Root/kernel/fork.c

1/*
2 * linux/kernel/fork.c
3 *
4 * Copyright (C) 1991, 1992 Linus Torvalds
5 */
6
7/*
8 * 'fork.c' contains the help-routines for the 'fork' system call
9 * (see also entry.S and others).
10 * Fork is rather simple, once you get the hang of it, but the memory
11 * management can be a bitch. See 'mm/memory.c': 'copy_page_range()'
12 */
13
14#include <linux/slab.h>
15#include <linux/init.h>
16#include <linux/unistd.h>
17#include <linux/module.h>
18#include <linux/vmalloc.h>
19#include <linux/completion.h>
20#include <linux/personality.h>
21#include <linux/mempolicy.h>
22#include <linux/sem.h>
23#include <linux/file.h>
24#include <linux/fdtable.h>
25#include <linux/iocontext.h>
26#include <linux/key.h>
27#include <linux/binfmts.h>
28#include <linux/mman.h>
29#include <linux/mmu_notifier.h>
30#include <linux/fs.h>
31#include <linux/nsproxy.h>
32#include <linux/capability.h>
33#include <linux/cpu.h>
34#include <linux/cgroup.h>
35#include <linux/security.h>
36#include <linux/hugetlb.h>
37#include <linux/swap.h>
38#include <linux/syscalls.h>
39#include <linux/jiffies.h>
40#include <linux/tracehook.h>
41#include <linux/futex.h>
42#include <linux/compat.h>
43#include <linux/task_io_accounting_ops.h>
44#include <linux/rcupdate.h>
45#include <linux/ptrace.h>
46#include <linux/mount.h>
47#include <linux/audit.h>
48#include <linux/memcontrol.h>
49#include <linux/ftrace.h>
50#include <linux/profile.h>
51#include <linux/rmap.h>
52#include <linux/ksm.h>
53#include <linux/acct.h>
54#include <linux/tsacct_kern.h>
55#include <linux/cn_proc.h>
56#include <linux/freezer.h>
57#include <linux/delayacct.h>
58#include <linux/taskstats_kern.h>
59#include <linux/random.h>
60#include <linux/tty.h>
61#include <linux/proc_fs.h>
62#include <linux/blkdev.h>
63#include <linux/fs_struct.h>
64#include <linux/magic.h>
65#include <linux/perf_event.h>
66#include <linux/posix-timers.h>
67
68#include <asm/pgtable.h>
69#include <asm/pgalloc.h>
70#include <asm/uaccess.h>
71#include <asm/mmu_context.h>
72#include <asm/cacheflush.h>
73#include <asm/tlbflush.h>
74
75#include <trace/events/sched.h>
76
77/*
78 * Protected counters by write_lock_irq(&tasklist_lock)
79 */
80unsigned long total_forks; /* Handle normal Linux uptimes. */
81int nr_threads; /* The idle threads do not count.. */
82
83int max_threads; /* tunable limit on nr_threads */
84
85DEFINE_PER_CPU(unsigned long, process_counts) = 0;
86
87__cacheline_aligned DEFINE_RWLOCK(tasklist_lock); /* outer */
88
89int nr_processes(void)
90{
91    int cpu;
92    int total = 0;
93
94    for_each_possible_cpu(cpu)
95        total += per_cpu(process_counts, cpu);
96
97    return total;
98}
99
100#ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
101# define alloc_task_struct() kmem_cache_alloc(task_struct_cachep, GFP_KERNEL)
102# define free_task_struct(tsk) kmem_cache_free(task_struct_cachep, (tsk))
103static struct kmem_cache *task_struct_cachep;
104#endif
105
106#ifndef __HAVE_ARCH_THREAD_INFO_ALLOCATOR
107static inline struct thread_info *alloc_thread_info(struct task_struct *tsk)
108{
109#ifdef CONFIG_DEBUG_STACK_USAGE
110    gfp_t mask = GFP_KERNEL | __GFP_ZERO;
111#else
112    gfp_t mask = GFP_KERNEL;
113#endif
114    return (struct thread_info *)__get_free_pages(mask, THREAD_SIZE_ORDER);
115}
116
117static inline void free_thread_info(struct thread_info *ti)
118{
119    free_pages((unsigned long)ti, THREAD_SIZE_ORDER);
120}
121#endif
122
123/* SLAB cache for signal_struct structures (tsk->signal) */
124static struct kmem_cache *signal_cachep;
125
126/* SLAB cache for sighand_struct structures (tsk->sighand) */
127struct kmem_cache *sighand_cachep;
128
129/* SLAB cache for files_struct structures (tsk->files) */
130struct kmem_cache *files_cachep;
131
132/* SLAB cache for fs_struct structures (tsk->fs) */
133struct kmem_cache *fs_cachep;
134
135/* SLAB cache for vm_area_struct structures */
136struct kmem_cache *vm_area_cachep;
137
138/* SLAB cache for mm_struct structures (tsk->mm) */
139static struct kmem_cache *mm_cachep;
140
141static void account_kernel_stack(struct thread_info *ti, int account)
142{
143    struct zone *zone = page_zone(virt_to_page(ti));
144
145    mod_zone_page_state(zone, NR_KERNEL_STACK, account);
146}
147
148void free_task(struct task_struct *tsk)
149{
150    prop_local_destroy_single(&tsk->dirties);
151    account_kernel_stack(tsk->stack, -1);
152    free_thread_info(tsk->stack);
153    rt_mutex_debug_task_free(tsk);
154    ftrace_graph_exit_task(tsk);
155    free_task_struct(tsk);
156}
157EXPORT_SYMBOL(free_task);
158
159void __put_task_struct(struct task_struct *tsk)
160{
161    WARN_ON(!tsk->exit_state);
162    WARN_ON(atomic_read(&tsk->usage));
163    WARN_ON(tsk == current);
164
165    exit_creds(tsk);
166    delayacct_tsk_free(tsk);
167
168    if (!profile_handoff_task(tsk))
169        free_task(tsk);
170}
171EXPORT_SYMBOL_GPL(__put_task_struct);
172
173/*
174 * macro override instead of weak attribute alias, to workaround
175 * gcc 4.1.0 and 4.1.1 bugs with weak attribute and empty functions.
176 */
177#ifndef arch_task_cache_init
178#define arch_task_cache_init()
179#endif
180
181void __init fork_init(unsigned long mempages)
182{
183#ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
184#ifndef ARCH_MIN_TASKALIGN
185#define ARCH_MIN_TASKALIGN L1_CACHE_BYTES
186#endif
187    /* create a slab on which task_structs can be allocated */
188    task_struct_cachep =
189        kmem_cache_create("task_struct", sizeof(struct task_struct),
190            ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
191#endif
192
193    /* do the arch specific task caches init */
194    arch_task_cache_init();
195
196    /*
197     * The default maximum number of threads is set to a safe
198     * value: the thread structures can take up at most half
199     * of memory.
