {
1240 PROC_SUNLOCK(p);
1241 if ((options & WNOWAIT) == 0)
1242 p->p_flag |= P_WAITED;
1243 sx_xunlock(&proctree_lock);
1244 td->td_retval[0] = p->p_pid;
1245
1246 if (status != NULL)
1247 *status = W_STOPCODE(p->p_xstat);
1248 if (siginfo != NULL) {
1249 siginfo->si_status = p->p_xstat;
1250 siginfo->si_code = CLD_STOPPED;
1251 }
1252 if ((options & WNOWAIT) == 0) {
1253 PROC_LOCK(q);
1254 sigqueue_take(p->p_ksi);
1255 PROC_UNLOCK(q);
1256 }
1257
1258 PROC_UNLOCK(p);
1259 return (0);
1260 }
1261 PROC_SUNLOCK(p);
1262 if ((options & WCONTINUED) != 0 &&
1263 (p->p_flag & P_CONTINUED) != 0) {
1264 sx_xunlock(&proctree_lock);
1265 td->td_retval[0] = p->p_pid;
1266 if ((options & WNOWAIT) == 0) {
1267 p->p_flag &= ~P_CONTINUED;
1268 PROC_LOCK(q);
1269 sigqueue_take(p->p_ksi);
1270 PROC_UNLOCK(q);
1271 }
1272 PROC_UNLOCK(p);
1273
1274 if (status != NULL)
1275 *status = SIGCONT;
1276 if (siginfo != NULL) {
1277 siginfo->si_status = SIGCONT;
1278 siginfo->si_code = CLD_CONTINUED;
1279 }
1280 return (0);
1281 }
1282 PROC_UNLOCK(p);
1283 }
1284
1285 /*
1286 * Look in the orphans list too, to allow the parent to
1287 * collect it's child exit status even if child is being
1288 * debugged.
1289 *
1290 * Debugger detaches from the parent upon successful
1291 * switch-over from parent to child. At this point due to
1292 * re-parenting the parent loses the child to debugger and a
1293 * wait4(2) call would report that it has no children to wait
1294 * for. By maintaining a list of orphans we allow the parent
1295 * to successfully wait until the child becomes a zombie.
1296 */
1297 LIST_FOREACH(p, &q->p_orphans, p_orphan) {
1298 ret = proc_to_reap(td, p, idtype, id, status, options,
1299 wrusage, siginfo);
1300 if (ret == 0)
1301 continue;
1302 else if (ret == 1)
1303 nfound++;
1304 else
1305 return (0);
1306 }
1307 if (nfound == 0) {
1308 sx_xunlock(&proctree_lock);
1309 return (ECHILD);
1310 }
1311 if (options & WNOHANG) {
1312 sx_xunlock(&proctree_lock);
1313 td->td_retval[0] = 0;
1314 return (0);
1315 }
1316 PROC_LOCK(q);
1317 sx_xunlock(&proctree_lock);
1318 if (q->p_flag & P_STATCHILD) {
1319 q->p_flag &= ~P_STATCHILD;
1320 error = 0;
1321 } else
1322 error = msleep(q, &q->p_mtx, PWAIT | PCATCH, "wait", 0);
1323 PROC_UNLOCK(q);
1324 if (error)
1325 return (error);
1326 goto loop;
1327}
1328
1329/*
1330 * Make process 'parent' the new parent of process 'child'.
1331 * Must be called with an exclusive hold of proctree lock.
1332 */
1333void
1334proc_reparent(struct proc *child, struct proc *parent)
1335{
1336
1337 sx_assert(&proctree_lock, SX_XLOCKED);
1338 PROC_LOCK_ASSERT(child, MA_OWNED);
1339 if (child->p_pptr == parent)
1340 return;
1341
1342 PROC_LOCK(child->p_pptr);
1343 sigqueue_take(child->p_ksi);
1344 PROC_UNLOCK(child->p_pptr);
1345 LIST_REMOVE(child, p_sibling);
1346 LIST_INSERT_HEAD(&parent->p_children, child, p_sibling);
1347
1348 clear_orphan(child);
1349 if (child->p_flag & P_TRACED) {
1350 if (LIST_EMPTY(&child->p_pptr->p_orphans)) {
1351 child->p_treeflag |= P_TREE_FIRST_ORPHAN;
1352 LIST_INSERT_HEAD(&child->p_pptr->p_orphans, child,
1353 p_orphan);
1354 } else {
1355 LIST_INSERT_AFTER(LIST_FIRST(&child->p_pptr->p_orphans),
1356 child, p_orphan);
1357 }
1358 child->p_treeflag |= P_TREE_ORPHANED;
1359 }
1360
1361 child->p_pptr = parent;
1362}
|