xref: /openbmc/linux/kernel/fork.c (revision e368cd72)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  linux/kernel/fork.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  */
7 
8 /*
9  *  'fork.c' contains the help-routines for the 'fork' system call
10  * (see also entry.S and others).
11  * Fork is rather simple, once you get the hang of it, but the memory
12  * management can be a bitch. See 'mm/memory.c': 'copy_page_range()'
13  */
14 
15 #include <linux/anon_inodes.h>
16 #include <linux/slab.h>
17 #include <linux/sched/autogroup.h>
18 #include <linux/sched/mm.h>
19 #include <linux/sched/coredump.h>
20 #include <linux/sched/user.h>
21 #include <linux/sched/numa_balancing.h>
22 #include <linux/sched/stat.h>
23 #include <linux/sched/task.h>
24 #include <linux/sched/task_stack.h>
25 #include <linux/sched/cputime.h>
26 #include <linux/seq_file.h>
27 #include <linux/rtmutex.h>
28 #include <linux/init.h>
29 #include <linux/unistd.h>
30 #include <linux/module.h>
31 #include <linux/vmalloc.h>
32 #include <linux/completion.h>
33 #include <linux/personality.h>
34 #include <linux/mempolicy.h>
35 #include <linux/sem.h>
36 #include <linux/file.h>
37 #include <linux/fdtable.h>
38 #include <linux/iocontext.h>
39 #include <linux/key.h>
40 #include <linux/binfmts.h>
41 #include <linux/mman.h>
42 #include <linux/mmu_notifier.h>
43 #include <linux/fs.h>
44 #include <linux/mm.h>
45 #include <linux/vmacache.h>
46 #include <linux/nsproxy.h>
47 #include <linux/capability.h>
48 #include <linux/cpu.h>
49 #include <linux/cgroup.h>
50 #include <linux/security.h>
51 #include <linux/hugetlb.h>
52 #include <linux/seccomp.h>
53 #include <linux/swap.h>
54 #include <linux/syscalls.h>
55 #include <linux/jiffies.h>
56 #include <linux/futex.h>
57 #include <linux/compat.h>
58 #include <linux/kthread.h>
59 #include <linux/task_io_accounting_ops.h>
60 #include <linux/rcupdate.h>
61 #include <linux/ptrace.h>
62 #include <linux/mount.h>
63 #include <linux/audit.h>
64 #include <linux/memcontrol.h>
65 #include <linux/ftrace.h>
66 #include <linux/proc_fs.h>
67 #include <linux/profile.h>
68 #include <linux/rmap.h>
69 #include <linux/ksm.h>
70 #include <linux/acct.h>
71 #include <linux/userfaultfd_k.h>
72 #include <linux/tsacct_kern.h>
73 #include <linux/cn_proc.h>
74 #include <linux/freezer.h>
75 #include <linux/delayacct.h>
76 #include <linux/taskstats_kern.h>
77 #include <linux/random.h>
78 #include <linux/tty.h>
79 #include <linux/blkdev.h>
80 #include <linux/fs_struct.h>
81 #include <linux/magic.h>
82 #include <linux/perf_event.h>
83 #include <linux/posix-timers.h>
84 #include <linux/user-return-notifier.h>
85 #include <linux/oom.h>
86 #include <linux/khugepaged.h>
87 #include <linux/signalfd.h>
88 #include <linux/uprobes.h>
89 #include <linux/aio.h>
90 #include <linux/compiler.h>
91 #include <linux/sysctl.h>
92 #include <linux/kcov.h>
93 #include <linux/livepatch.h>
94 #include <linux/thread_info.h>
95 #include <linux/stackleak.h>
96 #include <linux/kasan.h>
97 #include <linux/scs.h>
98 #include <linux/io_uring.h>
99 #include <linux/bpf.h>
100 
101 #include <asm/pgalloc.h>
102 #include <linux/uaccess.h>
103 #include <asm/mmu_context.h>
104 #include <asm/cacheflush.h>
105 #include <asm/tlbflush.h>
106 
107 #include <trace/events/sched.h>
108 
109 #define CREATE_TRACE_POINTS
110 #include <trace/events/task.h>
111 
112 /*
113  * Minimum number of threads to boot the kernel
114  */
115 #define MIN_THREADS 20
116 
117 /*
118  * Maximum number of threads
119  */
120 #define MAX_THREADS FUTEX_TID_MASK
121 
122 /*
123  * Protected counters by write_lock_irq(&tasklist_lock)
124  */
125 unsigned long total_forks;	/* Handle normal Linux uptimes. */
126 int nr_threads;			/* The idle threads do not count.. */
127 
128 static int max_threads;		/* tunable limit on nr_threads */
129 
130 #define NAMED_ARRAY_INDEX(x)	[x] = __stringify(x)
131 
132 static const char * const resident_page_types[] = {
133 	NAMED_ARRAY_INDEX(MM_FILEPAGES),
134 	NAMED_ARRAY_INDEX(MM_ANONPAGES),
135 	NAMED_ARRAY_INDEX(MM_SWAPENTS),
136 	NAMED_ARRAY_INDEX(MM_SHMEMPAGES),
137 };
138 
139 DEFINE_PER_CPU(unsigned long, process_counts) = 0;
140 
141 __cacheline_aligned DEFINE_RWLOCK(tasklist_lock);  /* outer */
142 
143 #ifdef CONFIG_PROVE_RCU
144 int lockdep_tasklist_lock_is_held(void)
145 {
146 	return lockdep_is_held(&tasklist_lock);
147 }
148 EXPORT_SYMBOL_GPL(lockdep_tasklist_lock_is_held);
149 #endif /* #ifdef CONFIG_PROVE_RCU */
150 
151 int nr_processes(void)
152 {
153 	int cpu;
154 	int total = 0;
155 
156 	for_each_possible_cpu(cpu)
157 		total += per_cpu(process_counts, cpu);
158 
159 	return total;
160 }
161 
162 void __weak arch_release_task_struct(struct task_struct *tsk)
163 {
164 }
165 
166 #ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
167 static struct kmem_cache *task_struct_cachep;
168 
169 static inline struct task_struct *alloc_task_struct_node(int node)
170 {
171 	return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
172 }
173 
174 static inline void free_task_struct(struct task_struct *tsk)
175 {
176 	kmem_cache_free(task_struct_cachep, tsk);
177 }
178 #endif
179 
180 #ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR
181 
182 /*
183  * Allocate pages if THREAD_SIZE is >= PAGE_SIZE, otherwise use a
184  * kmemcache based allocator.
185  */
186 # if THREAD_SIZE >= PAGE_SIZE || defined(CONFIG_VMAP_STACK)
187 
188 #ifdef CONFIG_VMAP_STACK
189 /*
190  * vmalloc() is a bit slow, and calling vfree() enough times will force a TLB
191  * flush.  Try to minimize the number of calls by caching stacks.
192  */
193 #define NR_CACHED_STACKS 2
194 static DEFINE_PER_CPU(struct vm_struct *, cached_stacks[NR_CACHED_STACKS]);
195 
196 static int free_vm_stack_cache(unsigned int cpu)
197 {
198 	struct vm_struct **cached_vm_stacks = per_cpu_ptr(cached_stacks, cpu);
199 	int i;
200 
201 	for (i = 0; i < NR_CACHED_STACKS; i++) {
202 		struct vm_struct *vm_stack = cached_vm_stacks[i];
203 
204 		if (!vm_stack)
205 			continue;
206 
207 		vfree(vm_stack->addr);
208 		cached_vm_stacks[i] = NULL;
209 	}
210 
211 	return 0;
212 }
213 #endif
214 
215 static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
216 {
217 #ifdef CONFIG_VMAP_STACK
218 	void *stack;
219 	int i;
220 
221 	for (i = 0; i < NR_CACHED_STACKS; i++) {
222 		struct vm_struct *s;
223 
224 		s = this_cpu_xchg(cached_stacks[i], NULL);
225 
226 		if (!s)
227 			continue;
228 
229 		/* Mark stack accessible for KASAN. */
230 		kasan_unpoison_range(s->addr, THREAD_SIZE);
231 
232 		/* Clear stale pointers from reused stack. */
233 		memset(s->addr, 0, THREAD_SIZE);
234 
235 		tsk->stack_vm_area = s;
236 		tsk->stack = s->addr;
237 		return s->addr;
238 	}
239 
240 	/*
241 	 * Allocated stacks are cached and later reused by new threads,
242 	 * so memcg accounting is performed manually on assigning/releasing
243 	 * stacks to tasks. Drop __GFP_ACCOUNT.
244 	 */
245 	stack = __vmalloc_node_range(THREAD_SIZE, THREAD_ALIGN,
246 				     VMALLOC_START, VMALLOC_END,
247 				     THREADINFO_GFP & ~__GFP_ACCOUNT,
248 				     PAGE_KERNEL,
249 				     0, node, __builtin_return_address(0));
250 
251 	/*
252 	 * We can't call find_vm_area() in interrupt context, and
253 	 * free_thread_stack() can be called in interrupt context,
254 	 * so cache the vm_struct.
255 	 */
256 	if (stack) {
257 		tsk->stack_vm_area = find_vm_area(stack);
258 		tsk->stack = stack;
259 	}
260 	return stack;
261 #else
262 	struct page *page = alloc_pages_node(node, THREADINFO_GFP,
263 					     THREAD_SIZE_ORDER);
264 
265 	if (likely(page)) {
266 		tsk->stack = kasan_reset_tag(page_address(page));
267 		return tsk->stack;
268 	}
269 	return NULL;
270 #endif
271 }
272 
273 static inline void free_thread_stack(struct task_struct *tsk)
274 {
275 #ifdef CONFIG_VMAP_STACK
276 	struct vm_struct *vm = task_stack_vm_area(tsk);
277 
278 	if (vm) {
279 		int i;
280 
281 		for (i = 0; i < THREAD_SIZE / PAGE_SIZE; i++)
282 			memcg_kmem_uncharge_page(vm->pages[i], 0);
283 
284 		for (i = 0; i < NR_CACHED_STACKS; i++) {
285 			if (this_cpu_cmpxchg(cached_stacks[i],
286 					NULL, tsk->stack_vm_area) != NULL)
287 				continue;
288 
289 			return;
290 		}
291 
292 		vfree_atomic(tsk->stack);
293 		return;
294 	}
295 #endif
296 
297 	__free_pages(virt_to_page(tsk->stack), THREAD_SIZE_ORDER);
298 }
299 # else
300 static struct kmem_cache *thread_stack_cache;
301 
302 static unsigned long *alloc_thread_stack_node(struct task_struct *tsk,
303 						  int node)
304 {
305 	unsigned long *stack;
306 	stack = kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
307 	stack = kasan_reset_tag(stack);
308 	tsk->stack = stack;
309 	return stack;
310 }
311 
312 static void free_thread_stack(struct task_struct *tsk)
313 {
314 	kmem_cache_free(thread_stack_cache, tsk->stack);
315 }
316 
317 void thread_stack_cache_init(void)
318 {
319 	thread_stack_cache = kmem_cache_create_usercopy("thread_stack",
320 					THREAD_SIZE, THREAD_SIZE, 0, 0,
321 					THREAD_SIZE, NULL);
322 	BUG_ON(thread_stack_cache == NULL);
323 }
324 # endif
325 #endif
326 
327 /* SLAB cache for signal_struct structures (tsk->signal) */
328 static struct kmem_cache *signal_cachep;
329 
330 /* SLAB cache for sighand_struct structures (tsk->sighand) */
331 struct kmem_cache *sighand_cachep;
332 
333 /* SLAB cache for files_struct structures (tsk->files) */
334 struct kmem_cache *files_cachep;
335 
336 /* SLAB cache for fs_struct structures (tsk->fs) */
337 struct kmem_cache *fs_cachep;
338 
339 /* SLAB cache for vm_area_struct structures */
340 static struct kmem_cache *vm_area_cachep;
341 
342 /* SLAB cache for mm_struct structures (tsk->mm) */
343 static struct kmem_cache *mm_cachep;
344 
345 struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
346 {
347 	struct vm_area_struct *vma;
348 
349 	vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
350 	if (vma)
351 		vma_init(vma, mm);
352 	return vma;
353 }
354 
355 struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
356 {
357 	struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
358 
359 	if (new) {
360 		ASSERT_EXCLUSIVE_WRITER(orig->vm_flags);
361 		ASSERT_EXCLUSIVE_WRITER(orig->vm_file);
362 		/*
363 		 * orig->shared.rb may be modified concurrently, but the clone
364 		 * will be reinitialized.
365 		 */
366 		*new = data_race(*orig);
367 		INIT_LIST_HEAD(&new->anon_vma_chain);
368 		new->vm_next = new->vm_prev = NULL;
369 	}
370 	return new;
371 }
372 
373 void vm_area_free(struct vm_area_struct *vma)
374 {
375 	kmem_cache_free(vm_area_cachep, vma);
376 }
377 
378 static void account_kernel_stack(struct task_struct *tsk, int account)
379 {
380 	void *stack = task_stack_page(tsk);
381 	struct vm_struct *vm = task_stack_vm_area(tsk);
382 
383 	if (vm) {
384 		int i;
385 
386 		for (i = 0; i < THREAD_SIZE / PAGE_SIZE; i++)
387 			mod_lruvec_page_state(vm->pages[i], NR_KERNEL_STACK_KB,
388 					      account * (PAGE_SIZE / 1024));
389 	} else {
390 		/* All stack pages are in the same node. */
391 		mod_lruvec_kmem_state(stack, NR_KERNEL_STACK_KB,
392 				      account * (THREAD_SIZE / 1024));
393 	}
394 }
395 
396 static int memcg_charge_kernel_stack(struct task_struct *tsk)
397 {
398 #ifdef CONFIG_VMAP_STACK
399 	struct vm_struct *vm = task_stack_vm_area(tsk);
400 	int ret;
401 
402 	BUILD_BUG_ON(IS_ENABLED(CONFIG_VMAP_STACK) && PAGE_SIZE % 1024 != 0);
403 
404 	if (vm) {
405 		int i;
406 
407 		BUG_ON(vm->nr_pages != THREAD_SIZE / PAGE_SIZE);
408 
409 		for (i = 0; i < THREAD_SIZE / PAGE_SIZE; i++) {
410 			/*
411 			 * If memcg_kmem_charge_page() fails, page's
412 			 * memory cgroup pointer is NULL, and
413 			 * memcg_kmem_uncharge_page() in free_thread_stack()
414 			 * will ignore this page.