200     */
201    max_threads = mempages / (8 * THREAD_SIZE / PAGE_SIZE);
202
203    /*
204     * we need to allow at least 20 threads to boot a system
205     */
206    if(max_threads < 20)
207        max_threads = 20;
208
209    init_task.signal->rlim[RLIMIT_NPROC].rlim_cur = max_threads/2;
210    init_task.signal->rlim[RLIMIT_NPROC].rlim_max = max_threads/2;
211    init_task.signal->rlim[RLIMIT_SIGPENDING] =
212        init_task.signal->rlim[RLIMIT_NPROC];
213}
214
215int __attribute__((weak)) arch_dup_task_struct(struct task_struct *dst,
216                           struct task_struct *src)
217{
218    *dst = *src;
219    return 0;
220}
221
222static struct task_struct *dup_task_struct(struct task_struct *orig)
223{
224    struct task_struct *tsk;
225    struct thread_info *ti;
226    unsigned long *stackend;
227
228    int err;
229
230    prepare_to_copy(orig);
231
232    tsk = alloc_task_struct();
233    if (!tsk)
234        return NULL;
235
236    ti = alloc_thread_info(tsk);
237    if (!ti) {
238        free_task_struct(tsk);
239        return NULL;
240    }
241
242     err = arch_dup_task_struct(tsk, orig);
243    if (err)
244        goto out;
245
246    tsk->stack = ti;
247
248    err = prop_local_init_single(&tsk->dirties);
249    if (err)
250        goto out;
251
252    setup_thread_stack(tsk, orig);
253    stackend = end_of_stack(tsk);
254    *stackend = STACK_END_MAGIC; /* for overflow detection */
255
256#ifdef CONFIG_CC_STACKPROTECTOR
257    tsk->stack_canary = get_random_int();
258#endif
259
260    /* One for us, one for whoever does the "release_task()" (usually parent) */
261    atomic_set(&tsk->usage,2);
262    atomic_set(&tsk->fs_excl, 0);
263#ifdef CONFIG_BLK_DEV_IO_TRACE
264    tsk->btrace_seq = 0;
265#endif
266    tsk->splice_pipe = NULL;
267
268    account_kernel_stack(ti, 1);
269
270    return tsk;
271
272out:
273    free_thread_info(ti);
274    free_task_struct(tsk);
275    return NULL;
276}
277
278#ifdef CONFIG_MMU
279static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
280{
281    struct vm_area_struct *mpnt, *tmp, **pprev;
282    struct rb_node **rb_link, *rb_parent;
283    int retval;
284    unsigned long charge;
285    struct mempolicy *pol;
286
287    down_write(&oldmm->mmap_sem);
288    flush_cache_dup_mm(oldmm);
289    /*
290     * Not linked in yet - no deadlock potential:
291     */
292    down_write_nested(&mm->mmap_sem, SINGLE_DEPTH_NESTING);
293
294    mm->locked_vm = 0;
295    mm->mmap = NULL;
296    mm->mmap_cache = NULL;
297    mm->free_area_cache = oldmm->mmap_base;
298    mm->cached_hole_size = ~0UL;
299    mm->map_count = 0;
300    cpumask_clear(mm_cpumask(mm));
301    mm->mm_rb = RB_ROOT;
302    rb_link = &mm->mm_rb.rb_node;
303    rb_parent = NULL;
304    pprev = &mm->mmap;
305    retval = ksm_fork(mm, oldmm);
306    if (retval)
307        goto out;
308
309    for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
310        struct file *file;
311
312        if (mpnt->vm_flags & VM_DONTCOPY) {
313            long pages = vma_pages(mpnt);
314            mm->total_vm -= pages;
315            vm_stat_account(mm, mpnt->vm_flags, mpnt->vm_file,
316                                -pages);
317            continue;
318        }
319        charge = 0;
320        if (mpnt->vm_flags & VM_ACCOUNT) {
321            unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
322            if (security_vm_enough_memory(len))
323                goto fail_nomem;
324            charge = len;
325        }
326        tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
327        if (!tmp)
328            goto fail_nomem;
329        *tmp = *mpnt;
330        pol = mpol_dup(vma_policy(mpnt));
331        retval = PTR_ERR(pol);
332        if (IS_ERR(pol))
333            goto fail_nomem_policy;
334        vma_set_policy(tmp, pol);
335        tmp->vm_flags &= ~VM_LOCKED;
336        tmp->vm_mm = mm;
337        tmp->vm_next = NULL;
338        anon_vma_link(tmp);
339        file = tmp->vm_file;
340        if (file) {
341            struct inode *inode = file->f_path.dentry->d_inode;
342            struct address_space *mapping = file->f_mapping;
343
344            get_file(file);
345            if (tmp->vm_flags & VM_DENYWRITE)
346                atomic_dec(&inode->i_writecount);
347            spin_lock(&mapping->i_mmap_lock);
348            if (tmp->vm_flags & VM_SHARED)
349                mapping->i_mmap_writable++;
350            tmp->vm_truncate_count = mpnt->vm_truncate_count;
351            flush_dcache_mmap_lock(mapping);
352            /* insert tmp into the share list, just after mpnt */
353            vma_prio_tree_add(tmp, mpnt);
354            flush_dcache_mmap_unlock(mapping);
355            spin_unlock(&mapping->i_mmap_lock);
356        }
357
358        /*
359         * Clear hugetlb-related page reserves for children. This only
360         * affects MAP_PRIVATE mappings. Faults generated by the child
361         * are not guaranteed to succeed, even if read-only
362         */
363        if (is_vm_hugetlb_page(tmp))
364            reset_vma_resv_huge_pages(tmp);
365
366        /*
367         * Link in the new vma and copy the page table entries.
368         */
369        *pprev = tmp;
370        pprev = &tmp->vm_next;
371
372        __vma_link_rb(mm, tmp, rb_link, rb_parent);
373        rb_link = &tmp->vm_rb.rb_right;
374        rb_parent = &tmp->vm_rb;
375
376        mm->map_count++;
377        retval = copy_page_range(mm, oldmm, mpnt);
378
379        if (tmp->vm_ops && tmp->vm_ops->open)
380            tmp->vm_ops->open(tmp);
381
382        if (retval)
383            goto out;
384    }
385    /* a new mm has just been created */
386    arch_dup_mmap(oldmm, mm);
387    retval = 0;
388out:
389    up_write(&mm->mmap_sem);
390    flush_tlb_mm(oldmm);
391    up_write(&oldmm->mmap_sem);
392    return retval;
393fail_nomem_policy:
394    kmem_cache_free(vm_area_cachep, tmp);
395fail_nomem:
396    retval = -ENOMEM;
397    vm_unacct_memory(charge);
398    goto out;
399}
400
401static inline int mm_alloc_pgd(struct mm_struct * mm)
402{
403    mm->pgd = pgd_alloc(mm);
404    if (unlikely(!mm->pgd))
405        return -ENOMEM;
406    return 0;
407}
408
409static inline void mm_free_pgd(struct mm_struct * mm)
410{
411    pgd_free(mm, mm->pgd);
412}
413#else
414#define dup_mmap(mm, oldmm) (0)
415#define mm_alloc_pgd(mm) (0)
416#define mm_free_pgd(mm)
417#endif /* CONFIG_MMU */
418
419__cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock);
420
421#define allocate_mm() (kmem_cache_alloc(mm_cachep, GFP_KERNEL))
422#define free_mm(mm) (kmem_cache_free(mm_cachep, (mm)))
423
424static unsigned long default_dump_filter = MMF_DUMP_FILTER_DEFAULT;
425
426static int __init coredump_filter_setup(char *s)
427{
428    default_dump_filter =
429        (simple_strtoul(s, NULL, 0) << MMF_DUMP_FILTER_SHIFT) &
430        MMF_DUMP_FILTER_MASK;
431    return 1;
432}
433
434__setup("coredump_filter=", coredump_filter_setup);
435
436#include <linux/init_task.h>
437
438static void mm_init_aio(struct mm_struct *mm)
439{
440#ifdef CONFIG_AIO
441    spin_lock_init(&mm->ioctx_lock);
442    INIT_HLIST_HEAD(&mm->ioctx_list);
443#endif
444}
445
446static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
447{
448    atomic_set(&mm->mm_users, 1);
449    atomic_set(&mm->mm_count, 1);
450    init_rwsem(&mm->mmap_sem);
451    INIT_LIST_HEAD(&mm->mmlist);
452    mm->flags = (current->mm) ?
