// SPDX-License-Identifier: GPL-2.0-only

/*

* linux/kernel/exit.c

*

* Copyright (C) 1991, 1992 Linus Torvalds

*/

#include <linux/mm.h>

#include <linux/slab.h>

#include <linux/sched/autogroup.h>

#include <linux/sched/mm.h>

#include <linux/sched/stat.h>

#include <linux/sched/task.h>

#include <linux/sched/task_stack.h>

#include <linux/sched/cputime.h>

#include <linux/interrupt.h>

#include <linux/module.h>

#include <linux/capability.h>

#include <linux/completion.h>

#include <linux/personality.h>

#include <linux/tty.h>

#include <linux/iocontext.h>

#include <linux/key.h>

#include <linux/cpu.h>

#include <linux/acct.h>

#include <linux/tsacct_kern.h>

#include <linux/file.h>

#include <linux/freezer.h>

#include <linux/binfmts.h>

#include <linux/nsproxy.h>

#include <linux/pid_namespace.h>

#include <linux/ptrace.h>

#include <linux/profile.h>

#include <linux/mount.h>

#include <linux/proc_fs.h>

#include <linux/kthread.h>

#include <linux/mempolicy.h>

#include <linux/taskstats_kern.h>

#include <linux/delayacct.h>

#include <linux/cgroup.h>

#include <linux/syscalls.h>

#include <linux/signal.h>

#include <linux/posix-timers.h>

#include <linux/cn_proc.h>

#include <linux/mutex.h>

#include <linux/futex.h>

#include <linux/pipe_fs_i.h>

#include <linux/audit.h> /* for audit_free() */

#include <linux/resource.h>

#include <linux/task_io_accounting_ops.h>

#include <linux/blkdev.h>

#include <linux/task_work.h>

#include <linux/fs_struct.h>

#include <linux/init_task.h>

#include <linux/perf_event.h>

#include <trace/events/sched.h>

#include <linux/hw_breakpoint.h>

#include <linux/oom.h>

#include <linux/writeback.h>

#include <linux/shm.h>

#include <linux/kcov.h>

#include <linux/kmsan.h>

#include <linux/random.h>

#include <linux/rcuwait.h>

#include <linux/compat.h>

#include <linux/io_uring.h>

#include <linux/kprobes.h>

#include <linux/rethook.h>

#include <linux/sysfs.h>

#include <linux/user_events.h>

#include <linux/unwind_deferred.h>

#include <linux/uaccess.h>

#include <linux/pidfs.h>

#include <uapi/linux/wait.h>

#include <asm/unistd.h>

#include <asm/mmu_context.h>

#include "exit.h"

/*

* The default value should be high enough to not crash a system that randomly

* crashes its kernel from time to time, but low enough to at least not permit

* overflowing 32-bit refcounts or the ldsem writer count.

*/

static unsigned int oops_limit = 10000;

#ifdef CONFIG_SYSCTL

static const struct ctl_table kern_exit_table[] = {

{

.procname = "oops_limit",

.data = &oops_limit,

.maxlen = sizeof(oops_limit),

.mode = 0644,

.proc_handler = proc_douintvec,

},

};

static __init int kernel_exit_sysctls_init(void)

{

register_sysctl_init("kernel", kern_exit_table);

return 0;

}

late_initcall(kernel_exit_sysctls_init);

#endif

static atomic_t oops_count = ATOMIC_INIT(0);

#ifdef CONFIG_SYSFS

static ssize_t oops_count_show(struct kobject *kobj, struct kobj_attribute *attr,

char *page)

{

return sysfs_emit(page, "%d\n", atomic_read(&oops_count));

}

static struct kobj_attribute oops_count_attr = __ATTR_RO(oops_count);

static __init int kernel_exit_sysfs_init(void)

{

sysfs_add_file_to_group(kernel_kobj, &oops_count_attr.attr, NULL);

return 0;

}

late_initcall(kernel_exit_sysfs_init);

#endif

/*

* For things release_task() would like to do *after* tasklist_lock is released.

