kern_exit.c revision 270089
1/*- 2 * Copyright (c) 1982, 1986, 1989, 1991, 1993 3 * The Regents of the University of California. All rights reserved. 4 * (c) UNIX System Laboratories, Inc. 5 * All or some portions of this file are derived from material licensed 6 * to the University of California by American Telephone and Telegraph 7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 8 * the permission of UNIX System Laboratories, Inc. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 4. Neither the name of the University nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * @(#)kern_exit.c 8.7 (Berkeley) 2/12/94 35 */ 36 37#include <sys/cdefs.h> 38__FBSDID("$FreeBSD: stable/10/sys/kern/kern_exit.c 270089 2014-08-17 07:05:30Z mjg $"); 39 40#include "opt_compat.h" 41#include "opt_kdtrace.h" 42#include "opt_ktrace.h" 43#include "opt_procdesc.h" 44 45#include <sys/param.h> 46#include <sys/systm.h> 47#include <sys/sysproto.h> 48#include <sys/capability.h> 49#include <sys/eventhandler.h> 50#include <sys/kernel.h> 51#include <sys/malloc.h> 52#include <sys/lock.h> 53#include <sys/mutex.h> 54#include <sys/proc.h> 55#include <sys/procdesc.h> 56#include <sys/pioctl.h> 57#include <sys/jail.h> 58#include <sys/tty.h> 59#include <sys/wait.h> 60#include <sys/vmmeter.h> 61#include <sys/vnode.h> 62#include <sys/racct.h> 63#include <sys/resourcevar.h> 64#include <sys/sbuf.h> 65#include <sys/signalvar.h> 66#include <sys/sched.h> 67#include <sys/sx.h> 68#include <sys/syscallsubr.h> 69#include <sys/syslog.h> 70#include <sys/ptrace.h> 71#include <sys/acct.h> /* for acct_process() function prototype */ 72#include <sys/filedesc.h> 73#include <sys/sdt.h> 74#include <sys/shm.h> 75#include <sys/sem.h> 76#ifdef KTRACE 77#include <sys/ktrace.h> 78#endif 79 80#include <security/audit/audit.h> 81#include <security/mac/mac_framework.h> 82 83#include <vm/vm.h> 84#include <vm/vm_extern.h> 85#include <vm/vm_param.h> 86#include <vm/pmap.h> 87#include <vm/vm_map.h> 88#include <vm/vm_page.h> 89#include <vm/uma.h> 90 91#ifdef KDTRACE_HOOKS 92#include <sys/dtrace_bsd.h> 93dtrace_execexit_func_t dtrace_fasttrap_exit; 94#endif 95 96SDT_PROVIDER_DECLARE(proc); 97SDT_PROBE_DEFINE1(proc, kernel, , exit, "int"); 98 99/* Hook for NFS teardown procedure. */ 100void (*nlminfo_release_p)(struct proc *p); 101 102static void 103clear_orphan(struct proc *p) 104{ 105 106 PROC_LOCK_ASSERT(p, MA_OWNED); 107 108 if (p->p_flag & P_ORPHAN) { 109 LIST_REMOVE(p, p_orphan); 110 p->p_flag &= ~P_ORPHAN; 111 } 112} 113 114/* 115 * exit -- death of process. 116 */ 117void 118sys_sys_exit(struct thread *td, struct sys_exit_args *uap) 119{ 120 121 exit1(td, W_EXITCODE(uap->rval, 0)); 122 /* NOTREACHED */ 123} 124 125/* 126 * Exit: deallocate address space and other resources, change proc state to 127 * zombie, and unlink proc from allproc and parent's lists. Save exit status 128 * and rusage for wait(). Check for child processes and orphan them. 129 */ 130void 131exit1(struct thread *td, int rv) 132{ 133 struct proc *p, *nq, *q; 134 struct vnode *vtmp; 135 struct vnode *ttyvp = NULL; 136 struct plimit *plim; 137 138 mtx_assert(&Giant, MA_NOTOWNED); 139 140 p = td->td_proc; 141 /* 142 * XXX in case we're rebooting we just let init die in order to 143 * work around an unsolved stack overflow seen very late during 144 * shutdown on sparc64 when the gmirror worker process exists. 145 */ 146 if (p == initproc && rebooting == 0) { 147 printf("init died (signal %d, exit %d)\n", 148 WTERMSIG(rv), WEXITSTATUS(rv)); 149 panic("Going nowhere without my init!"); 150 } 151 152 /* 153 * MUST abort all other threads before proceeding past here. 154 */ 155 PROC_LOCK(p); 156 while (p->p_flag & P_HADTHREADS) { 157 /* 158 * First check if some other thread got here before us. 159 * If so, act appropriately: exit or suspend. 160 */ 161 thread_suspend_check(0); 162 163 /* 164 * Kill off the other threads. This requires 165 * some co-operation from other parts of the kernel 166 * so it may not be instantaneous. With this state set 167 * any thread entering the kernel from userspace will 168 * thread_exit() in trap(). Any thread attempting to 169 * sleep will return immediately with EINTR or EWOULDBLOCK 170 * which will hopefully force them to back out to userland 171 * freeing resources as they go. Any thread attempting 172 * to return to userland will thread_exit() from userret(). 