453        (current->mm->flags & MMF_INIT_MASK) : default_dump_filter;
454    mm->core_state = NULL;
455    mm->nr_ptes = 0;
456    set_mm_counter(mm, file_rss, 0);
457    set_mm_counter(mm, anon_rss, 0);
458    spin_lock_init(&mm->page_table_lock);
459    mm->free_area_cache = TASK_UNMAPPED_BASE;
460    mm->cached_hole_size = ~0UL;
461    mm_init_aio(mm);
462    mm_init_owner(mm, p);
463
464    if (likely(!mm_alloc_pgd(mm))) {
465        mm->def_flags = 0;
466        mmu_notifier_mm_init(mm);
467        return mm;
468    }
469
470    free_mm(mm);
471    return NULL;
472}
473
474/*
475 * Allocate and initialize an mm_struct.
476 */
477struct mm_struct * mm_alloc(void)
478{
479    struct mm_struct * mm;
480
481    mm = allocate_mm();
482    if (mm) {
483        memset(mm, 0, sizeof(*mm));
484        mm = mm_init(mm, current);
485    }
486    return mm;
487}
488
489/*
490 * Called when the last reference to the mm
491 * is dropped: either by a lazy thread or by
492 * mmput. Free the page directory and the mm.
493 */
494void __mmdrop(struct mm_struct *mm)
495{
496    BUG_ON(mm == &init_mm);
497    mm_free_pgd(mm);
498    destroy_context(mm);
499    mmu_notifier_mm_destroy(mm);
500    free_mm(mm);
501}
502EXPORT_SYMBOL_GPL(__mmdrop);
503
504/*
505 * Decrement the use count and release all resources for an mm.
506 */
507void mmput(struct mm_struct *mm)
508{
509    might_sleep();
510
511    if (atomic_dec_and_test(&mm->mm_users)) {
512        exit_aio(mm);
513        ksm_exit(mm);
514        exit_mmap(mm);
515        set_mm_exe_file(mm, NULL);
516        if (!list_empty(&mm->mmlist)) {
517            spin_lock(&mmlist_lock);
518            list_del(&mm->mmlist);
519            spin_unlock(&mmlist_lock);
520        }
521        put_swap_token(mm);
522        if (mm->binfmt)
523            module_put(mm->binfmt->module);
524        mmdrop(mm);
525    }
526}
527EXPORT_SYMBOL_GPL(mmput);
528
529/**
530 * get_task_mm - acquire a reference to the task's mm
531 *
532 * Returns %NULL if the task has no mm. Checks PF_KTHREAD (meaning
533 * this kernel workthread has transiently adopted a user mm with use_mm,
534 * to do its AIO) is not set and if so returns a reference to it, after
535 * bumping up the use count. User must release the mm via mmput()
536 * after use. Typically used by /proc and ptrace.
537 */
538struct mm_struct *get_task_mm(struct task_struct *task)
539{
540    struct mm_struct *mm;
541
542    task_lock(task);
543    mm = task->mm;
544    if (mm) {
545        if (task->flags & PF_KTHREAD)
546            mm = NULL;
547        else
548            atomic_inc(&mm->mm_users);
549    }
550    task_unlock(task);
551    return mm;
552}
553EXPORT_SYMBOL_GPL(get_task_mm);
554
555/* Please note the differences between mmput and mm_release.
556 * mmput is called whenever we stop holding onto a mm_struct,
557 * error success whatever.
558 *
559 * mm_release is called after a mm_struct has been removed
560 * from the current process.
561 *
562 * This difference is important for error handling, when we
563 * only half set up a mm_struct for a new process and need to restore
564 * the old one. Because we mmput the new mm_struct before
565 * restoring the old one. . .
566 * Eric Biederman 10 January 1998
567 */
568void mm_release(struct task_struct *tsk, struct mm_struct *mm)
569{
570    struct completion *vfork_done = tsk->vfork_done;
571
572    /* Get rid of any futexes when releasing the mm */
573#ifdef CONFIG_FUTEX
574    if (unlikely(tsk->robust_list)) {
575        exit_robust_list(tsk);
576        tsk->robust_list = NULL;
577    }
578#ifdef CONFIG_COMPAT
579    if (unlikely(tsk->compat_robust_list)) {
580        compat_exit_robust_list(tsk);
581        tsk->compat_robust_list = NULL;
582    }
583#endif
584    if (unlikely(!list_empty(&tsk->pi_state_list)))
585        exit_pi_state_list(tsk);
586#endif
587
588    /* Get rid of any cached register state */
589    deactivate_mm(tsk, mm);
590
591    /* notify parent sleeping on vfork() */
592    if (vfork_done) {
593        tsk->vfork_done = NULL;
594        complete(vfork_done);
595    }
596
597    /*
598     * If we're exiting normally, clear a user-space tid field if
599     * requested. We leave this alone when dying by signal, to leave
600     * the value intact in a core dump, and to save the unnecessary
601     * trouble otherwise. Userland only wants this done for a sys_exit.
602     */
603    if (tsk->clear_child_tid) {
604        if (!(tsk->flags & PF_SIGNALED) &&
605            atomic_read(&mm->mm_users) > 1) {
606            /*
607             * We don't check the error code - if userspace has
608             * not set up a proper pointer then tough luck.
609             */
610            put_user(0, tsk->clear_child_tid);
611            sys_futex(tsk->clear_child_tid, FUTEX_WAKE,
612                    1, NULL, NULL, 0);
613        }
614        tsk->clear_child_tid = NULL;
615    }
616}
617
618/*
619 * Allocate a new mm structure and copy contents from the
620 * mm structure of the passed in task structure.
621 */
622struct mm_struct *dup_mm(struct task_struct *tsk)
623{
624    struct mm_struct *mm, *oldmm = current->mm;
625    int err;
626
627    if (!oldmm)
628        return NULL;
629
630    mm = allocate_mm();
631    if (!mm)
632        goto fail_nomem;
633
634    memcpy(mm, oldmm, sizeof(*mm));
635
636    /* Initializing for Swap token stuff */
637    mm->token_priority = 0;
638    mm->last_interval = 0;
639
640    if (!mm_init(mm, tsk))
641        goto fail_nomem;
642
643    if (init_new_context(tsk, mm))
644        goto fail_nocontext;
645
646    dup_mm_exe_file(oldmm, mm);
647
648    err = dup_mmap(mm, oldmm);
649    if (err)
650        goto free_pt;
651
652    mm->hiwater_rss = get_mm_rss(mm);
653    mm->hiwater_vm = mm->total_vm;
654
655    if (mm->binfmt && !try_module_get(mm->binfmt->module))
656        goto free_pt;
657
658    return mm;
659
660free_pt:
661    /* don't put binfmt in mmput, we haven't got module yet */
662    mm->binfmt = NULL;
663    mmput(mm);
664
665fail_nomem:
666    return NULL;
667
668fail_nocontext:
669    /*
670     * If init_new_context() failed, we cannot use mmput() to free the mm
671     * because it calls destroy_context()
672     */
673    mm_free_pgd(mm);
674    free_mm(mm);
675    return NULL;
676}
677
678static int copy_mm(unsigned long clone_flags, struct task_struct * tsk)
679{
680    struct mm_struct * mm, *oldmm;
681    int retval;
682
683    tsk->min_flt = tsk->maj_flt = 0;
684    tsk->nvcsw = tsk->nivcsw = 0;
685#ifdef CONFIG_DETECT_HUNG_TASK
686    tsk->last_switch_count = tsk->nvcsw + tsk->nivcsw;
687#endif
688
689    tsk->mm = NULL;
690    tsk->active_mm = NULL;
691
692    /*
693     * Are we cloning a kernel thread?
