1	// SPDX-License-Identifier: GPL-2.0-only
2	/*
3	* linux/kernel/fork.c
4	*
5	* Copyright (C) 1991, 1992 Linus Torvalds
6	*/
7
8	/*
9	* 'fork.c' contains the help-routines for the 'fork' system call
10	* (see also entry.S and others).
11	* Fork is rather simple, once you get the hang of it, but the memory
12	* management can be a bitch. See 'mm/memory.c': 'copy_page_range()'
13	*/
14
15	#include <linux/anon_inodes.h>
16	#include <linux/slab.h>
17	#include <linux/sched/autogroup.h>
18	#include <linux/sched/mm.h>
19	#include <linux/sched/coredump.h>
20	#include <linux/sched/user.h>
21	#include <linux/sched/numa_balancing.h>
22	#include <linux/sched/stat.h>
23	#include <linux/sched/task.h>
24	#include <linux/sched/task_stack.h>
25	#include <linux/sched/cputime.h>
26	#include <linux/seq_file.h>
27	#include <linux/rtmutex.h>
28	#include <linux/init.h>
29	#include <linux/unistd.h>
30	#include <linux/module.h>
31	#include <linux/vmalloc.h>
32	#include <linux/completion.h>
33	#include <linux/personality.h>
34	#include <linux/mempolicy.h>
35	#include <linux/sem.h>
36	#include <linux/file.h>
37	#include <linux/fdtable.h>
38	#include <linux/iocontext.h>
39	#include <linux/key.h>
40	#include <linux/binfmts.h>
41	#include <linux/mman.h>
42	#include <linux/mmu_notifier.h>
43	#include <linux/fs.h>
44	#include <linux/mm.h>
45	#include <linux/mm_inline.h>
46	#include <linux/vmacache.h>
47	#include <linux/nsproxy.h>
48	#include <linux/capability.h>
49	#include <linux/cpu.h>
50	#include <linux/cgroup.h>
51	#include <linux/security.h>
52	#include <linux/hugetlb.h>
53	#include <linux/seccomp.h>
54	#include <linux/swap.h>
55	#include <linux/syscalls.h>
56	#include <linux/jiffies.h>
57	#include <linux/futex.h>
58	#include <linux/compat.h>
59	#include <linux/kthread.h>
60	#include <linux/task_io_accounting_ops.h>
61	#include <linux/rcupdate.h>
62	#include <linux/ptrace.h>
63	#include <linux/mount.h>
64	#include <linux/audit.h>
65	#include <linux/memcontrol.h>
66	#include <linux/ftrace.h>
67	#include <linux/proc_fs.h>
68	#include <linux/profile.h>
69	#include <linux/rmap.h>
70	#include <linux/ksm.h>
71	#include <linux/acct.h>
72	#include <linux/userfaultfd_k.h>
73	#include <linux/tsacct_kern.h>
74	#include <linux/cn_proc.h>
75	#include <linux/freezer.h>
76	#include <linux/delayacct.h>
77	#include <linux/taskstats_kern.h>
78	#include <linux/random.h>
79	#include <linux/tty.h>
80	#include <linux/fs_struct.h>
81	#include <linux/magic.h>
82	#include <linux/perf_event.h>
83	#include <linux/posix-timers.h>
84	#include <linux/user-return-notifier.h>
85	#include <linux/oom.h>
86	#include <linux/khugepaged.h>
87	#include <linux/signalfd.h>
88	#include <linux/uprobes.h>
89	#include <linux/aio.h>
90	#include <linux/compiler.h>
91	#include <linux/sysctl.h>
92	#include <linux/kcov.h>
93	#include <linux/livepatch.h>
94	#include <linux/thread_info.h>
95	#include <linux/stackleak.h>
96	#include <linux/kasan.h>
97	#include <linux/scs.h>
98	#include <linux/io_uring.h>
99	#include <linux/bpf.h>
100	#include <linux/sched/mm.h>
101
102	#include <asm/pgalloc.h>
103	#include <linux/uaccess.h>
104	#include <asm/mmu_context.h>
105	#include <asm/cacheflush.h>
106	#include <asm/tlbflush.h>
107
108	#include <trace/events/sched.h>
109
110	#define CREATE_TRACE_POINTS
111	#include <trace/events/task.h>
112
113	/*
114	* Minimum number of threads to boot the kernel
115	*/
116	#define MIN_THREADS 20
117
118	/*
119	* Maximum number of threads
120	*/
121	#define MAX_THREADS FUTEX_TID_MASK
122
123	/*
124	* Protected counters by write_lock_irq(&tasklist_lock)
125	*/
126	unsigned long total_forks; /* Handle normal Linux uptimes. */
127	int nr_threads; /* The idle threads do not count.. */
128
129	static int max_threads; /* tunable limit on nr_threads */
130
131	#define NAMED_ARRAY_INDEX(x) [x] = __stringify(x)
132
133	static const char * const resident_page_types[] = {
134	NAMED_ARRAY_INDEX(MM_FILEPAGES),
135	NAMED_ARRAY_INDEX(MM_ANONPAGES),
136	NAMED_ARRAY_INDEX(MM_SWAPENTS),
137	NAMED_ARRAY_INDEX(MM_SHMEMPAGES),
138	};
139
140	DEFINE_PER_CPU(unsigned long, process_counts) = 0;
141
142	__cacheline_aligned DEFINE_RWLOCK(tasklist_lock); /* outer */
143
144	#ifdef CONFIG_PROVE_RCU
145	int lockdep_tasklist_lock_is_held(void)
146	{
147	return lockdep_is_held(&tasklist_lock);
148	}
149	EXPORT_SYMBOL_GPL(lockdep_tasklist_lock_is_held);
150	#endif /* #ifdef CONFIG_PROVE_RCU */
151
152	int nr_processes(void)
153	{
154	int cpu;
155	int total = 0;
156
157	for_each_possible_cpu(cpu)
158	total += per_cpu(process_counts, cpu);
159
160	return total;
161	}
162
163	void __weak arch_release_task_struct(struct task_struct *tsk)
164	{
165	}
166
167	#ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
168	static struct kmem_cache *task_struct_cachep;
169
170	static inline struct task_struct *alloc_task_struct_node(int node)
171	{
172	return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
173	}
174
175	static inline void free_task_struct(struct task_struct *tsk)
176	{
177	kmem_cache_free(task_struct_cachep, tsk);
178	}
179	#endif
180
181	#ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR
182
183	/*
184	* Allocate pages if THREAD_SIZE is >= PAGE_SIZE, otherwise use a
185	* kmemcache based allocator.
186	*/
187	# if THREAD_SIZE >= PAGE_SIZE || defined(CONFIG_VMAP_STACK)
188
189	# ifdef CONFIG_VMAP_STACK
190	/*
191	* vmalloc() is a bit slow, and calling vfree() enough times will force a TLB
192	* flush. Try to minimize the number of calls by caching stacks.
193	*/
194	#define NR_CACHED_STACKS 2
195	static DEFINE_PER_CPU(struct vm_struct *, cached_stacks[NR_CACHED_STACKS]);
196
197	struct vm_stack {
198	struct rcu_head rcu;
199	struct vm_struct *stack_vm_area;
200	};
201
202	static bool try_release_thread_stack_to_cache(struct vm_struct *vm)
203	{
204	unsigned int i;
205
206	for (i = 0; i < NR_CACHED_STACKS; i++) {
207	if (this_cpu_cmpxchg(cached_stacks[i], NULL, vm) != NULL)
208	continue;
209	return true;
210	}
211	return false;
212	}
213
214	static void thread_stack_free_rcu(struct rcu_head *rh)
215	{
216	struct vm_stack *vm_stack = container_of(rh, struct vm_stack, rcu);
217
218	if (try_release_thread_stack_to_cache(vm_stack->stack_vm_area))
219	return;
220
221	vfree(vm_stack);
222	}
223
224	static void thread_stack_delayed_free(struct task_struct *tsk)
225	{
226	struct vm_stack *vm_stack = tsk->stack;
227
228	vm_stack->stack_vm_area = tsk->stack_vm_area;
229	call_rcu(&vm_stack->rcu, thread_stack_free_rcu);
230	}
231
232	static int free_vm_stack_cache(unsigned int cpu)
233	{
234	struct vm_struct **cached_vm_stacks = per_cpu_ptr(cached_stacks, cpu);
235	int i;
236
237	for (i = 0; i < NR_CACHED_STACKS; i++) {
238	struct vm_struct *vm_stack = cached_vm_stacks[i];
239
240	if (!vm_stack)
241	continue;
242
243	vfree(vm_stack->addr);
244	cached_vm_stacks[i] = NULL;
245	}
246
247	return 0;
248	}
249
250	static int memcg_charge_kernel_stack(struct vm_struct *vm)
251	{
252	int i;
253	int ret;
254
255	BUILD_BUG_ON(IS_ENABLED(CONFIG_VMAP_STACK) && PAGE_SIZE % 1024 != 0);
256	BUG_ON(vm->nr_pages != THREAD_SIZE / PAGE_SIZE);
257
258	for (i = 0; i < THREAD_SIZE / PAGE_SIZE; i++) {
259	ret = memcg_kmem_charge_page(vm->pages[i], GFP_KERNEL, 0);
260	if (ret)
261	goto err;
262	}
263	return 0;
264	err:
265	/*
266	* If memcg_kmem_charge_page() fails, page's memory cgroup pointer is
267	* NULL, and memcg_kmem_uncharge_page() in free_thread_stack() will
268	* ignore this page.
269	*/
270	for (i = 0; i < THREAD_SIZE / PAGE_SIZE; i++)
271	memcg_kmem_uncharge_page(vm->pages[i], 0);
272	return ret;
273	}
274
275	static int alloc_thread_stack_node(struct task_struct *tsk, int node)
276	{
277	struct vm_struct *vm;
278	void *stack;
279	int i;
280
281	for (i = 0; i < NR_CACHED_STACKS; i++) {
282	struct vm_struct *s;
283
284	s = this_cpu_xchg(cached_stacks[i], NULL);
285
286	if (!s)
287	continue;
288
289	/* Reset stack metadata. */
290	kasan_unpoison_range(s->addr, THREAD_SIZE);
291
292	stack = kasan_reset_tag(s->addr);
293
294	/* Clear stale pointers from reused stack. */
295	memset(stack, 0, THREAD_SIZE);
296
297	if (memcg_charge_kernel_stack(s)) {
298	vfree(s->addr);
299	return -ENOMEM;
300	}
301
302	tsk->stack_vm_area = s;
303	tsk->stack = stack;
304	return 0;
305	}
306
307	/*
308	* Allocated stacks are cached and later reused by new threads,
309	* so memcg accounting is performed manually on assigning/releasing
310	* stacks to tasks. Drop __GFP_ACCOUNT.
311	*/
312	stack = __vmalloc_node_range(THREAD_SIZE, THREAD_ALIGN,
313	VMALLOC_START, VMALLOC_END,
314	THREADINFO_GFP & ~__GFP_ACCOUNT,
315	PAGE_KERNEL,
316	0, node, __builtin_return_address(0));
317	if (!stack)
318	return -ENOMEM;
319
320	vm = find_vm_area(stack);
321	if (memcg_charge_kernel_stack(vm)) {
322	vfree(stack);
323	return -ENOMEM;
324	}
325	/*
326	* We can't call find_vm_area() in interrupt context, and
327	* free_thread_stack() can be called in interrupt context,
328	* so cache the vm_struct.
329	*/
330	tsk->stack_vm_area = vm;
331	stack = kasan_reset_tag(stack);
332	tsk->stack = stack;
333	return 0;
334	}
335
336	static void free_thread_stack(struct task_struct *tsk)
337	{
338	if (!try_release_thread_stack_to_cache(tsk->stack_vm_area))
339	thread_stack_delayed_free(tsk);
340
341	tsk->stack = NULL;
342	tsk->stack_vm_area = NULL;
343	}
344
345	# else /* !CONFIG_VMAP_STACK */
346
347	static void thread_stack_free_rcu(struct rcu_head *rh)
348	{
349	__free_pages(virt_to_page(rh), THREAD_SIZE_ORDER);
350	}
351
352	static void thread_stack_delayed_free(struct task_struct *tsk)
353	{
354	struct rcu_head *rh = tsk->stack;
355
356	call_rcu(rh, thread_stack_free_rcu);
357	}
358
359	static int alloc_thread_stack_node(struct task_struct *tsk, int node)
360	{
361	struct page *page = alloc_pages_node(node, THREADINFO_GFP,
362	THREAD_SIZE_ORDER);
363
364	if (likely(page)) {
365	tsk->stack = kasan_reset_tag(page_address(page));
366	return 0;
367	}
368	return -ENOMEM;
369	}
370
371	static void free_thread_stack(struct task_struct *tsk)
372	{
373	thread_stack_delayed_free(tsk);
374	tsk->stack = NULL;
375	}
376
377	# endif /* CONFIG_VMAP_STACK */
378	# else /* !(THREAD_SIZE >= PAGE_SIZE || defined(CONFIG_VMAP_STACK)) */
379
380	static struct kmem_cache *thread_stack_cache;
381
382	static void thread_stack_free_rcu(struct rcu_head *rh)
383	{
384	kmem_cache_free(thread_stack_cache, rh);
385	}
386
387	static void thread_stack_delayed_free(struct task_struct *tsk)
388	{
389	struct rcu_head *rh = tsk->stack;
390
391	call_rcu(rh, thread_stack_free_rcu);
392	}
393
394	static int alloc_thread_stack_node(struct task_struct *tsk, int node)
395	{
396	unsigned long *stack;
397	stack = kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
398	stack = kasan_reset_tag(stack);
399	tsk->stack = stack;
400	return stack ? 0 : -ENOMEM;
401	}
402
403	static void free_thread_stack(struct task_struct *tsk)
404	{
405	thread_stack_delayed_free(tsk);
406	tsk->stack = NULL;
407	}
408
409	void thread_stack_cache_init(void)
410	{
411	thread_stack_cache = kmem_cache_create_usercopy("thread_stack",
412	THREAD_SIZE, THREAD_SIZE, 0, 0,
413	THREAD_SIZE, NULL);
414	BUG_ON(thread_stack_cache == NULL);
415	}
416
417	# endif /* THREAD_SIZE >= PAGE_SIZE || defined(CONFIG_VMAP_STACK) */
418	#else /* CONFIG_ARCH_THREAD_STACK_ALLOCATOR */
419
420	static int alloc_thread_stack_node(struct task_struct *tsk, int node)
421	{
422	unsigned long *stack;
423
424	stack = arch_alloc_thread_stack_node(tsk, node);
425	tsk->stack = stack;
426	return stack ? 0 : -ENOMEM;
427	}
428
429	static void free_thread_stack(struct task_struct *tsk)
430	{
431	arch_free_thread_stack(tsk);
432	tsk->stack = NULL;
433	}
434
435	#endif /* !CONFIG_ARCH_THREAD_STACK_ALLOCATOR */
436
437	/* SLAB cache for signal_struct structures (tsk->signal) */
438	static struct kmem_cache *signal_cachep;
439
440	/* SLAB cache for sighand_struct structures (tsk->sighand) */
441	struct kmem_cache *sighand_cachep;
442
443	/* SLAB cache for files_struct structures (tsk->files) */
444	struct kmem_cache *files_cachep;
445
446	/* SLAB cache for fs_struct structures (tsk->fs) */
447	struct kmem_cache *fs_cachep;
448
449	/* SLAB cache for vm_area_struct structures */
450	static struct kmem_cache *vm_area_cachep;
451
452	/* SLAB cache for mm_struct structures (tsk->mm) */
453	static struct kmem_cache *mm_cachep;
454
455	struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
456	{
457	struct vm_area_struct *vma;
458
459	vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
460	if (vma)
461	vma_init(vma, mm);
462	return vma;
463	}
464
465	struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
466	{
467	struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
468
469	if (new) {
470	ASSERT_EXCLUSIVE_WRITER(orig->vm_flags);
471	ASSERT_EXCLUSIVE_WRITER(orig->vm_file);
472	/*
473	* orig->shared.rb may be modified concurrently, but the clone
474	* will be reinitialized.