173 * thread_exit() will unsuspend us when the last of the 174 * other threads exits. 175 * If there is already a thread singler after resumption, 176 * calling thread_single will fail; in that case, we just 177 * re-check all suspension request, the thread should 178 * either be suspended there or exit. 179 */ 180 if (!thread_single(SINGLE_EXIT)) 181 break; 182 183 /* 184 * All other activity in this process is now stopped. 185 * Threading support has been turned off. 186 */ 187 } 188 KASSERT(p->p_numthreads == 1, 189 ("exit1: proc %p exiting with %d threads", p, p->p_numthreads)); 190 racct_sub(p, RACCT_NTHR, 1); 191 /* 192 * Wakeup anyone in procfs' PIOCWAIT. They should have a hold 193 * on our vmspace, so we should block below until they have 194 * released their reference to us. Note that if they have 195 * requested S_EXIT stops we will block here until they ack 196 * via PIOCCONT. 197 */ 198 _STOPEVENT(p, S_EXIT, rv); 199 200 /* 201 * Ignore any pending request to stop due to a stop signal. 202 * Once P_WEXIT is set, future requests will be ignored as 203 * well. 204 */ 205 p->p_flag &= ~P_STOPPED_SIG; 206 KASSERT(!P_SHOULDSTOP(p), ("exiting process is stopped")); 207 208 /* 209 * Note that we are exiting and do another wakeup of anyone in 210 * PIOCWAIT in case they aren't listening for S_EXIT stops or 211 * decided to wait again after we told them we are exiting. 212 */ 213 p->p_flag |= P_WEXIT; 214 wakeup(&p->p_stype); 215 216 /* 217 * Wait for any processes that have a hold on our vmspace to 218 * release their reference. 219 */ 220 while (p->p_lock > 0) 221 msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0); 222 223 p->p_xstat = rv; /* Let event handler change exit status */ 224 PROC_UNLOCK(p); 225 /* Drain the limit callout while we don't have the proc locked */ 226 callout_drain(&p->p_limco); 227 228#ifdef AUDIT 229 /* 230 * The Sun BSM exit token contains two components: an exit status as 231 * passed to exit(), and a return value to indicate what sort of exit 232 * it was. The exit status is WEXITSTATUS(rv), but it's not clear 233 * what the return value is. 234 */ 235 AUDIT_ARG_EXIT(WEXITSTATUS(rv), 0); 236 AUDIT_SYSCALL_EXIT(0, td); 237#endif 238 239 /* Are we a task leader? */ 240 if (p == p->p_leader) { 241 mtx_lock(&ppeers_lock); 242 q = p->p_peers; 243 while (q != NULL) { 244 PROC_LOCK(q); 245 kern_psignal(q, SIGKILL); 246 PROC_UNLOCK(q); 247 q = q->p_peers; 248 } 249 while (p->p_peers != NULL) 250 msleep(p, &ppeers_lock, PWAIT, "exit1", 0); 251 mtx_unlock(&ppeers_lock); 252 } 253 254 /* 255 * Check if any loadable modules need anything done at process exit. 256 * E.g. SYSV IPC stuff 257 * XXX what if one of these generates an error? 258 */ 259 EVENTHANDLER_INVOKE(process_exit, p); 260 261 /* 262 * If parent is waiting for us to exit or exec, 263 * P_PPWAIT is set; we will wakeup the parent below. 264 */ 265 PROC_LOCK(p); 266 rv = p->p_xstat; /* Event handler could change exit status */ 267 stopprofclock(p); 268 p->p_flag &= ~(P_TRACED | P_PPWAIT | P_PPTRACE); 269 270 /* 271 * Stop the real interval timer. If the handler is currently 272 * executing, prevent it from rearming itself and let it finish. 273 */ 274 if (timevalisset(&p->p_realtimer.it_value) && 275 callout_stop(&p->p_itcallout) == 0) { 276 timevalclear(&p->p_realtimer.it_interval); 277 msleep(&p->p_itcallout, &p->p_mtx, PWAIT, "ritwait", 0); 278 KASSERT(!timevalisset(&p->p_realtimer.it_value), 279 ("realtime timer is still armed")); 280 } 281 PROC_UNLOCK(p); 282 283 /* 284 * Reset any sigio structures pointing to us as a result of 285 * F_SETOWN with our pid. 286 */ 287 funsetownlst(&p->p_sigiolst); 288 289 /* 290 * If this process has an nlminfo data area (for lockd), release it 291 */ 292 if (nlminfo_release_p != NULL && p->p_nlminfo != NULL) 293 (*nlminfo_release_p)(p); 294 295 /* 296 * Close open files and release open-file table. 297 * This may block! 