1 files changed, 12 insertions, 3 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 2d14979577ee..2639a30a8aa5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -307,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w)
          *        MB (A)              MB (B)
          *    [L] cond            [L] tsk
          */
-        smp_rmb(); /* (B) */
+        smp_mb(); /* (B) */
 
         /*
          * Avoid using task_rcu_dereference() magic as long as we are careful,
@@ -558,12 +558,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p)
         return NULL;
 }
 
-static struct task_struct *find_child_reaper(struct task_struct *father)
+static struct task_struct *find_child_reaper(struct task_struct *father,
+                                                struct list_head *dead)
         __releases(&tasklist_lock)
         __acquires(&tasklist_lock)
 {
         struct pid_namespace *pid_ns = task_active_pid_ns(father);
         struct task_struct *reaper = pid_ns->child_reaper;
+        struct task_struct *p, *n;
 
         if (likely(reaper != father))
                 return reaper;
@@ -579,6 +581,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father)
                 panic("Attempted to kill init! exitcode=0x%08x\n",
                         father->signal->group_exit_code ?: father->exit_code);
         }
+
+        list_for_each_entry_safe(p, n, dead, ptrace_entry) {
+                list_del_init(&p->ptrace_entry);
+                release_task(p);
+        }
+
         zap_pid_ns_processes(pid_ns);
         write_lock_irq(&tasklist_lock);
 
@@ -668,7 +676,7 @@ static void forget_original_parent(struct task_struct *father,
                 exit_ptrace(father, dead);
 
         /* Can drop and reacquire tasklist_lock */
-        reaper = find_child_reaper(father);
+        reaper = find_child_reaper(father, dead);
         if (list_empty(&father->children))
                 return;
 
@@ -866,6 +874,7 @@ void __noreturn do_exit(long code)
         exit_task_namespaces(tsk);
         exit_task_work(tsk);
         exit_thread(tsk);
+        exit_umh(tsk);
 
         /*
          * Flush inherited counters to the parent - before the parent