475	*/
476	*new = data_race(*orig);
477	INIT_LIST_HEAD(&new->anon_vma_chain);
478	new->vm_next = new->vm_prev = NULL;
479	dup_anon_vma_name(orig, new);
480	}
481	return new;
482	}
483
484	void vm_area_free(struct vm_area_struct *vma)
485	{
486	free_anon_vma_name(vma);
487	kmem_cache_free(vm_area_cachep, vma);
488	}
489
490	static void account_kernel_stack(struct task_struct *tsk, int account)
491	{
492	if (IS_ENABLED(CONFIG_VMAP_STACK)) {
493	struct vm_struct *vm = task_stack_vm_area(tsk);
494	int i;
495
496	for (i = 0; i < THREAD_SIZE / PAGE_SIZE; i++)
497	mod_lruvec_page_state(vm->pages[i], NR_KERNEL_STACK_KB,
498	account * (PAGE_SIZE / 1024));
499	} else {
500	void *stack = task_stack_page(tsk);
501
502	/* All stack pages are in the same node. */
503	mod_lruvec_kmem_state(stack, NR_KERNEL_STACK_KB,
504	account * (THREAD_SIZE / 1024));
505	}
506	}
507
508	void exit_task_stack_account(struct task_struct *tsk)
509	{
510	account_kernel_stack(tsk, -1);
511
512	if (IS_ENABLED(CONFIG_VMAP_STACK)) {
513	struct vm_struct *vm;
514	int i;
515
516	vm = task_stack_vm_area(tsk);
517	for (i = 0; i < THREAD_SIZE / PAGE_SIZE; i++)
518	memcg_kmem_uncharge_page(vm->pages[i], 0);
519	}
520	}
521
522	static void release_task_stack(struct task_struct *tsk)
523	{
524	if (WARN_ON(READ_ONCE(tsk->__state) != TASK_DEAD))
525	return; /* Better to leak the stack than to free prematurely */
526
527	free_thread_stack(tsk);
528	}
529
530	#ifdef CONFIG_THREAD_INFO_IN_TASK
531	void put_task_stack(struct task_struct *tsk)
532	{
533	if (refcount_dec_and_test(&tsk->stack_refcount))
534	release_task_stack(tsk);
535	}
536	#endif
537
538	void free_task(struct task_struct *tsk)
539	{
540	release_user_cpus_ptr(tsk);
541	scs_release(tsk);
542
543	#ifndef CONFIG_THREAD_INFO_IN_TASK
544	/*
545	* The task is finally done with both the stack and thread_info,
546	* so free both.
547	*/
548	release_task_stack(tsk);
549	#else
550	/*
551	* If the task had a separate stack allocation, it should be gone
552	* by now.
553	*/
554	WARN_ON_ONCE(refcount_read(&tsk->stack_refcount) != 0);
555	#endif
556	rt_mutex_debug_task_free(tsk);
557	ftrace_graph_exit_task(tsk);
558	arch_release_task_struct(tsk);
559	if (tsk->flags & PF_KTHREAD)
560	free_kthread_struct(tsk);
561	free_task_struct(tsk);
562	}
563	EXPORT_SYMBOL(free_task);
564
565	static void dup_mm_exe_file(struct mm_struct *mm, struct mm_struct *oldmm)
566	{
567	struct file *exe_file;
568
569	exe_file = get_mm_exe_file(oldmm);
570	RCU_INIT_POINTER(mm->exe_file, exe_file);
571	/*
572	* We depend on the oldmm having properly denied write access to the
573	* exe_file already.
574	*/
575	if (exe_file && deny_write_access(exe_file))
576	pr_warn_once("deny_write_access() failed in %s\n", __func__);
577	}
578
579	#ifdef CONFIG_MMU
580	static __latent_entropy int dup_mmap(struct mm_struct *mm,
581	struct mm_struct *oldmm)
582	{
583	struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
584	struct rb_node **rb_link, *rb_parent;
585	int retval;
586	unsigned long charge;
587	LIST_HEAD(uf);
588
589	uprobe_start_dup_mmap();
590	if (mmap_write_lock_killable(oldmm)) {
591	retval = -EINTR;
592	goto fail_uprobe_end;
593	}
594	flush_cache_dup_mm(oldmm);
595	uprobe_dup_mmap(oldmm, mm);
596	/*
597	* Not linked in yet - no deadlock potential:
598	*/
599	mmap_write_lock_nested(mm, SINGLE_DEPTH_NESTING);
600
601	/* No ordering required: file already has been exposed. */
602	dup_mm_exe_file(mm, oldmm);
603
604	mm->total_vm = oldmm->total_vm;
605	mm->data_vm = oldmm->data_vm;
606	mm->exec_vm = oldmm->exec_vm;
607	mm->stack_vm = oldmm->stack_vm;
608
609	rb_link = &mm->mm_rb.rb_node;
610	rb_parent = NULL;
611	pprev = &mm->mmap;
612	retval = ksm_fork(mm, oldmm);
613	if (retval)
614	goto out;
615	khugepaged_fork(mm, oldmm);
616
617	prev = NULL;
618	for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
619	struct file *file;
620
621	if (mpnt->vm_flags & VM_DONTCOPY) {
622	vm_stat_account(mm, mpnt->vm_flags, -vma_pages(mpnt));
623	continue;
624	}
625	charge = 0;
626	/*
627	* Don't duplicate many vmas if we've been oom-killed (for
628	* example)
629	*/
630	if (fatal_signal_pending(current)) {
631	retval = -EINTR;
632	goto out;
633	}
634	if (mpnt->vm_flags & VM_ACCOUNT) {
635	unsigned long len = vma_pages(mpnt);
636
637	if (security_vm_enough_memory_mm(oldmm, len)) /* sic */
638	goto fail_nomem;
639	charge = len;
640	}
641	tmp = vm_area_dup(mpnt);
642	if (!tmp)
643	goto fail_nomem;
644	retval = vma_dup_policy(mpnt, tmp);
645	if (retval)
646	goto fail_nomem_policy;
647	tmp->vm_mm = mm;
648	retval = dup_userfaultfd(tmp, &uf);
649	if (retval)
650	goto fail_nomem_anon_vma_fork;
651	if (tmp->vm_flags & VM_WIPEONFORK) {
652	/*
653	* VM_WIPEONFORK gets a clean slate in the child.
654	* Don't prepare anon_vma until fault since we don't
655	* copy page for current vma.
656	*/
657	tmp->anon_vma = NULL;
658	} else if (anon_vma_fork(tmp, mpnt))
659	goto fail_nomem_anon_vma_fork;
660	tmp->vm_flags &= ~(VM_LOCKED | VM_LOCKONFAULT);
661	file = tmp->vm_file;
662	if (file) {
663	struct address_space *mapping = file->f_mapping;
664
665	get_file(file);
666	i_mmap_lock_write(mapping);
667	if (tmp->vm_flags & VM_SHARED)
668	mapping_allow_writable(mapping);
669	flush_dcache_mmap_lock(mapping);
670	/* insert tmp into the share list, just after mpnt */
671	vma_interval_tree_insert_after(tmp, mpnt,
672	&mapping->i_mmap);
673	flush_dcache_mmap_unlock(mapping);
674	i_mmap_unlock_write(mapping);
675	}
676
677	/*
678	* Clear hugetlb-related page reserves for children. This only
679	* affects MAP_PRIVATE mappings. Faults generated by the child
680	* are not guaranteed to succeed, even if read-only
681	*/
682	if (is_vm_hugetlb_page(tmp))
683	reset_vma_resv_huge_pages(tmp);
684
685	/*
686	* Link in the new vma and copy the page table entries.
687	*/
688	*pprev = tmp;
689	pprev = &tmp->vm_next;
690	tmp->vm_prev = prev;
691	prev = tmp;
692
693	__vma_link_rb(mm, tmp, rb_link, rb_parent);
694	rb_link = &tmp->vm_rb.rb_right;
695	rb_parent = &tmp->vm_rb;
696
697	mm->map_count++;
698	if (!(tmp->vm_flags & VM_WIPEONFORK))
699	retval = copy_page_range(tmp, mpnt);
700
701	if (tmp->vm_ops && tmp->vm_ops->open)
702	tmp->vm_ops->open(tmp);
703
704	if (retval)
705	goto out;
706	}
707	/* a new mm has just been created */
708	retval = arch_dup_mmap(oldmm, mm);
709	out:
710	mmap_write_unlock(mm);
711	flush_tlb_mm(oldmm);
712	mmap_write_unlock(oldmm);
713	dup_userfaultfd_complete(&uf);
714	fail_uprobe_end:
715	uprobe_end_dup_mmap();
716	return retval;
717	fail_nomem_anon_vma_fork:
718	mpol_put(vma_policy(tmp));
719	fail_nomem_policy:
720	vm_area_free(tmp);
721	fail_nomem:
722	retval = -ENOMEM;
723	vm_unacct_memory(charge);
724	goto out;
725	}
726
727	static inline int mm_alloc_pgd(struct mm_struct *mm)
728	{
729	mm->pgd = pgd_alloc(mm);
730	if (unlikely(!mm->pgd))
731	return -ENOMEM;
732	return 0;
733	}
734
735	static inline void mm_free_pgd(struct mm_struct *mm)
736	{
737	pgd_free(mm, mm->pgd);
738	}
739	#else
740	static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
741	{
742	mmap_write_lock(oldmm);
743	dup_mm_exe_file(mm, oldmm);
744	mmap_write_unlock(oldmm);
745	return 0;
746	}
747	#define mm_alloc_pgd(mm) (0)
748	#define mm_free_pgd(mm)
749	#endif /* CONFIG_MMU */
750
751	static void check_mm(struct mm_struct *mm)
752	{
753	int i;
754
755	BUILD_BUG_ON_MSG(ARRAY_SIZE(resident_page_types) != NR_MM_COUNTERS,
756	"Please make sure 'struct resident_page_types[]' is updated as well");
757
758	for (i = 0; i < NR_MM_COUNTERS; i++) {
759	long x = atomic_long_read(&mm->rss_stat.count[i]);
760
761	if (unlikely(x))
762	pr_alert("BUG: Bad rss-counter state mm:%p type:%s val:%ld\n",
763	mm, resident_page_types[i], x);
764	}
765
766	if (mm_pgtables_bytes(mm))
767	pr_alert("BUG: non-zero pgtables_bytes on freeing mm: %ld\n",
768	mm_pgtables_bytes(mm));
769
770	#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
771	VM_BUG_ON_MM(mm->pmd_huge_pte, mm);
772	#endif
773	}
774
775	#define allocate_mm() (kmem_cache_alloc(mm_cachep, GFP_KERNEL))
776	#define free_mm(mm) (kmem_cache_free(mm_cachep, (mm)))
777
778	/*
779	* Called when the last reference to the mm
780	* is dropped: either by a lazy thread or by
781	* mmput. Free the page directory and the mm.
782	*/
783	void __mmdrop(struct mm_struct *mm)
784	{
785	BUG_ON(mm == &init_mm);
786	WARN_ON_ONCE(mm == current->mm);
787	WARN_ON_ONCE(mm == current->active_mm);
788	mm_free_pgd(mm);
789	destroy_context(mm);
790	mmu_notifier_subscriptions_destroy(mm);
791	check_mm(mm);
792	put_user_ns(mm->user_ns);
793	mm_pasid_drop(mm);
794	free_mm(mm);
795	}
796	EXPORT_SYMBOL_GPL(__mmdrop);
797
798	static void mmdrop_async_fn(struct work_struct *work)
799	{
800	struct mm_struct *mm;
801
802	mm = container_of(work, struct mm_struct, async_put_work);
803	__mmdrop(mm);
804	}
805
806	static void mmdrop_async(struct mm_struct *mm)
807	{
808	if (unlikely(atomic_dec_and_test(&mm->mm_count))) {
809	INIT_WORK(&mm->async_put_work, mmdrop_async_fn);
810	schedule_work(&mm->async_put_work);
811	}
812	}
813
814	static inline void free_signal_struct(struct signal_struct *sig)
815	{
816	taskstats_tgid_free(sig);
817	sched_autogroup_exit(sig);
818	/*
819	* __mmdrop is not safe to call from softirq context on x86 due to
820	* pgd_dtor so postpone it to the async context
821	*/
822	if (sig->oom_mm)
823	mmdrop_async(sig->oom_mm);
824	kmem_cache_free(signal_cachep, sig);
825	}
826
827	static inline void put_signal_struct(struct signal_struct *sig)
828	{
829	if (refcount_dec_and_test(&sig->sigcnt))
830	free_signal_struct(sig);
831	}
832
833	void __put_task_struct(struct task_struct *tsk)
834	{
835	WARN_ON(!tsk->exit_state);
836	WARN_ON(refcount_read(&tsk->usage));
837	WARN_ON(tsk == current);
838
839	io_uring_free(tsk);
840	cgroup_free(tsk);
841	task_numa_free(tsk, true);
842	security_task_free(tsk);
843	bpf_task_storage_free(tsk);
844	exit_creds(tsk);
845	delayacct_tsk_free(tsk);
846	put_signal_struct(tsk->signal);
847	sched_core_free(tsk);
848	free_task(tsk);
849	}
850	EXPORT_SYMBOL_GPL(__put_task_struct);
851
852	void __init __weak arch_task_cache_init(void) { }
853
854	/*
855	* set_max_threads
856	*/
857	static void set_max_threads(unsigned int max_threads_suggested)
858	{
859	u64 threads;
860	unsigned long nr_pages = totalram_pages();
861
862	/*
863	* The number of threads shall be limited such that the thread
864	* structures may only consume a small part of the available memory.