298 */ 299 fdescfree(td); 300 301 /* 302 * If this thread tickled GEOM, we need to wait for the giggling to 303 * stop before we return to userland 304 */ 305 if (td->td_pflags & TDP_GEOM) 306 g_waitidle(); 307 308 /* 309 * Remove ourself from our leader's peer list and wake our leader. 310 */ 311 mtx_lock(&ppeers_lock); 312 if (p->p_leader->p_peers) { 313 q = p->p_leader; 314 while (q->p_peers != p) 315 q = q->p_peers; 316 q->p_peers = p->p_peers; 317 wakeup(p->p_leader); 318 } 319 mtx_unlock(&ppeers_lock); 320 321 vmspace_exit(td); 322 323 sx_xlock(&proctree_lock); 324 if (SESS_LEADER(p)) { 325 struct session *sp = p->p_session; 326 struct tty *tp; 327 328 /* 329 * s_ttyp is not zero'd; we use this to indicate that 330 * the session once had a controlling terminal. (for 331 * logging and informational purposes) 332 */ 333 SESS_LOCK(sp); 334 ttyvp = sp->s_ttyvp; 335 tp = sp->s_ttyp; 336 sp->s_ttyvp = NULL; 337 sp->s_ttydp = NULL; 338 sp->s_leader = NULL; 339 SESS_UNLOCK(sp); 340 341 /* 342 * Signal foreground pgrp and revoke access to 343 * controlling terminal if it has not been revoked 344 * already. 345 * 346 * Because the TTY may have been revoked in the mean 347 * time and could already have a new session associated 348 * with it, make sure we don't send a SIGHUP to a 349 * foreground process group that does not belong to this 350 * session. 351 */ 352 353 if (tp != NULL) { 354 tty_lock(tp); 355 if (tp->t_session == sp) 356 tty_signal_pgrp(tp, SIGHUP); 357 tty_unlock(tp); 358 } 359 360 if (ttyvp != NULL) { 361 sx_xunlock(&proctree_lock); 362 if (vn_lock(ttyvp, LK_EXCLUSIVE) == 0) { 363 VOP_REVOKE(ttyvp, REVOKEALL); 364 VOP_UNLOCK(ttyvp, 0); 365 } 366 sx_xlock(&proctree_lock); 367 } 368 } 369 fixjobc(p, p->p_pgrp, 0); 370 sx_xunlock(&proctree_lock); 371 (void)acct_process(td); 372 373 /* Release the TTY now we've unlocked everything. */ 374 if (ttyvp != NULL) 375 vrele(ttyvp); 376#ifdef KTRACE 377 ktrprocexit(td); 378#endif 379 /* 380 * Release reference to text vnode 381 */ 382 if ((vtmp = p->p_textvp) != NULL) { 383 p->p_textvp = NULL; 384 vrele(vtmp); 385 } 386 387 /* 388 * Release our limits structure. 389 */ 390 plim = p->p_limit; 391 p->p_limit = NULL; 392 lim_free(plim); 393 394 tidhash_remove(td); 395 396 /* 397 * Remove proc from allproc queue and pidhash chain. 398 * Place onto zombproc. Unlink from parent's child list. 399 */ 400 sx_xlock(&allproc_lock); 401 LIST_REMOVE(p, p_list); 402 LIST_INSERT_HEAD(&zombproc, p, p_list); 403 LIST_REMOVE(p, p_hash); 404 sx_xunlock(&allproc_lock); 405 406 /* 407 * Call machine-dependent code to release any 408 * machine-dependent resources other than the address space. 409 * The address space is released by "vmspace_exitfree(p)" in 410 * vm_waitproc(). 411 */ 412 cpu_exit(td); 413 414 WITNESS_WARN(WARN_PANIC, NULL, "process (pid %d) exiting", p->p_pid); 415 416 /* 417 * Reparent all of our children to init. 418 */ 419 sx_xlock(&proctree_lock); 420 q = LIST_FIRST(&p->p_children); 421 if (q != NULL) /* only need this if any child is S_ZOMB */ 422 wakeup(initproc); 423 for (; q != NULL; q = nq) { 424 nq = LIST_NEXT(q, p_sibling); 425 PROC_LOCK(q); 426 proc_reparent(q, initproc); 427 q->p_sigparent = SIGCHLD; 428 /* 429 * Traced processes are killed 430 * since their existence means someone is screwing up. 431 */ 432 if (q->p_flag & P_TRACED) { 433 struct thread *temp; 434 435 /* 436 * Since q was found on our children list, the 437 * proc_reparent() call moved q to the orphan 438 * list due to present P_TRACED flag. Clear 439 * orphan link for q now while q is locked. 440 */ 441 clear_orphan(q); 442 q->p_flag &= ~(P_TRACED | P_STOPPED_TRACE); 443 FOREACH_THREAD_IN_PROC(q, temp) 444 temp->td_dbgflags &= ~TDB_SUSPEND; 445 kern_psignal(q, SIGKILL); 446 } 447 PROC_UNLOCK(q); 448 } 449 450 /* 451 * Also get rid of our orphans. 452 */ 453 while ((q = LIST_FIRST(&p->p_orphans)) != NULL) { 454 PROC_LOCK(q); 455 clear_orphan(q); 456 PROC_UNLOCK(q); 457 } 458 459 /* Save exit status. */ 460 PROC_LOCK(p); 461 p->p_xthread = td; 462 463 /* Tell the prison that we are gone. */ 464 prison_proc_free(p->p_ucred->cr_prison); 465 466#ifdef KDTRACE_HOOKS 467 /* 468 * Tell the DTrace fasttrap provider about the exit if it 469 * has declared an interest. 