415 			 */
416 			ret = memcg_kmem_charge_page(vm->pages[i], GFP_KERNEL,
417 						     0);
418 			if (ret)
419 				return ret;
420 		}
421 	}
422 #endif
423 	return 0;
424 }
425 
426 static void release_task_stack(struct task_struct *tsk)
427 {
428 	if (WARN_ON(READ_ONCE(tsk->__state) != TASK_DEAD))
429 		return;  /* Better to leak the stack than to free prematurely */
430 
431 	account_kernel_stack(tsk, -1);
432 	free_thread_stack(tsk);
433 	tsk->stack = NULL;
434 #ifdef CONFIG_VMAP_STACK
435 	tsk->stack_vm_area = NULL;
436 #endif
437 }
438 
439 #ifdef CONFIG_THREAD_INFO_IN_TASK
440 void put_task_stack(struct task_struct *tsk)
441 {
442 	if (refcount_dec_and_test(&tsk->stack_refcount))
443 		release_task_stack(tsk);
444 }
445 #endif
446 
447 void free_task(struct task_struct *tsk)
448 {
449 	release_user_cpus_ptr(tsk);
450 	scs_release(tsk);
451 
452 #ifndef CONFIG_THREAD_INFO_IN_TASK
453 	/*
454 	 * The task is finally done with both the stack and thread_info,
455 	 * so free both.
456 	 */
457 	release_task_stack(tsk);
458 #else
459 	/*
460 	 * If the task had a separate stack allocation, it should be gone
461 	 * by now.
462 	 */
463 	WARN_ON_ONCE(refcount_read(&tsk->stack_refcount) != 0);
464 #endif
465 	rt_mutex_debug_task_free(tsk);
466 	ftrace_graph_exit_task(tsk);
467 	arch_release_task_struct(tsk);
468 	if (tsk->flags & PF_KTHREAD)
469 		free_kthread_struct(tsk);
470 	free_task_struct(tsk);
471 }
472 EXPORT_SYMBOL(free_task);
473 
474 #ifdef CONFIG_MMU
475 static __latent_entropy int dup_mmap(struct mm_struct *mm,
476 					struct mm_struct *oldmm)
477 {
478 	struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
479 	struct rb_node **rb_link, *rb_parent;
480 	int retval;
481 	unsigned long charge;
482 	LIST_HEAD(uf);
483 
484 	uprobe_start_dup_mmap();
485 	if (mmap_write_lock_killable(oldmm)) {
486 		retval = -EINTR;
487 		goto fail_uprobe_end;
488 	}
489 	flush_cache_dup_mm(oldmm);
490 	uprobe_dup_mmap(oldmm, mm);
491 	/*
492 	 * Not linked in yet - no deadlock potential:
493 	 */
494 	mmap_write_lock_nested(mm, SINGLE_DEPTH_NESTING);
495 
496 	/* No ordering required: file already has been exposed. */
497 	RCU_INIT_POINTER(mm->exe_file, get_mm_exe_file(oldmm));
498 
499 	mm->total_vm = oldmm->total_vm;
500 	mm->data_vm = oldmm->data_vm;
501 	mm->exec_vm = oldmm->exec_vm;
502 	mm->stack_vm = oldmm->stack_vm;
503 
504 	rb_link = &mm->mm_rb.rb_node;
505 	rb_parent = NULL;
506 	pprev = &mm->mmap;
507 	retval = ksm_fork(mm, oldmm);
508 	if (retval)
509 		goto out;
510 	retval = khugepaged_fork(mm, oldmm);
511 	if (retval)
512 		goto out;
513 
514 	prev = NULL;
515 	for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
516 		struct file *file;
517 
518 		if (mpnt->vm_flags & VM_DONTCOPY) {
519 			vm_stat_account(mm, mpnt->vm_flags, -vma_pages(mpnt));
520 			continue;
521 		}
522 		charge = 0;
523 		/*
524 		 * Don't duplicate many vmas if we've been oom-killed (for
525 		 * example)
526 		 */
527 		if (fatal_signal_pending(current)) {
528 			retval = -EINTR;
529 			goto out;
530 		}
531 		if (mpnt->vm_flags & VM_ACCOUNT) {
532 			unsigned long len = vma_pages(mpnt);
533 
534 			if (security_vm_enough_memory_mm(oldmm, len)) /* sic */
535 				goto fail_nomem;
536 			charge = len;
537 		}
538 		tmp = vm_area_dup(mpnt);
539 		if (!tmp)
540 			goto fail_nomem;
541 		retval = vma_dup_policy(mpnt, tmp);
542 		if (retval)
543 			goto fail_nomem_policy;
544 		tmp->vm_mm = mm;
545 		retval = dup_userfaultfd(tmp, &uf);
546 		if (retval)
547 			goto fail_nomem_anon_vma_fork;
548 		if (tmp->vm_flags & VM_WIPEONFORK) {
549 			/*
550 			 * VM_WIPEONFORK gets a clean slate in the child.
551 			 * Don't prepare anon_vma until fault since we don't
552 			 * copy page for current vma.
553 			 */
554 			tmp->anon_vma = NULL;
555 		} else if (anon_vma_fork(tmp, mpnt))
556 			goto fail_nomem_anon_vma_fork;
557 		tmp->vm_flags &= ~(VM_LOCKED | VM_LOCKONFAULT);
558 		file = tmp->vm_file;
559 		if (file) {
560 			struct inode *inode = file_inode(file);
561 			struct address_space *mapping = file->f_mapping;
562 
563 			get_file(file);
564 			if (tmp->vm_flags & VM_DENYWRITE)
565 				put_write_access(inode);
566 			i_mmap_lock_write(mapping);
567 			if (tmp->vm_flags & VM_SHARED)
568 				mapping_allow_writable(mapping);
569 			flush_dcache_mmap_lock(mapping);
570 			/* insert tmp into the share list, just after mpnt */
571 			vma_interval_tree_insert_after(tmp, mpnt,
572 					&mapping->i_mmap);
573 			flush_dcache_mmap_unlock(mapping);
574 			i_mmap_unlock_write(mapping);
575 		}
576 
577 		/*
578 		 * Clear hugetlb-related page reserves for children. This only
579 		 * affects MAP_PRIVATE mappings. Faults generated by the child
580 		 * are not guaranteed to succeed, even if read-only
581 		 */
582 		if (is_vm_hugetlb_page(tmp))
583 			reset_vma_resv_huge_pages(tmp);
584 
585 		/*
586 		 * Link in the new vma and copy the page table entries.
587 		 */
588 		*pprev = tmp;
589 		pprev = &tmp->vm_next;
590 		tmp->vm_prev = prev;
591 		prev = tmp;
592 
593 		__vma_link_rb(mm, tmp, rb_link, rb_parent);
594 		rb_link = &tmp->vm_rb.rb_right;
595 		rb_parent = &tmp->vm_rb;
596 
597 		mm->map_count++;
598 		if (!(tmp->vm_flags & VM_WIPEONFORK))
599 			retval = copy_page_range(tmp, mpnt);
600 
601 		if (tmp->vm_ops && tmp->vm_ops->open)
602 			tmp->vm_ops->open(tmp);
603 
604 		if (retval)
605 			goto out;
606 	}
607 	/* a new mm has just been created */
608 	retval = arch_dup_mmap(oldmm, mm);
609 out:
610 	mmap_write_unlock(mm);
611 	flush_tlb_mm(oldmm);
612 	mmap_write_unlock(oldmm);
613 	dup_userfaultfd_complete(&uf);
614 fail_uprobe_end:
615 	uprobe_end_dup_mmap();
616 	return retval;
617 fail_nomem_anon_vma_fork:
618 	mpol_put(vma_policy(tmp));
619 fail_nomem_policy:
620 	vm_area_free(tmp);
621 fail_nomem:
622 	retval = -ENOMEM;
623 	vm_unacct_memory(charge);
624 	goto out;
625 }
626 
627 static inline int mm_alloc_pgd(struct mm_struct *mm)
628 {
629 	mm->pgd = pgd_alloc(mm);
630 	if (unlikely(!mm->pgd))
631 		return -ENOMEM;
632 	return 0;
633 }
634 
635 static inline void mm_free_pgd(struct mm_struct *mm)
636 {
637 	pgd_free(mm, mm->pgd);
638 }
639 #else
640 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
641 {
642 	mmap_write_lock(oldmm);
643 	RCU_INIT_POINTER(mm->exe_file, get_mm_exe_file(oldmm));
644 	mmap_write_unlock(oldmm);
645 	return 0;
646 }
647 #define mm_alloc_pgd(mm)	(0)
648 #define mm_free_pgd(mm)
649 #endif /* CONFIG_MMU */
650 
651 static void check_mm(struct mm_struct *mm)
652 {
653 	int i;
654 
655 	BUILD_BUG_ON_MSG(ARRAY_SIZE(resident_page_types) != NR_MM_COUNTERS,
656 			 "Please make sure 'struct resident_page_types[]' is updated as well");
657 
658 	for (i = 0; i < NR_MM_COUNTERS; i++) {
659 		long x = atomic_long_read(&mm->rss_stat.count[i]);
660 
661 		if (unlikely(x))
662 			pr_alert("BUG: Bad rss-counter state mm:%p type:%s val:%ld\n",
663 				 mm, resident_page_types[i], x);
664 	}
665 
666 	if (mm_pgtables_bytes(mm))
667 		pr_alert("BUG: non-zero pgtables_bytes on freeing mm: %ld\n",
668 				mm_pgtables_bytes(mm));
669 
670 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
671 	VM_BUG_ON_MM(mm->pmd_huge_pte, mm);
672 #endif
673 }
674 
675 #define allocate_mm()	(kmem_cache_alloc(mm_cachep, GFP_KERNEL))
676 #define free_mm(mm)	(kmem_cache_free(mm_cachep, (mm)))
677 
678 /*
679  * Called when the last reference to the mm
680  * is dropped: either by a lazy thread or by
681  * mmput. Free the page directory and the mm.
682  */
683 void __mmdrop(struct mm_struct *mm)
684 {
685 	BUG_ON(mm == &init_mm);
686 	WARN_ON_ONCE(mm == current->mm);
687 	WARN_ON_ONCE(mm == current->active_mm);
688 	mm_free_pgd(mm);
689 	destroy_context(mm);
690 	mmu_notifier_subscriptions_destroy(mm);
691 	check_mm(mm);
692 	put_user_ns(mm->user_ns);
693 	free_mm(mm);
694 }
695 EXPORT_SYMBOL_GPL(__mmdrop);
696 
697 static void mmdrop_async_fn(struct work_struct *work)
698 {
699 	struct mm_struct *mm;
700 
701 	mm = container_of(work, struct mm_struct, async_put_work);
702 	__mmdrop(mm);
703 }
704 
705 static void mmdrop_async(struct mm_struct *mm)
706 {
707 	if (unlikely(atomic_dec_and_test(&mm->mm_count))) {
708 		INIT_WORK(&mm->async_put_work, mmdrop_async_fn);
709 		schedule_work(&mm->async_put_work);
710 	}
711 }
712 
713 static inline void free_signal_struct(struct signal_struct *sig)
714 {
715 	taskstats_tgid_free(sig);
716 	sched_autogroup_exit(sig);
717 	/*
718 	 * __mmdrop is not safe to call from softirq context on x86 due to
719 	 * pgd_dtor so postpone it to the async context
720 	 */
721 	if (sig->oom_mm)
722 		mmdrop_async(sig->oom_mm);
723 	kmem_cache_free(signal_cachep, sig);
724 }
725 
726 static inline void put_signal_struct(struct signal_struct *sig)
727 {
728 	if (refcount_dec_and_test(&sig->sigcnt))
729 		free_signal_struct(sig);
730 }
731 
732 void __put_task_struct(struct task_struct *tsk)
733 {
734 	WARN_ON(!tsk->exit_state);
735 	WARN_ON(refcount_read(&tsk->usage));
736 	WARN_ON(tsk == current);
737 
738 	io_uring_free(tsk);
739 	cgroup_free(tsk);
740 	task_numa_free(tsk, true);
741 	security_task_free(tsk);
742 	bpf_task_storage_free(tsk);
743 	exit_creds(tsk);
744 	delayacct_tsk_free(tsk);
745 	put_signal_struct(tsk->signal);
746 	sched_core_free(tsk);
747 
748 	if (!profile_handoff_task(tsk))
749 		free_task(tsk);
750 }
751 EXPORT_SYMBOL_GPL(__put_task_struct);
752 
753 void __init __weak arch_task_cache_init(void) { }
754 
755 /*
756  * set_max_threads
757  */
758 static void set_max_threads(unsigned int max_threads_suggested)
759 {
760 	u64 threads;
761 	unsigned long nr_pages = totalram_pages();
762 
763 	/*
764 	 * The number of threads shall be limited such that the thread
765 	 * structures may only consume a small part of the available memory.
766 	 */
767 	if (fls64(nr_pages) + fls64(PAGE_SIZE) > 64)
768 		threads = MAX_THREADS;
769 	else
770 		threads = div64_u64((u64) nr_pages * (u64) PAGE_SIZE,
771 				    (u64) THREAD_SIZE * 8UL);
772 
773 	if (threads > max_threads_suggested)
774 		threads = max_threads_suggested;
775 
776 	max_threads = clamp_t(u64, threads, MIN_THREADS, MAX_THREADS);
777 }
778 
779 #ifdef CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT
780 /* Initialized by the architecture: */
781 int arch_task_struct_size __read_mostly;
782 #endif
783 
784 #ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
785 static void task_struct_whitelist(unsigned long *offset, unsigned long *size)
786 {
787 	/* Fetch thread_struct whitelist for the architecture. */
788 	arch_thread_struct_whitelist(offset, size);
789 
790 	/*
791 	 * Handle zero-sized whitelist or empty thread_struct, otherwise
792 	 * adjust offset to position of thread_struct in task_struct.