*/

struct release_task_post {

struct pid *pids[PIDTYPE_MAX];

};

static void __unhash_process(struct release_task_post *post, struct task_struct *p,

bool group_dead)

{

struct pid *pid = task_pid(p);

nr_threads--;

detach_pid(post->pids, p, PIDTYPE_PID);

wake_up_all(&pid->wait_pidfd);

if (group_dead) {

detach_pid(post->pids, p, PIDTYPE_TGID);

detach_pid(post->pids, p, PIDTYPE_PGID);

detach_pid(post->pids, p, PIDTYPE_SID);

list_del_rcu(&p->tasks);

list_del_init(&p->sibling);

__this_cpu_dec(process_counts);

}

list_del_rcu(&p->thread_node);

}

/*

* This function expects the tasklist_lock write-locked.

*/

static void __exit_signal(struct release_task_post *post, struct task_struct *tsk)

{

struct signal_struct *sig = tsk->signal;

bool group_dead = thread_group_leader(tsk);

struct sighand_struct *sighand;

struct tty_struct *tty;

u64 utime, stime;

sighand = rcu_dereference_check(tsk->sighand,

lockdep_tasklist_lock_is_held());

spin_lock(&sighand->siglock);

#ifdef CONFIG_POSIX_TIMERS

posix_cpu_timers_exit(tsk);

if (group_dead)

posix_cpu_timers_exit_group(tsk);

#endif

if (group_dead) {

tty = sig->tty;

sig->tty = NULL;

} else {

/*

* If there is any task waiting for the group exit

* then notify it:

*/

if (sig->notify_count > 0 && !--sig->notify_count)

wake_up_process(sig->group_exec_task);

if (tsk == sig->curr_target)

sig->curr_target = next_thread(tsk);

}

/*

* Accumulate here the counters for all threads as they die. We could

* skip the group leader because it is the last user of signal_struct,

* but we want to avoid the race with thread_group_cputime() which can

* see the empty ->thread_head list.

*/

task_cputime(tsk, &utime, &stime);

write_seqlock(&sig->stats_lock);

sig->utime += utime;

sig->stime += stime;

sig->gtime += task_gtime(tsk);

sig->min_flt += tsk->min_flt;

sig->maj_flt += tsk->maj_flt;

sig->nvcsw += tsk->nvcsw;

sig->nivcsw += tsk->nivcsw;

sig->inblock += task_io_get_inblock(tsk);

sig->oublock += task_io_get_oublock(tsk);

task_io_accounting_add(&sig->ioac, &tsk->ioac);

sig->sum_sched_runtime += tsk->se.sum_exec_runtime;

sig->nr_threads--;

__unhash_process(post, tsk, group_dead);

write_sequnlock(&sig->stats_lock);

tsk->sighand = NULL;

spin_unlock(&sighand->siglock);

__cleanup_sighand(sighand);

if (group_dead)

tty_kref_put(tty);

}

static void delayed_put_task_struct(struct rcu_head *rhp)

{

struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);

kprobe_flush_task(tsk);

rethook_flush_task(tsk);

perf_event_delayed_put(tsk);

trace_sched_process_free(tsk);

put_task_struct(tsk);

}

void put_task_struct_rcu_user(struct task_struct *task)

{

if (refcount_dec_and_test(&task->rcu_users))

call_rcu(&task->rcu, delayed_put_task_struct);

}

void __weak release_thread(struct task_struct *dead_task)

{

}

void release_task(struct task_struct *p)

{

struct release_task_post post;

struct task_struct *leader;

struct pid *thread_pid;

int zap_leader;

repeat:

memset(&post, 0, sizeof(post));

/* don't need to get the RCU readlock here - the process is dead and

* can't be modifying its own credentials. */

dec_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1);

pidfs_exit(p);

cgroup_task_release(p);

/* Retrieve @thread_pid before __unhash_process() may set it to NULL. */

thread_pid = task_pid(p);

write_lock_irq(&tasklist_lock);

ptrace_release_task(p);

__exit_signal(&post, p);

/*

* If we are the last non-leader member of the thread

* group, and the leader is zombie, then notify the

* group leader's parent process. (if it wants notification.)