694     *
695     * We need to steal a active VM for that..
696     */
697    oldmm = current->mm;
698    if (!oldmm)
699        return 0;
700
701    if (clone_flags & CLONE_VM) {
702        atomic_inc(&oldmm->mm_users);
703        mm = oldmm;
704        goto good_mm;
705    }
706
707    retval = -ENOMEM;
708    mm = dup_mm(tsk);
709    if (!mm)
710        goto fail_nomem;
711
712good_mm:
713    /* Initializing for Swap token stuff */
714    mm->token_priority = 0;
715    mm->last_interval = 0;
716
717    tsk->mm = mm;
718    tsk->active_mm = mm;
719    return 0;
720
721fail_nomem:
722    return retval;
723}
724
725static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
726{
727    struct fs_struct *fs = current->fs;
728    if (clone_flags & CLONE_FS) {
729        /* tsk->fs is already what we want */
730        write_lock(&fs->lock);
731        if (fs->in_exec) {
732            write_unlock(&fs->lock);
733            return -EAGAIN;
734        }
735        fs->users++;
736        write_unlock(&fs->lock);
737        return 0;
738    }
739    tsk->fs = copy_fs_struct(fs);
740    if (!tsk->fs)
741        return -ENOMEM;
742    return 0;
743}
744
745static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
746{
747    struct files_struct *oldf, *newf;
748    int error = 0;
749
750    /*
751     * A background process may not have any files ...
752     */
753    oldf = current->files;
754    if (!oldf)
755        goto out;
756
757    if (clone_flags & CLONE_FILES) {
758        atomic_inc(&oldf->count);
759        goto out;
760    }
761
762    newf = dup_fd(oldf, &error);
763    if (!newf)
764        goto out;
765
766    tsk->files = newf;
767    error = 0;
768out:
769    return error;
770}
771
772static int copy_io(unsigned long clone_flags, struct task_struct *tsk)
773{
774#ifdef CONFIG_BLOCK
775    struct io_context *ioc = current->io_context;
776
777    if (!ioc)
778        return 0;
779    /*
780     * Share io context with parent, if CLONE_IO is set
781     */
782    if (clone_flags & CLONE_IO) {
783        tsk->io_context = ioc_task_link(ioc);
784        if (unlikely(!tsk->io_context))
785            return -ENOMEM;
786    } else if (ioprio_valid(ioc->ioprio)) {
787        tsk->io_context = alloc_io_context(GFP_KERNEL, -1);
788        if (unlikely(!tsk->io_context))
789            return -ENOMEM;
790
791        tsk->io_context->ioprio = ioc->ioprio;
792    }
793#endif
794    return 0;
795}
796
797static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
798{
799    struct sighand_struct *sig;
800
801    if (clone_flags & CLONE_SIGHAND) {
802        atomic_inc(&current->sighand->count);
803        return 0;
804    }
805    sig = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
806    rcu_assign_pointer(tsk->sighand, sig);
807    if (!sig)
808        return -ENOMEM;
809    atomic_set(&sig->count, 1);
810    memcpy(sig->action, current->sighand->action, sizeof(sig->action));
811    return 0;
812}
813
814void __cleanup_sighand(struct sighand_struct *sighand)
815{
816    if (atomic_dec_and_test(&sighand->count))
817        kmem_cache_free(sighand_cachep, sighand);
818}
819
820
821/*
822 * Initialize POSIX timer handling for a thread group.
823 */
824static void posix_cpu_timers_init_group(struct signal_struct *sig)
825{
826    /* Thread group counters. */
827    thread_group_cputime_init(sig);
828
829    /* Expiration times and increments. */
830    sig->it[CPUCLOCK_PROF].expires = cputime_zero;
831    sig->it[CPUCLOCK_PROF].incr = cputime_zero;
832    sig->it[CPUCLOCK_VIRT].expires = cputime_zero;
833    sig->it[CPUCLOCK_VIRT].incr = cputime_zero;
834
835    /* Cached expiration times. */
836    sig->cputime_expires.prof_exp = cputime_zero;
837    sig->cputime_expires.virt_exp = cputime_zero;
838    sig->cputime_expires.sched_exp = 0;
839
840    if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
841        sig->cputime_expires.prof_exp =
842            secs_to_cputime(sig->rlim[RLIMIT_CPU].rlim_cur);
843        sig->cputimer.running = 1;
844    }
845
846    /* The timer lists. */
847    INIT_LIST_HEAD(&sig->cpu_timers[0]);
848    INIT_LIST_HEAD(&sig->cpu_timers[1]);
849    INIT_LIST_HEAD(&sig->cpu_timers[2]);
850}
851
852static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
853{
854    struct signal_struct *sig;
855
856    if (clone_flags & CLONE_THREAD)
857        return 0;
858
859    sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
860    tsk->signal = sig;
861    if (!sig)
862        return -ENOMEM;
863
864    atomic_set(&sig->count, 1);
865    atomic_set(&sig->live, 1);
866    init_waitqueue_head(&sig->wait_chldexit);
867    sig->flags = 0;
868    if (clone_flags & CLONE_NEWPID)
869        sig->flags |= SIGNAL_UNKILLABLE;
870    sig->group_exit_code = 0;
871    sig->group_exit_task = NULL;
872    sig->group_stop_count = 0;
873    sig->curr_target = tsk;
874    init_sigpending(&sig->shared_pending);
875    INIT_LIST_HEAD(&sig->posix_timers);
876
877    hrtimer_init(&sig->real_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
878    sig->it_real_incr.tv64 = 0;
879    sig->real_timer.function = it_real_fn;
880
881    sig->leader = 0; /* session leadership doesn't inherit */
882    sig->tty_old_pgrp = NULL;
883    sig->tty = NULL;
884
885    sig->utime = sig->stime = sig->cutime = sig->cstime = cputime_zero;
886    sig->gtime = cputime_zero;
887    sig->cgtime = cputime_zero;
888    sig->nvcsw = sig->nivcsw = sig->cnvcsw = sig->cnivcsw = 0;
889    sig->min_flt = sig->maj_flt = sig->cmin_flt = sig->cmaj_flt = 0;
890    sig->inblock = sig->oublock = sig->cinblock = sig->coublock = 0;
891    sig->maxrss = sig->cmaxrss = 0;
892    task_io_accounting_init(&sig->ioac);
893    sig->sum_sched_runtime = 0;
894    taskstats_tgid_init(sig);
895
896    task_lock(current->group_leader);
897    memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim);
898    task_unlock(current->group_leader);
899
900    posix_cpu_timers_init_group(sig);
901
902    acct_init_pacct(&sig->pacct);
903
904    tty_audit_fork(sig);
905
906    sig->oom_adj = current->signal->oom_adj;
907
908    return 0;
909}
910
911void __cleanup_signal(struct signal_struct *sig)
912{
913    thread_group_cputime_free(sig);
914    tty_kref_put(sig->tty);
915    kmem_cache_free(signal_cachep, sig);
916}
917
918static void copy_flags(unsigned long clone_flags, struct task_struct *p)
919{
920    unsigned long new_flags = p->flags;
921
922    new_flags &= ~PF_SUPERPRIV;
923    new_flags |= PF_FORKNOEXEC;
924    new_flags |= PF_STARTING;
925    p->flags = new_flags;
926    clear_freeze_flag(p);
927}
928
929SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
930{
931    current->clear_child_tid = tidptr;
932
933    return task_pid_vnr(current);
934}
935
936static void rt_mutex_init_task(struct task_struct *p)
937{
938    spin_lock_init(&p->pi_lock);
939#ifdef CONFIG_RT_MUTEXES
940    plist_head_init(&p->pi_waiters, &p->pi_lock);
941    p->pi_blocked_on = NULL;
942#endif
943}
944
945#ifdef CONFIG_MM_OWNER
946void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
947{
948    mm->owner = p;
949}
950#endif /* CONFIG_MM_OWNER */
951
952/*
953 * Initialize POSIX timer handling for a single task.