865	*/
866	if (fls64(nr_pages) + fls64(PAGE_SIZE) > 64)
867	threads = MAX_THREADS;
868	else
869	threads = div64_u64((u64) nr_pages * (u64) PAGE_SIZE,
870	(u64) THREAD_SIZE * 8UL);
871
872	if (threads > max_threads_suggested)
873	threads = max_threads_suggested;
874
875	max_threads = clamp_t(u64, threads, MIN_THREADS, MAX_THREADS);
876	}
877
878	#ifdef CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT
879	/* Initialized by the architecture: */
880	int arch_task_struct_size __read_mostly;
881	#endif
882
883	#ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
884	static void task_struct_whitelist(unsigned long *offset, unsigned long *size)
885	{
886	/* Fetch thread_struct whitelist for the architecture. */
887	arch_thread_struct_whitelist(offset, size);
888
889	/*
890	* Handle zero-sized whitelist or empty thread_struct, otherwise
891	* adjust offset to position of thread_struct in task_struct.
892	*/
893	if (unlikely(*size == 0))
894	*offset = 0;
895	else
896	*offset += offsetof(struct task_struct, thread);
897	}
898	#endif /* CONFIG_ARCH_TASK_STRUCT_ALLOCATOR */
899
900	void __init fork_init(void)
901	{
902	int i;
903	#ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
904	#ifndef ARCH_MIN_TASKALIGN
905	#define ARCH_MIN_TASKALIGN 0
906	#endif
907	int align = max_t(int, L1_CACHE_BYTES, ARCH_MIN_TASKALIGN);
908	unsigned long useroffset, usersize;
909
910	/* create a slab on which task_structs can be allocated */
911	task_struct_whitelist(&useroffset, &usersize);
912	task_struct_cachep = kmem_cache_create_usercopy("task_struct",
913	arch_task_struct_size, align,
914	SLAB_PANIC|SLAB_ACCOUNT,
915	useroffset, usersize, NULL);
916	#endif
917
918	/* do the arch specific task caches init */
919	arch_task_cache_init();
920
921	set_max_threads(MAX_THREADS);
922
923	init_task.signal->rlim[RLIMIT_NPROC].rlim_cur = max_threads/2;
924	init_task.signal->rlim[RLIMIT_NPROC].rlim_max = max_threads/2;
925	init_task.signal->rlim[RLIMIT_SIGPENDING] =
926	init_task.signal->rlim[RLIMIT_NPROC];
927
928	for (i = 0; i < MAX_PER_NAMESPACE_UCOUNTS; i++)
929	init_user_ns.ucount_max[i] = max_threads/2;
930
931	set_rlimit_ucount_max(&init_user_ns, UCOUNT_RLIMIT_NPROC, RLIM_INFINITY);
932	set_rlimit_ucount_max(&init_user_ns, UCOUNT_RLIMIT_MSGQUEUE, RLIM_INFINITY);
933	set_rlimit_ucount_max(&init_user_ns, UCOUNT_RLIMIT_SIGPENDING, RLIM_INFINITY);
934	set_rlimit_ucount_max(&init_user_ns, UCOUNT_RLIMIT_MEMLOCK, RLIM_INFINITY);
935
936	#ifdef CONFIG_VMAP_STACK
937	cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "fork:vm_stack_cache",
938	NULL, free_vm_stack_cache);
939	#endif
940
941	scs_init();
942
943	lockdep_init_task(&init_task);
944	uprobes_init();
945	}
946
947	int __weak arch_dup_task_struct(struct task_struct *dst,
948	struct task_struct *src)
949	{
950	*dst = *src;
951	return 0;
952	}
953
954	void set_task_stack_end_magic(struct task_struct *tsk)
955	{
956	unsigned long *stackend;
957
958	stackend = end_of_stack(tsk);
959	*stackend = STACK_END_MAGIC; /* for overflow detection */
960	}
961
962	static struct task_struct *dup_task_struct(struct task_struct *orig, int node)
963	{
964	struct task_struct *tsk;
965	int err;
966
967	if (node == NUMA_NO_NODE)
968	node = tsk_fork_get_node(orig);
969	tsk = alloc_task_struct_node(node);
970	if (!tsk)
971	return NULL;
972
973	err = arch_dup_task_struct(tsk, orig);
974	if (err)
975	goto free_tsk;
976
977	err = alloc_thread_stack_node(tsk, node);
978	if (err)
979	goto free_tsk;
980
981	#ifdef CONFIG_THREAD_INFO_IN_TASK
982	refcount_set(&tsk->stack_refcount, 1);
983	#endif
984	account_kernel_stack(tsk, 1);
985
986	err = scs_prepare(tsk, node);
987	if (err)
988	goto free_stack;
989
990	#ifdef CONFIG_SECCOMP
991	/*
992	* We must handle setting up seccomp filters once we're under
993	* the sighand lock in case orig has changed between now and
994	* then. Until then, filter must be NULL to avoid messing up
995	* the usage counts on the error path calling free_task.
996	*/
997	tsk->seccomp.filter = NULL;
998	#endif
999
1000	setup_thread_stack(tsk, orig);
1001	clear_user_return_notifier(tsk);
1002	clear_tsk_need_resched(tsk);
1003	set_task_stack_end_magic(tsk);
1004	clear_syscall_work_syscall_user_dispatch(tsk);
1005
1006	#ifdef CONFIG_STACKPROTECTOR
1007	tsk->stack_canary = get_random_canary();
1008	#endif
1009	if (orig->cpus_ptr == &orig->cpus_mask)
1010	tsk->cpus_ptr = &tsk->cpus_mask;
1011	dup_user_cpus_ptr(tsk, orig, node);
1012
1013	/*
1014	* One for the user space visible state that goes away when reaped.
1015	* One for the scheduler.
1016	*/
1017	refcount_set(&tsk->rcu_users, 2);
1018	/* One for the rcu users */
1019	refcount_set(&tsk->usage, 1);
1020	#ifdef CONFIG_BLK_DEV_IO_TRACE
1021	tsk->btrace_seq = 0;
1022	#endif
1023	tsk->splice_pipe = NULL;
1024	tsk->task_frag.page = NULL;
1025	tsk->wake_q.next = NULL;
1026	tsk->worker_private = NULL;
1027
1028	kcov_task_init(tsk);
1029	kmap_local_fork(tsk);
1030
1031	#ifdef CONFIG_FAULT_INJECTION
1032	tsk->fail_nth = 0;
1033	#endif
1034
1035	#ifdef CONFIG_BLK_CGROUP
1036	tsk->throttle_queue = NULL;
1037	tsk->use_memdelay = 0;
1038	#endif
1039
1040	#ifdef CONFIG_IOMMU_SVA
1041	tsk->pasid_activated = 0;
1042	#endif
1043
1044	#ifdef CONFIG_MEMCG
1045	tsk->active_memcg = NULL;
1046	#endif
1047
1048	#ifdef CONFIG_CPU_SUP_INTEL
1049	tsk->reported_split_lock = 0;
1050	#endif
1051
1052	return tsk;
1053
1054	free_stack:
1055	exit_task_stack_account(tsk);
1056	free_thread_stack(tsk);
1057	free_tsk:
1058	free_task_struct(tsk);
1059	return NULL;
1060	}
1061
1062	__cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock);
1063
1064	static unsigned long default_dump_filter = MMF_DUMP_FILTER_DEFAULT;
1065
1066	static int __init coredump_filter_setup(char *s)
1067	{
1068	default_dump_filter =
1069	(simple_strtoul(s, NULL, 0) << MMF_DUMP_FILTER_SHIFT) &
1070	MMF_DUMP_FILTER_MASK;
1071	return 1;
1072	}
1073
1074	__setup("coredump_filter=", coredump_filter_setup);
1075
1076	#include <linux/init_task.h>
1077
1078	static void mm_init_aio(struct mm_struct *mm)
1079	{
1080	#ifdef CONFIG_AIO
1081	spin_lock_init(&mm->ioctx_lock);
1082	mm->ioctx_table = NULL;
1083	#endif
1084	}
1085
1086	static __always_inline void mm_clear_owner(struct mm_struct *mm,
1087	struct task_struct *p)
1088	{
1089	#ifdef CONFIG_MEMCG
1090	if (mm->owner == p)
1091	WRITE_ONCE(mm->owner, NULL);
1092	#endif
1093	}
1094
1095	static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
1096	{
1097	#ifdef CONFIG_MEMCG
1098	mm->owner = p;
1099	#endif
1100	}
1101
1102	static void mm_init_uprobes_state(struct mm_struct *mm)
1103	{
1104	#ifdef CONFIG_UPROBES
1105	mm->uprobes_state.xol_area = NULL;
1106	#endif
1107	}
1108
1109	static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
1110	struct user_namespace *user_ns)
1111	{
1112	mm->mmap = NULL;
1113	mm->mm_rb = RB_ROOT;
1114	mm->vmacache_seqnum = 0;
1115	atomic_set(&mm->mm_users, 1);
1116	atomic_set(&mm->mm_count, 1);
1117	seqcount_init(&mm->write_protect_seq);
1118	mmap_init_lock(mm);
1119	INIT_LIST_HEAD(&mm->mmlist);
1120	mm_pgtables_bytes_init(mm);
1121	mm->map_count = 0;
1122	mm->locked_vm = 0;
1123	atomic64_set(&mm->pinned_vm, 0);
1124	memset(&mm->rss_stat, 0, sizeof(mm->rss_stat));
1125	spin_lock_init(&mm->page_table_lock);
1126	spin_lock_init(&mm->arg_lock);
1127	mm_init_cpumask(mm);
1128	mm_init_aio(mm);
1129	mm_init_owner(mm, p);
1130	mm_pasid_init(mm);
1131	RCU_INIT_POINTER(mm->exe_file, NULL);
1132	mmu_notifier_subscriptions_init(mm);
1133	init_tlb_flush_pending(mm);
1134	#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
1135	mm->pmd_huge_pte = NULL;
1136	#endif
1137	mm_init_uprobes_state(mm);
1138	hugetlb_count_init(mm);
1139
1140	if (current->mm) {
1141	mm->flags = current->mm->flags & MMF_INIT_MASK;
1142	mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK;
1143	} else {
1144	mm->flags = default_dump_filter;
1145	mm->def_flags = 0;
1146	}
1147
1148	if (mm_alloc_pgd(mm))
1149	goto fail_nopgd;
1150
1151	if (init_new_context(p, mm))
1152	goto fail_nocontext;
1153
1154	mm->user_ns = get_user_ns(user_ns);
1155	return mm;
1156
1157	fail_nocontext:
1158	mm_free_pgd(mm);
1159	fail_nopgd:
1160	free_mm(mm);
1161	return NULL;
1162	}
1163
1164	/*
1165	* Allocate and initialize an mm_struct.
1166	*/
1167	struct mm_struct *mm_alloc(void)
1168	{
1169	struct mm_struct *mm;
1170
1171	mm = allocate_mm();
1172	if (!mm)
1173	return NULL;
1174
1175	memset(mm, 0, sizeof(*mm));
1176	return mm_init(mm, current, current_user_ns());
1177	}
1178
1179	static inline void __mmput(struct mm_struct *mm)
1180	{
1181	VM_BUG_ON(atomic_read(&mm->mm_users));
1182
1183	uprobe_clear_state(mm);
1184	exit_aio(mm);
1185	ksm_exit(mm);
1186	khugepaged_exit(mm); /* must run before exit_mmap */
1187	exit_mmap(mm);
1188	mm_put_huge_zero_page(mm);
1189	set_mm_exe_file(mm, NULL);
1190	if (!list_empty(&mm->mmlist)) {
1191	spin_lock(&mmlist_lock);
1192	list_del(&mm->mmlist);
1193	spin_unlock(&mmlist_lock);
1194	}
1195	if (mm->binfmt)
1196	module_put(mm->binfmt->module);
1197	mmdrop(mm);
1198	}
1199
1200	/*
1201	* Decrement the use count and release all resources for an mm.
1202	*/
1203	void mmput(struct mm_struct *mm)
1204	{
1205	might_sleep();
1206
1207	if (atomic_dec_and_test(&mm->mm_users))
1208	__mmput(mm);
1209	}
1210	EXPORT_SYMBOL_GPL(mmput);
1211
1212	#ifdef CONFIG_MMU
1213	static void mmput_async_fn(struct work_struct *work)
1214	{
1215	struct mm_struct *mm = container_of(work, struct mm_struct,
1216	async_put_work);
1217
1218	__mmput(mm);
1219	}
1220
1221	void mmput_async(struct mm_struct *mm)
1222	{
1223	if (atomic_dec_and_test(&mm->mm_users)) {
1224	INIT_WORK(&mm->async_put_work, mmput_async_fn);
1225	schedule_work(&mm->async_put_work);
1226	}
1227	}
1228	#endif
1229
1230	/**
1231	* set_mm_exe_file - change a reference to the mm's executable file
1232	*
1233	* This changes mm's executable file (shown as symlink /proc/[pid]/exe).
1234	*
1235	* Main users are mmput() and sys_execve(). Callers prevent concurrent
1236	* invocations: in mmput() nobody alive left, in execve task is single
1237	* threaded.
1238	*
1239	* Can only fail if new_exe_file != NULL.
1240	*/
1241	int set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file)
1242	{
1243	struct file *old_exe_file;
1244
1245	/*
1246	* It is safe to dereference the exe_file without RCU as
1247	* this function is only called if nobody else can access
1248	* this mm -- see comment above for justification.
1249	*/
1250	old_exe_file = rcu_dereference_raw(mm->exe_file);
1251
1252	if (new_exe_file) {
1253	/*
1254	* We expect the caller (i.e., sys_execve) to already denied
1255	* write access, so this is unlikely to fail.