793 	 */
794 	if (unlikely(*size == 0))
795 		*offset = 0;
796 	else
797 		*offset += offsetof(struct task_struct, thread);
798 }
799 #endif /* CONFIG_ARCH_TASK_STRUCT_ALLOCATOR */
800 
801 void __init fork_init(void)
802 {
803 	int i;
804 #ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
805 #ifndef ARCH_MIN_TASKALIGN
806 #define ARCH_MIN_TASKALIGN	0
807 #endif
808 	int align = max_t(int, L1_CACHE_BYTES, ARCH_MIN_TASKALIGN);
809 	unsigned long useroffset, usersize;
810 
811 	/* create a slab on which task_structs can be allocated */
812 	task_struct_whitelist(&useroffset, &usersize);
813 	task_struct_cachep = kmem_cache_create_usercopy("task_struct",
814 			arch_task_struct_size, align,
815 			SLAB_PANIC|SLAB_ACCOUNT,
816 			useroffset, usersize, NULL);
817 #endif
818 
819 	/* do the arch specific task caches init */
820 	arch_task_cache_init();
821 
822 	set_max_threads(MAX_THREADS);
823 
824 	init_task.signal->rlim[RLIMIT_NPROC].rlim_cur = max_threads/2;
825 	init_task.signal->rlim[RLIMIT_NPROC].rlim_max = max_threads/2;
826 	init_task.signal->rlim[RLIMIT_SIGPENDING] =
827 		init_task.signal->rlim[RLIMIT_NPROC];
828 
829 	for (i = 0; i < MAX_PER_NAMESPACE_UCOUNTS; i++)
830 		init_user_ns.ucount_max[i] = max_threads/2;
831 
832 	set_rlimit_ucount_max(&init_user_ns, UCOUNT_RLIMIT_NPROC,      RLIM_INFINITY);
833 	set_rlimit_ucount_max(&init_user_ns, UCOUNT_RLIMIT_MSGQUEUE,   RLIM_INFINITY);
834 	set_rlimit_ucount_max(&init_user_ns, UCOUNT_RLIMIT_SIGPENDING, RLIM_INFINITY);
835 	set_rlimit_ucount_max(&init_user_ns, UCOUNT_RLIMIT_MEMLOCK,    RLIM_INFINITY);
836 
837 #ifdef CONFIG_VMAP_STACK
838 	cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "fork:vm_stack_cache",
839 			  NULL, free_vm_stack_cache);
840 #endif
841 
842 	scs_init();
843 
844 	lockdep_init_task(&init_task);
845 	uprobes_init();
846 }
847 
848 int __weak arch_dup_task_struct(struct task_struct *dst,
849 					       struct task_struct *src)
850 {
851 	*dst = *src;
852 	return 0;
853 }
854 
855 void set_task_stack_end_magic(struct task_struct *tsk)
856 {
857 	unsigned long *stackend;
858 
859 	stackend = end_of_stack(tsk);
860 	*stackend = STACK_END_MAGIC;	/* for overflow detection */
861 }
862 
863 static struct task_struct *dup_task_struct(struct task_struct *orig, int node)
864 {
865 	struct task_struct *tsk;
866 	unsigned long *stack;
867 	struct vm_struct *stack_vm_area __maybe_unused;
868 	int err;
869 
870 	if (node == NUMA_NO_NODE)
871 		node = tsk_fork_get_node(orig);
872 	tsk = alloc_task_struct_node(node);
873 	if (!tsk)
874 		return NULL;
875 
876 	stack = alloc_thread_stack_node(tsk, node);
877 	if (!stack)
878 		goto free_tsk;
879 
880 	if (memcg_charge_kernel_stack(tsk))
881 		goto free_stack;
882 
883 	stack_vm_area = task_stack_vm_area(tsk);
884 
885 	err = arch_dup_task_struct(tsk, orig);
886 
887 	/*
888 	 * arch_dup_task_struct() clobbers the stack-related fields.  Make
889 	 * sure they're properly initialized before using any stack-related
890 	 * functions again.
891 	 */
892 	tsk->stack = stack;
893 #ifdef CONFIG_VMAP_STACK
894 	tsk->stack_vm_area = stack_vm_area;
895 #endif
896 #ifdef CONFIG_THREAD_INFO_IN_TASK
897 	refcount_set(&tsk->stack_refcount, 1);
898 #endif
899 
900 	if (err)
901 		goto free_stack;
902 
903 	err = scs_prepare(tsk, node);
904 	if (err)
905 		goto free_stack;
906 
907 #ifdef CONFIG_SECCOMP
908 	/*
909 	 * We must handle setting up seccomp filters once we're under
910 	 * the sighand lock in case orig has changed between now and
911 	 * then. Until then, filter must be NULL to avoid messing up
912 	 * the usage counts on the error path calling free_task.
913 	 */
914 	tsk->seccomp.filter = NULL;
915 #endif
916 
917 	setup_thread_stack(tsk, orig);
918 	clear_user_return_notifier(tsk);
919 	clear_tsk_need_resched(tsk);
920 	set_task_stack_end_magic(tsk);
921 	clear_syscall_work_syscall_user_dispatch(tsk);
922 
923 #ifdef CONFIG_STACKPROTECTOR
924 	tsk->stack_canary = get_random_canary();
925 #endif
926 	if (orig->cpus_ptr == &orig->cpus_mask)
927 		tsk->cpus_ptr = &tsk->cpus_mask;
928 	dup_user_cpus_ptr(tsk, orig, node);
929 
930 	/*
931 	 * One for the user space visible state that goes away when reaped.
932 	 * One for the scheduler.
933 	 */
934 	refcount_set(&tsk->rcu_users, 2);
935 	/* One for the rcu users */
936 	refcount_set(&tsk->usage, 1);
937 #ifdef CONFIG_BLK_DEV_IO_TRACE
938 	tsk->btrace_seq = 0;
939 #endif
940 	tsk->splice_pipe = NULL;
941 	tsk->task_frag.page = NULL;
942 	tsk->wake_q.next = NULL;
943 	tsk->pf_io_worker = NULL;
944 
945 	account_kernel_stack(tsk, 1);
946 
947 	kcov_task_init(tsk);
948 	kmap_local_fork(tsk);
949 
950 #ifdef CONFIG_FAULT_INJECTION
951 	tsk->fail_nth = 0;
952 #endif
953 
954 #ifdef CONFIG_BLK_CGROUP
955 	tsk->throttle_queue = NULL;
956 	tsk->use_memdelay = 0;
957 #endif
958 
959 #ifdef CONFIG_MEMCG
960 	tsk->active_memcg = NULL;
961 #endif
962 	return tsk;
963 
964 free_stack:
965 	free_thread_stack(tsk);
966 free_tsk:
967 	free_task_struct(tsk);
968 	return NULL;
969 }
970 
971 __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock);
972 
973 static unsigned long default_dump_filter = MMF_DUMP_FILTER_DEFAULT;
974 
975 static int __init coredump_filter_setup(char *s)
976 {
977 	default_dump_filter =
978 		(simple_strtoul(s, NULL, 0) << MMF_DUMP_FILTER_SHIFT) &
979 		MMF_DUMP_FILTER_MASK;
980 	return 1;
981 }
982 
983 __setup("coredump_filter=", coredump_filter_setup);
984 
985 #include <linux/init_task.h>
986 
987 static void mm_init_aio(struct mm_struct *mm)
988 {
989 #ifdef CONFIG_AIO
990 	spin_lock_init(&mm->ioctx_lock);
991 	mm->ioctx_table = NULL;
992 #endif
993 }
994 
995 static __always_inline void mm_clear_owner(struct mm_struct *mm,
996 					   struct task_struct *p)
997 {
998 #ifdef CONFIG_MEMCG
999 	if (mm->owner == p)
1000 		WRITE_ONCE(mm->owner, NULL);
1001 #endif
1002 }
1003 
1004 static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
1005 {
1006 #ifdef CONFIG_MEMCG
1007 	mm->owner = p;
1008 #endif
1009 }
1010 
1011 static void mm_init_pasid(struct mm_struct *mm)
1012 {
1013 #ifdef CONFIG_IOMMU_SUPPORT
1014 	mm->pasid = INIT_PASID;
1015 #endif
1016 }
1017 
1018 static void mm_init_uprobes_state(struct mm_struct *mm)
1019 {
1020 #ifdef CONFIG_UPROBES
1021 	mm->uprobes_state.xol_area = NULL;
1022 #endif
1023 }
1024 
1025 static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
1026 	struct user_namespace *user_ns)
1027 {
1028 	mm->mmap = NULL;
1029 	mm->mm_rb = RB_ROOT;
1030 	mm->vmacache_seqnum = 0;
1031 	atomic_set(&mm->mm_users, 1);
1032 	atomic_set(&mm->mm_count, 1);
1033 	seqcount_init(&mm->write_protect_seq);
1034 	mmap_init_lock(mm);
1035 	INIT_LIST_HEAD(&mm->mmlist);
1036 	mm->core_state = NULL;
1037 	mm_pgtables_bytes_init(mm);
1038 	mm->map_count = 0;
1039 	mm->locked_vm = 0;
1040 	atomic64_set(&mm->pinned_vm, 0);
1041 	memset(&mm->rss_stat, 0, sizeof(mm->rss_stat));
1042 	spin_lock_init(&mm->page_table_lock);
1043 	spin_lock_init(&mm->arg_lock);
1044 	mm_init_cpumask(mm);
1045 	mm_init_aio(mm);
1046 	mm_init_owner(mm, p);
1047 	mm_init_pasid(mm);
1048 	RCU_INIT_POINTER(mm->exe_file, NULL);
1049 	mmu_notifier_subscriptions_init(mm);
1050 	init_tlb_flush_pending(mm);
1051 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
1052 	mm->pmd_huge_pte = NULL;
1053 #endif
1054 	mm_init_uprobes_state(mm);
1055 
1056 	if (current->mm) {
1057 		mm->flags = current->mm->flags & MMF_INIT_MASK;
1058 		mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK;
1059 	} else {
1060 		mm->flags = default_dump_filter;
1061 		mm->def_flags = 0;
1062 	}
1063 
1064 	if (mm_alloc_pgd(mm))
1065 		goto fail_nopgd;
1066 
1067 	if (init_new_context(p, mm))
1068 		goto fail_nocontext;
1069 
1070 	mm->user_ns = get_user_ns(user_ns);
1071 	return mm;
1072 
1073 fail_nocontext:
1074 	mm_free_pgd(mm);
1075 fail_nopgd:
1076 	free_mm(mm);
1077 	return NULL;
1078 }
1079 
1080 /*
1081  * Allocate and initialize an mm_struct.
1082  */
1083 struct mm_struct *mm_alloc(void)
1084 {
1085 	struct mm_struct *mm;
1086 
1087 	mm = allocate_mm();
1088 	if (!mm)
1089 		return NULL;
1090 
1091 	memset(mm, 0, sizeof(*mm));
1092 	return mm_init(mm, current, current_user_ns());
1093 }
1094 
1095 static inline void __mmput(struct mm_struct *mm)
1096 {
1097 	VM_BUG_ON(atomic_read(&mm->mm_users));
1098 
1099 	uprobe_clear_state(mm);
1100 	exit_aio(mm);
1101 	ksm_exit(mm);
1102 	khugepaged_exit(mm); /* must run before exit_mmap */
1103 	exit_mmap(mm);
1104 	mm_put_huge_zero_page(mm);
1105 	set_mm_exe_file(mm, NULL);
1106 	if (!list_empty(&mm->mmlist)) {
1107 		spin_lock(&mmlist_lock);
1108 		list_del(&mm->mmlist);
1109 		spin_unlock(&mmlist_lock);
1110 	}
1111 	if (mm->binfmt)
1112 		module_put(mm->binfmt->module);
1113 	mmdrop(mm);
1114 }
1115 
1116 /*
1117  * Decrement the use count and release all resources for an mm.
1118  */
1119 void mmput(struct mm_struct *mm)
1120 {
1121 	might_sleep();
1122 
1123 	if (atomic_dec_and_test(&mm->mm_users))
1124 		__mmput(mm);
1125 }
1126 EXPORT_SYMBOL_GPL(mmput);
1127 
1128 #ifdef CONFIG_MMU
1129 static void mmput_async_fn(struct work_struct *work)
1130 {
1131 	struct mm_struct *mm = container_of(work, struct mm_struct,
1132 					    async_put_work);
1133 
1134 	__mmput(mm);
1135 }
1136 
1137 void mmput_async(struct mm_struct *mm)
1138 {
1139 	if (atomic_dec_and_test(&mm->mm_users)) {
1140 		INIT_WORK(&mm->async_put_work, mmput_async_fn);
1141 		schedule_work(&mm->async_put_work);
1142 	}
1143 }
1144 #endif
1145 
1146 /**
1147  * set_mm_exe_file - change a reference to the mm's executable file
1148  *
1149  * This changes mm's executable file (shown as symlink /proc/[pid]/exe).
1150  *
1151  * Main users are mmput() and sys_execve(). Callers prevent concurrent
1152  * invocations: in mmput() nobody alive left, in execve task is single
1153  * threaded. sys_prctl(PR_SET_MM_MAP/EXE_FILE) also needs to set the
1154  * mm->exe_file, but does so without using set_mm_exe_file() in order
1155  * to avoid the need for any locks.
1156  */
1157 void set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file)
1158 {
1159 	struct file *old_exe_file;
1160 
1161 	/*
1162 	 * It is safe to dereference the exe_file without RCU as
1163 	 * this function is only called if nobody else can access
1164 	 * this mm -- see comment above for justification.
1165 	 */
1166 	old_exe_file = rcu_dereference_raw(mm->exe_file);
1167 
1168 	if (new_exe_file)
1169 		get_file(new_exe_file);
1170 	rcu_assign_pointer(mm->exe_file, new_exe_file);
1171 	if (old_exe_file)
1172 		fput(old_exe_file);
1173 }
1174 
1175 /**
1176  * get_mm_exe_file - acquire a reference to the mm's executable file
1177  *
1178  * Returns %NULL if mm has no associated executable file.
1179  * User must release file via fput().
1180  */
1181 struct file *get_mm_exe_file(struct mm_struct *mm)
1182 {
1183 	struct file *exe_file;
1184 
1185 	rcu_read_lock();
1186 	exe_file = rcu_dereference(mm->exe_file);
1187 	if (exe_file && !get_file_rcu(exe_file))
1188 		exe_file = NULL;
1189 	rcu_read_unlock();
1190 	return exe_file;
1191 }
1192 EXPORT_SYMBOL(get_mm_exe_file);
1193 
1194 /**
1195  * get_task_exe_file - acquire a reference to the task's executable file
1196  *
1197  * Returns %NULL if task's mm (if any) has no associated executable file or
1198  * this is a kernel thread with borrowed mm (see the comment above get_task_mm).
1199  * User must release file via fput().