954 */
955static void posix_cpu_timers_init(struct task_struct *tsk)
956{
957    tsk->cputime_expires.prof_exp = cputime_zero;
958    tsk->cputime_expires.virt_exp = cputime_zero;
959    tsk->cputime_expires.sched_exp = 0;
960    INIT_LIST_HEAD(&tsk->cpu_timers[0]);
961    INIT_LIST_HEAD(&tsk->cpu_timers[1]);
962    INIT_LIST_HEAD(&tsk->cpu_timers[2]);
963}
964
965/*
966 * This creates a new process as a copy of the old one,
967 * but does not actually start it yet.
968 *
969 * It copies the registers, and all the appropriate
970 * parts of the process environment (as per the clone
971 * flags). The actual kick-off is left to the caller.
972 */
973static struct task_struct *copy_process(unsigned long clone_flags,
974                    unsigned long stack_start,
975                    struct pt_regs *regs,
976                    unsigned long stack_size,
977                    int __user *child_tidptr,
978                    struct pid *pid,
979                    int trace)
980{
981    int retval;
982    struct task_struct *p;
983    int cgroup_callbacks_done = 0;
984
985    if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
986        return ERR_PTR(-EINVAL);
987
988    /*
989     * Thread groups must share signals as well, and detached threads
990     * can only be started up within the thread group.
991     */
992    if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND))
993        return ERR_PTR(-EINVAL);
994
995    /*
996     * Shared signal handlers imply shared VM. By way of the above,
997     * thread groups also imply shared VM. Blocking this case allows
998     * for various simplifications in other code.
999     */
1000    if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM))
1001        return ERR_PTR(-EINVAL);
1002
1003    /*
1004     * Siblings of global init remain as zombies on exit since they are
1005     * not reaped by their parent (swapper). To solve this and to avoid
1006     * multi-rooted process trees, prevent global and container-inits
1007     * from creating siblings.
1008     */
1009    if ((clone_flags & CLONE_PARENT) &&
1010                current->signal->flags & SIGNAL_UNKILLABLE)
1011        return ERR_PTR(-EINVAL);
1012
1013    retval = security_task_create(clone_flags);
1014    if (retval)
1015        goto fork_out;
1016
1017    retval = -ENOMEM;
1018    p = dup_task_struct(current);
1019    if (!p)
1020        goto fork_out;
1021
1022    ftrace_graph_init_task(p);
1023
1024    rt_mutex_init_task(p);
1025
1026#ifdef CONFIG_PROVE_LOCKING
1027    DEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled);
1028    DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
1029#endif
1030    retval = -EAGAIN;
1031    if (atomic_read(&p->real_cred->user->processes) >=
1032            p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
1033        if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
1034            p->real_cred->user != INIT_USER)
1035            goto bad_fork_free;
1036    }
1037
1038    retval = copy_creds(p, clone_flags);
1039    if (retval < 0)
1040        goto bad_fork_free;
1041
1042    /*
1043     * If multiple threads are within copy_process(), then this check
1044     * triggers too late. This doesn't hurt, the check is only there
1045     * to stop root fork bombs.
1046     */
1047    retval = -EAGAIN;
1048    if (nr_threads >= max_threads)
1049        goto bad_fork_cleanup_count;
1050
1051    if (!try_module_get(task_thread_info(p)->exec_domain->module))
1052        goto bad_fork_cleanup_count;
1053
1054    p->did_exec = 0;
1055    delayacct_tsk_init(p); /* Must remain after dup_task_struct() */
1056    copy_flags(clone_flags, p);
1057    INIT_LIST_HEAD(&p->children);
1058    INIT_LIST_HEAD(&p->sibling);
1059    rcu_copy_process(p);
1060    p->vfork_done = NULL;
1061    spin_lock_init(&p->alloc_lock);
1062
1063    init_sigpending(&p->pending);
1064
1065    p->utime = cputime_zero;
1066    p->stime = cputime_zero;
1067    p->gtime = cputime_zero;
1068    p->utimescaled = cputime_zero;
1069    p->stimescaled = cputime_zero;
1070    p->prev_utime = cputime_zero;
1071    p->prev_stime = cputime_zero;
1072
1073    p->default_timer_slack_ns = current->timer_slack_ns;
1074
1075    task_io_accounting_init(&p->ioac);
1076    acct_clear_integrals(p);
1077
1078    posix_cpu_timers_init(p);
1079
1080    p->lock_depth = -1; /* -1 = no lock */
1081    do_posix_clock_monotonic_gettime(&p->start_time);
1082    p->real_start_time = p->start_time;
1083    monotonic_to_bootbased(&p->real_start_time);
1084    p->io_context = NULL;
1085    p->audit_context = NULL;
1086    cgroup_fork(p);
1087#ifdef CONFIG_NUMA
1088    p->mempolicy = mpol_dup(p->mempolicy);
1089     if (IS_ERR(p->mempolicy)) {
1090         retval = PTR_ERR(p->mempolicy);
1091         p->mempolicy = NULL;
1092         goto bad_fork_cleanup_cgroup;
1093     }
1094    mpol_fix_fork_child_flag(p);
1095#endif
1096#ifdef CONFIG_TRACE_IRQFLAGS
1097    p->irq_events = 0;
1098#ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW
1099    p->hardirqs_enabled = 1;
1100#else
1101    p->hardirqs_enabled = 0;
1102#endif
1103    p->hardirq_enable_ip = 0;
1104    p->hardirq_enable_event = 0;
1105    p->hardirq_disable_ip = _THIS_IP_;
1106    p->hardirq_disable_event = 0;
1107    p->softirqs_enabled = 1;
1108    p->softirq_enable_ip = _THIS_IP_;
1109    p->softirq_enable_event = 0;
1110    p->softirq_disable_ip = 0;
1111    p->softirq_disable_event = 0;
1112    p->hardirq_context = 0;
1113    p->softirq_context = 0;
1114#endif
1115#ifdef CONFIG_LOCKDEP
1116    p->lockdep_depth = 0; /* no locks held yet */
1117    p->curr_chain_key = 0;
1118    p->lockdep_recursion = 0;
1119#endif
1120
1121#ifdef CONFIG_DEBUG_MUTEXES
1122    p->blocked_on = NULL; /* not blocked yet */
1123#endif
1124
1125    p->bts = NULL;
1126
1127    p->stack_start = stack_start;
1128
1129    /* Perform scheduler related setup. Assign this task to a CPU. */
1130    sched_fork(p, clone_flags);
1131
1132    retval = perf_event_init_task(p);
1133    if (retval)
1134        goto bad_fork_cleanup_policy;
1135
1136    if ((retval = audit_alloc(p)))
1137        goto bad_fork_cleanup_policy;
1138    /* copy all the process information */
1139    if ((retval = copy_semundo(clone_flags, p)))
1140        goto bad_fork_cleanup_audit;
1141    if ((retval = copy_files(clone_flags, p)))
1142        goto bad_fork_cleanup_semundo;
1143    if ((retval = copy_fs(clone_flags, p)))
1144        goto bad_fork_cleanup_files;
1145    if ((retval = copy_sighand(clone_flags, p)))
1146        goto bad_fork_cleanup_fs;
1147    if ((retval = copy_signal(clone_flags, p)))
1148        goto bad_fork_cleanup_sighand;
1149    if ((retval = copy_mm(clone_flags, p)))
1150        goto bad_fork_cleanup_signal;
1151    if ((retval = copy_namespaces(clone_flags, p)))
1152        goto bad_fork_cleanup_mm;
1153    if ((retval = copy_io(clone_flags, p)))
1154        goto bad_fork_cleanup_namespaces;
1155    retval = copy_thread(clone_flags, stack_start, stack_size, p, regs);
1156    if (retval)
1157        goto bad_fork_cleanup_io;
1158
1159    if (pid != &init_struct_pid) {
1160        retval = -ENOMEM;
1161        pid = alloc_pid(p->nsproxy->pid_ns);
1162        if (!pid)
1163            goto bad_fork_cleanup_io;
1164
1165        if (clone_flags & CLONE_NEWPID) {
1166            retval = pid_ns_prepare_proc(p->nsproxy->pid_ns);
1167            if (retval < 0)
1168                goto bad_fork_free_pid;
1169        }
1170    }
1171
1172    p->pid = pid_nr(pid);
1173    p->tgid = p->pid;
1174    if (clone_flags & CLONE_THREAD)
1175        p->tgid = current->tgid;
1176
1177    if (current->nsproxy != p->nsproxy) {
1178        retval = ns_cgroup_clone(p, pid);
1179        if (retval)
1180            goto bad_fork_free_pid;
1181    }
1182
1183    p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
1184    /*
1185     * Clear TID on mm_release()?