1256	*/
1257	if (unlikely(deny_write_access(new_exe_file)))
1258	return -EACCES;
1259	get_file(new_exe_file);
1260	}
1261	rcu_assign_pointer(mm->exe_file, new_exe_file);
1262	if (old_exe_file) {
1263	allow_write_access(old_exe_file);
1264	fput(old_exe_file);
1265	}
1266	return 0;
1267	}
1268
1269	/**
1270	* replace_mm_exe_file - replace a reference to the mm's executable file
1271	*
1272	* This changes mm's executable file (shown as symlink /proc/[pid]/exe),
1273	* dealing with concurrent invocation and without grabbing the mmap lock in
1274	* write mode.
1275	*
1276	* Main user is sys_prctl(PR_SET_MM_MAP/EXE_FILE).
1277	*/
1278	int replace_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file)
1279	{
1280	struct vm_area_struct *vma;
1281	struct file *old_exe_file;
1282	int ret = 0;
1283
1284	/* Forbid mm->exe_file change if old file still mapped. */
1285	old_exe_file = get_mm_exe_file(mm);
1286	if (old_exe_file) {
1287	mmap_read_lock(mm);
1288	for (vma = mm->mmap; vma && !ret; vma = vma->vm_next) {
1289	if (!vma->vm_file)
1290	continue;
1291	if (path_equal(&vma->vm_file->f_path,
1292	&old_exe_file->f_path))
1293	ret = -EBUSY;
1294	}
1295	mmap_read_unlock(mm);
1296	fput(old_exe_file);
1297	if (ret)
1298	return ret;
1299	}
1300
1301	/* set the new file, lockless */
1302	ret = deny_write_access(new_exe_file);
1303	if (ret)
1304	return -EACCES;
1305	get_file(new_exe_file);
1306
1307	old_exe_file = xchg(&mm->exe_file, new_exe_file);
1308	if (old_exe_file) {
1309	/*
1310	* Don't race with dup_mmap() getting the file and disallowing
1311	* write access while someone might open the file writable.
1312	*/
1313	mmap_read_lock(mm);
1314	allow_write_access(old_exe_file);
1315	fput(old_exe_file);
1316	mmap_read_unlock(mm);
1317	}
1318	return 0;
1319	}
1320
1321	/**
1322	* get_mm_exe_file - acquire a reference to the mm's executable file
1323	*
1324	* Returns %NULL if mm has no associated executable file.
1325	* User must release file via fput().
1326	*/
1327	struct file *get_mm_exe_file(struct mm_struct *mm)
1328	{
1329	struct file *exe_file;
1330
1331	rcu_read_lock();
1332	exe_file = rcu_dereference(mm->exe_file);
1333	if (exe_file && !get_file_rcu(exe_file))
1334	exe_file = NULL;
1335	rcu_read_unlock();
1336	return exe_file;
1337	}
1338
1339	/**
1340	* get_task_exe_file - acquire a reference to the task's executable file
1341	*
1342	* Returns %NULL if task's mm (if any) has no associated executable file or
1343	* this is a kernel thread with borrowed mm (see the comment above get_task_mm).
1344	* User must release file via fput().
1345	*/
1346	struct file *get_task_exe_file(struct task_struct *task)
1347	{
1348	struct file *exe_file = NULL;
1349	struct mm_struct *mm;
1350
1351	task_lock(task);
1352	mm = task->mm;
1353	if (mm) {
1354	if (!(task->flags & PF_KTHREAD))
1355	exe_file = get_mm_exe_file(mm);
1356	}
1357	task_unlock(task);
1358	return exe_file;
1359	}
1360
1361	/**
1362	* get_task_mm - acquire a reference to the task's mm
1363	*
1364	* Returns %NULL if the task has no mm. Checks PF_KTHREAD (meaning
1365	* this kernel workthread has transiently adopted a user mm with use_mm,
1366	* to do its AIO) is not set and if so returns a reference to it, after
1367	* bumping up the use count. User must release the mm via mmput()
1368	* after use. Typically used by /proc and ptrace.
1369	*/
1370	struct mm_struct *get_task_mm(struct task_struct *task)
1371	{
1372	struct mm_struct *mm;
1373
1374	task_lock(task);
1375	mm = task->mm;
1376	if (mm) {
1377	if (task->flags & PF_KTHREAD)
1378	mm = NULL;
1379	else
1380	mmget(mm);
1381	}
1382	task_unlock(task);
1383	return mm;
1384	}
1385	EXPORT_SYMBOL_GPL(get_task_mm);
1386
1387	struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
1388	{
1389	struct mm_struct *mm;
1390	int err;
1391
1392	err = down_read_killable(&task->signal->exec_update_lock);
1393	if (err)
1394	return ERR_PTR(err);
1395
1396	mm = get_task_mm(task);
1397	if (mm && mm != current->mm &&
1398	!ptrace_may_access(task, mode)) {
1399	mmput(mm);
1400	mm = ERR_PTR(-EACCES);
1401	}
1402	up_read(&task->signal->exec_update_lock);
1403
1404	return mm;
1405	}
1406
1407	static void complete_vfork_done(struct task_struct *tsk)
1408	{
1409	struct completion *vfork;
1410
1411	task_lock(tsk);
1412	vfork = tsk->vfork_done;
1413	if (likely(vfork)) {
1414	tsk->vfork_done = NULL;
1415	complete(vfork);
1416	}
1417	task_unlock(tsk);
1418	}
1419
1420	static int wait_for_vfork_done(struct task_struct *child,
1421	struct completion *vfork)
1422	{
1423	int killed;
1424
1425	freezer_do_not_count();
1426	cgroup_enter_frozen();
1427	killed = wait_for_completion_killable(vfork);
1428	cgroup_leave_frozen(false);
1429	freezer_count();
1430
1431	if (killed) {
1432	task_lock(child);
1433	child->vfork_done = NULL;
1434	task_unlock(child);
1435	}
1436
1437	put_task_struct(child);
1438	return killed;
1439	}
1440
1441	/* Please note the differences between mmput and mm_release.
1442	* mmput is called whenever we stop holding onto a mm_struct,
1443	* error success whatever.
1444	*
1445	* mm_release is called after a mm_struct has been removed
1446	* from the current process.
1447	*
1448	* This difference is important for error handling, when we
1449	* only half set up a mm_struct for a new process and need to restore
1450	* the old one. Because we mmput the new mm_struct before
1451	* restoring the old one. . .
1452	* Eric Biederman 10 January 1998
1453	*/
1454	static void mm_release(struct task_struct *tsk, struct mm_struct *mm)
1455	{
1456	uprobe_free_utask(tsk);
1457
1458	/* Get rid of any cached register state */
1459	deactivate_mm(tsk, mm);
1460
1461	/*
1462	* Signal userspace if we're not exiting with a core dump
1463	* because we want to leave the value intact for debugging
1464	* purposes.
1465	*/
1466	if (tsk->clear_child_tid) {
1467	if (atomic_read(&mm->mm_users) > 1) {
1468	/*
1469	* We don't check the error code - if userspace has
1470	* not set up a proper pointer then tough luck.
1471	*/
1472	put_user(0, tsk->clear_child_tid);
1473	do_futex(tsk->clear_child_tid, FUTEX_WAKE,
1474	1, NULL, NULL, 0, 0);
1475	}
1476	tsk->clear_child_tid = NULL;
1477	}
1478
1479	/*
1480	* All done, finally we can wake up parent and return this mm to him.
1481	* Also kthread_stop() uses this completion for synchronization.
1482	*/
1483	if (tsk->vfork_done)
1484	complete_vfork_done(tsk);
1485	}
1486
1487	void exit_mm_release(struct task_struct *tsk, struct mm_struct *mm)
1488	{
1489	futex_exit_release(tsk);
1490	mm_release(tsk, mm);
1491	}
1492
1493	void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm)
1494	{
1495	futex_exec_release(tsk);
1496	mm_release(tsk, mm);
1497	}
1498
1499	/**
1500	* dup_mm() - duplicates an existing mm structure
1501	* @tsk: the task_struct with which the new mm will be associated.
1502	* @oldmm: the mm to duplicate.
1503	*
1504	* Allocates a new mm structure and duplicates the provided @oldmm structure
1505	* content into it.
1506	*
1507	* Return: the duplicated mm or NULL on failure.
1508	*/
1509	static struct mm_struct *dup_mm(struct task_struct *tsk,
1510	struct mm_struct *oldmm)
1511	{
1512	struct mm_struct *mm;
1513	int err;
1514
1515	mm = allocate_mm();
1516	if (!mm)
1517	goto fail_nomem;
1518
1519	memcpy(mm, oldmm, sizeof(*mm));
1520
1521	if (!mm_init(mm, tsk, mm->user_ns))
1522	goto fail_nomem;
1523
1524	err = dup_mmap(mm, oldmm);
1525	if (err)
1526	goto free_pt;
1527
1528	mm->hiwater_rss = get_mm_rss(mm);
1529	mm->hiwater_vm = mm->total_vm;
1530
1531	if (mm->binfmt && !try_module_get(mm->binfmt->module))
1532	goto free_pt;
1533
1534	return mm;
1535
1536	free_pt:
1537	/* don't put binfmt in mmput, we haven't got module yet */
1538	mm->binfmt = NULL;
1539	mm_init_owner(mm, NULL);
1540	mmput(mm);
1541
1542	fail_nomem:
1543	return NULL;
1544	}
1545
1546	static int copy_mm(unsigned long clone_flags, struct task_struct *tsk)
1547	{
1548	struct mm_struct *mm, *oldmm;
1549
1550	tsk->min_flt = tsk->maj_flt = 0;
1551	tsk->nvcsw = tsk->nivcsw = 0;
1552	#ifdef CONFIG_DETECT_HUNG_TASK
1553	tsk->last_switch_count = tsk->nvcsw + tsk->nivcsw;
1554	tsk->last_switch_time = 0;
1555	#endif
1556
1557	tsk->mm = NULL;
1558	tsk->active_mm = NULL;
1559
1560	/*
1561	* Are we cloning a kernel thread?
1562	*
1563	* We need to steal a active VM for that..
1564	*/
1565	oldmm = current->mm;
1566	if (!oldmm)
1567	return 0;
1568
1569	/* initialize the new vmacache entries */
1570	vmacache_flush(tsk);
1571
1572	if (clone_flags & CLONE_VM) {
1573	mmget(oldmm);
1574	mm = oldmm;
1575	} else {
1576	mm = dup_mm(tsk, current->mm);
1577	if (!mm)
1578	return -ENOMEM;
1579	}
1580
1581	tsk->mm = mm;
1582	tsk->active_mm = mm;
1583	return 0;
1584	}
1585
1586	static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
1587	{
1588	struct fs_struct *fs = current->fs;
1589	if (clone_flags & CLONE_FS) {
1590	/* tsk->fs is already what we want */
1591	spin_lock(&fs->lock);
1592	if (fs->in_exec) {
1593	spin_unlock(&fs->lock);
1594	return -EAGAIN;
1595	}
1596	fs->users++;
1597	spin_unlock(&fs->lock);
1598	return 0;
1599	}
1600	tsk->fs = copy_fs_struct(fs);
1601	if (!tsk->fs)
1602	return -ENOMEM;
1603	return 0;
1604	}
1605
1606	static int copy_files(unsigned long clone_flags, struct task_struct *tsk)
1607	{
1608	struct files_struct *oldf, *newf;
1609	int error = 0;
1610
1611	/*
1612	* A background process may not have any files ...
1613	*/
1614	oldf = current->files;
1615	if (!oldf)
1616	goto out;
1617
1618	if (clone_flags & CLONE_FILES) {
1619	atomic_inc(&oldf->count);
1620	goto out;
1621	}
1622
1623	newf = dup_fd(oldf, NR_OPEN_MAX, &error);
1624	if (!newf)
1625	goto out;
1626
1627	tsk->files = newf;
1628	error = 0;
1629	out:
1630	return error;
1631	}
1632
1633	static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
1634	{
1635	struct sighand_struct *sig;
1636
1637	if (clone_flags & CLONE_SIGHAND) {
1638	refcount_inc(&current->sighand->count);
1639	return 0;
1640	}
1641	sig = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
1642	RCU_INIT_POINTER(tsk->sighand, sig);
1643	if (!sig)
1644	return -ENOMEM;
1645
1646	refcount_set(&sig->count, 1);
1647	spin_lock_irq(&current->sighand->siglock);
1648	memcpy(sig->action, current->sighand->action, sizeof(sig->action));
1649	spin_unlock_irq(&current->sighand->siglock);
1650
1651	/* Reset all signal handler not set to SIG_IGN to SIG_DFL. */
1652	if (clone_flags & CLONE_CLEAR_SIGHAND)
1653	flush_signal_handlers(tsk, 0);
1654
1655	return 0;
1656	}
1657
1658	void __cleanup_sighand(struct sighand_struct *sighand)
1659	{
1660	if (refcount_dec_and_test(&sighand->count)) {
1661	signalfd_cleanup(sighand);
1662	/*
1663	* sighand_cachep is SLAB_TYPESAFE_BY_RCU so we can free it
1664	* without an RCU grace period, see __lock_task_sighand().
1665	*/
1666	kmem_cache_free(sighand_cachep, sighand);
1667	}
1668	}
1669
1670	/*
1671	* Initialize POSIX timer handling for a thread group.