1200  */
1201 struct file *get_task_exe_file(struct task_struct *task)
1202 {
1203 	struct file *exe_file = NULL;
1204 	struct mm_struct *mm;
1205 
1206 	task_lock(task);
1207 	mm = task->mm;
1208 	if (mm) {
1209 		if (!(task->flags & PF_KTHREAD))
1210 			exe_file = get_mm_exe_file(mm);
1211 	}
1212 	task_unlock(task);
1213 	return exe_file;
1214 }
1215 EXPORT_SYMBOL(get_task_exe_file);
1216 
1217 /**
1218  * get_task_mm - acquire a reference to the task's mm
1219  *
1220  * Returns %NULL if the task has no mm.  Checks PF_KTHREAD (meaning
1221  * this kernel workthread has transiently adopted a user mm with use_mm,
1222  * to do its AIO) is not set and if so returns a reference to it, after
1223  * bumping up the use count.  User must release the mm via mmput()
1224  * after use.  Typically used by /proc and ptrace.
1225  */
1226 struct mm_struct *get_task_mm(struct task_struct *task)
1227 {
1228 	struct mm_struct *mm;
1229 
1230 	task_lock(task);
1231 	mm = task->mm;
1232 	if (mm) {
1233 		if (task->flags & PF_KTHREAD)
1234 			mm = NULL;
1235 		else
1236 			mmget(mm);
1237 	}
1238 	task_unlock(task);
1239 	return mm;
1240 }
1241 EXPORT_SYMBOL_GPL(get_task_mm);
1242 
1243 struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
1244 {
1245 	struct mm_struct *mm;
1246 	int err;
1247 
1248 	err =  down_read_killable(&task->signal->exec_update_lock);
1249 	if (err)
1250 		return ERR_PTR(err);
1251 
1252 	mm = get_task_mm(task);
1253 	if (mm && mm != current->mm &&
1254 			!ptrace_may_access(task, mode)) {
1255 		mmput(mm);
1256 		mm = ERR_PTR(-EACCES);
1257 	}
1258 	up_read(&task->signal->exec_update_lock);
1259 
1260 	return mm;
1261 }
1262 
1263 static void complete_vfork_done(struct task_struct *tsk)
1264 {
1265 	struct completion *vfork;
1266 
1267 	task_lock(tsk);
1268 	vfork = tsk->vfork_done;
1269 	if (likely(vfork)) {
1270 		tsk->vfork_done = NULL;
1271 		complete(vfork);
1272 	}
1273 	task_unlock(tsk);
1274 }
1275 
1276 static int wait_for_vfork_done(struct task_struct *child,
1277 				struct completion *vfork)
1278 {
1279 	int killed;
1280 
1281 	freezer_do_not_count();
1282 	cgroup_enter_frozen();
1283 	killed = wait_for_completion_killable(vfork);
1284 	cgroup_leave_frozen(false);
1285 	freezer_count();
1286 
1287 	if (killed) {
1288 		task_lock(child);
1289 		child->vfork_done = NULL;
1290 		task_unlock(child);
1291 	}
1292 
1293 	put_task_struct(child);
1294 	return killed;
1295 }
1296 
1297 /* Please note the differences between mmput and mm_release.
1298  * mmput is called whenever we stop holding onto a mm_struct,
1299  * error success whatever.
1300  *
1301  * mm_release is called after a mm_struct has been removed
1302  * from the current process.
1303  *
1304  * This difference is important for error handling, when we
1305  * only half set up a mm_struct for a new process and need to restore
1306  * the old one.  Because we mmput the new mm_struct before
1307  * restoring the old one. . .
1308  * Eric Biederman 10 January 1998
1309  */
1310 static void mm_release(struct task_struct *tsk, struct mm_struct *mm)
1311 {
1312 	uprobe_free_utask(tsk);
1313 
1314 	/* Get rid of any cached register state */
1315 	deactivate_mm(tsk, mm);
1316 
1317 	/*
1318 	 * Signal userspace if we're not exiting with a core dump
1319 	 * because we want to leave the value intact for debugging
1320 	 * purposes.
1321 	 */
1322 	if (tsk->clear_child_tid) {
1323 		if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
1324 		    atomic_read(&mm->mm_users) > 1) {
1325 			/*
1326 			 * We don't check the error code - if userspace has
1327 			 * not set up a proper pointer then tough luck.
1328 			 */
1329 			put_user(0, tsk->clear_child_tid);
1330 			do_futex(tsk->clear_child_tid, FUTEX_WAKE,
1331 					1, NULL, NULL, 0, 0);
1332 		}
1333 		tsk->clear_child_tid = NULL;
1334 	}
1335 
1336 	/*
1337 	 * All done, finally we can wake up parent and return this mm to him.
1338 	 * Also kthread_stop() uses this completion for synchronization.
1339 	 */
1340 	if (tsk->vfork_done)
1341 		complete_vfork_done(tsk);
1342 }
1343 
1344 void exit_mm_release(struct task_struct *tsk, struct mm_struct *mm)
1345 {
1346 	futex_exit_release(tsk);
1347 	mm_release(tsk, mm);
1348 }
1349 
1350 void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm)
1351 {
1352 	futex_exec_release(tsk);
1353 	mm_release(tsk, mm);
1354 }
1355 
1356 /**
1357  * dup_mm() - duplicates an existing mm structure
1358  * @tsk: the task_struct with which the new mm will be associated.
1359  * @oldmm: the mm to duplicate.
1360  *
1361  * Allocates a new mm structure and duplicates the provided @oldmm structure
1362  * content into it.
1363  *
1364  * Return: the duplicated mm or NULL on failure.
1365  */
1366 static struct mm_struct *dup_mm(struct task_struct *tsk,
1367 				struct mm_struct *oldmm)
1368 {
1369 	struct mm_struct *mm;
1370 	int err;
1371 
1372 	mm = allocate_mm();
1373 	if (!mm)
1374 		goto fail_nomem;
1375 
1376 	memcpy(mm, oldmm, sizeof(*mm));
1377 
1378 	if (!mm_init(mm, tsk, mm->user_ns))
1379 		goto fail_nomem;
1380 
1381 	err = dup_mmap(mm, oldmm);
1382 	if (err)
1383 		goto free_pt;
1384 
1385 	mm->hiwater_rss = get_mm_rss(mm);
1386 	mm->hiwater_vm = mm->total_vm;
1387 
1388 	if (mm->binfmt && !try_module_get(mm->binfmt->module))
1389 		goto free_pt;
1390 
1391 	return mm;
1392 
1393 free_pt:
1394 	/* don't put binfmt in mmput, we haven't got module yet */
1395 	mm->binfmt = NULL;
1396 	mm_init_owner(mm, NULL);
1397 	mmput(mm);
1398 
1399 fail_nomem:
1400 	return NULL;
1401 }
1402 
1403 static int copy_mm(unsigned long clone_flags, struct task_struct *tsk)
1404 {
1405 	struct mm_struct *mm, *oldmm;
1406 
1407 	tsk->min_flt = tsk->maj_flt = 0;
1408 	tsk->nvcsw = tsk->nivcsw = 0;
1409 #ifdef CONFIG_DETECT_HUNG_TASK
1410 	tsk->last_switch_count = tsk->nvcsw + tsk->nivcsw;
1411 	tsk->last_switch_time = 0;
1412 #endif
1413 
1414 	tsk->mm = NULL;
1415 	tsk->active_mm = NULL;
1416 
1417 	/*
1418 	 * Are we cloning a kernel thread?
1419 	 *
1420 	 * We need to steal a active VM for that..
1421 	 */
1422 	oldmm = current->mm;
1423 	if (!oldmm)
1424 		return 0;
1425 
1426 	/* initialize the new vmacache entries */
1427 	vmacache_flush(tsk);
1428 
1429 	if (clone_flags & CLONE_VM) {
1430 		mmget(oldmm);
1431 		mm = oldmm;
1432 	} else {
1433 		mm = dup_mm(tsk, current->mm);
1434 		if (!mm)
1435 			return -ENOMEM;
1436 	}
1437 
1438 	tsk->mm = mm;
1439 	tsk->active_mm = mm;
1440 	return 0;
1441 }
1442 
1443 static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
1444 {
1445 	struct fs_struct *fs = current->fs;
1446 	if (clone_flags & CLONE_FS) {
1447 		/* tsk->fs is already what we want */
1448 		spin_lock(&fs->lock);
1449 		if (fs->in_exec) {
1450 			spin_unlock(&fs->lock);
1451 			return -EAGAIN;
1452 		}
1453 		fs->users++;
1454 		spin_unlock(&fs->lock);
1455 		return 0;
1456 	}
1457 	tsk->fs = copy_fs_struct(fs);
1458 	if (!tsk->fs)
1459 		return -ENOMEM;
1460 	return 0;
1461 }
1462 
1463 static int copy_files(unsigned long clone_flags, struct task_struct *tsk)
1464 {
1465 	struct files_struct *oldf, *newf;
1466 	int error = 0;
1467 
1468 	/*
1469 	 * A background process may not have any files ...
1470 	 */
1471 	oldf = current->files;
1472 	if (!oldf)
1473 		goto out;
1474 
1475 	if (clone_flags & CLONE_FILES) {
1476 		atomic_inc(&oldf->count);
1477 		goto out;
1478 	}
1479 
1480 	newf = dup_fd(oldf, NR_OPEN_MAX, &error);
1481 	if (!newf)
1482 		goto out;
1483 
1484 	tsk->files = newf;
1485 	error = 0;
1486 out:
1487 	return error;
1488 }
1489 
1490 static int copy_io(unsigned long clone_flags, struct task_struct *tsk)
1491 {
1492 #ifdef CONFIG_BLOCK
1493 	struct io_context *ioc = current->io_context;
1494 	struct io_context *new_ioc;
1495 
1496 	if (!ioc)
1497 		return 0;
1498 	/*
1499 	 * Share io context with parent, if CLONE_IO is set
1500 	 */
1501 	if (clone_flags & CLONE_IO) {
1502 		ioc_task_link(ioc);
1503 		tsk->io_context = ioc;
1504 	} else if (ioprio_valid(ioc->ioprio)) {
1505 		new_ioc = get_task_io_context(tsk, GFP_KERNEL, NUMA_NO_NODE);
1506 		if (unlikely(!new_ioc))
1507 			return -ENOMEM;
1508 
1509 		new_ioc->ioprio = ioc->ioprio;
1510 		put_io_context(new_ioc);
1511 	}
1512 #endif
1513 	return 0;
1514 }
1515 
1516 static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
1517 {
1518 	struct sighand_struct *sig;
1519 
1520 	if (clone_flags & CLONE_SIGHAND) {
1521 		refcount_inc(&current->sighand->count);
1522 		return 0;
1523 	}
1524 	sig = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
1525 	RCU_INIT_POINTER(tsk->sighand, sig);
1526 	if (!sig)
1527 		return -ENOMEM;
1528 
1529 	refcount_set(&sig->count, 1);
1530 	spin_lock_irq(&current->sighand->siglock);
1531 	memcpy(sig->action, current->sighand->action, sizeof(sig->action));
1532 	spin_unlock_irq(&current->sighand->siglock);
1533 
1534 	/* Reset all signal handler not set to SIG_IGN to SIG_DFL. */
1535 	if (clone_flags & CLONE_CLEAR_SIGHAND)
1536 		flush_signal_handlers(tsk, 0);
1537 
1538 	return 0;
1539 }
1540 
1541 void __cleanup_sighand(struct sighand_struct *sighand)
1542 {
1543 	if (refcount_dec_and_test(&sighand->count)) {
1544 		signalfd_cleanup(sighand);
1545 		/*
1546 		 * sighand_cachep is SLAB_TYPESAFE_BY_RCU so we can free it
1547 		 * without an RCU grace period, see __lock_task_sighand().
1548 		 */
1549 		kmem_cache_free(sighand_cachep, sighand);
1550 	}
1551 }
1552 
1553 /*
1554  * Initialize POSIX timer handling for a thread group.
1555  */
1556 static void posix_cpu_timers_init_group(struct signal_struct *sig)
1557 {
1558 	struct posix_cputimers *pct = &sig->posix_cputimers;
1559 	unsigned long cpu_limit;
1560 
1561 	cpu_limit = READ_ONCE(sig->rlim[RLIMIT_CPU].rlim_cur);
1562 	posix_cputimers_group_init(pct, cpu_limit);
1563 }
1564 
1565 static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
1566 {
1567 	struct signal_struct *sig;
1568 
1569 	if (clone_flags & CLONE_THREAD)
1570 		return 0;
1571 
1572 	sig = kmem_cache_zalloc(signal_cachep, GFP_KERNEL);
1573 	tsk->signal = sig;
1574 	if (!sig)
1575 		return -ENOMEM;
1576 
1577 	sig->nr_threads = 1;
1578 	atomic_set(&sig->live, 1);
1579 	refcount_set(&sig->sigcnt, 1);
1580 
1581 	/* list_add(thread_node, thread_head) without INIT_LIST_HEAD() */
1582 	sig->thread_head = (struct list_head)LIST_HEAD_INIT(tsk->thread_node);
1583 	tsk->thread_node = (struct list_head)LIST_HEAD_INIT(sig->thread_head);
1584 
1585 	init_waitqueue_head(&sig->wait_chldexit);
1586 	sig->curr_target = tsk;
1587 	init_sigpending(&sig->shared_pending);
1588 	INIT_HLIST_HEAD(&sig->multiprocess);
1589 	seqlock_init(&sig->stats_lock);
1590 	prev_cputime_init(&sig->prev_cputime);
1591 
1592 #ifdef CONFIG_POSIX_TIMERS
1593 	INIT_LIST_HEAD(&sig->posix_timers);
1594 	hrtimer_init(&sig->real_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
1595 	sig->real_timer.function = it_real_fn;
1596 #endif
1597 
1598 	task_lock(current->group_leader);
1599 	memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim);
1600 	task_unlock(current->group_leader);
1601 
1602 	posix_cpu_timers_init_group(sig);
1603 
1604 	tty_audit_fork(sig);
1605 	sched_autogroup_fork(sig);
1606 
1607 	sig->oom_score_adj = current->signal->oom_score_adj;
1608 	sig->oom_score_adj_min = current->signal->oom_score_adj_min;
1609 
1610 	mutex_init(&sig->cred_guard_mutex);
1611 	init_rwsem(&sig->exec_update_lock);
1612 
1613 	return 0;
1614 }
1615 
1616 static void copy_seccomp(struct task_struct *p)
1617 {
1618 #ifdef CONFIG_SECCOMP
1619 	/*
1620 	 * Must be called with sighand->lock held, which is common to
1621 	 * all threads in the group. Holding cred_guard_mutex is not
1622 	 * needed because this new task is not yet running and cannot
1623 	 * be racing exec.