470 */ 471 if (dtrace_fasttrap_exit) 472 dtrace_fasttrap_exit(p); 473#endif 474 475 /* 476 * Notify interested parties of our demise. 477 */ 478 KNOTE_LOCKED(&p->p_klist, NOTE_EXIT); 479 480#ifdef KDTRACE_HOOKS 481 int reason = CLD_EXITED; 482 if (WCOREDUMP(rv)) 483 reason = CLD_DUMPED; 484 else if (WIFSIGNALED(rv)) 485 reason = CLD_KILLED; 486 SDT_PROBE(proc, kernel, , exit, reason, 0, 0, 0, 0); 487#endif 488 489 /* 490 * Just delete all entries in the p_klist. At this point we won't 491 * report any more events, and there are nasty race conditions that 492 * can beat us if we don't. 493 */ 494 knlist_clear(&p->p_klist, 1); 495 496 /* 497 * If this is a process with a descriptor, we may not need to deliver 498 * a signal to the parent. proctree_lock is held over 499 * procdesc_exit() to serialize concurrent calls to close() and 500 * exit(). 501 */ 502#ifdef PROCDESC 503 if (p->p_procdesc == NULL || procdesc_exit(p)) { 504#endif 505 /* 506 * Notify parent that we're gone. If parent has the 507 * PS_NOCLDWAIT flag set, or if the handler is set to SIG_IGN, 508 * notify process 1 instead (and hope it will handle this 509 * situation). 510 */ 511 PROC_LOCK(p->p_pptr); 512 mtx_lock(&p->p_pptr->p_sigacts->ps_mtx); 513 if (p->p_pptr->p_sigacts->ps_flag & 514 (PS_NOCLDWAIT | PS_CLDSIGIGN)) { 515 struct proc *pp; 516 517 mtx_unlock(&p->p_pptr->p_sigacts->ps_mtx); 518 pp = p->p_pptr; 519 PROC_UNLOCK(pp); 520 proc_reparent(p, initproc); 521 p->p_sigparent = SIGCHLD; 522 PROC_LOCK(p->p_pptr); 523 524 /* 525 * Notify parent, so in case he was wait(2)ing or 526 * executing waitpid(2) with our pid, he will 527 * continue. 528 */ 529 wakeup(pp); 530 } else 531 mtx_unlock(&p->p_pptr->p_sigacts->ps_mtx); 532 533 if (p->p_pptr == initproc) 534 kern_psignal(p->p_pptr, SIGCHLD); 535 else if (p->p_sigparent != 0) { 536 if (p->p_sigparent == SIGCHLD) 537 childproc_exited(p); 538 else /* LINUX thread */ 539 kern_psignal(p->p_pptr, p->p_sigparent); 540 } 541#ifdef PROCDESC 542 } else 543 PROC_LOCK(p->p_pptr); 544#endif 545 sx_xunlock(&proctree_lock); 546 547 /* 548 * The state PRS_ZOMBIE prevents other proesses from sending 549 * signal to the process, to avoid memory leak, we free memory 550 * for signal queue at the time when the state is set. 551 */ 552 sigqueue_flush(&p->p_sigqueue); 553 sigqueue_flush(&td->td_sigqueue); 554 555 /* 556 * We have to wait until after acquiring all locks before 557 * changing p_state. We need to avoid all possible context 558 * switches (including ones from blocking on a mutex) while 559 * marked as a zombie. We also have to set the zombie state 560 * before we release the parent process' proc lock to avoid 561 * a lost wakeup. So, we first call wakeup, then we grab the 562 * sched lock, update the state, and release the parent process' 563 * proc lock. 564 */ 565 wakeup(p->p_pptr); 566 cv_broadcast(&p->p_pwait); 567 sched_exit(p->p_pptr, td); 568 PROC_SLOCK(p); 569 p->p_state = PRS_ZOMBIE; 570 PROC_UNLOCK(p->p_pptr); 571 572 /* 573 * Hopefully no one will try to deliver a signal to the process this 574 * late in the game. 575 */ 576 knlist_destroy(&p->p_klist); 577 578 /* 579 * Save our children's rusage information in our exit rusage. 580 */ 581 ruadd(&p->p_ru, &p->p_rux, &p->p_stats->p_cru, &p->p_crux); 582 583 /* 584 * Make sure the scheduler takes this thread out of its tables etc. 585 * This will also release this thread's reference to the ucred. 586 * Other thread parts to release include pcb bits and such. 587 */ 588 thread_exit(); 589} 590 591 592#ifndef _SYS_SYSPROTO_H_ 593struct abort2_args { 594 char *why; 595 int nargs; 596 void **args; 597}; 598#endif 599 600int 601sys_abort2(struct thread *td, struct abort2_args *uap) 602{ 603 struct proc *p = td->td_proc; 604 struct sbuf *sb; 605 void *uargs[16]; 606 int error, i, sig; 607 608 /* 609 * Do it right now so we can log either proper call of abort2(), or 610 * note, that invalid argument was passed. 512 is big enough to 611 * handle 16 arguments' descriptions with additional comments. 