1672	*/
1673	static void posix_cpu_timers_init_group(struct signal_struct *sig)
1674	{
1675	struct posix_cputimers *pct = &sig->posix_cputimers;
1676	unsigned long cpu_limit;
1677
1678	cpu_limit = READ_ONCE(sig->rlim[RLIMIT_CPU].rlim_cur);
1679	posix_cputimers_group_init(pct, cpu_limit);
1680	}
1681
1682	static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
1683	{
1684	struct signal_struct *sig;
1685
1686	if (clone_flags & CLONE_THREAD)
1687	return 0;
1688
1689	sig = kmem_cache_zalloc(signal_cachep, GFP_KERNEL);
1690	tsk->signal = sig;
1691	if (!sig)
1692	return -ENOMEM;
1693
1694	sig->nr_threads = 1;
1695	atomic_set(&sig->live, 1);
1696	refcount_set(&sig->sigcnt, 1);
1697
1698	/* list_add(thread_node, thread_head) without INIT_LIST_HEAD() */
1699	sig->thread_head = (struct list_head)LIST_HEAD_INIT(tsk->thread_node);
1700	tsk->thread_node = (struct list_head)LIST_HEAD_INIT(sig->thread_head);
1701
1702	init_waitqueue_head(&sig->wait_chldexit);
1703	sig->curr_target = tsk;
1704	init_sigpending(&sig->shared_pending);
1705	INIT_HLIST_HEAD(&sig->multiprocess);
1706	seqlock_init(&sig->stats_lock);
1707	prev_cputime_init(&sig->prev_cputime);
1708
1709	#ifdef CONFIG_POSIX_TIMERS
1710	INIT_LIST_HEAD(&sig->posix_timers);
1711	hrtimer_init(&sig->real_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
1712	sig->real_timer.function = it_real_fn;
1713	#endif
1714
1715	task_lock(current->group_leader);
1716	memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim);
1717	task_unlock(current->group_leader);
1718
1719	posix_cpu_timers_init_group(sig);
1720
1721	tty_audit_fork(sig);
1722	sched_autogroup_fork(sig);
1723
1724	sig->oom_score_adj = current->signal->oom_score_adj;
1725	sig->oom_score_adj_min = current->signal->oom_score_adj_min;
1726
1727	mutex_init(&sig->cred_guard_mutex);
1728	init_rwsem(&sig->exec_update_lock);
1729
1730	return 0;
1731	}
1732
1733	static void copy_seccomp(struct task_struct *p)
1734	{
1735	#ifdef CONFIG_SECCOMP
1736	/*
1737	* Must be called with sighand->lock held, which is common to
1738	* all threads in the group. Holding cred_guard_mutex is not
1739	* needed because this new task is not yet running and cannot
1740	* be racing exec.
1741	*/
1742	assert_spin_locked(&current->sighand->siglock);
1743
1744	/* Ref-count the new filter user, and assign it. */
1745	get_seccomp_filter(current);
1746	p->seccomp = current->seccomp;
1747
1748	/*
1749	* Explicitly enable no_new_privs here in case it got set
1750	* between the task_struct being duplicated and holding the
1751	* sighand lock. The seccomp state and nnp must be in sync.
1752	*/
1753	if (task_no_new_privs(current))
1754	task_set_no_new_privs(p);
1755
1756	/*
1757	* If the parent gained a seccomp mode after copying thread
1758	* flags and between before we held the sighand lock, we have
1759	* to manually enable the seccomp thread flag here.
1760	*/
1761	if (p->seccomp.mode != SECCOMP_MODE_DISABLED)
1762	set_task_syscall_work(p, SECCOMP);
1763	#endif
1764	}
1765
1766	SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
1767	{
1768	current->clear_child_tid = tidptr;
1769
1770	return task_pid_vnr(current);
1771	}
1772
1773	static void rt_mutex_init_task(struct task_struct *p)
1774	{
1775	raw_spin_lock_init(&p->pi_lock);
1776	#ifdef CONFIG_RT_MUTEXES
1777	p->pi_waiters = RB_ROOT_CACHED;
1778	p->pi_top_task = NULL;
1779	p->pi_blocked_on = NULL;
1780	#endif
1781	}
1782
1783	static inline void init_task_pid_links(struct task_struct *task)
1784	{
1785	enum pid_type type;
1786
1787	for (type = PIDTYPE_PID; type < PIDTYPE_MAX; ++type)
1788	INIT_HLIST_NODE(&task->pid_links[type]);
1789	}
1790
1791	static inline void
1792	init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid)
1793	{
1794	if (type == PIDTYPE_PID)
1795	task->thread_pid = pid;
1796	else
1797	task->signal->pids[type] = pid;
1798	}
1799
1800	static inline void rcu_copy_process(struct task_struct *p)
1801	{
1802	#ifdef CONFIG_PREEMPT_RCU
1803	p->rcu_read_lock_nesting = 0;
1804	p->rcu_read_unlock_special.s = 0;
1805	p->rcu_blocked_node = NULL;
1806	INIT_LIST_HEAD(&p->rcu_node_entry);
1807	#endif /* #ifdef CONFIG_PREEMPT_RCU */
1808	#ifdef CONFIG_TASKS_RCU
1809	p->rcu_tasks_holdout = false;
1810	INIT_LIST_HEAD(&p->rcu_tasks_holdout_list);
1811	p->rcu_tasks_idle_cpu = -1;
1812	#endif /* #ifdef CONFIG_TASKS_RCU */
1813	#ifdef CONFIG_TASKS_TRACE_RCU
1814	p->trc_reader_nesting = 0;
1815	p->trc_reader_special.s = 0;
1816	INIT_LIST_HEAD(&p->trc_holdout_list);
1817	INIT_LIST_HEAD(&p->trc_blkd_node);
1818	#endif /* #ifdef CONFIG_TASKS_TRACE_RCU */
1819	}
1820
1821	struct pid *pidfd_pid(const struct file *file)
1822	{
1823	if (file->f_op == &pidfd_fops)
1824	return file->private_data;
1825
1826	return ERR_PTR(-EBADF);
1827	}
1828
1829	static int pidfd_release(struct inode *inode, struct file *file)
1830	{
1831	struct pid *pid = file->private_data;
1832
1833	file->private_data = NULL;
1834	put_pid(pid);
1835	return 0;
1836	}
1837
1838	#ifdef CONFIG_PROC_FS
1839	/**
1840	* pidfd_show_fdinfo - print information about a pidfd
1841	* @m: proc fdinfo file
1842	* @f: file referencing a pidfd
1843	*
1844	* Pid:
1845	* This function will print the pid that a given pidfd refers to in the
1846	* pid namespace of the procfs instance.
1847	* If the pid namespace of the process is not a descendant of the pid
1848	* namespace of the procfs instance 0 will be shown as its pid. This is
1849	* similar to calling getppid() on a process whose parent is outside of
1850	* its pid namespace.
1851	*
1852	* NSpid:
1853	* If pid namespaces are supported then this function will also print
1854	* the pid of a given pidfd refers to for all descendant pid namespaces
1855	* starting from the current pid namespace of the instance, i.e. the
1856	* Pid field and the first entry in the NSpid field will be identical.
1857	* If the pid namespace of the process is not a descendant of the pid
1858	* namespace of the procfs instance 0 will be shown as its first NSpid
1859	* entry and no others will be shown.
1860	* Note that this differs from the Pid and NSpid fields in
1861	* /proc/<pid>/status where Pid and NSpid are always shown relative to
1862	* the pid namespace of the procfs instance. The difference becomes
1863	* obvious when sending around a pidfd between pid namespaces from a
1864	* different branch of the tree, i.e. where no ancestral relation is
1865	* present between the pid namespaces:
1866	* - create two new pid namespaces ns1 and ns2 in the initial pid
1867	* namespace (also take care to create new mount namespaces in the
1868	* new pid namespace and mount procfs)
1869	* - create a process with a pidfd in ns1
1870	* - send pidfd from ns1 to ns2
1871	* - read /proc/self/fdinfo/<pidfd> and observe that both Pid and NSpid
1872	* have exactly one entry, which is 0
1873	*/
1874	static void pidfd_show_fdinfo(struct seq_file *m, struct file *f)
1875	{
1876	struct pid *pid = f->private_data;
1877	struct pid_namespace *ns;
1878	pid_t nr = -1;
1879
1880	if (likely(pid_has_task(pid, PIDTYPE_PID))) {
1881	ns = proc_pid_ns(file_inode(m->file)->i_sb);
1882	nr = pid_nr_ns(pid, ns);
1883	}
1884
1885	seq_put_decimal_ll(m, "Pid:\t", nr);
1886
1887	#ifdef CONFIG_PID_NS
1888	seq_put_decimal_ll(m, "\nNSpid:\t", nr);
1889	if (nr > 0) {
1890	int i;
1891
1892	/* If nr is non-zero it means that 'pid' is valid and that
1893	* ns, i.e. the pid namespace associated with the procfs
1894	* instance, is in the pid namespace hierarchy of pid.
1895	* Start at one below the already printed level.
1896	*/
1897	for (i = ns->level + 1; i <= pid->level; i++)
1898	seq_put_decimal_ll(m, "\t", pid->numbers[i].nr);
1899	}
1900	#endif
1901	seq_putc(m, '\n');
1902	}
1903	#endif
1904
1905	/*
1906	* Poll support for process exit notification.
1907	*/
1908	static __poll_t pidfd_poll(struct file *file, struct poll_table_struct *pts)
1909	{
1910	struct pid *pid = file->private_data;
1911	__poll_t poll_flags = 0;
1912
1913	poll_wait(file, &pid->wait_pidfd, pts);
1914
1915	/*
1916	* Inform pollers only when the whole thread group exits.
1917	* If the thread group leader exits before all other threads in the
1918	* group, then poll(2) should block, similar to the wait(2) family.
1919	*/
1920	if (thread_group_exited(pid))
1921	poll_flags = EPOLLIN | EPOLLRDNORM;
1922
1923	return poll_flags;
1924	}
1925
1926	const struct file_operations pidfd_fops = {
1927	.release = pidfd_release,
1928	.poll = pidfd_poll,
1929	#ifdef CONFIG_PROC_FS
1930	.show_fdinfo = pidfd_show_fdinfo,
1931	#endif
1932	};
1933
1934	static void __delayed_free_task(struct rcu_head *rhp)
1935	{
1936	struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
1937
1938	free_task(tsk);
1939	}
1940
1941	static __always_inline void delayed_free_task(struct task_struct *tsk)
1942	{
1943	if (IS_ENABLED(CONFIG_MEMCG))
1944	call_rcu(&tsk->rcu, __delayed_free_task);
1945	else
1946	free_task(tsk);
1947	}
1948
1949	static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk)
1950	{
1951	/* Skip if kernel thread */
1952	if (!tsk->mm)
1953	return;
1954
1955	/* Skip if spawning a thread or using vfork */
1956	if ((clone_flags & (CLONE_VM | CLONE_THREAD | CLONE_VFORK)) != CLONE_VM)
1957	return;
1958
1959	/* We need to synchronize with __set_oom_adj */
1960	mutex_lock(&oom_adj_mutex);
1961	set_bit(MMF_MULTIPROCESS, &tsk->mm->flags);
1962	/* Update the values in case they were changed after copy_signal */
1963	tsk->signal->oom_score_adj = current->signal->oom_score_adj;
1964	tsk->signal->oom_score_adj_min = current->signal->oom_score_adj_min;
1965	mutex_unlock(&oom_adj_mutex);
1966	}
1967
1968	#ifdef CONFIG_RV
1969	static void rv_task_fork(struct task_struct *p)
1970	{
1971	int i;
1972
1973	for (i = 0; i < RV_PER_TASK_MONITORS; i++)
1974	p->rv[i].da_mon.monitoring = false;
1975	}
1976	#else
1977	#define rv_task_fork(p) do {} while (0)
1978	#endif
1979
1980	/*
1981	* This creates a new process as a copy of the old one,
1982	* but does not actually start it yet.
1983	*
1984	* It copies the registers, and all the appropriate
1985	* parts of the process environment (as per the clone
1986	* flags). The actual kick-off is left to the caller.
1987	*/
1988	static __latent_entropy struct task_struct *copy_process(
1989	struct pid *pid,
1990	int trace,
1991	int node,
1992	struct kernel_clone_args *args)
1993	{
1994	int pidfd = -1, retval;
1995	struct task_struct *p;
1996	struct multiprocess_signals delayed;
1997	struct file *pidfile = NULL;
1998	const u64 clone_flags = args->flags;
1999	struct nsproxy *nsp = current->nsproxy;
2000
2001	/*
2002	* Don't allow sharing the root directory with processes in a different
2003	* namespace
2004	*/
2005	if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
2006	return ERR_PTR(-EINVAL);
2007
2008	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
2009	return ERR_PTR(-EINVAL);
2010
2011	/*
2012	* Thread groups must share signals as well, and detached threads
2013	* can only be started up within the thread group.
2014	*/
2015	if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND))
2016	return ERR_PTR(-EINVAL);
2017
2018	/*
2019	* Shared signal handlers imply shared VM. By way of the above,
2020	* thread groups also imply shared VM. Blocking this case allows
2021	* for various simplifications in other code.
2022	*/
2023	if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM))
2024	return ERR_PTR(-EINVAL);
2025
2026	/*
2027	* Siblings of global init remain as zombies on exit since they are
2028	* not reaped by their parent (swapper). To solve this and to avoid
2029	* multi-rooted process trees, prevent global and container-inits
2030	* from creating siblings.
2031	*/
2032	if ((clone_flags & CLONE_PARENT) &&
2033	current->signal->flags & SIGNAL_UNKILLABLE)
2034	return ERR_PTR(-EINVAL);
2035
2036	/*
2037	* If the new process will be in a different pid or user namespace
2038	* do not allow it to share a thread group with the forking task.
2039	*/
2040	if (clone_flags & CLONE_THREAD) {
2041	if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
2042	(task_active_pid_ns(current) != nsp->pid_ns_for_children))
2043	return ERR_PTR(-EINVAL);
2044	}
2045
2046	/*
2047	* If the new process will be in a different time namespace
2048	* do not allow it to share VM or a thread group with the forking task.
2049	*
2050	* On vfork, the child process enters the target time namespace only
2051	* after exec.
2052	*/
2053	if ((clone_flags & (CLONE_VM | CLONE_VFORK)) == CLONE_VM) {
2054	if (nsp->time_ns != nsp->time_ns_for_children)
2055	return ERR_PTR(-EINVAL);
2056	}
2057
2058	if (clone_flags & CLONE_PIDFD) {
2059	/*
2060	* - CLONE_DETACHED is blocked so that we can potentially
2061	* reuse it later for CLONE_PIDFD.
2062	* - CLONE_THREAD is blocked until someone really needs it.
2063	*/
2064	if (clone_flags & (CLONE_DETACHED | CLONE_THREAD))
2065	return ERR_PTR(-EINVAL);
2066	}
2067
2068	/*
2069	* Force any signals received before this point to be delivered
2070	* before the fork happens. Collect up signals sent to multiple
2071	* processes that happen during the fork and delay them so that
2072	* they appear to happen after the fork.