1624 	 */
1625 	assert_spin_locked(&current->sighand->siglock);
1626 
1627 	/* Ref-count the new filter user, and assign it. */
1628 	get_seccomp_filter(current);
1629 	p->seccomp = current->seccomp;
1630 
1631 	/*
1632 	 * Explicitly enable no_new_privs here in case it got set
1633 	 * between the task_struct being duplicated and holding the
1634 	 * sighand lock. The seccomp state and nnp must be in sync.
1635 	 */
1636 	if (task_no_new_privs(current))
1637 		task_set_no_new_privs(p);
1638 
1639 	/*
1640 	 * If the parent gained a seccomp mode after copying thread
1641 	 * flags and between before we held the sighand lock, we have
1642 	 * to manually enable the seccomp thread flag here.
1643 	 */
1644 	if (p->seccomp.mode != SECCOMP_MODE_DISABLED)
1645 		set_task_syscall_work(p, SECCOMP);
1646 #endif
1647 }
1648 
1649 SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
1650 {
1651 	current->clear_child_tid = tidptr;
1652 
1653 	return task_pid_vnr(current);
1654 }
1655 
1656 static void rt_mutex_init_task(struct task_struct *p)
1657 {
1658 	raw_spin_lock_init(&p->pi_lock);
1659 #ifdef CONFIG_RT_MUTEXES
1660 	p->pi_waiters = RB_ROOT_CACHED;
1661 	p->pi_top_task = NULL;
1662 	p->pi_blocked_on = NULL;
1663 #endif
1664 }
1665 
1666 static inline void init_task_pid_links(struct task_struct *task)
1667 {
1668 	enum pid_type type;
1669 
1670 	for (type = PIDTYPE_PID; type < PIDTYPE_MAX; ++type)
1671 		INIT_HLIST_NODE(&task->pid_links[type]);
1672 }
1673 
1674 static inline void
1675 init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid)
1676 {
1677 	if (type == PIDTYPE_PID)
1678 		task->thread_pid = pid;
1679 	else
1680 		task->signal->pids[type] = pid;
1681 }
1682 
1683 static inline void rcu_copy_process(struct task_struct *p)
1684 {
1685 #ifdef CONFIG_PREEMPT_RCU
1686 	p->rcu_read_lock_nesting = 0;
1687 	p->rcu_read_unlock_special.s = 0;
1688 	p->rcu_blocked_node = NULL;
1689 	INIT_LIST_HEAD(&p->rcu_node_entry);
1690 #endif /* #ifdef CONFIG_PREEMPT_RCU */
1691 #ifdef CONFIG_TASKS_RCU
1692 	p->rcu_tasks_holdout = false;
1693 	INIT_LIST_HEAD(&p->rcu_tasks_holdout_list);
1694 	p->rcu_tasks_idle_cpu = -1;
1695 #endif /* #ifdef CONFIG_TASKS_RCU */
1696 #ifdef CONFIG_TASKS_TRACE_RCU
1697 	p->trc_reader_nesting = 0;
1698 	p->trc_reader_special.s = 0;
1699 	INIT_LIST_HEAD(&p->trc_holdout_list);
1700 #endif /* #ifdef CONFIG_TASKS_TRACE_RCU */
1701 }
1702 
1703 struct pid *pidfd_pid(const struct file *file)
1704 {
1705 	if (file->f_op == &pidfd_fops)
1706 		return file->private_data;
1707 
1708 	return ERR_PTR(-EBADF);
1709 }
1710 
1711 static int pidfd_release(struct inode *inode, struct file *file)
1712 {
1713 	struct pid *pid = file->private_data;
1714 
1715 	file->private_data = NULL;
1716 	put_pid(pid);
1717 	return 0;
1718 }
1719 
1720 #ifdef CONFIG_PROC_FS
1721 /**
1722  * pidfd_show_fdinfo - print information about a pidfd
1723  * @m: proc fdinfo file
1724  * @f: file referencing a pidfd
1725  *
1726  * Pid:
1727  * This function will print the pid that a given pidfd refers to in the
1728  * pid namespace of the procfs instance.
1729  * If the pid namespace of the process is not a descendant of the pid
1730  * namespace of the procfs instance 0 will be shown as its pid. This is
1731  * similar to calling getppid() on a process whose parent is outside of
1732  * its pid namespace.
1733  *
1734  * NSpid:
1735  * If pid namespaces are supported then this function will also print
1736  * the pid of a given pidfd refers to for all descendant pid namespaces
1737  * starting from the current pid namespace of the instance, i.e. the
1738  * Pid field and the first entry in the NSpid field will be identical.
1739  * If the pid namespace of the process is not a descendant of the pid
1740  * namespace of the procfs instance 0 will be shown as its first NSpid
1741  * entry and no others will be shown.
1742  * Note that this differs from the Pid and NSpid fields in
1743  * /proc/<pid>/status where Pid and NSpid are always shown relative to
1744  * the  pid namespace of the procfs instance. The difference becomes
1745  * obvious when sending around a pidfd between pid namespaces from a
1746  * different branch of the tree, i.e. where no ancestral relation is
1747  * present between the pid namespaces:
1748  * - create two new pid namespaces ns1 and ns2 in the initial pid
1749  *   namespace (also take care to create new mount namespaces in the
1750  *   new pid namespace and mount procfs)
1751  * - create a process with a pidfd in ns1
1752  * - send pidfd from ns1 to ns2
1753  * - read /proc/self/fdinfo/<pidfd> and observe that both Pid and NSpid
1754  *   have exactly one entry, which is 0
1755  */
1756 static void pidfd_show_fdinfo(struct seq_file *m, struct file *f)
1757 {
1758 	struct pid *pid = f->private_data;
1759 	struct pid_namespace *ns;
1760 	pid_t nr = -1;
1761 
1762 	if (likely(pid_has_task(pid, PIDTYPE_PID))) {
1763 		ns = proc_pid_ns(file_inode(m->file)->i_sb);
1764 		nr = pid_nr_ns(pid, ns);
1765 	}
1766 
1767 	seq_put_decimal_ll(m, "Pid:\t", nr);
1768 
1769 #ifdef CONFIG_PID_NS
1770 	seq_put_decimal_ll(m, "\nNSpid:\t", nr);
1771 	if (nr > 0) {
1772 		int i;
1773 
1774 		/* If nr is non-zero it means that 'pid' is valid and that
1775 		 * ns, i.e. the pid namespace associated with the procfs
1776 		 * instance, is in the pid namespace hierarchy of pid.
1777 		 * Start at one below the already printed level.
1778 		 */
1779 		for (i = ns->level + 1; i <= pid->level; i++)
1780 			seq_put_decimal_ll(m, "\t", pid->numbers[i].nr);
1781 	}
1782 #endif
1783 	seq_putc(m, '\n');
1784 }
1785 #endif
1786 
1787 /*
1788  * Poll support for process exit notification.
1789  */
1790 static __poll_t pidfd_poll(struct file *file, struct poll_table_struct *pts)
1791 {
1792 	struct pid *pid = file->private_data;
1793 	__poll_t poll_flags = 0;
1794 
1795 	poll_wait(file, &pid->wait_pidfd, pts);
1796 
1797 	/*
1798 	 * Inform pollers only when the whole thread group exits.
1799 	 * If the thread group leader exits before all other threads in the
1800 	 * group, then poll(2) should block, similar to the wait(2) family.
1801 	 */
1802 	if (thread_group_exited(pid))
1803 		poll_flags = EPOLLIN | EPOLLRDNORM;
1804 
1805 	return poll_flags;
1806 }
1807 
1808 const struct file_operations pidfd_fops = {
1809 	.release = pidfd_release,
1810 	.poll = pidfd_poll,
1811 #ifdef CONFIG_PROC_FS
1812 	.show_fdinfo = pidfd_show_fdinfo,
1813 #endif
1814 };
1815 
1816 static void __delayed_free_task(struct rcu_head *rhp)
1817 {
1818 	struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
1819 
1820 	free_task(tsk);
1821 }
1822 
1823 static __always_inline void delayed_free_task(struct task_struct *tsk)
1824 {
1825 	if (IS_ENABLED(CONFIG_MEMCG))
1826 		call_rcu(&tsk->rcu, __delayed_free_task);
1827 	else
1828 		free_task(tsk);
1829 }
1830 
1831 static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk)
1832 {
1833 	/* Skip if kernel thread */
1834 	if (!tsk->mm)
1835 		return;
1836 
1837 	/* Skip if spawning a thread or using vfork */
1838 	if ((clone_flags & (CLONE_VM | CLONE_THREAD | CLONE_VFORK)) != CLONE_VM)
1839 		return;
1840 
1841 	/* We need to synchronize with __set_oom_adj */
1842 	mutex_lock(&oom_adj_mutex);
1843 	set_bit(MMF_MULTIPROCESS, &tsk->mm->flags);
1844 	/* Update the values in case they were changed after copy_signal */
1845 	tsk->signal->oom_score_adj = current->signal->oom_score_adj;
1846 	tsk->signal->oom_score_adj_min = current->signal->oom_score_adj_min;
1847 	mutex_unlock(&oom_adj_mutex);
1848 }
1849 
1850 /*
1851  * This creates a new process as a copy of the old one,
1852  * but does not actually start it yet.
1853  *
1854  * It copies the registers, and all the appropriate
1855  * parts of the process environment (as per the clone
1856  * flags). The actual kick-off is left to the caller.
1857  */
1858 static __latent_entropy struct task_struct *copy_process(
1859 					struct pid *pid,
1860 					int trace,
1861 					int node,
1862 					struct kernel_clone_args *args)
1863 {
1864 	int pidfd = -1, retval;
1865 	struct task_struct *p;
1866 	struct multiprocess_signals delayed;
1867 	struct file *pidfile = NULL;
1868 	u64 clone_flags = args->flags;
1869 	struct nsproxy *nsp = current->nsproxy;
1870 
1871 	/*
1872 	 * Don't allow sharing the root directory with processes in a different
1873 	 * namespace
1874 	 */
1875 	if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
1876 		return ERR_PTR(-EINVAL);
1877 
1878 	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
1879 		return ERR_PTR(-EINVAL);
1880 
1881 	/*
1882 	 * Thread groups must share signals as well, and detached threads
1883 	 * can only be started up within the thread group.
1884 	 */
1885 	if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND))
1886 		return ERR_PTR(-EINVAL);
1887 
1888 	/*
1889 	 * Shared signal handlers imply shared VM. By way of the above,
1890 	 * thread groups also imply shared VM. Blocking this case allows
1891 	 * for various simplifications in other code.
1892 	 */
1893 	if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM))
1894 		return ERR_PTR(-EINVAL);
1895 
1896 	/*
1897 	 * Siblings of global init remain as zombies on exit since they are
1898 	 * not reaped by their parent (swapper). To solve this and to avoid
1899 	 * multi-rooted process trees, prevent global and container-inits
1900 	 * from creating siblings.
1901 	 */
1902 	if ((clone_flags & CLONE_PARENT) &&
1903 				current->signal->flags & SIGNAL_UNKILLABLE)
1904 		return ERR_PTR(-EINVAL);
1905 
1906 	/*
1907 	 * If the new process will be in a different pid or user namespace
1908 	 * do not allow it to share a thread group with the forking task.
1909 	 */
1910 	if (clone_flags & CLONE_THREAD) {
1911 		if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
1912 		    (task_active_pid_ns(current) != nsp->pid_ns_for_children))
1913 			return ERR_PTR(-EINVAL);
1914 	}
1915 
1916 	/*
1917 	 * If the new process will be in a different time namespace
1918 	 * do not allow it to share VM or a thread group with the forking task.
1919 	 */
1920 	if (clone_flags & (CLONE_THREAD | CLONE_VM)) {
1921 		if (nsp->time_ns != nsp->time_ns_for_children)
1922 			return ERR_PTR(-EINVAL);
1923 	}
1924 
1925 	if (clone_flags & CLONE_PIDFD) {
1926 		/*
1927 		 * - CLONE_DETACHED is blocked so that we can potentially
1928 		 *   reuse it later for CLONE_PIDFD.
1929 		 * - CLONE_THREAD is blocked until someone really needs it.
1930 		 */
1931 		if (clone_flags & (CLONE_DETACHED | CLONE_THREAD))
1932 			return ERR_PTR(-EINVAL);
1933 	}
1934 
1935 	/*
1936 	 * Force any signals received before this point to be delivered
1937 	 * before the fork happens.  Collect up signals sent to multiple
1938 	 * processes that happen during the fork and delay them so that
1939 	 * they appear to happen after the fork.
1940 	 */
1941 	sigemptyset(&delayed.signal);
1942 	INIT_HLIST_NODE(&delayed.node);
1943 
1944 	spin_lock_irq(&current->sighand->siglock);
1945 	if (!(clone_flags & CLONE_THREAD))
1946 		hlist_add_head(&delayed.node, &current->signal->multiprocess);
1947 	recalc_sigpending();
1948 	spin_unlock_irq(&current->sighand->siglock);
1949 	retval = -ERESTARTNOINTR;
1950 	if (task_sigpending(current))
1951 		goto fork_out;
1952 
1953 	retval = -ENOMEM;
1954 	p = dup_task_struct(current, node);
1955 	if (!p)
1956 		goto fork_out;
1957 	if (args->io_thread) {
1958 		/*
1959 		 * Mark us an IO worker, and block any signal that isn't
1960 		 * fatal or STOP
1961 		 */
1962 		p->flags |= PF_IO_WORKER;
1963 		siginitsetinv(&p->blocked, sigmask(SIGKILL)|sigmask(SIGSTOP));
1964 	}
1965 
1966 	/*
1967 	 * This _must_ happen before we call free_task(), i.e. before we jump
1968 	 * to any of the bad_fork_* labels. This is to avoid freeing
1969 	 * p->set_child_tid which is (ab)used as a kthread's data pointer for
1970 	 * kernel threads (PF_KTHREAD).
1971 	 */
1972 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? args->child_tid : NULL;
1973 	/*
1974 	 * Clear TID on mm_release()?