612 */ 613 sb = sbuf_new(NULL, NULL, 512, SBUF_FIXEDLEN); 614 sbuf_clear(sb); 615 sbuf_printf(sb, "%s(pid %d uid %d) aborted: ", 616 p->p_comm, p->p_pid, td->td_ucred->cr_uid); 617 /* 618 * Since we can't return from abort2(), send SIGKILL in cases, where 619 * abort2() was called improperly 620 */ 621 sig = SIGKILL; 622 /* Prevent from DoSes from user-space. */ 623 if (uap->nargs < 0 || uap->nargs > 16) 624 goto out; 625 if (uap->nargs > 0) { 626 if (uap->args == NULL) 627 goto out; 628 error = copyin(uap->args, uargs, uap->nargs * sizeof(void *)); 629 if (error != 0) 630 goto out; 631 } 632 /* 633 * Limit size of 'reason' string to 128. Will fit even when 634 * maximal number of arguments was chosen to be logged. 635 */ 636 if (uap->why != NULL) { 637 error = sbuf_copyin(sb, uap->why, 128); 638 if (error < 0) 639 goto out; 640 } else { 641 sbuf_printf(sb, "(null)"); 642 } 643 if (uap->nargs > 0) { 644 sbuf_printf(sb, "("); 645 for (i = 0;i < uap->nargs; i++) 646 sbuf_printf(sb, "%s%p", i == 0 ? "" : ", ", uargs[i]); 647 sbuf_printf(sb, ")"); 648 } 649 /* 650 * Final stage: arguments were proper, string has been 651 * successfully copied from userspace, and copying pointers 652 * from user-space succeed. 653 */ 654 sig = SIGABRT; 655out: 656 if (sig == SIGKILL) { 657 sbuf_trim(sb); 658 sbuf_printf(sb, " (Reason text inaccessible)"); 659 } 660 sbuf_cat(sb, "\n"); 661 sbuf_finish(sb); 662 log(LOG_INFO, "%s", sbuf_data(sb)); 663 sbuf_delete(sb); 664 exit1(td, W_EXITCODE(0, sig)); 665 return (0); 666} 667 668 669#ifdef COMPAT_43 670/* 671 * The dirty work is handled by kern_wait(). 672 */ 673int 674owait(struct thread *td, struct owait_args *uap __unused) 675{ 676 int error, status; 677 678 error = kern_wait(td, WAIT_ANY, &status, 0, NULL); 679 if (error == 0) 680 td->td_retval[1] = status; 681 return (error); 682} 683#endif /* COMPAT_43 */ 684 685/* 686 * The dirty work is handled by kern_wait(). 687 */ 688int 689sys_wait4(struct thread *td, struct wait4_args *uap) 690{ 691 struct rusage ru, *rup; 692 int error, status; 693 694 if (uap->rusage != NULL) 695 rup = &ru; 696 else 697 rup = NULL; 698 error = kern_wait(td, uap->pid, &status, uap->options, rup); 699 if (uap->status != NULL && error == 0) 700 error = copyout(&status, uap->status, sizeof(status)); 701 if (uap->rusage != NULL && error == 0) 702 error = copyout(&ru, uap->rusage, sizeof(struct rusage)); 703 return (error); 704} 705 706int 707sys_wait6(struct thread *td, struct wait6_args *uap) 708{ 709 struct __wrusage wru, *wrup; 710 siginfo_t si, *sip; 711 idtype_t idtype; 712 id_t id; 713 int error, status; 714 715 idtype = uap->idtype; 716 id = uap->id; 717 718 if (uap->wrusage != NULL) 719 wrup = &wru; 720 else 721 wrup = NULL; 722 723 if (uap->info != NULL) { 724 sip = &si; 725 bzero(sip, sizeof(*sip)); 726 } else 727 sip = NULL; 728 729 /* 730 * We expect all callers of wait6() to know about WEXITED and 731 * WTRAPPED. 732 */ 733 error = kern_wait6(td, idtype, id, &status, uap->options, wrup, sip); 734 735 if (uap->status != NULL && error == 0) 736 error = copyout(&status, uap->status, sizeof(status)); 737 if (uap->wrusage != NULL && error == 0) 738 error = copyout(&wru, uap->wrusage, sizeof(wru)); 739 if (uap->info != NULL && error == 0) 740 error = copyout(&si, uap->info, sizeof(si)); 741 return (error); 742} 743 744/* 745 * Reap the remains of a zombie process and optionally return status and 746 * rusage. Asserts and will release both the proctree_lock and the process 747 * lock as part of its work. 748 */ 749void 750proc_reap(struct thread *td, struct proc *p, int *status, int options) 751{ 752 struct proc *q, *t; 753 754 sx_assert(&proctree_lock, SA_XLOCKED); 755 PROC_LOCK_ASSERT(p, MA_OWNED); 756 PROC_SLOCK_ASSERT(p, MA_OWNED); 757 KASSERT(p->p_state == PRS_ZOMBIE, ("proc_reap: !PRS_ZOMBIE")); 758 759 q = td->td_proc; 760 761 PROC_SUNLOCK(p); 762 td->td_retval[0] = p->p_pid; 763 if (status) 764 *status = p->p_xstat; /* convert to int */ 765 if (options & WNOWAIT) { 766 /* 767 * Only poll, returning the status. Caller does not wish to 768 * release the proc struct just yet. 769 */ 770 PROC_UNLOCK(p); 771 sx_xunlock(&proctree_lock); 772 return; 773 } 774 775 PROC_LOCK(q); 776 sigqueue_take(p->p_ksi); 777 PROC_UNLOCK(q); 778 PROC_UNLOCK(p); 779 780 /* 781 * If we got the child via a ptrace 'attach', we need to give it back 782 * to the old parent. 