2073	*/
2074	sigemptyset(&delayed.signal);
2075	INIT_HLIST_NODE(&delayed.node);
2076
2077	spin_lock_irq(&current->sighand->siglock);
2078	if (!(clone_flags & CLONE_THREAD))
2079	hlist_add_head(&delayed.node, &current->signal->multiprocess);
2080	recalc_sigpending();
2081	spin_unlock_irq(&current->sighand->siglock);
2082	retval = -ERESTARTNOINTR;
2083	if (task_sigpending(current))
2084	goto fork_out;
2085
2086	retval = -ENOMEM;
2087	p = dup_task_struct(current, node);
2088	if (!p)
2089	goto fork_out;
2090	p->flags &= ~PF_KTHREAD;
2091	if (args->kthread)
2092	p->flags |= PF_KTHREAD;
2093	if (args->io_thread) {
2094	/*
2095	* Mark us an IO worker, and block any signal that isn't
2096	* fatal or STOP
2097	*/
2098	p->flags |= PF_IO_WORKER;
2099	siginitsetinv(&p->blocked, sigmask(SIGKILL)|sigmask(SIGSTOP));
2100	}
2101
2102	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? args->child_tid : NULL;
2103	/*
2104	* Clear TID on mm_release()?
2105	*/
2106	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? args->child_tid : NULL;
2107
2108	ftrace_graph_init_task(p);
2109
2110	rt_mutex_init_task(p);
2111
2112	lockdep_assert_irqs_enabled();
2113	#ifdef CONFIG_PROVE_LOCKING
2114	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
2115	#endif
2116	retval = copy_creds(p, clone_flags);
2117	if (retval < 0)
2118	goto bad_fork_free;
2119
2120	retval = -EAGAIN;
2121	if (is_ucounts_overlimit(task_ucounts(p), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
2122	if (p->real_cred->user != INIT_USER &&
2123	!capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
2124	goto bad_fork_cleanup_count;
2125	}
2126	current->flags &= ~PF_NPROC_EXCEEDED;
2127
2128	/*
2129	* If multiple threads are within copy_process(), then this check
2130	* triggers too late. This doesn't hurt, the check is only there
2131	* to stop root fork bombs.
2132	*/
2133	retval = -EAGAIN;
2134	if (data_race(nr_threads >= max_threads))
2135	goto bad_fork_cleanup_count;
2136
2137	delayacct_tsk_init(p); /* Must remain after dup_task_struct() */
2138	p->flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER | PF_IDLE | PF_NO_SETAFFINITY);
2139	p->flags |= PF_FORKNOEXEC;
2140	INIT_LIST_HEAD(&p->children);
2141	INIT_LIST_HEAD(&p->sibling);
2142	rcu_copy_process(p);
2143	p->vfork_done = NULL;
2144	spin_lock_init(&p->alloc_lock);
2145
2146	init_sigpending(&p->pending);
2147
2148	p->utime = p->stime = p->gtime = 0;
2149	#ifdef CONFIG_ARCH_HAS_SCALED_CPUTIME
2150	p->utimescaled = p->stimescaled = 0;
2151	#endif
2152	prev_cputime_init(&p->prev_cputime);
2153
2154	#ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN
2155	seqcount_init(&p->vtime.seqcount);
2156	p->vtime.starttime = 0;
2157	p->vtime.state = VTIME_INACTIVE;
2158	#endif
2159
2160	#ifdef CONFIG_IO_URING
2161	p->io_uring = NULL;
2162	#endif
2163
2164	#if defined(SPLIT_RSS_COUNTING)
2165	memset(&p->rss_stat, 0, sizeof(p->rss_stat));
2166	#endif
2167
2168	p->default_timer_slack_ns = current->timer_slack_ns;
2169
2170	#ifdef CONFIG_PSI
2171	p->psi_flags = 0;
2172	#endif
2173
2174	task_io_accounting_init(&p->ioac);
2175	acct_clear_integrals(p);
2176
2177	posix_cputimers_init(&p->posix_cputimers);
2178
2179	p->io_context = NULL;
2180	audit_set_context(p, NULL);
2181	cgroup_fork(p);
2182	if (args->kthread) {
2183	if (!set_kthread_struct(p))
2184	goto bad_fork_cleanup_delayacct;
2185	}
2186	#ifdef CONFIG_NUMA
2187	p->mempolicy = mpol_dup(p->mempolicy);
2188	if (IS_ERR(p->mempolicy)) {
2189	retval = PTR_ERR(p->mempolicy);
2190	p->mempolicy = NULL;
2191	goto bad_fork_cleanup_delayacct;
2192	}
2193	#endif
2194	#ifdef CONFIG_CPUSETS
2195	p->cpuset_mem_spread_rotor = NUMA_NO_NODE;
2196	p->cpuset_slab_spread_rotor = NUMA_NO_NODE;
2197	seqcount_spinlock_init(&p->mems_allowed_seq, &p->alloc_lock);
2198	#endif
2199	#ifdef CONFIG_TRACE_IRQFLAGS
2200	memset(&p->irqtrace, 0, sizeof(p->irqtrace));
2201	p->irqtrace.hardirq_disable_ip = _THIS_IP_;
2202	p->irqtrace.softirq_enable_ip = _THIS_IP_;
2203	p->softirqs_enabled = 1;
2204	p->softirq_context = 0;
2205	#endif
2206
2207	p->pagefault_disabled = 0;
2208
2209	#ifdef CONFIG_LOCKDEP
2210	lockdep_init_task(p);
2211	#endif
2212
2213	#ifdef CONFIG_DEBUG_MUTEXES
2214	p->blocked_on = NULL; /* not blocked yet */
2215	#endif
2216	#ifdef CONFIG_BCACHE
2217	p->sequential_io = 0;
2218	p->sequential_io_avg = 0;
2219	#endif
2220	#ifdef CONFIG_BPF_SYSCALL
2221	RCU_INIT_POINTER(p->bpf_storage, NULL);
2222	p->bpf_ctx = NULL;
2223	#endif
2224
2225	/* Perform scheduler related setup. Assign this task to a CPU. */
2226	retval = sched_fork(clone_flags, p);
2227	if (retval)
2228	goto bad_fork_cleanup_policy;
2229
2230	retval = perf_event_init_task(p, clone_flags);
2231	if (retval)
2232	goto bad_fork_cleanup_policy;
2233	retval = audit_alloc(p);
2234	if (retval)
2235	goto bad_fork_cleanup_perf;
2236	/* copy all the process information */
2237	shm_init_task(p);
2238	retval = security_task_alloc(p, clone_flags);
2239	if (retval)
2240	goto bad_fork_cleanup_audit;
2241	retval = copy_semundo(clone_flags, p);
2242	if (retval)
2243	goto bad_fork_cleanup_security;
2244	retval = copy_files(clone_flags, p);
2245	if (retval)
2246	goto bad_fork_cleanup_semundo;
2247	retval = copy_fs(clone_flags, p);
2248	if (retval)
2249	goto bad_fork_cleanup_files;
2250	retval = copy_sighand(clone_flags, p);
2251	if (retval)
2252	goto bad_fork_cleanup_fs;
2253	retval = copy_signal(clone_flags, p);
2254	if (retval)
2255	goto bad_fork_cleanup_sighand;
2256	retval = copy_mm(clone_flags, p);
2257	if (retval)
2258	goto bad_fork_cleanup_signal;
2259	retval = copy_namespaces(clone_flags, p);
2260	if (retval)
2261	goto bad_fork_cleanup_mm;
2262	retval = copy_io(clone_flags, p);
2263	if (retval)
2264	goto bad_fork_cleanup_namespaces;
2265	retval = copy_thread(p, args);
2266	if (retval)
2267	goto bad_fork_cleanup_io;
2268
2269	stackleak_task_init(p);
2270
2271	if (pid != &init_struct_pid) {
2272	pid = alloc_pid(p->nsproxy->pid_ns_for_children, args->set_tid,
2273	args->set_tid_size);
2274	if (IS_ERR(pid)) {
2275	retval = PTR_ERR(pid);
2276	goto bad_fork_cleanup_thread;
2277	}
2278	}
2279
2280	/*
2281	* This has to happen after we've potentially unshared the file
2282	* descriptor table (so that the pidfd doesn't leak into the child
2283	* if the fd table isn't shared).
2284	*/
2285	if (clone_flags & CLONE_PIDFD) {
2286	retval = get_unused_fd_flags(O_RDWR | O_CLOEXEC);
2287	if (retval < 0)
2288	goto bad_fork_free_pid;
2289
2290	pidfd = retval;
2291
2292	pidfile = anon_inode_getfile("[pidfd]", &pidfd_fops, pid,
2293	O_RDWR | O_CLOEXEC);
2294	if (IS_ERR(pidfile)) {
2295	put_unused_fd(pidfd);
2296	retval = PTR_ERR(pidfile);
2297	goto bad_fork_free_pid;
2298	}
2299	get_pid(pid); /* held by pidfile now */
2300
2301	retval = put_user(pidfd, args->pidfd);
2302	if (retval)
2303	goto bad_fork_put_pidfd;
2304	}
2305
2306	#ifdef CONFIG_BLOCK
2307	p->plug = NULL;
2308	#endif
2309	futex_init_task(p);
2310
2311	/*
2312	* sigaltstack should be cleared when sharing the same VM
2313	*/
2314	if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM)
2315	sas_ss_reset(p);
2316
2317	/*
2318	* Syscall tracing and stepping should be turned off in the
2319	* child regardless of CLONE_PTRACE.
2320	*/
2321	user_disable_single_step(p);
2322	clear_task_syscall_work(p, SYSCALL_TRACE);
2323	#if defined(CONFIG_GENERIC_ENTRY) || defined(TIF_SYSCALL_EMU)
2324	clear_task_syscall_work(p, SYSCALL_EMU);
2325	#endif
2326	clear_tsk_latency_tracing(p);
2327
2328	/* ok, now we should be set up.. */
2329	p->pid = pid_nr(pid);
2330	if (clone_flags & CLONE_THREAD) {
2331	p->group_leader = current->group_leader;
2332	p->tgid = current->tgid;
2333	} else {
2334	p->group_leader = p;
2335	p->tgid = p->pid;
2336	}
2337
2338	p->nr_dirtied = 0;
2339	p->nr_dirtied_pause = 128 >> (PAGE_SHIFT - 10);
2340	p->dirty_paused_when = 0;
2341
2342	p->pdeath_signal = 0;
2343	INIT_LIST_HEAD(&p->thread_group);
2344	p->task_works = NULL;
2345	clear_posix_cputimers_work(p);
2346
2347	#ifdef CONFIG_KRETPROBES
2348	p->kretprobe_instances.first = NULL;
2349	#endif
2350	#ifdef CONFIG_RETHOOK
2351	p->rethooks.first = NULL;
2352	#endif
2353
2354	/*
2355	* Ensure that the cgroup subsystem policies allow the new process to be
2356	* forked. It should be noted that the new process's css_set can be changed
2357	* between here and cgroup_post_fork() if an organisation operation is in
2358	* progress.
2359	*/
2360	retval = cgroup_can_fork(p, args);
2361	if (retval)
2362	goto bad_fork_put_pidfd;
2363
2364	/*
2365	* Now that the cgroups are pinned, re-clone the parent cgroup and put
2366	* the new task on the correct runqueue. All this *before* the task
2367	* becomes visible.
2368	*
2369	* This isn't part of ->can_fork() because while the re-cloning is
2370	* cgroup specific, it unconditionally needs to place the task on a
2371	* runqueue.
2372	*/
2373	sched_cgroup_fork(p, args);
2374
2375	/*
2376	* From this point on we must avoid any synchronous user-space
2377	* communication until we take the tasklist-lock. In particular, we do
2378	* not want user-space to be able to predict the process start-time by
2379	* stalling fork(2) after we recorded the start_time but before it is
2380	* visible to the system.
2381	*/
2382
2383	p->start_time = ktime_get_ns();
2384	p->start_boottime = ktime_get_boottime_ns();
2385
2386	/*
2387	* Make it visible to the rest of the system, but dont wake it up yet.
2388	* Need tasklist lock for parent etc handling!
2389	*/
2390	write_lock_irq(&tasklist_lock);
2391
2392	/* CLONE_PARENT re-uses the old parent */
2393	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
2394	p->real_parent = current->real_parent;
2395	p->parent_exec_id = current->parent_exec_id;
2396	if (clone_flags & CLONE_THREAD)
2397	p->exit_signal = -1;
2398	else
2399	p->exit_signal = current->group_leader->exit_signal;
2400	} else {
2401	p->real_parent = current;
2402	p->parent_exec_id = current->self_exec_id;
2403	p->exit_signal = args->exit_signal;
2404	}
2405
2406	klp_copy_process(p);
2407
2408	sched_core_fork(p);
2409
2410	spin_lock(&current->sighand->siglock);
2411
2412	/*
2413	* Copy seccomp details explicitly here, in case they were changed
2414	* before holding sighand lock.
2415	*/
2416	copy_seccomp(p);
2417
2418	rv_task_fork(p);
2419
2420	rseq_fork(p, clone_flags);
2421
2422	/* Don't start children in a dying pid namespace */
2423	if (unlikely(!(ns_of_pid(pid)->pid_allocated & PIDNS_ADDING))) {
2424	retval = -ENOMEM;
2425	goto bad_fork_cancel_cgroup;
2426	}
2427
2428	/* Let kill terminate clone/fork in the middle */
2429	if (fatal_signal_pending(current)) {
2430	retval = -EINTR;
2431	goto bad_fork_cancel_cgroup;
2432	}
2433
2434	init_task_pid_links(p);
2435	if (likely(p->pid)) {
2436	ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
2437
2438	init_task_pid(p, PIDTYPE_PID, pid);
2439	if (thread_group_leader(p)) {
2440	init_task_pid(p, PIDTYPE_TGID, pid);
2441	init_task_pid(p, PIDTYPE_PGID, task_pgrp(current));
2442	init_task_pid(p, PIDTYPE_SID, task_session(current));
2443
2444	if (is_child_reaper(pid)) {
2445	ns_of_pid(pid)->child_reaper = p;
2446	p->signal->flags |= SIGNAL_UNKILLABLE;
2447	}
2448	p->signal->shared_pending.signal = delayed.signal;
2449	p->signal->tty = tty_kref_get(current->signal->tty);
2450	/*
2451	* Inherit has_child_subreaper flag under the same
2452	* tasklist_lock with adding child to the process tree
2453	* for propagate_has_child_subreaper optimization.