*/

zap_leader = 0;

leader = p->group_leader;

if (leader != p && thread_group_empty(leader)

&& leader->exit_state == EXIT_ZOMBIE) {

/* for pidfs_exit() and do_notify_parent() */

if (leader->signal->flags & SIGNAL_GROUP_EXIT)

leader->exit_code = leader->signal->group_exit_code;

/*

* If we were the last child thread and the leader has

* exited already, and the leader's parent ignores SIGCHLD,

* then we are the one who should release the leader.

*/

zap_leader = do_notify_parent(leader, leader->exit_signal);

if (zap_leader)

leader->exit_state = EXIT_DEAD;

}

write_unlock_irq(&tasklist_lock);

/* @thread_pid can't go away until free_pids() below */

proc_flush_pid(thread_pid);

exit_cred_namespaces(p);

add_device_randomness(&p->se.sum_exec_runtime,

sizeof(p->se.sum_exec_runtime));

free_pids(post.pids);

release_thread(p);

/*

* This task was already removed from the process/thread/pid lists

* and lock_task_sighand(p) can't succeed. Nobody else can touch

* ->pending or, if group dead, signal->shared_pending. We can call

* flush_sigqueue() lockless.

*/

flush_sigqueue(&p->pending);

if (thread_group_leader(p))

flush_sigqueue(&p->signal->shared_pending);

put_task_struct_rcu_user(p);

p = leader;

if (unlikely(zap_leader))

goto repeat;

}

int rcuwait_wake_up(struct rcuwait *w)

{

int ret = 0;

struct task_struct *task;

rcu_read_lock();

/*

* Order condition vs @task, such that everything prior to the load

* of @task is visible. This is the condition as to why the user called

* rcuwait_wake() in the first place. Pairs with set_current_state()

* barrier (A) in rcuwait_wait_event().

*

* WAIT WAKE

* [S] tsk = current [S] cond = true

* MB (A) MB (B)

* [L] cond [L] tsk

*/

smp_mb(); /* (B) */

task = rcu_dereference(w->task);

if (task)

ret = wake_up_process(task);

rcu_read_unlock();

return ret;

}

EXPORT_SYMBOL_GPL(rcuwait_wake_up);

/*

* Determine if a process group is "orphaned", according to the POSIX

* definition in 2.2.2.52. Orphaned process groups are not to be affected

* by terminal-generated stop signals. Newly orphaned process groups are

* to receive a SIGHUP and a SIGCONT.

*

* "I ask you, have you ever known what it is to be an orphan?"

*/

static int will_become_orphaned_pgrp(struct pid *pgrp,

struct task_struct *ignored_task)

{

struct task_struct *p;

do_each_pid_task(pgrp, PIDTYPE_PGID, p) {

if ((p == ignored_task) ||

(p->exit_state && thread_group_empty(p)) ||

is_global_init(p->real_parent))

continue;

if (task_pgrp(p->real_parent) != pgrp &&

task_session(p->real_parent) == task_session(p))

return 0;

} while_each_pid_task(pgrp, PIDTYPE_PGID, p);

return 1;

}

int is_current_pgrp_orphaned(void)

{

int retval;

read_lock(&tasklist_lock);

retval = will_become_orphaned_pgrp(task_pgrp(current), NULL);

read_unlock(&tasklist_lock);

return retval;

}

static bool has_stopped_jobs(struct pid *pgrp)

{

struct task_struct *p;

do_each_pid_task(pgrp, PIDTYPE_PGID, p) {

if (p->signal->flags & SIGNAL_STOP_STOPPED)

return true;

} while_each_pid_task(pgrp, PIDTYPE_PGID, p);

return false;

}

/*

* Check to see if any process groups have become orphaned as

* a result of our exiting, and if they have any stopped jobs,

* send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2)

*/

static void

kill_orphaned_pgrp(struct task_struct *tsk, struct task_struct *parent)

{

struct pid *pgrp = task_pgrp(tsk);

struct task_struct *ignored_task = tsk;

if (!parent)

/* exit: our father is in a different pgrp than

* we are and we were the only connection outside.

*/

parent = tsk->real_parent;

else

/* reparent: our child is in a different pgrp than

* we are, and it was the only connection outside.