1186     */
1187    p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr: NULL;
1188#ifdef CONFIG_FUTEX
1189    p->robust_list = NULL;
1190#ifdef CONFIG_COMPAT
1191    p->compat_robust_list = NULL;
1192#endif
1193    INIT_LIST_HEAD(&p->pi_state_list);
1194    p->pi_state_cache = NULL;
1195#endif
1196    /*
1197     * sigaltstack should be cleared when sharing the same VM
1198     */
1199    if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM)
1200        p->sas_ss_sp = p->sas_ss_size = 0;
1201
1202    /*
1203     * Syscall tracing should be turned off in the child regardless
1204     * of CLONE_PTRACE.
1205     */
1206    clear_tsk_thread_flag(p, TIF_SYSCALL_TRACE);
1207#ifdef TIF_SYSCALL_EMU
1208    clear_tsk_thread_flag(p, TIF_SYSCALL_EMU);
1209#endif
1210    clear_all_latency_tracing(p);
1211
1212    /* ok, now we should be set up.. */
1213    p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
1214    p->pdeath_signal = 0;
1215    p->exit_state = 0;
1216
1217    /*
1218     * Ok, make it visible to the rest of the system.
1219     * We dont wake it up yet.
1220     */
1221    p->group_leader = p;
1222    INIT_LIST_HEAD(&p->thread_group);
1223
1224    /* Now that the task is set up, run cgroup callbacks if
1225     * necessary. We need to run them before the task is visible
1226     * on the tasklist. */
1227    cgroup_fork_callbacks(p);
1228    cgroup_callbacks_done = 1;
1229
1230    /* Need tasklist lock for parent etc handling! */
1231    write_lock_irq(&tasklist_lock);
1232
1233    /*
1234     * The task hasn't been attached yet, so its cpus_allowed mask will
1235     * not be changed, nor will its assigned CPU.
1236     *
1237     * The cpus_allowed mask of the parent may have changed after it was
1238     * copied first time - so re-copy it here, then check the child's CPU
1239     * to ensure it is on a valid CPU (and if not, just force it back to
1240     * parent's CPU). This avoids alot of nasty races.
1241     */
1242    p->cpus_allowed = current->cpus_allowed;
1243    p->rt.nr_cpus_allowed = current->rt.nr_cpus_allowed;
1244    if (unlikely(!cpu_isset(task_cpu(p), p->cpus_allowed) ||
1245            !cpu_online(task_cpu(p))))
1246        set_task_cpu(p, smp_processor_id());
1247
1248    /* CLONE_PARENT re-uses the old parent */
1249    if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
1250        p->real_parent = current->real_parent;
1251        p->parent_exec_id = current->parent_exec_id;
1252    } else {
1253        p->real_parent = current;
1254        p->parent_exec_id = current->self_exec_id;
1255    }
1256
1257    spin_lock(&current->sighand->siglock);
1258
1259    /*
1260     * Process group and session signals need to be delivered to just the
1261     * parent before the fork or both the parent and the child after the
1262     * fork. Restart if a signal comes in before we add the new process to
1263     * it's process group.
1264     * A fatal signal pending means that current will exit, so the new
1265     * thread can't slip out of an OOM kill (or normal SIGKILL).
1266      */
1267    recalc_sigpending();
1268    if (signal_pending(current)) {
1269        spin_unlock(&current->sighand->siglock);
1270        write_unlock_irq(&tasklist_lock);
1271        retval = -ERESTARTNOINTR;
1272        goto bad_fork_free_pid;
1273    }
1274
1275    if (clone_flags & CLONE_THREAD) {
1276        atomic_inc(&current->signal->count);
1277        atomic_inc(&current->signal->live);
1278        p->group_leader = current->group_leader;
1279        list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
1280    }
1281
1282    if (likely(p->pid)) {
1283        list_add_tail(&p->sibling, &p->real_parent->children);
1284        tracehook_finish_clone(p, clone_flags, trace);
1285
1286        if (thread_group_leader(p)) {
1287            if (clone_flags & CLONE_NEWPID)
1288                p->nsproxy->pid_ns->child_reaper = p;
1289
1290            p->signal->leader_pid = pid;
1291            tty_kref_put(p->signal->tty);
1292            p->signal->tty = tty_kref_get(current->signal->tty);
1293            attach_pid(p, PIDTYPE_PGID, task_pgrp(current));
1294            attach_pid(p, PIDTYPE_SID, task_session(current));
1295            list_add_tail_rcu(&p->tasks, &init_task.tasks);
1296            __get_cpu_var(process_counts)++;
1297        }
1298        attach_pid(p, PIDTYPE_PID, pid);
1299        nr_threads++;
1300    }
1301
1302    total_forks++;
1303    spin_unlock(&current->sighand->siglock);
1304    write_unlock_irq(&tasklist_lock);
1305    proc_fork_connector(p);
1306    cgroup_post_fork(p);
1307    perf_event_fork(p);
1308    return p;
1309
1310bad_fork_free_pid:
1311    if (pid != &init_struct_pid)
1312        free_pid(pid);
1313bad_fork_cleanup_io:
1314    put_io_context(p->io_context);
1315bad_fork_cleanup_namespaces:
1316    exit_task_namespaces(p);
1317bad_fork_cleanup_mm:
1318    if (p->mm)
1319        mmput(p->mm);
1320bad_fork_cleanup_signal:
1321    if (!(clone_flags & CLONE_THREAD))
1322        __cleanup_signal(p->signal);
1323bad_fork_cleanup_sighand:
1324    __cleanup_sighand(p->sighand);
1325bad_fork_cleanup_fs:
1326    exit_fs(p); /* blocking */
1327bad_fork_cleanup_files:
1328    exit_files(p); /* blocking */
1329bad_fork_cleanup_semundo:
1330    exit_sem(p);
1331bad_fork_cleanup_audit:
1332    audit_free(p);
1333bad_fork_cleanup_policy:
1334    perf_event_free_task(p);
1335#ifdef CONFIG_NUMA
1336    mpol_put(p->mempolicy);
1337bad_fork_cleanup_cgroup:
1338#endif
1339    cgroup_exit(p, cgroup_callbacks_done);
1340    delayacct_tsk_free(p);
1341    module_put(task_thread_info(p)->exec_domain->module);
1342bad_fork_cleanup_count:
1343    atomic_dec(&p->cred->user->processes);
1344    exit_creds(p);
1345bad_fork_free:
1346    free_task(p);
1347fork_out:
1348    return ERR_PTR(retval);
1349}
1350
1351noinline struct pt_regs * __cpuinit __attribute__((weak)) idle_regs(struct pt_regs *regs)
1352{
1353    memset(regs, 0, sizeof(struct pt_regs));
1354    return regs;
1355}
1356
1357struct task_struct * __cpuinit fork_idle(int cpu)
1358{
1359    struct task_struct *task;
1360    struct pt_regs regs;
1361
1362    task = copy_process(CLONE_VM, 0, idle_regs(&regs), 0, NULL,
1363                &init_struct_pid, 0);
1364    if (!IS_ERR(task))
1365        init_idle(task, cpu);
1366
1367    return task;
1368}
1369
1370/*
1371 * Ok, this is the main fork-routine.