2454	*/
2455	p->signal->has_child_subreaper = p->real_parent->signal->has_child_subreaper ||
2456	p->real_parent->signal->is_child_subreaper;
2457	list_add_tail(&p->sibling, &p->real_parent->children);
2458	list_add_tail_rcu(&p->tasks, &init_task.tasks);
2459	attach_pid(p, PIDTYPE_TGID);
2460	attach_pid(p, PIDTYPE_PGID);
2461	attach_pid(p, PIDTYPE_SID);
2462	__this_cpu_inc(process_counts);
2463	} else {
2464	current->signal->nr_threads++;
2465	atomic_inc(&current->signal->live);
2466	refcount_inc(&current->signal->sigcnt);
2467	task_join_group_stop(p);
2468	list_add_tail_rcu(&p->thread_group,
2469	&p->group_leader->thread_group);
2470	list_add_tail_rcu(&p->thread_node,
2471	&p->signal->thread_head);
2472	}
2473	attach_pid(p, PIDTYPE_PID);
2474	nr_threads++;
2475	}
2476	total_forks++;
2477	hlist_del_init(&delayed.node);
2478	spin_unlock(&current->sighand->siglock);
2479	syscall_tracepoint_update(p);
2480	write_unlock_irq(&tasklist_lock);
2481
2482	if (pidfile)
2483	fd_install(pidfd, pidfile);
2484
2485	proc_fork_connector(p);
2486	sched_post_fork(p);
2487	cgroup_post_fork(p, args);
2488	perf_event_fork(p);
2489
2490	trace_task_newtask(p, clone_flags);
2491	uprobe_copy_process(p, clone_flags);
2492
2493	copy_oom_score_adj(clone_flags, p);
2494
2495	return p;
2496
2497	bad_fork_cancel_cgroup:
2498	sched_core_free(p);
2499	spin_unlock(&current->sighand->siglock);
2500	write_unlock_irq(&tasklist_lock);
2501	cgroup_cancel_fork(p, args);
2502	bad_fork_put_pidfd:
2503	if (clone_flags & CLONE_PIDFD) {
2504	fput(pidfile);
2505	put_unused_fd(pidfd);
2506	}
2507	bad_fork_free_pid:
2508	if (pid != &init_struct_pid)
2509	free_pid(pid);
2510	bad_fork_cleanup_thread:
2511	exit_thread(p);
2512	bad_fork_cleanup_io:
2513	if (p->io_context)
2514	exit_io_context(p);
2515	bad_fork_cleanup_namespaces:
2516	exit_task_namespaces(p);
2517	bad_fork_cleanup_mm:
2518	if (p->mm) {
2519	mm_clear_owner(p->mm, p);
2520	mmput(p->mm);
2521	}
2522	bad_fork_cleanup_signal:
2523	if (!(clone_flags & CLONE_THREAD))
2524	free_signal_struct(p->signal);
2525	bad_fork_cleanup_sighand:
2526	__cleanup_sighand(p->sighand);
2527	bad_fork_cleanup_fs:
2528	exit_fs(p); /* blocking */
2529	bad_fork_cleanup_files:
2530	exit_files(p); /* blocking */
2531	bad_fork_cleanup_semundo:
2532	exit_sem(p);
2533	bad_fork_cleanup_security:
2534	security_task_free(p);
2535	bad_fork_cleanup_audit:
2536	audit_free(p);
2537	bad_fork_cleanup_perf:
2538	perf_event_free_task(p);
2539	bad_fork_cleanup_policy:
2540	lockdep_free_task(p);
2541	#ifdef CONFIG_NUMA
2542	mpol_put(p->mempolicy);
2543	#endif
2544	bad_fork_cleanup_delayacct:
2545	delayacct_tsk_free(p);
2546	bad_fork_cleanup_count:
2547	dec_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1);
2548	exit_creds(p);
2549	bad_fork_free:
2550	WRITE_ONCE(p->__state, TASK_DEAD);
2551	exit_task_stack_account(p);
2552	put_task_stack(p);
2553	delayed_free_task(p);
2554	fork_out:
2555	spin_lock_irq(&current->sighand->siglock);
2556	hlist_del_init(&delayed.node);
2557	spin_unlock_irq(&current->sighand->siglock);
2558	return ERR_PTR(retval);
2559	}
2560
2561	static inline void init_idle_pids(struct task_struct *idle)
2562	{
2563	enum pid_type type;
2564
2565	for (type = PIDTYPE_PID; type < PIDTYPE_MAX; ++type) {
2566	INIT_HLIST_NODE(&idle->pid_links[type]); /* not really needed */
2567	init_task_pid(idle, type, &init_struct_pid);
2568	}
2569	}
2570
2571	static int idle_dummy(void *dummy)
2572	{
2573	/* This function is never called */
2574	return 0;
2575	}
2576
2577	struct task_struct * __init fork_idle(int cpu)
2578	{
2579	struct task_struct *task;
2580	struct kernel_clone_args args = {
2581	.flags = CLONE_VM,
2582	.fn = &idle_dummy,
2583	.fn_arg = NULL,
2584	.kthread = 1,
2585	.idle = 1,
2586	};
2587
2588	task = copy_process(&init_struct_pid, 0, cpu_to_node(cpu), &args);
2589	if (!IS_ERR(task)) {
2590	init_idle_pids(task);
2591	init_idle(task, cpu);
2592	}
2593
2594	return task;
2595	}
2596
2597	struct mm_struct *copy_init_mm(void)
2598	{
2599	return dup_mm(NULL, &init_mm);
2600	}
2601
2602	/*
2603	* This is like kernel_clone(), but shaved down and tailored to just
2604	* creating io_uring workers. It returns a created task, or an error pointer.
2605	* The returned task is inactive, and the caller must fire it up through
2606	* wake_up_new_task(p). All signals are blocked in the created task.
2607	*/
2608	struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node)
2609	{
2610	unsigned long flags = CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|
2611	CLONE_IO;
2612	struct kernel_clone_args args = {
2613	.flags = ((lower_32_bits(flags) | CLONE_VM |
2614	CLONE_UNTRACED) & ~CSIGNAL),
2615	.exit_signal = (lower_32_bits(flags) & CSIGNAL),
2616	.fn = fn,
2617	.fn_arg = arg,
2618	.io_thread = 1,
2619	};
2620
2621	return copy_process(NULL, 0, node, &args);
2622	}
2623
2624	/*
2625	* Ok, this is the main fork-routine.
2626	*
2627	* It copies the process, and if successful kick-starts
2628	* it and waits for it to finish using the VM if required.
2629	*
2630	* args->exit_signal is expected to be checked for sanity by the caller.
2631	*/
2632	pid_t kernel_clone(struct kernel_clone_args *args)
2633	{
2634	u64 clone_flags = args->flags;
2635	struct completion vfork;
2636	struct pid *pid;
2637	struct task_struct *p;
2638	int trace = 0;
2639	pid_t nr;
2640
2641	/*
2642	* For legacy clone() calls, CLONE_PIDFD uses the parent_tid argument
2643	* to return the pidfd. Hence, CLONE_PIDFD and CLONE_PARENT_SETTID are
2644	* mutually exclusive. With clone3() CLONE_PIDFD has grown a separate
2645	* field in struct clone_args and it still doesn't make sense to have
2646	* them both point at the same memory location. Performing this check
2647	* here has the advantage that we don't need to have a separate helper
2648	* to check for legacy clone().
2649	*/
2650	if ((args->flags & CLONE_PIDFD) &&
2651	(args->flags & CLONE_PARENT_SETTID) &&
2652	(args->pidfd == args->parent_tid))
2653	return -EINVAL;
2654
2655	/*
2656	* Determine whether and which event to report to ptracer. When
2657	* called from kernel_thread or CLONE_UNTRACED is explicitly
2658	* requested, no event is reported; otherwise, report if the event
2659	* for the type of forking is enabled.
2660	*/
2661	if (!(clone_flags & CLONE_UNTRACED)) {
2662	if (clone_flags & CLONE_VFORK)
2663	trace = PTRACE_EVENT_VFORK;
2664	else if (args->exit_signal != SIGCHLD)
2665	trace = PTRACE_EVENT_CLONE;
2666	else
2667	trace = PTRACE_EVENT_FORK;
2668
2669	if (likely(!ptrace_event_enabled(current, trace)))
2670	trace = 0;
2671	}
2672
2673	p = copy_process(NULL, trace, NUMA_NO_NODE, args);
2674	add_latent_entropy();
2675
2676	if (IS_ERR(p))
2677	return PTR_ERR(p);
2678
2679	/*
2680	* Do this prior waking up the new thread - the thread pointer
2681	* might get invalid after that point, if the thread exits quickly.
2682	*/
2683	trace_sched_process_fork(current, p);
2684
2685	pid = get_task_pid(p, PIDTYPE_PID);
2686	nr = pid_vnr(pid);
2687
2688	if (clone_flags & CLONE_PARENT_SETTID)
2689	put_user(nr, args->parent_tid);
2690
2691	if (clone_flags & CLONE_VFORK) {
2692	p->vfork_done = &vfork;
2693	init_completion(&vfork);
2694	get_task_struct(p);
2695	}
2696
2697	wake_up_new_task(p);
2698
2699	/* forking complete and child started to run, tell ptracer */
2700	if (unlikely(trace))
2701	ptrace_event_pid(trace, pid);
2702
2703	if (clone_flags & CLONE_VFORK) {
2704	if (!wait_for_vfork_done(p, &vfork))
2705	ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid);
2706	}
2707
2708	put_pid(pid);
2709	return nr;
2710	}
2711
2712	/*
2713	* Create a kernel thread.
2714	*/
2715	pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
2716	{
2717	struct kernel_clone_args args = {
2718	.flags = ((lower_32_bits(flags) | CLONE_VM |
2719	CLONE_UNTRACED) & ~CSIGNAL),
2720	.exit_signal = (lower_32_bits(flags) & CSIGNAL),
2721	.fn = fn,
2722	.fn_arg = arg,
2723	.kthread = 1,
2724	};
2725
2726	return kernel_clone(&args);
2727	}
2728
2729	/*
2730	* Create a user mode thread.
2731	*/
2732	pid_t user_mode_thread(int (*fn)(void *), void *arg, unsigned long flags)
2733	{
2734	struct kernel_clone_args args = {
2735	.flags = ((lower_32_bits(flags) | CLONE_VM |
2736	CLONE_UNTRACED) & ~CSIGNAL),
2737	.exit_signal = (lower_32_bits(flags) & CSIGNAL),
2738	.fn = fn,
2739	.fn_arg = arg,
2740	};
2741
2742	return kernel_clone(&args);
2743	}
2744
2745	#ifdef __ARCH_WANT_SYS_FORK
2746	SYSCALL_DEFINE0(fork)
2747	{
2748	#ifdef CONFIG_MMU
2749	struct kernel_clone_args args = {
2750	.exit_signal = SIGCHLD,
2751	};
2752
2753	return kernel_clone(&args);
2754	#else
2755	/* can not support in nommu mode */
2756	return -EINVAL;
2757	#endif
2758	}
2759	#endif
2760
2761	#ifdef __ARCH_WANT_SYS_VFORK
2762	SYSCALL_DEFINE0(vfork)
2763	{
2764	struct kernel_clone_args args = {
2765	.flags = CLONE_VFORK | CLONE_VM,
2766	.exit_signal = SIGCHLD,
2767	};
2768
2769	return kernel_clone(&args);
2770	}
2771	#endif
2772
2773	#ifdef __ARCH_WANT_SYS_CLONE
2774	#ifdef CONFIG_CLONE_BACKWARDS
2775	SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
2776	int __user *, parent_tidptr,
2777	unsigned long, tls,
2778	int __user *, child_tidptr)
2779	#elif defined(CONFIG_CLONE_BACKWARDS2)
2780	SYSCALL_DEFINE5(clone, unsigned long, newsp, unsigned long, clone_flags,
2781	int __user *, parent_tidptr,
2782	int __user *, child_tidptr,
2783	unsigned long, tls)
2784	#elif defined(CONFIG_CLONE_BACKWARDS3)
2785	SYSCALL_DEFINE6(clone, unsigned long, clone_flags, unsigned long, newsp,
2786	int, stack_size,
2787	int __user *, parent_tidptr,
2788	int __user *, child_tidptr,
2789	unsigned long, tls)
2790	#else
2791	SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
2792	int __user *, parent_tidptr,
2793	int __user *, child_tidptr,
2794	unsigned long, tls)
2795	#endif
2796	{
2797	struct kernel_clone_args args = {
2798	.flags = (lower_32_bits(clone_flags) & ~CSIGNAL),
2799	.pidfd = parent_tidptr,
2800	.child_tid = child_tidptr,
2801	.parent_tid = parent_tidptr,
2802	.exit_signal = (lower_32_bits(clone_flags) & CSIGNAL),
2803	.stack = newsp,
2804	.tls = tls,
2805	};
2806
2807	return kernel_clone(&args);
2808	}
2809	#endif
2810
2811	#ifdef __ARCH_WANT_SYS_CLONE3
2812
2813	noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
2814	struct clone_args __user *uargs,
2815	size_t usize)
2816	{
2817	int err;
2818	struct clone_args args;
2819	pid_t *kset_tid = kargs->set_tid;
2820
2821	BUILD_BUG_ON(offsetofend(struct clone_args, tls) !=
2822	CLONE_ARGS_SIZE_VER0);
2823	BUILD_BUG_ON(offsetofend(struct clone_args, set_tid_size) !=
2824	CLONE_ARGS_SIZE_VER1);
2825	BUILD_BUG_ON(offsetofend(struct clone_args, cgroup) !=
2826	CLONE_ARGS_SIZE_VER2);
2827	BUILD_BUG_ON(sizeof(struct clone_args) != CLONE_ARGS_SIZE_VER2);
2828
2829	if (unlikely(usize > PAGE_SIZE))
2830	return -E2BIG;
2831	if (unlikely(usize < CLONE_ARGS_SIZE_VER0))
2832	return -EINVAL;
2833
2834	err = copy_struct_from_user(&args, sizeof(args), uargs, usize);
2835	if (err)
2836	return err;
2837
2838	if (unlikely(args.set_tid_size > MAX_PID_NS_LEVEL))
2839	return -EINVAL;
2840
2841	if (unlikely(!args.set_tid && args.set_tid_size > 0))
2842	return -EINVAL;
2843
2844	if (unlikely(args.set_tid && args.set_tid_size == 0))
2845	return -EINVAL;
2846
2847	/*
2848	* Verify that higher 32bits of exit_signal are unset and that
2849	* it is a valid signal
2850	*/
2851	if (unlikely((args.exit_signal & ~((u64)CSIGNAL)) ||
2852	!valid_signal(args.exit_signal)))
2853	return -EINVAL;
2854
2855	if ((args.flags & CLONE_INTO_CGROUP) &&
2856	(args.cgroup > INT_MAX || usize < CLONE_ARGS_SIZE_VER2))
2857	return -EINVAL;
2858
2859	*kargs = (struct kernel_clone_args){
2860	.flags = args.flags,
2861	.pidfd = u64_to_user_ptr(args.pidfd),
2862	.child_tid = u64_to_user_ptr(args.child_tid),
2863	.parent_tid = u64_to_user_ptr(args.parent_tid),
2864	.exit_signal = args.exit_signal,
2865	.stack = args.stack,
2866	.stack_size = args.stack_size,
2867	.tls = args.tls,
2868	.set_tid_size = args.set_tid_size,
2869	.cgroup = args.cgroup,
2870	};
2871
2872	if (args.set_tid &&
2873	copy_from_user(kset_tid, u64_to_user_ptr(args.set_tid),
2874	(kargs->set_tid_size * sizeof(pid_t))))
2875	return -EFAULT;
2876
2877	kargs->set_tid = kset_tid;
2878
2879	return 0;
2880	}
2881
2882	/**
2883	* clone3_stack_valid - check and prepare stack
2884	* @kargs: kernel clone args
2885	*
2886	* Verify that the stack arguments userspace gave us are sane.