783 */ 784 if (p->p_oppid && (t = pfind(p->p_oppid)) != NULL) { 785 PROC_LOCK(p); 786 proc_reparent(p, t); 787 p->p_oppid = 0; 788 PROC_UNLOCK(p); 789 pksignal(t, SIGCHLD, p->p_ksi); 790 wakeup(t); 791 cv_broadcast(&p->p_pwait); 792 PROC_UNLOCK(t); 793 sx_xunlock(&proctree_lock); 794 return; 795 } 796 797 /* 798 * Remove other references to this process to ensure we have an 799 * exclusive reference. 800 */ 801 sx_xlock(&allproc_lock); 802 LIST_REMOVE(p, p_list); /* off zombproc */ 803 sx_xunlock(&allproc_lock); 804 LIST_REMOVE(p, p_sibling); 805 PROC_LOCK(p); 806 clear_orphan(p); 807 PROC_UNLOCK(p); 808 leavepgrp(p); 809#ifdef PROCDESC 810 if (p->p_procdesc != NULL) 811 procdesc_reap(p); 812#endif 813 sx_xunlock(&proctree_lock); 814 815 /* 816 * As a side effect of this lock, we know that all other writes to 817 * this proc are visible now, so no more locking is needed for p. 818 */ 819 PROC_LOCK(p); 820 p->p_xstat = 0; /* XXX: why? */ 821 PROC_UNLOCK(p); 822 PROC_LOCK(q); 823 ruadd(&q->p_stats->p_cru, &q->p_crux, &p->p_ru, &p->p_rux); 824 PROC_UNLOCK(q); 825 826 /* 827 * Decrement the count of procs running with this uid. 828 */ 829 (void)chgproccnt(p->p_ucred->cr_ruidinfo, -1, 0); 830 831 /* 832 * Destroy resource accounting information associated with the process. 833 */ 834#ifdef RACCT 835 PROC_LOCK(p); 836 racct_sub(p, RACCT_NPROC, 1); 837 PROC_UNLOCK(p); 838#endif 839 racct_proc_exit(p); 840 841 /* 842 * Free credentials, arguments, and sigacts. 843 */ 844 crfree(p->p_ucred); 845 p->p_ucred = NULL; 846 pargs_drop(p->p_args); 847 p->p_args = NULL; 848 sigacts_free(p->p_sigacts); 849 p->p_sigacts = NULL; 850 851 /* 852 * Do any thread-system specific cleanups. 853 */ 854 thread_wait(p); 855 856 /* 857 * Give vm and machine-dependent layer a chance to free anything that 858 * cpu_exit couldn't release while still running in process context. 859 */ 860 vm_waitproc(p); 861#ifdef MAC 862 mac_proc_destroy(p); 863#endif 864 KASSERT(FIRST_THREAD_IN_PROC(p), 865 ("proc_reap: no residual thread!")); 866 uma_zfree(proc_zone, p); 867 sx_xlock(&allproc_lock); 868 nprocs--; 869 sx_xunlock(&allproc_lock); 870} 871 872static int 873proc_to_reap(struct thread *td, struct proc *p, idtype_t idtype, id_t id, 874 int *status, int options, struct __wrusage *wrusage, siginfo_t *siginfo) 875{ 876 struct proc *q; 877 struct rusage *rup; 878 879 sx_assert(&proctree_lock, SA_XLOCKED); 880 881 q = td->td_proc; 882 PROC_LOCK(p); 883 884 switch (idtype) { 885 case P_ALL: 886 break; 887 case P_PID: 888 if (p->p_pid != (pid_t)id) { 889 PROC_UNLOCK(p); 890 return (0); 891 } 892 break; 893 case P_PGID: 894 if (p->p_pgid != (pid_t)id) { 895 PROC_UNLOCK(p); 896 return (0); 897 } 898 break; 899 case P_SID: 900 if (p->p_session->s_sid != (pid_t)id) { 901 PROC_UNLOCK(p); 902 return (0); 903 } 904 break; 905 case P_UID: 906 if (p->p_ucred->cr_uid != (uid_t)id) { 907 PROC_UNLOCK(p); 908 return (0); 909 } 910 break; 911 case P_GID: 912 if (p->p_ucred->cr_gid != (gid_t)id) { 913 PROC_UNLOCK(p); 914 return (0); 915 } 916 break; 917 case P_JAILID: 918 if (p->p_ucred->cr_prison->pr_id != (int)id) { 919 PROC_UNLOCK(p); 920 return (0); 921 } 922 break; 923 /* 924 * It seems that the thread structures get zeroed out 925 * at process exit. This makes it impossible to 926 * support P_SETID, P_CID or P_CPUID. 927 */ 928 default: 929 PROC_UNLOCK(p); 930 return (0); 931 } 932 933 if (p_canwait(td, p)) { 934 PROC_UNLOCK(p); 935 return (0); 936 } 937 938 if (((options & WEXITED) == 0) && (p->p_state == PRS_ZOMBIE)) { 939 PROC_UNLOCK(p); 940 return (0); 941 } 942 943 /* 944 * This special case handles a kthread spawned by linux_clone 945 * (see linux_misc.c). The linux_wait4 and linux_waitpid 946 * functions need to be able to distinguish between waiting 947 * on a process and waiting on a thread. It is a thread if 948 * p_sigparent is not SIGCHLD, and the WLINUXCLONE option 949 * signifies we want to wait for threads and not processes. 