1975 	 */
1976 	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? args->child_tid : NULL;
1977 
1978 	ftrace_graph_init_task(p);
1979 
1980 	rt_mutex_init_task(p);
1981 
1982 	lockdep_assert_irqs_enabled();
1983 #ifdef CONFIG_PROVE_LOCKING
1984 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
1985 #endif
1986 	retval = -EAGAIN;
1987 	if (is_ucounts_overlimit(task_ucounts(p), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
1988 		if (p->real_cred->user != INIT_USER &&
1989 		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
1990 			goto bad_fork_free;
1991 	}
1992 	current->flags &= ~PF_NPROC_EXCEEDED;
1993 
1994 	retval = copy_creds(p, clone_flags);
1995 	if (retval < 0)
1996 		goto bad_fork_free;
1997 
1998 	/*
1999 	 * If multiple threads are within copy_process(), then this check
2000 	 * triggers too late. This doesn't hurt, the check is only there
2001 	 * to stop root fork bombs.
2002 	 */
2003 	retval = -EAGAIN;
2004 	if (data_race(nr_threads >= max_threads))
2005 		goto bad_fork_cleanup_count;
2006 
2007 	delayacct_tsk_init(p);	/* Must remain after dup_task_struct() */
2008 	p->flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER | PF_IDLE | PF_NO_SETAFFINITY);
2009 	p->flags |= PF_FORKNOEXEC;
2010 	INIT_LIST_HEAD(&p->children);
2011 	INIT_LIST_HEAD(&p->sibling);
2012 	rcu_copy_process(p);
2013 	p->vfork_done = NULL;
2014 	spin_lock_init(&p->alloc_lock);
2015 
2016 	init_sigpending(&p->pending);
2017 
2018 	p->utime = p->stime = p->gtime = 0;
2019 #ifdef CONFIG_ARCH_HAS_SCALED_CPUTIME
2020 	p->utimescaled = p->stimescaled = 0;
2021 #endif
2022 	prev_cputime_init(&p->prev_cputime);
2023 
2024 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN
2025 	seqcount_init(&p->vtime.seqcount);
2026 	p->vtime.starttime = 0;
2027 	p->vtime.state = VTIME_INACTIVE;
2028 #endif
2029 
2030 #ifdef CONFIG_IO_URING
2031 	p->io_uring = NULL;
2032 #endif
2033 
2034 #if defined(SPLIT_RSS_COUNTING)
2035 	memset(&p->rss_stat, 0, sizeof(p->rss_stat));
2036 #endif
2037 
2038 	p->default_timer_slack_ns = current->timer_slack_ns;
2039 
2040 #ifdef CONFIG_PSI
2041 	p->psi_flags = 0;
2042 #endif
2043 
2044 	task_io_accounting_init(&p->ioac);
2045 	acct_clear_integrals(p);
2046 
2047 	posix_cputimers_init(&p->posix_cputimers);
2048 
2049 	p->io_context = NULL;
2050 	audit_set_context(p, NULL);
2051 	cgroup_fork(p);
2052 #ifdef CONFIG_NUMA
2053 	p->mempolicy = mpol_dup(p->mempolicy);
2054 	if (IS_ERR(p->mempolicy)) {
2055 		retval = PTR_ERR(p->mempolicy);
2056 		p->mempolicy = NULL;
2057 		goto bad_fork_cleanup_threadgroup_lock;
2058 	}
2059 #endif
2060 #ifdef CONFIG_CPUSETS
2061 	p->cpuset_mem_spread_rotor = NUMA_NO_NODE;
2062 	p->cpuset_slab_spread_rotor = NUMA_NO_NODE;
2063 	seqcount_spinlock_init(&p->mems_allowed_seq, &p->alloc_lock);
2064 #endif
2065 #ifdef CONFIG_TRACE_IRQFLAGS
2066 	memset(&p->irqtrace, 0, sizeof(p->irqtrace));
2067 	p->irqtrace.hardirq_disable_ip	= _THIS_IP_;
2068 	p->irqtrace.softirq_enable_ip	= _THIS_IP_;
2069 	p->softirqs_enabled		= 1;
2070 	p->softirq_context		= 0;
2071 #endif
2072 
2073 	p->pagefault_disabled = 0;
2074 
2075 #ifdef CONFIG_LOCKDEP
2076 	lockdep_init_task(p);
2077 #endif
2078 
2079 #ifdef CONFIG_DEBUG_MUTEXES
2080 	p->blocked_on = NULL; /* not blocked yet */
2081 #endif
2082 #ifdef CONFIG_BCACHE
2083 	p->sequential_io	= 0;
2084 	p->sequential_io_avg	= 0;
2085 #endif
2086 #ifdef CONFIG_BPF_SYSCALL
2087 	RCU_INIT_POINTER(p->bpf_storage, NULL);
2088 	p->bpf_ctx = NULL;
2089 #endif
2090 
2091 	/* Perform scheduler related setup. Assign this task to a CPU. */
2092 	retval = sched_fork(clone_flags, p);
2093 	if (retval)
2094 		goto bad_fork_cleanup_policy;
2095 
2096 	retval = perf_event_init_task(p, clone_flags);
2097 	if (retval)
2098 		goto bad_fork_cleanup_policy;
2099 	retval = audit_alloc(p);
2100 	if (retval)
2101 		goto bad_fork_cleanup_perf;
2102 	/* copy all the process information */
2103 	shm_init_task(p);
2104 	retval = security_task_alloc(p, clone_flags);
2105 	if (retval)
2106 		goto bad_fork_cleanup_audit;
2107 	retval = copy_semundo(clone_flags, p);
2108 	if (retval)
2109 		goto bad_fork_cleanup_security;
2110 	retval = copy_files(clone_flags, p);
2111 	if (retval)
2112 		goto bad_fork_cleanup_semundo;
2113 	retval = copy_fs(clone_flags, p);
2114 	if (retval)
2115 		goto bad_fork_cleanup_files;
2116 	retval = copy_sighand(clone_flags, p);
2117 	if (retval)
2118 		goto bad_fork_cleanup_fs;
2119 	retval = copy_signal(clone_flags, p);
2120 	if (retval)
2121 		goto bad_fork_cleanup_sighand;
2122 	retval = copy_mm(clone_flags, p);
2123 	if (retval)
2124 		goto bad_fork_cleanup_signal;
2125 	retval = copy_namespaces(clone_flags, p);
2126 	if (retval)
2127 		goto bad_fork_cleanup_mm;
2128 	retval = copy_io(clone_flags, p);
2129 	if (retval)
2130 		goto bad_fork_cleanup_namespaces;
2131 	retval = copy_thread(clone_flags, args->stack, args->stack_size, p, args->tls);
2132 	if (retval)
2133 		goto bad_fork_cleanup_io;
2134 
2135 	stackleak_task_init(p);
2136 
2137 	if (pid != &init_struct_pid) {
2138 		pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid,
2139 				args->set_tid_size);
2140 		if (IS_ERR(pid)) {
2141 			retval = PTR_ERR(pid);
2142 			goto bad_fork_cleanup_thread;
2143 		}
2144 	}
2145 
2146 	/*
2147 	 * This has to happen after we've potentially unshared the file
2148 	 * descriptor table (so that the pidfd doesn't leak into the child
2149 	 * if the fd table isn't shared).
2150 	 */
2151 	if (clone_flags & CLONE_PIDFD) {
2152 		retval = get_unused_fd_flags(O_RDWR | O_CLOEXEC);
2153 		if (retval < 0)
2154 			goto bad_fork_free_pid;
2155 
2156 		pidfd = retval;
2157 
2158 		pidfile = anon_inode_getfile("[pidfd]", &pidfd_fops, pid,
2159 					      O_RDWR | O_CLOEXEC);
2160 		if (IS_ERR(pidfile)) {
2161 			put_unused_fd(pidfd);
2162 			retval = PTR_ERR(pidfile);
2163 			goto bad_fork_free_pid;
2164 		}
2165 		get_pid(pid);	/* held by pidfile now */
2166 
2167 		retval = put_user(pidfd, args->pidfd);
2168 		if (retval)
2169 			goto bad_fork_put_pidfd;
2170 	}
2171 
2172 #ifdef CONFIG_BLOCK
2173 	p->plug = NULL;
2174 #endif
2175 	futex_init_task(p);
2176 
2177 	/*
2178 	 * sigaltstack should be cleared when sharing the same VM
2179 	 */
2180 	if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM)
2181 		sas_ss_reset(p);
2182 
2183 	/*
2184 	 * Syscall tracing and stepping should be turned off in the
2185 	 * child regardless of CLONE_PTRACE.
2186 	 */
2187 	user_disable_single_step(p);
2188 	clear_task_syscall_work(p, SYSCALL_TRACE);
2189 #if defined(CONFIG_GENERIC_ENTRY) || defined(TIF_SYSCALL_EMU)
2190 	clear_task_syscall_work(p, SYSCALL_EMU);
2191 #endif
2192 	clear_tsk_latency_tracing(p);
2193 
2194 	/* ok, now we should be set up.. */
2195 	p->pid = pid_nr(pid);
2196 	if (clone_flags & CLONE_THREAD) {
2197 		p->group_leader = current->group_leader;
2198 		p->tgid = current->tgid;
2199 	} else {
2200 		p->group_leader = p;
2201 		p->tgid = p->pid;
2202 	}
2203 
2204 	p->nr_dirtied = 0;
2205 	p->nr_dirtied_pause = 128 >> (PAGE_SHIFT - 10);
2206 	p->dirty_paused_when = 0;
2207 
2208 	p->pdeath_signal = 0;
2209 	INIT_LIST_HEAD(&p->thread_group);
2210 	p->task_works = NULL;
2211 
2212 #ifdef CONFIG_KRETPROBES
2213 	p->kretprobe_instances.first = NULL;
2214 #endif
2215 
2216 	/*
2217 	 * Ensure that the cgroup subsystem policies allow the new process to be
2218 	 * forked. It should be noted that the new process's css_set can be changed
2219 	 * between here and cgroup_post_fork() if an organisation operation is in
2220 	 * progress.
2221 	 */
2222 	retval = cgroup_can_fork(p, args);
2223 	if (retval)
2224 		goto bad_fork_put_pidfd;
2225 
2226 	/*
2227 	 * From this point on we must avoid any synchronous user-space
2228 	 * communication until we take the tasklist-lock. In particular, we do
2229 	 * not want user-space to be able to predict the process start-time by
2230 	 * stalling fork(2) after we recorded the start_time but before it is
2231 	 * visible to the system.
2232 	 */
2233 
2234 	p->start_time = ktime_get_ns();
2235 	p->start_boottime = ktime_get_boottime_ns();
2236 
2237 	/*
2238 	 * Make it visible to the rest of the system, but dont wake it up yet.
2239 	 * Need tasklist lock for parent etc handling!
2240 	 */
2241 	write_lock_irq(&tasklist_lock);
2242 
2243 	/* CLONE_PARENT re-uses the old parent */
2244 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
2245 		p->real_parent = current->real_parent;
2246 		p->parent_exec_id = current->parent_exec_id;
2247 		if (clone_flags & CLONE_THREAD)
2248 			p->exit_signal = -1;
2249 		else
2250 			p->exit_signal = current->group_leader->exit_signal;
2251 	} else {
2252 		p->real_parent = current;
2253 		p->parent_exec_id = current->self_exec_id;
2254 		p->exit_signal = args->exit_signal;
2255 	}
2256 
2257 	klp_copy_process(p);
2258 
2259 	sched_core_fork(p);
2260 
2261 	spin_lock(&current->sighand->siglock);
2262 
2263 	/*
2264 	 * Copy seccomp details explicitly here, in case they were changed
2265 	 * before holding sighand lock.
2266 	 */
2267 	copy_seccomp(p);
2268 
2269 	rseq_fork(p, clone_flags);
2270 
2271 	/* Don't start children in a dying pid namespace */
2272 	if (unlikely(!(ns_of_pid(pid)->pid_allocated & PIDNS_ADDING))) {
2273 		retval = -ENOMEM;
2274 		goto bad_fork_cancel_cgroup;
2275 	}
2276 
2277 	/* Let kill terminate clone/fork in the middle */
2278 	if (fatal_signal_pending(current)) {
2279 		retval = -EINTR;
2280 		goto bad_fork_cancel_cgroup;
2281 	}
2282 
2283 	/* past the last point of failure */
2284 	if (pidfile)
2285 		fd_install(pidfd, pidfile);
2286 
2287 	init_task_pid_links(p);
2288 	if (likely(p->pid)) {
2289 		ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
2290 
2291 		init_task_pid(p, PIDTYPE_PID, pid);
2292 		if (thread_group_leader(p)) {
2293 			init_task_pid(p, PIDTYPE_TGID, pid);
2294 			init_task_pid(p, PIDTYPE_PGID, task_pgrp(current));
2295 			init_task_pid(p, PIDTYPE_SID, task_session(current));
2296 
2297 			if (is_child_reaper(pid)) {
2298 				ns_of_pid(pid)->child_reaper = p;
2299 				p->signal->flags |= SIGNAL_UNKILLABLE;
2300 			}
2301 			p->signal->shared_pending.signal = delayed.signal;
2302 			p->signal->tty = tty_kref_get(current->signal->tty);
2303 			/*
2304 			 * Inherit has_child_subreaper flag under the same
2305 			 * tasklist_lock with adding child to the process tree
2306 			 * for propagate_has_child_subreaper optimization.