2887	* In addition, set the stack direction for userspace since it's easy for us to
2888	* determine.
2889	*/
2890	static inline bool clone3_stack_valid(struct kernel_clone_args *kargs)
2891	{
2892	if (kargs->stack == 0) {
2893	if (kargs->stack_size > 0)
2894	return false;
2895	} else {
2896	if (kargs->stack_size == 0)
2897	return false;
2898
2899	if (!access_ok((void __user *)kargs->stack, kargs->stack_size))
2900	return false;
2901
2902	#if !defined(CONFIG_STACK_GROWSUP) && !defined(CONFIG_IA64)
2903	kargs->stack += kargs->stack_size;
2904	#endif
2905	}
2906
2907	return true;
2908	}
2909
2910	static bool clone3_args_valid(struct kernel_clone_args *kargs)
2911	{
2912	/* Verify that no unknown flags are passed along. */
2913	if (kargs->flags &
2914	~(CLONE_LEGACY_FLAGS | CLONE_CLEAR_SIGHAND | CLONE_INTO_CGROUP))
2915	return false;
2916
2917	/*
2918	* - make the CLONE_DETACHED bit reusable for clone3
2919	* - make the CSIGNAL bits reusable for clone3
2920	*/
2921	if (kargs->flags & (CLONE_DETACHED | CSIGNAL))
2922	return false;
2923
2924	if ((kargs->flags & (CLONE_SIGHAND | CLONE_CLEAR_SIGHAND)) ==
2925	(CLONE_SIGHAND | CLONE_CLEAR_SIGHAND))
2926	return false;
2927
2928	if ((kargs->flags & (CLONE_THREAD | CLONE_PARENT)) &&
2929	kargs->exit_signal)
2930	return false;
2931
2932	if (!clone3_stack_valid(kargs))
2933	return false;
2934
2935	return true;
2936	}
2937
2938	/**
2939	* clone3 - create a new process with specific properties
2940	* @uargs: argument structure
2941	* @size: size of @uargs
2942	*
2943	* clone3() is the extensible successor to clone()/clone2().
2944	* It takes a struct as argument that is versioned by its size.
2945	*
2946	* Return: On success, a positive PID for the child process.
2947	* On error, a negative errno number.
2948	*/
2949	SYSCALL_DEFINE2(clone3, struct clone_args __user *, uargs, size_t, size)
2950	{
2951	int err;
2952
2953	struct kernel_clone_args kargs;
2954	pid_t set_tid[MAX_PID_NS_LEVEL];
2955
2956	kargs.set_tid = set_tid;
2957
2958	err = copy_clone_args_from_user(&kargs, uargs, size);
2959	if (err)
2960	return err;
2961
2962	if (!clone3_args_valid(&kargs))
2963	return -EINVAL;
2964
2965	return kernel_clone(&kargs);
2966	}
2967	#endif
2968
2969	void walk_process_tree(struct task_struct *top, proc_visitor visitor, void *data)
2970	{
2971	struct task_struct *leader, *parent, *child;
2972	int res;
2973
2974	read_lock(&tasklist_lock);
2975	leader = top = top->group_leader;
2976	down:
2977	for_each_thread(leader, parent) {
2978	list_for_each_entry(child, &parent->children, sibling) {
2979	res = visitor(child, data);
2980	if (res) {
2981	if (res < 0)
2982	goto out;
2983	leader = child;
2984	goto down;
2985	}
2986	up:
2987	;
2988	}
2989	}
2990
2991	if (leader != top) {
2992	child = leader;
2993	parent = child->real_parent;
2994	leader = parent->group_leader;
2995	goto up;
2996	}
2997	out:
2998	read_unlock(&tasklist_lock);
2999	}
3000
3001	#ifndef ARCH_MIN_MMSTRUCT_ALIGN
3002	#define ARCH_MIN_MMSTRUCT_ALIGN 0
3003	#endif
3004
3005	static void sighand_ctor(void *data)
3006	{
3007	struct sighand_struct *sighand = data;
3008
3009	spin_lock_init(&sighand->siglock);
3010	init_waitqueue_head(&sighand->signalfd_wqh);
3011	}
3012
3013	void __init proc_caches_init(void)
3014	{
3015	unsigned int mm_size;
3016
3017	sighand_cachep = kmem_cache_create("sighand_cache",
3018	sizeof(struct sighand_struct), 0,
3019	SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_TYPESAFE_BY_RCU|
3020	SLAB_ACCOUNT, sighand_ctor);
3021	signal_cachep = kmem_cache_create("signal_cache",
3022	sizeof(struct signal_struct), 0,
3023	SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
3024	NULL);
3025	files_cachep = kmem_cache_create("files_cache",
3026	sizeof(struct files_struct), 0,
3027	SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
3028	NULL);
3029	fs_cachep = kmem_cache_create("fs_cache",
3030	sizeof(struct fs_struct), 0,
3031	SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
3032	NULL);
3033
3034	/*
3035	* The mm_cpumask is located at the end of mm_struct, and is
3036	* dynamically sized based on the maximum CPU number this system
3037	* can have, taking hotplug into account (nr_cpu_ids).
3038	*/
3039	mm_size = sizeof(struct mm_struct) + cpumask_size();
3040
3041	mm_cachep = kmem_cache_create_usercopy("mm_struct",
3042	mm_size, ARCH_MIN_MMSTRUCT_ALIGN,
3043	SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
3044	offsetof(struct mm_struct, saved_auxv),
3045	sizeof_field(struct mm_struct, saved_auxv),
3046	NULL);
3047	vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT);
3048	mmap_init();
3049	nsproxy_cache_init();
3050	}
3051
3052	/*
3053	* Check constraints on flags passed to the unshare system call.
3054	*/
3055	static int check_unshare_flags(unsigned long unshare_flags)
3056	{
3057	if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
3058	CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
3059	CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET|
3060	CLONE_NEWUSER|CLONE_NEWPID|CLONE_NEWCGROUP|
3061	CLONE_NEWTIME))
3062	return -EINVAL;
3063	/*
3064	* Not implemented, but pretend it works if there is nothing
3065	* to unshare. Note that unsharing the address space or the
3066	* signal handlers also need to unshare the signal queues (aka
3067	* CLONE_THREAD).
3068	*/
3069	if (unshare_flags & (CLONE_THREAD | CLONE_SIGHAND | CLONE_VM)) {
3070	if (!thread_group_empty(current))
3071	return -EINVAL;
3072	}
3073	if (unshare_flags & (CLONE_SIGHAND | CLONE_VM)) {
3074	if (refcount_read(&current->sighand->count) > 1)
3075	return -EINVAL;
3076	}
3077	if (unshare_flags & CLONE_VM) {
3078	if (!current_is_single_threaded())
3079	return -EINVAL;
3080	}
3081
3082	return 0;
3083	}
3084
3085	/*
3086	* Unshare the filesystem structure if it is being shared
3087	*/
3088	static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
3089	{
3090	struct fs_struct *fs = current->fs;
3091
3092	if (!(unshare_flags & CLONE_FS) || !fs)
3093	return 0;
3094
3095	/* don't need lock here; in the worst case we'll do useless copy */
3096	if (fs->users == 1)
3097	return 0;
3098
3099	*new_fsp = copy_fs_struct(fs);
3100	if (!*new_fsp)
3101	return -ENOMEM;
3102
3103	return 0;
3104	}
3105
3106	/*
3107	* Unshare file descriptor table if it is being shared
3108	*/
3109	int unshare_fd(unsigned long unshare_flags, unsigned int max_fds,
3110	struct files_struct **new_fdp)
3111	{
3112	struct files_struct *fd = current->files;
3113	int error = 0;
3114
3115	if ((unshare_flags & CLONE_FILES) &&
3116	(fd && atomic_read(&fd->count) > 1)) {
3117	*new_fdp = dup_fd(fd, max_fds, &error);
3118	if (!*new_fdp)
3119	return error;
3120	}
3121
3122	return 0;
3123	}
3124
3125	/*
3126	* unshare allows a process to 'unshare' part of the process
3127	* context which was originally shared using clone. copy_*
3128	* functions used by kernel_clone() cannot be used here directly
3129	* because they modify an inactive task_struct that is being
3130	* constructed. Here we are modifying the current, active,
3131	* task_struct.
3132	*/
3133	int ksys_unshare(unsigned long unshare_flags)
3134	{
3135	struct fs_struct *fs, *new_fs = NULL;
3136	struct files_struct *new_fd = NULL;
3137	struct cred *new_cred = NULL;
3138	struct nsproxy *new_nsproxy = NULL;
3139	int do_sysvsem = 0;
3140	int err;
3141
3142	/*
3143	* If unsharing a user namespace must also unshare the thread group
3144	* and unshare the filesystem root and working directories.
3145	*/
3146	if (unshare_flags & CLONE_NEWUSER)
3147	unshare_flags |= CLONE_THREAD | CLONE_FS;
3148	/*
3149	* If unsharing vm, must also unshare signal handlers.
3150	*/
3151	if (unshare_flags & CLONE_VM)
3152	unshare_flags |= CLONE_SIGHAND;
3153	/*
3154	* If unsharing a signal handlers, must also unshare the signal queues.
3155	*/
3156	if (unshare_flags & CLONE_SIGHAND)
3157	unshare_flags |= CLONE_THREAD;
3158	/*
3159	* If unsharing namespace, must also unshare filesystem information.
3160	*/
3161	if (unshare_flags & CLONE_NEWNS)
3162	unshare_flags |= CLONE_FS;
3163
3164	err = check_unshare_flags(unshare_flags);
3165	if (err)
3166	goto bad_unshare_out;
3167	/*
3168	* CLONE_NEWIPC must also detach from the undolist: after switching
3169	* to a new ipc namespace, the semaphore arrays from the old
3170	* namespace are unreachable.
3171	*/
3172	if (unshare_flags & (CLONE_NEWIPC|CLONE_SYSVSEM))
3173	do_sysvsem = 1;
3174	err = unshare_fs(unshare_flags, &new_fs);
3175	if (err)
3176	goto bad_unshare_out;
3177	err = unshare_fd(unshare_flags, NR_OPEN_MAX, &new_fd);
3178	if (err)
3179	goto bad_unshare_cleanup_fs;
3180	err = unshare_userns(unshare_flags, &new_cred);
3181	if (err)
3182	goto bad_unshare_cleanup_fd;
3183	err = unshare_nsproxy_namespaces(unshare_flags, &new_nsproxy,
3184	new_cred, new_fs);
3185	if (err)
3186	goto bad_unshare_cleanup_cred;
3187
3188	if (new_cred) {
3189	err = set_cred_ucounts(new_cred);
3190	if (err)
3191	goto bad_unshare_cleanup_cred;
3192	}
3193
3194	if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) {
3195	if (do_sysvsem) {
3196	/*
3197	* CLONE_SYSVSEM is equivalent to sys_exit().
3198	*/
3199	exit_sem(current);
3200	}
3201	if (unshare_flags & CLONE_NEWIPC) {
3202	/* Orphan segments in old ns (see sem above). */
3203	exit_shm(current);
3204	shm_init_task(current);
3205	}
3206
3207	if (new_nsproxy)
3208	switch_task_namespaces(current, new_nsproxy);
3209
3210	task_lock(current);
3211
3212	if (new_fs) {
3213	fs = current->fs;
3214	spin_lock(&fs->lock);
3215	current->fs = new_fs;
3216	if (--fs->users)
3217	new_fs = NULL;
3218	else
3219	new_fs = fs;
3220	spin_unlock(&fs->lock);
3221	}
3222
3223	if (new_fd)
3224	swap(current->files, new_fd);
3225
3226	task_unlock(current);
3227
3228	if (new_cred) {
3229	/* Install the new user namespace */
3230	commit_creds(new_cred);
3231	new_cred = NULL;
3232	}
3233	}
3234
3235	perf_event_namespaces(current);
3236
3237	bad_unshare_cleanup_cred:
3238	if (new_cred)
3239	put_cred(new_cred);
3240	bad_unshare_cleanup_fd:
3241	if (new_fd)
3242	put_files_struct(new_fd);
3243
3244	bad_unshare_cleanup_fs:
3245	if (new_fs)
3246	free_fs_struct(new_fs);
3247
3248	bad_unshare_out:
3249	return err;
3250	}
3251
3252	SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
3253	{
3254	return ksys_unshare(unshare_flags);
3255	}
3256
3257	/*
3258	* Helper to unshare the files of the current task.
3259	* We don't want to expose copy_files internals to
3260	* the exec layer of the kernel.
3261	*/
3262
3263	int unshare_files(void)
3264	{
3265	struct task_struct *task = current;
3266	struct files_struct *old, *copy = NULL;
3267	int error;
3268
3269	error = unshare_fd(CLONE_FILES, NR_OPEN_MAX, &copy);
3270	if (error || !copy)
3271	return error;
3272
3273	old = task->files;
3274	task_lock(task);
3275	task->files = copy;
3276	task_unlock(task);
3277	put_files_struct(old);
3278	return 0;
3279	}
3280
3281	int sysctl_max_threads(struct ctl_table *table, int write,
3282	void *buffer, size_t *lenp, loff_t *ppos)
3283	{
3284	struct ctl_table t;
3285	int ret;
3286	int threads = max_threads;
3287	int min = 1;
3288	int max = MAX_THREADS;
3289
3290	t = *table;
3291	t.data = &threads;
3292	t.extra1 = &min;
3293	t.extra2 = &max;
3294
3295	ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
3296	if (ret || !write)
3297	return ret;
3298
3299	max_threads = threads;
3300
3301	return 0;
3302	}
3303