950 */ 951 if ((p->p_sigparent != SIGCHLD) ^ 952 ((options & WLINUXCLONE) != 0)) { 953 PROC_UNLOCK(p); 954 return (0); 955 } 956 957 PROC_SLOCK(p); 958 959 if (siginfo != NULL) { 960 bzero(siginfo, sizeof(*siginfo)); 961 siginfo->si_errno = 0; 962 963 /* 964 * SUSv4 requires that the si_signo value is always 965 * SIGCHLD. Obey it despite the rfork(2) interface 966 * allows to request other signal for child exit 967 * notification. 968 */ 969 siginfo->si_signo = SIGCHLD; 970 971 /* 972 * This is still a rough estimate. We will fix the 973 * cases TRAPPED, STOPPED, and CONTINUED later. 974 */ 975 if (WCOREDUMP(p->p_xstat)) { 976 siginfo->si_code = CLD_DUMPED; 977 siginfo->si_status = WTERMSIG(p->p_xstat); 978 } else if (WIFSIGNALED(p->p_xstat)) { 979 siginfo->si_code = CLD_KILLED; 980 siginfo->si_status = WTERMSIG(p->p_xstat); 981 } else { 982 siginfo->si_code = CLD_EXITED; 983 siginfo->si_status = WEXITSTATUS(p->p_xstat); 984 } 985 986 siginfo->si_pid = p->p_pid; 987 siginfo->si_uid = p->p_ucred->cr_uid; 988 989 /* 990 * The si_addr field would be useful additional 991 * detail, but apparently the PC value may be lost 992 * when we reach this point. bzero() above sets 993 * siginfo->si_addr to NULL. 994 */ 995 } 996 997 /* 998 * There should be no reason to limit resources usage info to 999 * exited processes only. A snapshot about any resources used 1000 * by a stopped process may be exactly what is needed. 1001 */ 1002 if (wrusage != NULL) { 1003 rup = &wrusage->wru_self; 1004 *rup = p->p_ru; 1005 calcru(p, &rup->ru_utime, &rup->ru_stime); 1006 1007 rup = &wrusage->wru_children; 1008 *rup = p->p_stats->p_cru; 1009 calccru(p, &rup->ru_utime, &rup->ru_stime); 1010 } 1011 1012 if (p->p_state == PRS_ZOMBIE) { 1013 proc_reap(td, p, status, options); 1014 return (-1); 1015 } 1016 PROC_SUNLOCK(p); 1017 PROC_UNLOCK(p); 1018 return (1); 1019} 1020 1021int 1022kern_wait(struct thread *td, pid_t pid, int *status, int options, 1023 struct rusage *rusage) 1024{ 1025 struct __wrusage wru, *wrup; 1026 idtype_t idtype; 1027 id_t id; 1028 int ret; 1029 1030 /* 1031 * Translate the special pid values into the (idtype, pid) 1032 * pair for kern_wait6. The WAIT_MYPGRP case is handled by 1033 * kern_wait6() on its own. 1034 */ 1035 if (pid == WAIT_ANY) { 1036 idtype = P_ALL; 1037 id = 0; 1038 } else if (pid < 0) { 1039 idtype = P_PGID; 1040 id = (id_t)-pid; 1041 } else { 1042 idtype = P_PID; 1043 id = (id_t)pid; 1044 } 1045 1046 if (rusage != NULL) 1047 wrup = &wru; 1048 else 1049 wrup = NULL; 1050 1051 /* 1052 * For backward compatibility we implicitly add flags WEXITED 1053 * and WTRAPPED here. 1054 */ 1055 options |= WEXITED | WTRAPPED; 1056 ret = kern_wait6(td, idtype, id, status, options, wrup, NULL); 1057 if (rusage != NULL) 1058 *rusage = wru.wru_self; 1059 return (ret); 1060} 1061 1062int 1063kern_wait6(struct thread *td, idtype_t idtype, id_t id, int *status, 1064 int options, struct __wrusage *wrusage, siginfo_t *siginfo) 1065{ 1066 struct proc *p, *q; 1067 int error, nfound, ret; 1068 1069 AUDIT_ARG_VALUE((int)idtype); /* XXX - This is likely wrong! */ 1070 AUDIT_ARG_PID((pid_t)id); /* XXX - This may be wrong! */ 1071 AUDIT_ARG_VALUE(options); 1072 1073 q = td->td_proc; 1074 1075 if ((pid_t)id == WAIT_MYPGRP && (idtype == P_PID || idtype == P_PGID)) { 1076 PROC_LOCK(q); 1077 id = (id_t)q->p_pgid; 1078 PROC_UNLOCK(q); 1079 idtype = P_PGID; 1080 } 1081 1082 /* If we don't know the option, just return. */ 1083 if ((options & ~(WUNTRACED | WNOHANG | WCONTINUED | WNOWAIT | 1084 WEXITED | WTRAPPED | WLINUXCLONE)) != 0) 1085 return (EINVAL); 1086 if ((options & (WEXITED | WUNTRACED | WCONTINUED | WTRAPPED)) == 0) { 1087 /* 1088 * We will be unable to find any matching processes, 1089 * because there are no known events to look for. 1090 * Prefer to return error instead of blocking 1091 * indefinitely. 