*/

ignored_task = NULL;

if (task_pgrp(parent) != pgrp &&

task_session(parent) == task_session(tsk) &&

will_become_orphaned_pgrp(pgrp, ignored_task) &&

has_stopped_jobs(pgrp)) {

__kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp);

__kill_pgrp_info(SIGCONT, SEND_SIG_PRIV, pgrp);

}

}

static void coredump_task_exit(struct task_struct *tsk,

struct core_state *core_state)

{

struct core_thread self;

self.task = tsk;

if (self.task->flags & PF_SIGNALED)

self.next = xchg(&core_state->dumper.next, &self);

else

self.task = NULL;

/*

* Implies mb(), the result of xchg() must be visible

* to core_state->dumper.

*/

if (atomic_dec_and_test(&core_state->nr_threads))

complete(&core_state->startup);

for (;;) {

set_current_state(TASK_IDLE|TASK_FREEZABLE);

if (!self.task) /* see coredump_finish() */

break;

schedule();

}

__set_current_state(TASK_RUNNING);

}

#ifdef CONFIG_MEMCG

/* drops tasklist_lock if succeeds */

static bool __try_to_set_owner(struct task_struct *tsk, struct mm_struct *mm)

{

bool ret = false;

task_lock(tsk);

if (likely(tsk->mm == mm)) {

/* tsk can't pass exit_mm/exec_mmap and exit */

read_unlock(&tasklist_lock);

WRITE_ONCE(mm->owner, tsk);

lru_gen_migrate_mm(mm);

ret = true;

}

task_unlock(tsk);

return ret;

}

static bool try_to_set_owner(struct task_struct *g, struct mm_struct *mm)

{

struct task_struct *t;

for_each_thread(g, t) {

struct mm_struct *t_mm = READ_ONCE(t->mm);

if (t_mm == mm) {

if (__try_to_set_owner(t, mm))

return true;

} else if (t_mm)

break;

}

return false;

}

/*

* A task is exiting. If it owned this mm, find a new owner for the mm.

*/

void mm_update_next_owner(struct mm_struct *mm)

{

struct task_struct *g, *p = current;

/*

* If the exiting or execing task is not the owner, it's

* someone else's problem.

*/

if (mm->owner != p)

return;

/*

* The current owner is exiting/execing and there are no other

* candidates. Do not leave the mm pointing to a possibly

* freed task structure.

*/

if (atomic_read(&mm->mm_users) <= 1) {

WRITE_ONCE(mm->owner, NULL);

return;

}

read_lock(&tasklist_lock);

/*

* Search in the children

*/

list_for_each_entry(g, &p->children, sibling) {

if (try_to_set_owner(g, mm))

goto ret;

}

/*

* Search in the siblings

*/

list_for_each_entry(g, &p->real_parent->children, sibling) {

if (try_to_set_owner(g, mm))

goto ret;

}

/*

* Search through everything else, we should not get here often.

*/

for_each_process(g) {

if (atomic_read(&mm->mm_users) <= 1)

break;

if (g->flags & PF_KTHREAD)

continue;

if (try_to_set_owner(g, mm))

goto ret;

}

read_unlock(&tasklist_lock);

/*

* We found no owner yet mm_users > 1: this implies that we are

* most likely racing with swapoff (try_to_unuse()) or /proc or

* ptrace or page migration (get_task_mm()). Mark owner as NULL.

*/

WRITE_ONCE(mm->owner, NULL);

ret:

return;

}

#endif /* CONFIG_MEMCG */

/*

* Turn us into a lazy TLB process if we

* aren't already..

*/

static void exit_mm(void)

{

struct mm_struct *mm = current->mm;

exit_mm_release(current, mm);

if (!mm)

return;

mmap_read_lock(mm);

mmgrab_lazy_tlb(mm);

BUG_ON(mm != current->active_mm);

/* more a memory barrier than a real lock */

task_lock(current);

/*

* When a thread stops operating on an address space, the loop

* in membarrier_private_expedited() may not observe that

* tsk->mm, and the loop in membarrier_global_expedited() may

* not observe a MEMBARRIER_STATE_GLOBAL_EXPEDITED

* rq->membarrier_state, so those would not issue an IPI.

* Membarrier requires a memory barrier after accessing

* user-space memory, before clearing tsk->mm or the

* rq->membarrier_state.