1372 *
1373 * It copies the process, and if successful kick-starts
1374 * it and waits for it to finish using the VM if required.
1375 */
1376long do_fork(unsigned long clone_flags,
1377          unsigned long stack_start,
1378          struct pt_regs *regs,
1379          unsigned long stack_size,
1380          int __user *parent_tidptr,
1381          int __user *child_tidptr)
1382{
1383    struct task_struct *p;
1384    int trace = 0;
1385    long nr;
1386
1387    /*
1388     * Do some preliminary argument and permissions checking before we
1389     * actually start allocating stuff
1390     */
1391    if (clone_flags & CLONE_NEWUSER) {
1392        if (clone_flags & CLONE_THREAD)
1393            return -EINVAL;
1394        /* hopefully this check will go away when userns support is
1395         * complete
1396         */
1397        if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SETUID) ||
1398                !capable(CAP_SETGID))
1399            return -EPERM;
1400    }
1401
1402    /*
1403     * We hope to recycle these flags after 2.6.26
1404     */
1405    if (unlikely(clone_flags & CLONE_STOPPED)) {
1406        static int __read_mostly count = 100;
1407
1408        if (count > 0 && printk_ratelimit()) {
1409            char comm[TASK_COMM_LEN];
1410
1411            count--;
1412            printk(KERN_INFO "fork(): process `%s' used deprecated "
1413                    "clone flags 0x%lx\n",
1414                get_task_comm(comm, current),
1415                clone_flags & CLONE_STOPPED);
1416        }
1417    }
1418
1419    /*
1420     * When called from kernel_thread, don't do user tracing stuff.
1421     */
1422    if (likely(user_mode(regs)))
1423        trace = tracehook_prepare_clone(clone_flags);
1424
1425    p = copy_process(clone_flags, stack_start, regs, stack_size,
1426             child_tidptr, NULL, trace);
1427    /*
1428     * Do this prior waking up the new thread - the thread pointer
1429     * might get invalid after that point, if the thread exits quickly.
1430     */
1431    if (!IS_ERR(p)) {
1432        struct completion vfork;
1433
1434        trace_sched_process_fork(current, p);
1435
1436        nr = task_pid_vnr(p);
1437
1438        if (clone_flags & CLONE_PARENT_SETTID)
1439            put_user(nr, parent_tidptr);
1440
1441        if (clone_flags & CLONE_VFORK) {
1442            p->vfork_done = &vfork;
1443            init_completion(&vfork);
1444        }
1445
1446        audit_finish_fork(p);
1447        tracehook_report_clone(regs, clone_flags, nr, p);
1448
1449        /*
1450         * We set PF_STARTING at creation in case tracing wants to
1451         * use this to distinguish a fully live task from one that
1452         * hasn't gotten to tracehook_report_clone() yet. Now we
1453         * clear it and set the child going.
1454         */
1455        p->flags &= ~PF_STARTING;
1456
1457        if (unlikely(clone_flags & CLONE_STOPPED)) {
1458            /*
1459             * We'll start up with an immediate SIGSTOP.
1460             */
1461            sigaddset(&p->pending.signal, SIGSTOP);
1462            set_tsk_thread_flag(p, TIF_SIGPENDING);
1463            __set_task_state(p, TASK_STOPPED);
1464        } else {
1465            wake_up_new_task(p, clone_flags);
1466        }
1467
1468        tracehook_report_clone_complete(trace, regs,
1469                        clone_flags, nr, p);
1470
1471        if (clone_flags & CLONE_VFORK) {
1472            freezer_do_not_count();
1473            wait_for_completion(&vfork);
1474            freezer_count();
1475            tracehook_report_vfork_done(p, nr);
1476        }
1477    } else {
1478        nr = PTR_ERR(p);
1479    }
1480    return nr;
1481}
1482
1483#ifndef ARCH_MIN_MMSTRUCT_ALIGN
1484#define ARCH_MIN_MMSTRUCT_ALIGN 0
1485#endif
1486
1487static void sighand_ctor(void *data)
1488{
1489    struct sighand_struct *sighand = data;
1490
1491    spin_lock_init(&sighand->siglock);
1492    init_waitqueue_head(&sighand->signalfd_wqh);
1493}
1494
1495void __init proc_caches_init(void)
1496{
1497    sighand_cachep = kmem_cache_create("sighand_cache",
1498            sizeof(struct sighand_struct), 0,
1499            SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_DESTROY_BY_RCU|
1500            SLAB_NOTRACK, sighand_ctor);
1501    signal_cachep = kmem_cache_create("signal_cache",
1502            sizeof(struct signal_struct), 0,
1503            SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
1504    files_cachep = kmem_cache_create("files_cache",
1505            sizeof(struct files_struct), 0,
1506            SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
1507    fs_cachep = kmem_cache_create("fs_cache",
1508            sizeof(struct fs_struct), 0,
1509            SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
1510    mm_cachep = kmem_cache_create("mm_struct",
1511            sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
1512            SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
1513    vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC);
1514    mmap_init();
1515}
1516
1517/*
1518 * Check constraints on flags passed to the unshare system call and
1519 * force unsharing of additional process context as appropriate.
1520 */
1521static void check_unshare_flags(unsigned long *flags_ptr)
1522{
1523    /*
1524     * If unsharing a thread from a thread group, must also
1525     * unshare vm.
1526     */
1527    if (*flags_ptr & CLONE_THREAD)
1528        *flags_ptr |= CLONE_VM;
1529
1530    /*
1531     * If unsharing vm, must also unshare signal handlers.
