x86/apic/msi: Plug non-maskable MSI affinity race

[mirror_ubuntu-bionic-kernel.git] / kernel / exit.c

diff --git a/kernel/exit.c b/kernel/exit.c
index 995453d9fb5529d0e210538cf27943839ec67721..2962618627b3b0e5c5e3d435bf9251f1a753881a 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -193,6 +193,7 @@ repeat:
        rcu_read_unlock();
 
        proc_flush_task(p);
+       cgroup_release(p);
 
        write_lock_irq(&tasklist_lock);
        ptrace_release_task(p);
@@ -306,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w)
         *        MB (A)              MB (B)
         *    [L] cond            [L] tsk
         */
-       smp_rmb(); /* (B) */
+       smp_mb(); /* (B) */
 
        /*
         * Avoid using task_rcu_dereference() magic as long as we are careful,
@@ -496,7 +497,7 @@ static void exit_mm(void)
        struct mm_struct *mm = current->mm;
        struct core_state *core_state;
 
-       mm_release(current, mm);
+       exit_mm_release(current, mm);
        if (!mm)
                return;
        sync_mm_rss(mm);
@@ -557,12 +558,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p)
        return NULL;
 }
 
-static struct task_struct *find_child_reaper(struct task_struct *father)
+static struct task_struct *find_child_reaper(struct task_struct *father,
+                                               struct list_head *dead)
        __releases(&tasklist_lock)
        __acquires(&tasklist_lock)
 {
        struct pid_namespace *pid_ns = task_active_pid_ns(father);
        struct task_struct *reaper = pid_ns->child_reaper;
+       struct task_struct *p, *n;
 
        if (likely(reaper != father))
                return reaper;
@@ -574,10 +577,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father)
        }
 
        write_unlock_irq(&tasklist_lock);
-       if (unlikely(pid_ns == &init_pid_ns)) {
-               panic("Attempted to kill init! exitcode=0x%08x\n",
-                       father->signal->group_exit_code ?: father->exit_code);
+
+       list_for_each_entry_safe(p, n, dead, ptrace_entry) {
+               list_del_init(&p->ptrace_entry);
+               release_task(p);
        }
+
        zap_pid_ns_processes(pid_ns);
        write_lock_irq(&tasklist_lock);
 
@@ -667,7 +672,7 @@ static void forget_original_parent(struct task_struct *father,
                exit_ptrace(father, dead);
 
        /* Can drop and reacquire tasklist_lock */
-       reaper = find_child_reaper(father);
+       reaper = find_child_reaper(father, dead);
        if (list_empty(&father->children))
                return;
 
@@ -794,32 +799,12 @@ void __noreturn do_exit(long code)
         */
        if (unlikely(tsk->flags & PF_EXITING)) {
                pr_alert("Fixing recursive fault but reboot is needed!\n");
-               /*
-                * We can do this unlocked here. The futex code uses
-                * this flag just to verify whether the pi state
-                * cleanup has been done or not. In the worst case it
-                * loops once more. We pretend that the cleanup was
-                * done as there is no way to return. Either the
-                * OWNER_DIED bit is set by now or we push the blocked
-                * task into the wait for ever nirwana as well.
-                */
-               tsk->flags |= PF_EXITPIDONE;
+               futex_exit_recursive(tsk);
                set_current_state(TASK_UNINTERRUPTIBLE);
                schedule();
        }
 
        exit_signals(tsk);  /* sets PF_EXITING */
-       /*
-        * Ensure that all new tsk->pi_lock acquisitions must observe
-        * PF_EXITING. Serializes against futex.c:attach_to_pi_owner().
-        */
-       smp_mb();
-       /*
-        * Ensure that we must observe the pi_state in exit_mm() ->
-        * mm_release() -> exit_pi_state_list().
-        */
-       raw_spin_lock_irq(&tsk->pi_lock);
-       raw_spin_unlock_irq(&tsk->pi_lock);
 
        if (unlikely(in_atomic())) {
                pr_info("note: %s[%d] exited with preempt_count %d\n",
@@ -834,6 +819,14 @@ void __noreturn do_exit(long code)
        acct_update_integrals(tsk);
        group_dead = atomic_dec_and_test(&tsk->signal->live);
        if (group_dead) {
+               /*
+                * If the last thread of global init has exited, panic
+                * immediately to get a useable coredump.
+                */
+               if (unlikely(is_global_init(tsk)))
+                       panic("Attempted to kill init! exitcode=0x%08x\n",
+                               tsk->signal->group_exit_code ?: (int)code);
+
 #ifdef CONFIG_POSIX_TIMERS
                hrtimer_cancel(&tsk->signal->real_timer);
                exit_itimers(tsk->signal);
@@ -893,12 +886,6 @@ void __noreturn do_exit(long code)
         * Make sure we are holding no locks:
         */
        debug_check_no_locks_held();
-       /*
-        * We can do this unlocked here. The futex code uses this flag
-        * just to verify whether the pi state cleanup has been done
-        * or not. In the worst case it loops once more.
-        */
-       tsk->flags |= PF_EXITPIDONE;
 
        if (tsk->io_context)
                exit_io_context(tsk);