*/

smp_mb__after_spinlock();

local_irq_disable();

current->mm = NULL;

membarrier_update_current_mm(NULL);

enter_lazy_tlb(mm, current);

local_irq_enable();

task_unlock(current);

mmap_read_unlock(mm);

mm_update_next_owner(mm);

mmput(mm);

if (test_thread_flag(TIF_MEMDIE))

exit_oom_victim();

}

static struct task_struct *find_alive_thread(struct task_struct *p)

{

struct task_struct *t;

for_each_thread(p, t) {

if (!(t->flags & PF_EXITING))

return t;

}

return NULL;

}

static struct task_struct *find_child_reaper(struct task_struct *father,

struct list_head *dead)

__releases(&tasklist_lock)

__acquires(&tasklist_lock)

{

struct pid_namespace *pid_ns = task_active_pid_ns(father);

struct task_struct *reaper = pid_ns->child_reaper;

struct task_struct *p, *n;

if (likely(reaper != father))

return reaper;

reaper = find_alive_thread(father);

if (reaper) {

pid_ns->child_reaper = reaper;

return reaper;

}

write_unlock_irq(&tasklist_lock);

list_for_each_entry_safe(p, n, dead, ptrace_entry) {

list_del_init(&p->ptrace_entry);

release_task(p);

}

zap_pid_ns_processes(pid_ns);

write_lock_irq(&tasklist_lock);

return father;

}

/*

* When we die, we re-parent all our children, and try to:

* 1. give them to another thread in our thread group, if such a member exists

* 2. give it to the first ancestor process which prctl'd itself as a

* child_subreaper for its children (like a service manager)

* 3. give it to the init process (PID 1) in our pid namespace

*/

static struct task_struct *find_new_reaper(struct task_struct *father,

struct task_struct *child_reaper)

{

struct task_struct *thread, *reaper;

thread = find_alive_thread(father);

if (thread)

return thread;

if (father->signal->has_child_subreaper) {

unsigned int ns_level = task_pid(father)->level;

/*

* Find the first ->is_child_subreaper ancestor in our pid_ns.

* We can't check reaper != child_reaper to ensure we do not

* cross the namespaces, the exiting parent could be injected

* by setns() + fork().

* We check pid->level, this is slightly more efficient than

* task_active_pid_ns(reaper) != task_active_pid_ns(father).

*/

for (reaper = father->real_parent;

task_pid(reaper)->level == ns_level;

reaper = reaper->real_parent) {

if (reaper == &init_task)

break;

if (!reaper->signal->is_child_subreaper)

continue;

thread = find_alive_thread(reaper);

if (thread)

return thread;

}

}

return child_reaper;

}

/*

* Any that need to be release_task'd are put on the @dead list.

*/

static void reparent_leader(struct task_struct *father, struct task_struct *p,

struct list_head *dead)

{

if (unlikely(p->exit_state == EXIT_DEAD))

return;

/* We don't want people slaying init. */

p->exit_signal = SIGCHLD;

/* If it has exited notify the new parent about this child's death. */

if (!p->ptrace &&

p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {

if (do_notify_parent(p, p->exit_signal)) {

p->exit_state = EXIT_DEAD;

list_add(&p->ptrace_entry, dead);

}

}

kill_orphaned_pgrp(p, father);

}

/*

* Make init inherit all the child processes

*/

static void forget_original_parent(struct task_struct *father,

struct list_head *dead)

{

struct task_struct *p, *t, *reaper;

if (unlikely(!list_empty(&father->ptraced)))

exit_ptrace(father, dead);

/* Can drop and reacquire tasklist_lock */

reaper = find_child_reaper(father, dead);

if (list_empty(&father->children))

return;

reaper = find_new_reaper(father, reaper);

list_for_each_entry(p, &father->children, sibling) {

for_each_thread(p, t) {

RCU_INIT_POINTER(t->real_parent, reaper);

BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father));

if (likely(!t->ptrace))

t->parent = t->real_parent;

if (t->pdeath_signal)

group_send_sig_info(t->pdeath_signal,

SEND_SIG_NOINFO, t,

PIDTYPE_TGID);

}

/*

* If this is a threaded reparent there is no need to

* notify anyone anything has happened.