1092 */ 1093 return (EINVAL); 1094 } 1095 1096loop: 1097 if (q->p_flag & P_STATCHILD) { 1098 PROC_LOCK(q); 1099 q->p_flag &= ~P_STATCHILD; 1100 PROC_UNLOCK(q); 1101 } 1102 nfound = 0; 1103 sx_xlock(&proctree_lock); 1104 LIST_FOREACH(p, &q->p_children, p_sibling) { 1105 ret = proc_to_reap(td, p, idtype, id, status, options, 1106 wrusage, siginfo); 1107 if (ret == 0) 1108 continue; 1109 else if (ret == 1) 1110 nfound++; 1111 else 1112 return (0); 1113 1114 PROC_LOCK(p); 1115 PROC_SLOCK(p); 1116 1117 if ((options & WTRAPPED) != 0 && 1118 (p->p_flag & P_TRACED) != 0 && 1119 (p->p_flag & (P_STOPPED_TRACE | P_STOPPED_SIG)) != 0 && 1120 (p->p_suspcount == p->p_numthreads) && 1121 ((p->p_flag & P_WAITED) == 0)) { 1122 PROC_SUNLOCK(p); 1123 if ((options & WNOWAIT) == 0) 1124 p->p_flag |= P_WAITED; 1125 sx_xunlock(&proctree_lock); 1126 td->td_retval[0] = p->p_pid; 1127 1128 if (status != NULL) 1129 *status = W_STOPCODE(p->p_xstat); 1130 if (siginfo != NULL) { 1131 siginfo->si_status = p->p_xstat; 1132 siginfo->si_code = CLD_TRAPPED; 1133 } 1134 if ((options & WNOWAIT) == 0) { 1135 PROC_LOCK(q); 1136 sigqueue_take(p->p_ksi); 1137 PROC_UNLOCK(q); 1138 } 1139 1140 PROC_UNLOCK(p); 1141 return (0); 1142 } 1143 if ((options & WUNTRACED) != 0 && 1144 (p->p_flag & P_STOPPED_SIG) != 0 && 1145 (p->p_suspcount == p->p_numthreads) && 1146 ((p->p_flag & P_WAITED) == 0)) { 1147 PROC_SUNLOCK(p); 1148 if ((options & WNOWAIT) == 0) 1149 p->p_flag |= P_WAITED; 1150 sx_xunlock(&proctree_lock); 1151 td->td_retval[0] = p->p_pid; 1152 1153 if (status != NULL) 1154 *status = W_STOPCODE(p->p_xstat); 1155 if (siginfo != NULL) { 1156 siginfo->si_status = p->p_xstat; 1157 siginfo->si_code = CLD_STOPPED; 1158 } 1159 if ((options & WNOWAIT) == 0) { 1160 PROC_LOCK(q); 1161 sigqueue_take(p->p_ksi); 1162 PROC_UNLOCK(q); 1163 } 1164 1165 PROC_UNLOCK(p); 1166 return (0); 1167 } 1168 PROC_SUNLOCK(p); 1169 if ((options & WCONTINUED) != 0 && 1170 (p->p_flag & P_CONTINUED) != 0) { 1171 sx_xunlock(&proctree_lock); 1172 td->td_retval[0] = p->p_pid; 1173 if ((options & WNOWAIT) == 0) { 1174 p->p_flag &= ~P_CONTINUED; 1175 PROC_LOCK(q); 1176 sigqueue_take(p->p_ksi); 1177 PROC_UNLOCK(q); 1178 } 1179 PROC_UNLOCK(p); 1180 1181 if (status != NULL) 1182 *status = SIGCONT; 1183 if (siginfo != NULL) { 1184 siginfo->si_status = SIGCONT; 1185 siginfo->si_code = CLD_CONTINUED; 1186 } 1187 return (0); 1188 } 1189 PROC_UNLOCK(p); 1190 } 1191 1192 /* 1193 * Look in the orphans list too, to allow the parent to 1194 * collect it's child exit status even if child is being 1195 * debugged. 1196 * 1197 * Debugger detaches from the parent upon successful 1198 * switch-over from parent to child. At this point due to 1199 * re-parenting the parent loses the child to debugger and a 1200 * wait4(2) call would report that it has no children to wait 1201 * for. By maintaining a list of orphans we allow the parent 1202 * to successfully wait until the child becomes a zombie. 1203 */ 1204 LIST_FOREACH(p, &q->p_orphans, p_orphan) { 1205 ret = proc_to_reap(td, p, idtype, id, status, options, 1206 wrusage, siginfo); 1207 if (ret == 0) 1208 continue; 1209 else if (ret == 1) 1210 nfound++; 1211 else 1212 return (0); 1213 } 1214 if (nfound == 0) { 1215 sx_xunlock(&proctree_lock); 1216 return (ECHILD); 1217 } 1218 if (options & WNOHANG) { 1219 sx_xunlock(&proctree_lock); 1220 td->td_retval[0] = 0; 1221 return (0); 1222 } 1223 PROC_LOCK(q); 1224 sx_xunlock(&proctree_lock); 1225 if (q->p_flag & P_STATCHILD) { 1226 q->p_flag &= ~P_STATCHILD; 1227 error = 0; 1228 } else 1229 error = msleep(q, &q->p_mtx, PWAIT | PCATCH, "wait", 0); 1230 PROC_UNLOCK(q); 1231 if (error) 1232 return (error); 1233 goto loop; 1234} 1235 1236/* 1237 * Make process 'parent' the new parent of process 'child'. 1238 * Must be called with an exclusive hold of proctree lock. 1239 */ 1240void 1241proc_reparent(struct proc *child, struct proc *parent) 1242{ 1243 1244 sx_assert(&proctree_lock, SX_XLOCKED); 1245 PROC_LOCK_ASSERT(child, MA_OWNED); 1246 if (child->p_pptr == parent) 1247 return; 1248 1249 PROC_LOCK(child->p_pptr); 1250 sigqueue_take(child->p_ksi); 1251 PROC_UNLOCK(child->p_pptr); 1252 LIST_REMOVE(child, p_sibling); 1253 LIST_INSERT_HEAD(&parent->p_children, child, p_sibling); 1254 1255 clear_orphan(child); 1256 if (child->p_flag & P_TRACED) { 1257 LIST_INSERT_HEAD(&child->p_pptr->p_orphans, child, p_orphan); 1258 child->p_flag |= P_ORPHAN; 1259 } 1260 1261 child->p_pptr = parent; 1262} 1263