2307 			 */
2308 			p->signal->has_child_subreaper = p->real_parent->signal->has_child_subreaper ||
2309 							 p->real_parent->signal->is_child_subreaper;
2310 			list_add_tail(&p->sibling, &p->real_parent->children);
2311 			list_add_tail_rcu(&p->tasks, &init_task.tasks);
2312 			attach_pid(p, PIDTYPE_TGID);
2313 			attach_pid(p, PIDTYPE_PGID);
2314 			attach_pid(p, PIDTYPE_SID);
2315 			__this_cpu_inc(process_counts);
2316 		} else {
2317 			current->signal->nr_threads++;
2318 			atomic_inc(&current->signal->live);
2319 			refcount_inc(&current->signal->sigcnt);
2320 			task_join_group_stop(p);
2321 			list_add_tail_rcu(&p->thread_group,
2322 					  &p->group_leader->thread_group);
2323 			list_add_tail_rcu(&p->thread_node,
2324 					  &p->signal->thread_head);
2325 		}
2326 		attach_pid(p, PIDTYPE_PID);
2327 		nr_threads++;
2328 	}
2329 	total_forks++;
2330 	hlist_del_init(&delayed.node);
2331 	spin_unlock(&current->sighand->siglock);
2332 	syscall_tracepoint_update(p);
2333 	write_unlock_irq(&tasklist_lock);
2334 
2335 	proc_fork_connector(p);
2336 	sched_post_fork(p);
2337 	cgroup_post_fork(p, args);
2338 	perf_event_fork(p);
2339 
2340 	trace_task_newtask(p, clone_flags);
2341 	uprobe_copy_process(p, clone_flags);
2342 
2343 	copy_oom_score_adj(clone_flags, p);
2344 
2345 	return p;
2346 
2347 bad_fork_cancel_cgroup:
2348 	sched_core_free(p);
2349 	spin_unlock(&current->sighand->siglock);
2350 	write_unlock_irq(&tasklist_lock);
2351 	cgroup_cancel_fork(p, args);
2352 bad_fork_put_pidfd:
2353 	if (clone_flags & CLONE_PIDFD) {
2354 		fput(pidfile);
2355 		put_unused_fd(pidfd);
2356 	}
2357 bad_fork_free_pid:
2358 	if (pid != &init_struct_pid)
2359 		free_pid(pid);
2360 bad_fork_cleanup_thread:
2361 	exit_thread(p);
2362 bad_fork_cleanup_io:
2363 	if (p->io_context)
2364 		exit_io_context(p);
2365 bad_fork_cleanup_namespaces:
2366 	exit_task_namespaces(p);
2367 bad_fork_cleanup_mm:
2368 	if (p->mm) {
2369 		mm_clear_owner(p->mm, p);
2370 		mmput(p->mm);
2371 	}
2372 bad_fork_cleanup_signal:
2373 	if (!(clone_flags & CLONE_THREAD))
2374 		free_signal_struct(p->signal);
2375 bad_fork_cleanup_sighand:
2376 	__cleanup_sighand(p->sighand);
2377 bad_fork_cleanup_fs:
2378 	exit_fs(p); /* blocking */
2379 bad_fork_cleanup_files:
2380 	exit_files(p); /* blocking */
2381 bad_fork_cleanup_semundo:
2382 	exit_sem(p);
2383 bad_fork_cleanup_security:
2384 	security_task_free(p);
2385 bad_fork_cleanup_audit:
2386 	audit_free(p);
2387 bad_fork_cleanup_perf:
2388 	perf_event_free_task(p);
2389 bad_fork_cleanup_policy:
2390 	lockdep_free_task(p);
2391 #ifdef CONFIG_NUMA
2392 	mpol_put(p->mempolicy);
2393 bad_fork_cleanup_threadgroup_lock:
2394 #endif
2395 	delayacct_tsk_free(p);
2396 bad_fork_cleanup_count:
2397 	dec_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1);
2398 	exit_creds(p);
2399 bad_fork_free:
2400 	WRITE_ONCE(p->__state, TASK_DEAD);
2401 	put_task_stack(p);
2402 	delayed_free_task(p);
2403 fork_out:
2404 	spin_lock_irq(&current->sighand->siglock);
2405 	hlist_del_init(&delayed.node);
2406 	spin_unlock_irq(&current->sighand->siglock);
2407 	return ERR_PTR(retval);
2408 }
2409 
2410 static inline void init_idle_pids(struct task_struct *idle)
2411 {
2412 	enum pid_type type;
2413 
2414 	for (type = PIDTYPE_PID; type < PIDTYPE_MAX; ++type) {
2415 		INIT_HLIST_NODE(&idle->pid_links[type]); /* not really needed */
2416 		init_task_pid(idle, type, &init_struct_pid);
2417 	}
2418 }
2419 
2420 struct task_struct * __init fork_idle(int cpu)
2421 {
2422 	struct task_struct *task;
2423 	struct kernel_clone_args args = {
2424 		.flags = CLONE_VM,
2425 	};
2426 
2427 	task = copy_process(&init_struct_pid, 0, cpu_to_node(cpu), &args);
2428 	if (!IS_ERR(task)) {
2429 		init_idle_pids(task);
2430 		init_idle(task, cpu);
2431 	}
2432 
2433 	return task;
2434 }
2435 
2436 struct mm_struct *copy_init_mm(void)
2437 {
2438 	return dup_mm(NULL, &init_mm);
2439 }
2440 
2441 /*
2442  * This is like kernel_clone(), but shaved down and tailored to just
2443  * creating io_uring workers. It returns a created task, or an error pointer.
2444  * The returned task is inactive, and the caller must fire it up through
2445  * wake_up_new_task(p). All signals are blocked in the created task.
2446  */
2447 struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node)
2448 {
2449 	unsigned long flags = CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|
2450 				CLONE_IO;
2451 	struct kernel_clone_args args = {
2452 		.flags		= ((lower_32_bits(flags) | CLONE_VM |
2453 				    CLONE_UNTRACED) & ~CSIGNAL),
2454 		.exit_signal	= (lower_32_bits(flags) & CSIGNAL),
2455 		.stack		= (unsigned long)fn,
2456 		.stack_size	= (unsigned long)arg,
2457 		.io_thread	= 1,
2458 	};
2459 
2460 	return copy_process(NULL, 0, node, &args);
2461 }
2462 
2463 /*
2464  *  Ok, this is the main fork-routine.
2465  *
2466  * It copies the process, and if successful kick-starts
2467  * it and waits for it to finish using the VM if required.
2468  *
2469  * args->exit_signal is expected to be checked for sanity by the caller.
2470  */
2471 pid_t kernel_clone(struct kernel_clone_args *args)
2472 {
2473 	u64 clone_flags = args->flags;
2474 	struct completion vfork;
2475 	struct pid *pid;
2476 	struct task_struct *p;
2477 	int trace = 0;
2478 	pid_t nr;
2479 
2480 	/*
2481 	 * For legacy clone() calls, CLONE_PIDFD uses the parent_tid argument
2482 	 * to return the pidfd. Hence, CLONE_PIDFD and CLONE_PARENT_SETTID are
2483 	 * mutually exclusive. With clone3() CLONE_PIDFD has grown a separate
2484 	 * field in struct clone_args and it still doesn't make sense to have
2485 	 * them both point at the same memory location. Performing this check
2486 	 * here has the advantage that we don't need to have a separate helper
2487 	 * to check for legacy clone().
2488 	 */
2489 	if ((args->flags & CLONE_PIDFD) &&
2490 	    (args->flags & CLONE_PARENT_SETTID) &&
2491 	    (args->pidfd == args->parent_tid))
2492 		return -EINVAL;
2493 
2494 	/*
2495 	 * Determine whether and which event to report to ptracer.  When
2496 	 * called from kernel_thread or CLONE_UNTRACED is explicitly
2497 	 * requested, no event is reported; otherwise, report if the event
2498 	 * for the type of forking is enabled.
2499 	 */
2500 	if (!(clone_flags & CLONE_UNTRACED)) {
2501 		if (clone_flags & CLONE_VFORK)
2502 			trace = PTRACE_EVENT_VFORK;
2503 		else if (args->exit_signal != SIGCHLD)
2504 			trace = PTRACE_EVENT_CLONE;
2505 		else
2506 			trace = PTRACE_EVENT_FORK;
2507 
2508 		if (likely(!ptrace_event_enabled(current, trace)))
2509 			trace = 0;
2510 	}
2511 
2512 	p = copy_process(NULL, trace, NUMA_NO_NODE, args);
2513 	add_latent_entropy();
2514 
2515 	if (IS_ERR(p))
2516 		return PTR_ERR(p);
2517 
2518 	/*
2519 	 * Do this prior waking up the new thread - the thread pointer
2520 	 * might get invalid after that point, if the thread exits quickly.
2521 	 */
2522 	trace_sched_process_fork(current, p);
2523 
2524 	pid = get_task_pid(p, PIDTYPE_PID);
2525 	nr = pid_vnr(pid);
2526 
2527 	if (clone_flags & CLONE_PARENT_SETTID)
2528 		put_user(nr, args->parent_tid);
2529 
2530 	if (clone_flags & CLONE_VFORK) {
2531 		p->vfork_done = &vfork;
2532 		init_completion(&vfork);
2533 		get_task_struct(p);
2534 	}
2535 
2536 	wake_up_new_task(p);
2537 
2538 	/* forking complete and child started to run, tell ptracer */
2539 	if (unlikely(trace))
2540 		ptrace_event_pid(trace, pid);
2541 
2542 	if (clone_flags & CLONE_VFORK) {
2543 		if (!wait_for_vfork_done(p, &vfork))
2544 			ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid);
2545 	}
2546 
2547 	put_pid(pid);
2548 	return nr;
2549 }
2550 
2551 /*
2552  * Create a kernel thread.
2553  */
2554 pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
2555 {
2556 	struct kernel_clone_args args = {
2557 		.flags		= ((lower_32_bits(flags) | CLONE_VM |
2558 				    CLONE_UNTRACED) & ~CSIGNAL),
2559 		.exit_signal	= (lower_32_bits(flags) & CSIGNAL),
2560 		.stack		= (unsigned long)fn,
2561 		.stack_size	= (unsigned long)arg,
2562 	};
2563 
2564 	return kernel_clone(&args);
2565 }
2566 
2567 #ifdef __ARCH_WANT_SYS_FORK
2568 SYSCALL_DEFINE0(fork)
2569 {
2570 #ifdef CONFIG_MMU
2571 	struct kernel_clone_args args = {
2572 		.exit_signal = SIGCHLD,
2573 	};
2574 
2575 	return kernel_clone(&args);
2576 #else
2577 	/* can not support in nommu mode */
2578 	return -EINVAL;
2579 #endif
2580 }
2581 #endif
2582 
2583 #ifdef __ARCH_WANT_SYS_VFORK
2584 SYSCALL_DEFINE0(vfork)
2585 {
2586 	struct kernel_clone_args args = {
2587 		.flags		= CLONE_VFORK | CLONE_VM,
2588 		.exit_signal	= SIGCHLD,
2589 	};
2590 
2591 	return kernel_clone(&args);
2592 }
2593 #endif
2594 
2595 #ifdef __ARCH_WANT_SYS_CLONE
2596 #ifdef CONFIG_CLONE_BACKWARDS
2597 SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
2598 		 int __user *, parent_tidptr,
2599 		 unsigned long, tls,
2600 		 int __user *, child_tidptr)
2601 #elif defined(CONFIG_CLONE_BACKWARDS2)
2602 SYSCALL_DEFINE5(clone, unsigned long, newsp, unsigned long, clone_flags,
2603 		 int __user *, parent_tidptr,
2604 		 int __user *, child_tidptr,
2605 		 unsigned long, tls)
2606 #elif defined(CONFIG_CLONE_BACKWARDS3)
2607 SYSCALL_DEFINE6(clone, unsigned long, clone_flags, unsigned long, newsp,
2608 		int, stack_size,
2609 		int __user *, parent_tidptr,
2610 		int __user *, child_tidptr,
2611 		unsigned long, tls)
2612 #else
2613 SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
2614 		 int __user *, parent_tidptr,
2615 		 int __user *, child_tidptr,
2616 		 unsigned long, tls)
2617 #endif
2618 {
2619 	struct kernel_clone_args args = {
2620 		.flags		= (lower_32_bits(clone_flags) & ~CSIGNAL),
2621 		.pidfd		= parent_tidptr,
2622 		.child_tid	= child_tidptr,
2623 		.parent_tid	= parent_tidptr,
2624 		.exit_signal	= (lower_32_bits(clone_flags) & CSIGNAL),
2625 		.stack		= newsp,
2626 		.tls		= tls,
2627 	};
2628 
2629 	return kernel_clone(&args);
2630 }
2631 #endif
2632 
2633 #ifdef __ARCH_WANT_SYS_CLONE3
2634 
2635 noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
2636 					      struct clone_args __user *uargs,
2637 					      size_t usize)
2638 {
2639 	int err;
2640 	struct clone_args args;
2641 	pid_t *kset_tid = kargs->set_tid;
2642 
2643 	BUILD_BUG_ON(offsetofend(struct clone_args, tls) !=
2644 		     CLONE_ARGS_SIZE_VER0);
2645 	BUILD_BUG_ON(offsetofend(struct clone_args, set_tid_size) !=
2646 		     CLONE_ARGS_SIZE_VER1);
2647 	BUILD_BUG_ON(offsetofend(struct clone_args, cgroup) !=
2648 		     CLONE_ARGS_SIZE_VER2);
2649 	BUILD_BUG_ON(sizeof(struct clone_args) != CLONE_ARGS_SIZE_VER2);
2650 
2651 	if (unlikely(usize > PAGE_SIZE))
2652 		return -E2BIG;
2653 	if (unlikely(usize < CLONE_ARGS_SIZE_VER0))
2654 		return -EINVAL;
2655 
2656 	err = copy_struct_from_user(&args, sizeof(args), uargs, usize);
2657 	if (err)
2658 		return err;
2659 
2660 	if (unlikely(args.set_tid_size > MAX_PID_NS_LEVEL))
2661 		return -EINVAL;
2662 
2663 	if (unlikely(!args.set_tid && args.set_tid_size > 0))
2664 		return -EINVAL;
2665 
2666 	if (unlikely(args.set_tid && args.set_tid_size == 0))
2667 		return -EINVAL;
2668 
2669 	/*
2670 	 * Verify that higher 32bits of exit_signal are unset and that
2671 	 * it is a valid signal
2672 	 */
2673 	if (unlikely((args.exit_signal & ~((u64)CSIGNAL)) ||
2674 		     !valid_signal(args.exit_signal)))
2675 		return -EINVAL;
2676 
2677 	if ((args.flags & CLONE_INTO_CGROUP) &&
2678 	    (args.cgroup > INT_MAX || usize < CLONE_ARGS_SIZE_VER2))
2679 		return -EINVAL;
2680 
2681 	*kargs = (struct kernel_clone_args){
2682 		.flags		= args.flags,
2683 		.pidfd		= u64_to_user_ptr(args.pidfd),
2684 		.child_tid	= u64_to_user_ptr(args.child_tid),
2685 		.parent_tid	= u64_to_user_ptr(args.parent_tid),
2686 		.exit_signal	= args.exit_signal,
2687 		.stack		= args.stack,
2688 		.stack_size	= args.stack_size,
2689 		.tls		= args.tls,
2690 		.set_tid_size	= args.set_tid_size,
2691 		.cgroup		= args.cgroup,
2692 	};
2693 
2694 	if (args.set_tid &&
2695 		copy_from_user(kset_tid, u64_to_user_ptr(args.set_tid),
2696 			(kargs->set_tid_size * sizeof(pid_t))))
2697 		return -EFAULT;
2698 
2699 	kargs->set_tid = kset_tid;
2700 
2701 	return 0;
2702 }
2703 
2704 /**
2705  * clone3_stack_valid - check and prepare stack
2706  * @kargs: kernel clone args
2707  *
2708  * Verify that the stack arguments userspace gave us are sane.