*/

if (!same_thread_group(reaper, father))

reparent_leader(father, p, dead);

}

list_splice_tail_init(&father->children, &reaper->children);

}

/*

* Send signals to all our closest relatives so that they know

* to properly mourn us..

*/

static void exit_notify(struct task_struct *tsk, int group_dead)

{

bool autoreap;

struct task_struct *p, *n;

LIST_HEAD(dead);

write_lock_irq(&tasklist_lock);

forget_original_parent(tsk, &dead);

if (group_dead)

kill_orphaned_pgrp(tsk->group_leader, NULL);

tsk->exit_state = EXIT_ZOMBIE;

if (unlikely(tsk->ptrace)) {

int sig = thread_group_leader(tsk) &&

thread_group_empty(tsk) &&

!ptrace_reparented(tsk) ?

tsk->exit_signal : SIGCHLD;

autoreap = do_notify_parent(tsk, sig);

} else if (thread_group_leader(tsk)) {

autoreap = thread_group_empty(tsk) &&

do_notify_parent(tsk, tsk->exit_signal);

} else {

autoreap = true;

/* untraced sub-thread */

do_notify_pidfd(tsk);

}

if (autoreap) {

tsk->exit_state = EXIT_DEAD;

list_add(&tsk->ptrace_entry, &dead);

}

/* mt-exec, de_thread() is waiting for group leader */

if (unlikely(tsk->signal->notify_count < 0))

wake_up_process(tsk->signal->group_exec_task);

write_unlock_irq(&tasklist_lock);

list_for_each_entry_safe(p, n, &dead, ptrace_entry) {

list_del_init(&p->ptrace_entry);

release_task(p);

}

}

#ifdef CONFIG_DEBUG_STACK_USAGE

#ifdef CONFIG_STACK_GROWSUP

unsigned long stack_not_used(struct task_struct *p)

{

unsigned long *n = end_of_stack(p);

do { /* Skip over canary */

n--;

} while (!*n);

return (unsigned long)end_of_stack(p) - (unsigned long)n;

}

#else /* !CONFIG_STACK_GROWSUP */

unsigned long stack_not_used(struct task_struct *p)

{

unsigned long *n = end_of_stack(p);

do { /* Skip over canary */

n++;

} while (!*n);

return (unsigned long)n - (unsigned long)end_of_stack(p);

}

#endif /* CONFIG_STACK_GROWSUP */

/* Count the maximum pages reached in kernel stacks */

static inline void kstack_histogram(unsigned long used_stack)

{

#ifdef CONFIG_VM_EVENT_COUNTERS

if (used_stack <= 1024)

count_vm_event(KSTACK_1K);

#if THREAD_SIZE > 1024

else if (used_stack <= 2048)

count_vm_event(KSTACK_2K);

#endif

#if THREAD_SIZE > 2048

else if (used_stack <= 4096)

count_vm_event(KSTACK_4K);

#endif

#if THREAD_SIZE > 4096

else if (used_stack <= 8192)

count_vm_event(KSTACK_8K);

#endif

#if THREAD_SIZE > 8192

else if (used_stack <= 16384)

count_vm_event(KSTACK_16K);

#endif

#if THREAD_SIZE > 16384

else if (used_stack <= 32768)

count_vm_event(KSTACK_32K);

#endif

#if THREAD_SIZE > 32768

else if (used_stack <= 65536)

count_vm_event(KSTACK_64K);

#endif

#if THREAD_SIZE > 65536

else

count_vm_event(KSTACK_REST);

#endif

#endif /* CONFIG_VM_EVENT_COUNTERS */

}

static void check_stack_usage(void)

{

static DEFINE_SPINLOCK(low_water_lock);

static int lowest_to_date = THREAD_SIZE;

unsigned long free;

free = stack_not_used(current);

kstack_histogram(THREAD_SIZE - free);

if (free >= lowest_to_date)

return;

spin_lock(&low_water_lock);

if (free < lowest_to_date) {

pr_info("%s (%d) used greatest stack depth: %lu bytes left\n",

current->comm, task_pid_nr(current), free);

lowest_to_date = free;