1532     */
1533    if (*flags_ptr & CLONE_VM)
1534        *flags_ptr |= CLONE_SIGHAND;
1535
1536    /*
1537     * If unsharing signal handlers and the task was created
1538     * using CLONE_THREAD, then must unshare the thread
1539     */
1540    if ((*flags_ptr & CLONE_SIGHAND) &&
1541        (atomic_read(&current->signal->count) > 1))
1542        *flags_ptr |= CLONE_THREAD;
1543
1544    /*
1545     * If unsharing namespace, must also unshare filesystem information.
1546     */
1547    if (*flags_ptr & CLONE_NEWNS)
1548        *flags_ptr |= CLONE_FS;
1549}
1550
1551/*
1552 * Unsharing of tasks created with CLONE_THREAD is not supported yet
1553 */
1554static int unshare_thread(unsigned long unshare_flags)
1555{
1556    if (unshare_flags & CLONE_THREAD)
1557        return -EINVAL;
1558
1559    return 0;
1560}
1561
1562/*
1563 * Unshare the filesystem structure if it is being shared
1564 */
1565static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
1566{
1567    struct fs_struct *fs = current->fs;
1568
1569    if (!(unshare_flags & CLONE_FS) || !fs)
1570        return 0;
1571
1572    /* don't need lock here; in the worst case we'll do useless copy */
1573    if (fs->users == 1)
1574        return 0;
1575
1576    *new_fsp = copy_fs_struct(fs);
1577    if (!*new_fsp)
1578        return -ENOMEM;
1579
1580    return 0;
1581}
1582
1583/*
1584 * Unsharing of sighand is not supported yet
1585 */
1586static int unshare_sighand(unsigned long unshare_flags, struct sighand_struct **new_sighp)
1587{
1588    struct sighand_struct *sigh = current->sighand;
1589
1590    if ((unshare_flags & CLONE_SIGHAND) && atomic_read(&sigh->count) > 1)
1591        return -EINVAL;
1592    else
1593        return 0;
1594}
1595
1596/*
1597 * Unshare vm if it is being shared
1598 */
1599static int unshare_vm(unsigned long unshare_flags, struct mm_struct **new_mmp)
1600{
1601    struct mm_struct *mm = current->mm;
1602
1603    if ((unshare_flags & CLONE_VM) &&
1604        (mm && atomic_read(&mm->mm_users) > 1)) {
1605        return -EINVAL;
1606    }
1607
1608    return 0;
1609}
1610
1611/*
1612 * Unshare file descriptor table if it is being shared
1613 */
1614static int unshare_fd(unsigned long unshare_flags, struct files_struct **new_fdp)
1615{
1616    struct files_struct *fd = current->files;
1617    int error = 0;
1618
1619    if ((unshare_flags & CLONE_FILES) &&
1620        (fd && atomic_read(&fd->count) > 1)) {
1621        *new_fdp = dup_fd(fd, &error);
1622        if (!*new_fdp)
1623            return error;
1624    }
1625
1626    return 0;
1627}
1628
1629/*
1630 * unshare allows a process to 'unshare' part of the process
1631 * context which was originally shared using clone. copy_*
1632 * functions used by do_fork() cannot be used here directly
1633 * because they modify an inactive task_struct that is being
1634 * constructed. Here we are modifying the current, active,
1635 * task_struct.
1636 */
1637SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
1638{
1639    int err = 0;
1640    struct fs_struct *fs, *new_fs = NULL;
1641    struct sighand_struct *new_sigh = NULL;
1642    struct mm_struct *mm, *new_mm = NULL, *active_mm = NULL;
1643    struct files_struct *fd, *new_fd = NULL;
1644    struct nsproxy *new_nsproxy = NULL;
1645    int do_sysvsem = 0;
1646
1647    check_unshare_flags(&unshare_flags);
1648
1649    /* Return -EINVAL for all unsupported flags */
1650    err = -EINVAL;
1651    if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
1652                CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
1653                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET))
1654        goto bad_unshare_out;
1655
1656    /*
1657     * CLONE_NEWIPC must also detach from the undolist: after switching
1658     * to a new ipc namespace, the semaphore arrays from the old
1659     * namespace are unreachable.
1660     */
1661    if (unshare_flags & (CLONE_NEWIPC|CLONE_SYSVSEM))
1662        do_sysvsem = 1;
1663    if ((err = unshare_thread(unshare_flags)))
1664        goto bad_unshare_out;
1665    if ((err = unshare_fs(unshare_flags, &new_fs)))
1666        goto bad_unshare_cleanup_thread;
1667    if ((err = unshare_sighand(unshare_flags, &new_sigh)))
1668        goto bad_unshare_cleanup_fs;
1669    if ((err = unshare_vm(unshare_flags, &new_mm)))
1670        goto bad_unshare_cleanup_sigh;
1671    if ((err = unshare_fd(unshare_flags, &new_fd)))
1672        goto bad_unshare_cleanup_vm;
1673    if ((err = unshare_nsproxy_namespaces(unshare_flags, &new_nsproxy,
1674            new_fs)))
1675        goto bad_unshare_cleanup_fd;
1676
1677    if (new_fs || new_mm || new_fd || do_sysvsem || new_nsproxy) {
1678        if (do_sysvsem) {
1679            /*
1680             * CLONE_SYSVSEM is equivalent to sys_exit().
1681             */
1682            exit_sem(current);
1683        }
1684
1685        if (new_nsproxy) {
1686            switch_task_namespaces(current, new_nsproxy);
1687            new_nsproxy = NULL;
1688        }
1689
1690        task_lock(current);
1691
1692        if (new_fs) {
1693            fs = current->fs;
1694            write_lock(&fs->lock);
1695            current->fs = new_fs;
1696            if (--fs->users)
1697                new_fs = NULL;
1698            else
1699                new_fs = fs;
1700            write_unlock(&fs->lock);
1701        }
1702
1703        if (new_mm) {
1704            mm = current->mm;
1705            active_mm = current->active_mm;
1706            current->mm = new_mm;
1707            current->active_mm = new_mm;
1708            activate_mm(active_mm, new_mm);
1709            new_mm = mm;
1710        }
1711
1712        if (new_fd) {
1713            fd = current->files;
1714            current->files = new_fd;
1715            new_fd = fd;
1716        }
1717
1718        task_unlock(current);
1719    }
1720
1721    if (new_nsproxy)
1722        put_nsproxy(new_nsproxy);
1723
1724bad_unshare_cleanup_fd:
1725    if (new_fd)
1726        put_files_struct(new_fd);
1727
1728bad_unshare_cleanup_vm:
1729    if (new_mm)
1730        mmput(new_mm);
1731
1732bad_unshare_cleanup_sigh:
1733    if (new_sigh)
1734        if (atomic_dec_and_test(&new_sigh->count))
1735            kmem_cache_free(sighand_cachep, new_sigh);
1736
1737bad_unshare_cleanup_fs:
1738    if (new_fs)
1739        free_fs_struct(new_fs);
1740
1741bad_unshare_cleanup_thread:
1742bad_unshare_out:
1743    return err;
1744}
1745
1746/*
1747 * Helper to unshare the files of the current task.
1748 * We don't want to expose copy_files internals to
1749 * the exec layer of the kernel.
1750 */
1751
1752int unshare_files(struct files_struct **displaced)
1753{
1754    struct task_struct *task = current;
1755    struct files_struct *copy = NULL;
1756    int error;
1757
1758    error = unshare_fd(CLONE_FILES, &copy);
1759    if (error || !copy) {
1760        *displaced = NULL;
1761        return error;
1762    }
1763    *displaced = task->files;
1764    task_lock(task);
1765    task->files = copy;
1766    task_unlock(task);
1767    return 0;
1768}
1769

Archive Download this file

Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master

Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9



interactive