2709  * In addition, set the stack direction for userspace since it's easy for us to
2710  * determine.
2711  */
2712 static inline bool clone3_stack_valid(struct kernel_clone_args *kargs)
2713 {
2714 	if (kargs->stack == 0) {
2715 		if (kargs->stack_size > 0)
2716 			return false;
2717 	} else {
2718 		if (kargs->stack_size == 0)
2719 			return false;
2720 
2721 		if (!access_ok((void __user *)kargs->stack, kargs->stack_size))
2722 			return false;
2723 
2724 #if !defined(CONFIG_STACK_GROWSUP) && !defined(CONFIG_IA64)
2725 		kargs->stack += kargs->stack_size;
2726 #endif
2727 	}
2728 
2729 	return true;
2730 }
2731 
2732 static bool clone3_args_valid(struct kernel_clone_args *kargs)
2733 {
2734 	/* Verify that no unknown flags are passed along. */
2735 	if (kargs->flags &
2736 	    ~(CLONE_LEGACY_FLAGS | CLONE_CLEAR_SIGHAND | CLONE_INTO_CGROUP))
2737 		return false;
2738 
2739 	/*
2740 	 * - make the CLONE_DETACHED bit reusable for clone3
2741 	 * - make the CSIGNAL bits reusable for clone3
2742 	 */
2743 	if (kargs->flags & (CLONE_DETACHED | CSIGNAL))
2744 		return false;
2745 
2746 	if ((kargs->flags & (CLONE_SIGHAND | CLONE_CLEAR_SIGHAND)) ==
2747 	    (CLONE_SIGHAND | CLONE_CLEAR_SIGHAND))
2748 		return false;
2749 
2750 	if ((kargs->flags & (CLONE_THREAD | CLONE_PARENT)) &&
2751 	    kargs->exit_signal)
2752 		return false;
2753 
2754 	if (!clone3_stack_valid(kargs))
2755 		return false;
2756 
2757 	return true;
2758 }
2759 
2760 /**
2761  * clone3 - create a new process with specific properties
2762  * @uargs: argument structure
2763  * @size:  size of @uargs
2764  *
2765  * clone3() is the extensible successor to clone()/clone2().
2766  * It takes a struct as argument that is versioned by its size.
2767  *
2768  * Return: On success, a positive PID for the child process.
2769  *         On error, a negative errno number.
2770  */
2771 SYSCALL_DEFINE2(clone3, struct clone_args __user *, uargs, size_t, size)
2772 {
2773 	int err;
2774 
2775 	struct kernel_clone_args kargs;
2776 	pid_t set_tid[MAX_PID_NS_LEVEL];
2777 
2778 	kargs.set_tid = set_tid;
2779 
2780 	err = copy_clone_args_from_user(&kargs, uargs, size);
2781 	if (err)
2782 		return err;
2783 
2784 	if (!clone3_args_valid(&kargs))
2785 		return -EINVAL;
2786 
2787 	return kernel_clone(&kargs);
2788 }
2789 #endif
2790 
2791 void walk_process_tree(struct task_struct *top, proc_visitor visitor, void *data)
2792 {
2793 	struct task_struct *leader, *parent, *child;
2794 	int res;
2795 
2796 	read_lock(&tasklist_lock);
2797 	leader = top = top->group_leader;
2798 down:
2799 	for_each_thread(leader, parent) {
2800 		list_for_each_entry(child, &parent->children, sibling) {
2801 			res = visitor(child, data);
2802 			if (res) {
2803 				if (res < 0)
2804 					goto out;
2805 				leader = child;
2806 				goto down;
2807 			}
2808 up:
2809 			;
2810 		}
2811 	}
2812 
2813 	if (leader != top) {
2814 		child = leader;
2815 		parent = child->real_parent;
2816 		leader = parent->group_leader;
2817 		goto up;
2818 	}
2819 out:
2820 	read_unlock(&tasklist_lock);
2821 }
2822 
2823 #ifndef ARCH_MIN_MMSTRUCT_ALIGN
2824 #define ARCH_MIN_MMSTRUCT_ALIGN 0
2825 #endif
2826 
2827 static void sighand_ctor(void *data)
2828 {
2829 	struct sighand_struct *sighand = data;
2830 
2831 	spin_lock_init(&sighand->siglock);
2832 	init_waitqueue_head(&sighand->signalfd_wqh);
2833 }
2834 
2835 void __init proc_caches_init(void)
2836 {
2837 	unsigned int mm_size;
2838 
2839 	sighand_cachep = kmem_cache_create("sighand_cache",
2840 			sizeof(struct sighand_struct), 0,
2841 			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_TYPESAFE_BY_RCU|
2842 			SLAB_ACCOUNT, sighand_ctor);
2843 	signal_cachep = kmem_cache_create("signal_cache",
2844 			sizeof(struct signal_struct), 0,
2845 			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
2846 			NULL);
2847 	files_cachep = kmem_cache_create("files_cache",
2848 			sizeof(struct files_struct), 0,
2849 			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
2850 			NULL);
2851 	fs_cachep = kmem_cache_create("fs_cache",
2852 			sizeof(struct fs_struct), 0,
2853 			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
2854 			NULL);
2855 
2856 	/*
2857 	 * The mm_cpumask is located at the end of mm_struct, and is
2858 	 * dynamically sized based on the maximum CPU number this system
2859 	 * can have, taking hotplug into account (nr_cpu_ids).
2860 	 */
2861 	mm_size = sizeof(struct mm_struct) + cpumask_size();
2862 
2863 	mm_cachep = kmem_cache_create_usercopy("mm_struct",
2864 			mm_size, ARCH_MIN_MMSTRUCT_ALIGN,
2865 			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
2866 			offsetof(struct mm_struct, saved_auxv),
2867 			sizeof_field(struct mm_struct, saved_auxv),
2868 			NULL);
2869 	vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT);
2870 	mmap_init();
2871 	nsproxy_cache_init();
2872 }
2873 
2874 /*
2875  * Check constraints on flags passed to the unshare system call.
2876  */
2877 static int check_unshare_flags(unsigned long unshare_flags)
2878 {
2879 	if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
2880 				CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
2881 				CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET|
2882 				CLONE_NEWUSER|CLONE_NEWPID|CLONE_NEWCGROUP|
2883 				CLONE_NEWTIME))
2884 		return -EINVAL;
2885 	/*
2886 	 * Not implemented, but pretend it works if there is nothing
2887 	 * to unshare.  Note that unsharing the address space or the
2888 	 * signal handlers also need to unshare the signal queues (aka
2889 	 * CLONE_THREAD).
2890 	 */
2891 	if (unshare_flags & (CLONE_THREAD | CLONE_SIGHAND | CLONE_VM)) {
2892 		if (!thread_group_empty(current))
2893 			return -EINVAL;
2894 	}
2895 	if (unshare_flags & (CLONE_SIGHAND | CLONE_VM)) {
2896 		if (refcount_read(&current->sighand->count) > 1)
2897 			return -EINVAL;
2898 	}
2899 	if (unshare_flags & CLONE_VM) {
2900 		if (!current_is_single_threaded())
2901 			return -EINVAL;
2902 	}
2903 
2904 	return 0;
2905 }
2906 
2907 /*
2908  * Unshare the filesystem structure if it is being shared
2909  */
2910 static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
2911 {
2912 	struct fs_struct *fs = current->fs;
2913 
2914 	if (!(unshare_flags & CLONE_FS) || !fs)
2915 		return 0;
2916 
2917 	/* don't need lock here; in the worst case we'll do useless copy */
2918 	if (fs->users == 1)
2919 		return 0;
2920 
2921 	*new_fsp = copy_fs_struct(fs);
2922 	if (!*new_fsp)
2923 		return -ENOMEM;
2924 
2925 	return 0;
2926 }
2927 
2928 /*
2929  * Unshare file descriptor table if it is being shared
2930  */
2931 int unshare_fd(unsigned long unshare_flags, unsigned int max_fds,
2932 	       struct files_struct **new_fdp)
2933 {
2934 	struct files_struct *fd = current->files;
2935 	int error = 0;
2936 
2937 	if ((unshare_flags & CLONE_FILES) &&
2938 	    (fd && atomic_read(&fd->count) > 1)) {
2939 		*new_fdp = dup_fd(fd, max_fds, &error);
2940 		if (!*new_fdp)
2941 			return error;
2942 	}
2943 
2944 	return 0;
2945 }
2946 
2947 /*
2948  * unshare allows a process to 'unshare' part of the process
2949  * context which was originally shared using clone.  copy_*
2950  * functions used by kernel_clone() cannot be used here directly
2951  * because they modify an inactive task_struct that is being
2952  * constructed. Here we are modifying the current, active,
2953  * task_struct.
2954  */
2955 int ksys_unshare(unsigned long unshare_flags)
2956 {
2957 	struct fs_struct *fs, *new_fs = NULL;
2958 	struct files_struct *fd, *new_fd = NULL;
2959 	struct cred *new_cred = NULL;
2960 	struct nsproxy *new_nsproxy = NULL;
2961 	int do_sysvsem = 0;
2962 	int err;
2963 
2964 	/*
2965 	 * If unsharing a user namespace must also unshare the thread group
2966 	 * and unshare the filesystem root and working directories.
2967 	 */
2968 	if (unshare_flags & CLONE_NEWUSER)
2969 		unshare_flags |= CLONE_THREAD | CLONE_FS;
2970 	/*
2971 	 * If unsharing vm, must also unshare signal handlers.
2972 	 */
2973 	if (unshare_flags & CLONE_VM)
2974 		unshare_flags |= CLONE_SIGHAND;
2975 	/*
2976 	 * If unsharing a signal handlers, must also unshare the signal queues.
2977 	 */
2978 	if (unshare_flags & CLONE_SIGHAND)
2979 		unshare_flags |= CLONE_THREAD;
2980 	/*
2981 	 * If unsharing namespace, must also unshare filesystem information.
2982 	 */
2983 	if (unshare_flags & CLONE_NEWNS)
2984 		unshare_flags |= CLONE_FS;
2985 
2986 	err = check_unshare_flags(unshare_flags);
2987 	if (err)
2988 		goto bad_unshare_out;
2989 	/*
2990 	 * CLONE_NEWIPC must also detach from the undolist: after switching
2991 	 * to a new ipc namespace, the semaphore arrays from the old
2992 	 * namespace are unreachable.
2993 	 */
2994 	if (unshare_flags & (CLONE_NEWIPC|CLONE_SYSVSEM))
2995 		do_sysvsem = 1;
2996 	err = unshare_fs(unshare_flags, &new_fs);
2997 	if (err)
2998 		goto bad_unshare_out;
2999 	err = unshare_fd(unshare_flags, NR_OPEN_MAX, &new_fd);
3000 	if (err)
3001 		goto bad_unshare_cleanup_fs;
3002 	err = unshare_userns(unshare_flags, &new_cred);
3003 	if (err)
3004 		goto bad_unshare_cleanup_fd;
3005 	err = unshare_nsproxy_namespaces(unshare_flags, &new_nsproxy,
3006 					 new_cred, new_fs);
3007 	if (err)
3008 		goto bad_unshare_cleanup_cred;
3009 
3010 	if (new_cred) {
3011 		err = set_cred_ucounts(new_cred);
3012 		if (err)
3013 			goto bad_unshare_cleanup_cred;
3014 	}
3015 
3016 	if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) {
3017 		if (do_sysvsem) {
3018 			/*
3019 			 * CLONE_SYSVSEM is equivalent to sys_exit().
3020 			 */
3021 			exit_sem(current);
3022 		}
3023 		if (unshare_flags & CLONE_NEWIPC) {
3024 			/* Orphan segments in old ns (see sem above). */
3025 			exit_shm(current);
3026 			shm_init_task(current);
3027 		}
3028 
3029 		if (new_nsproxy)
3030 			switch_task_namespaces(current, new_nsproxy);
3031 
3032 		task_lock(current);
3033 
3034 		if (new_fs) {
3035 			fs = current->fs;
3036 			spin_lock(&fs->lock);
3037 			current->fs = new_fs;
3038 			if (--fs->users)
3039 				new_fs = NULL;
3040 			else
3041 				new_fs = fs;
3042 			spin_unlock(&fs->lock);
3043 		}
3044 
3045 		if (new_fd) {
3046 			fd = current->files;
3047 			current->files = new_fd;
3048 			new_fd = fd;
3049 		}
3050 
3051 		task_unlock(current);
3052 
3053 		if (new_cred) {
3054 			/* Install the new user namespace */
3055 			commit_creds(new_cred);
3056 			new_cred = NULL;
3057 		}
3058 	}
3059 
3060 	perf_event_namespaces(current);
3061 
3062 bad_unshare_cleanup_cred:
3063 	if (new_cred)
3064 		put_cred(new_cred);
3065 bad_unshare_cleanup_fd:
3066 	if (new_fd)
3067 		put_files_struct(new_fd);
3068 
3069 bad_unshare_cleanup_fs:
3070 	if (new_fs)
3071 		free_fs_struct(new_fs);
3072 
3073 bad_unshare_out:
3074 	return err;
3075 }
3076 
3077 SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
3078 {
3079 	return ksys_unshare(unshare_flags);
3080 }
3081 
3082 /*
3083  *	Helper to unshare the files of the current task.
3084  *	We don't want to expose copy_files internals to
3085  *	the exec layer of the kernel.
3086  */
3087 
3088 int unshare_files(void)
3089 {
3090 	struct task_struct *task = current;
3091 	struct files_struct *old, *copy = NULL;
3092 	int error;
3093 
3094 	error = unshare_fd(CLONE_FILES, NR_OPEN_MAX, &copy);
3095 	if (error || !copy)
3096 		return error;
3097 
3098 	old = task->files;
3099 	task_lock(task);
3100 	task->files = copy;
3101 	task_unlock(task);
3102 	put_files_struct(old);
3103 	return 0;
3104 }
3105 
3106 int sysctl_max_threads(struct ctl_table *table, int write,
3107 		       void *buffer, size_t *lenp, loff_t *ppos)
3108 {
3109 	struct ctl_table t;
3110 	int ret;
3111 	int threads = max_threads;
3112 	int min = 1;
3113 	int max = MAX_THREADS;
3114 
3115 	t = *table;
3116 	t.data = &threads;
3117 	t.extra1 = &min;
3118 	t.extra2 = &max;
3119 
3120 	ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
3121 	if (ret || !write)
3122 		return ret;
3123 
3124 	max_threads = threads;
3125 
3126 	return 0;
3127 }
3128