}

spin_unlock(&low_water_lock);

}

#else /* !CONFIG_DEBUG_STACK_USAGE */

static inline void check_stack_usage(void) {}

#endif /* CONFIG_DEBUG_STACK_USAGE */

static void synchronize_group_exit(struct task_struct *tsk, long code)

{

struct sighand_struct *sighand = tsk->sighand;

struct signal_struct *signal = tsk->signal;

struct core_state *core_state;

spin_lock_irq(&sighand->siglock);

signal->quick_threads--;

if ((signal->quick_threads == 0) &&

!(signal->flags & SIGNAL_GROUP_EXIT)) {

signal->flags = SIGNAL_GROUP_EXIT;

signal->group_exit_code = code;

signal->group_stop_count = 0;

}

/*

* Serialize with any possible pending coredump.

* We must hold siglock around checking core_state

* and setting PF_POSTCOREDUMP. The core-inducing thread

* will increment ->nr_threads for each thread in the

* group without PF_POSTCOREDUMP set.

*/

tsk->flags |= PF_POSTCOREDUMP;

core_state = signal->core_state;

spin_unlock_irq(&sighand->siglock);

if (unlikely(core_state))

coredump_task_exit(tsk, core_state);

}

void __noreturn do_exit(long code)

{

struct task_struct *tsk = current;

struct kthread *kthread;

int group_dead;

WARN_ON(irqs_disabled());

WARN_ON(tsk->plug);

kthread = tsk_is_kthread(tsk);

if (unlikely(kthread))

kthread_do_exit(kthread, code);

kcov_task_exit(tsk);

kmsan_task_exit(tsk);

synchronize_group_exit(tsk, code);

ptrace_event(PTRACE_EVENT_EXIT, code);

user_events_exit(tsk);

io_uring_files_cancel();

sched_mm_cid_exit(tsk);

exit_signals(tsk); /* sets PF_EXITING */

seccomp_filter_release(tsk);

acct_update_integrals(tsk);

group_dead = atomic_dec_and_test(&tsk->signal->live);

if (group_dead) {

/*

* If the last thread of global init has exited, panic

* immediately to get a useable coredump.

*/

if (unlikely(is_global_init(tsk)))

panic("Attempted to kill init! exitcode=0x%08x\n",

tsk->signal->group_exit_code ?: (int)code);

#ifdef CONFIG_POSIX_TIMERS

hrtimer_cancel(&tsk->signal->real_timer);

exit_itimers(tsk);

#endif

if (tsk->mm)

setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);

}

acct_collect(code, group_dead);

if (group_dead)

tty_audit_exit();

audit_free(tsk);

tsk->exit_code = code;

taskstats_exit(tsk, group_dead);

trace_sched_process_exit(tsk, group_dead);

/*

* Since sampling can touch ->mm, make sure to stop everything before we

* tear it down.

*

* Also flushes inherited counters to the parent - before the parent

* gets woken up by child-exit notifications.

*/

perf_event_exit_task(tsk);

/*

* PF_EXITING (above) ensures unwind_deferred_request() will no

* longer add new unwinds. While exit_mm() (below) will destroy the

* abaility to do unwinds. So flush any pending unwinds here.

*/

unwind_deferred_task_exit(tsk);

exit_mm();

if (group_dead)

acct_process();

exit_sem(tsk);

exit_shm(tsk);

exit_files(tsk);

exit_fs(tsk);

if (group_dead)

disassociate_ctty(1);

exit_nsproxy_namespaces(tsk);

exit_task_work(tsk);

exit_thread(tsk);

sched_autogroup_exit_task(tsk);

cgroup_task_exit(tsk);

/*

* FIXME: do that only when needed, using sched_exit tracepoint

*/

flush_ptrace_hw_breakpoint(tsk);

exit_tasks_rcu_start();

exit_notify(tsk, group_dead);

proc_exit_connector(tsk);

mpol_put_task_policy(tsk);

#ifdef CONFIG_FUTEX

if (unlikely(current->pi_state_cache))

kfree(current->pi_state_cache);

#endif

/*

* Make sure we are holding no locks:

*/

debug_check_no_locks_held();

if (tsk->io_context)