1 files changed, 32 insertions, 31 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 546774a31a66..ceffc67b564a 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -55,15 +55,14 @@
 #include <asm/unistd.h>
 #include <asm/pgtable.h>
 #include <asm/mmu_context.h>
-#include "cred-internals.h"
 
 static void exit_mm(struct task_struct * tsk);
 
-static void __unhash_process(struct task_struct *p)
+static void __unhash_process(struct task_struct *p, bool group_dead)
 {
         nr_threads--;
         detach_pid(p, PIDTYPE_PID);
-        if (thread_group_leader(p)) {
+        if (group_dead) {
                 detach_pid(p, PIDTYPE_PGID);
                 detach_pid(p, PIDTYPE_SID);
 
@@ -80,23 +79,26 @@ static void __unhash_process(struct task_struct *p)
 static void __exit_signal(struct task_struct *tsk)
 {
         struct signal_struct *sig = tsk->signal;
+        bool group_dead = thread_group_leader(tsk);
         struct sighand_struct *sighand;
+        struct tty_struct *uninitialized_var(tty);
 
-        BUG_ON(!sig);
-        BUG_ON(!atomic_read(&sig->count));
-
-        sighand = rcu_dereference(tsk->sighand);
+        sighand = rcu_dereference_check(tsk->sighand,
+                                        rcu_read_lock_held() ||
+                                        lockdep_tasklist_lock_is_held());
         spin_lock(&sighand->siglock);
 
         posix_cpu_timers_exit(tsk);
-        if (atomic_dec_and_test(&sig->count))
+        if (group_dead) {
                 posix_cpu_timers_exit_group(tsk);
-        else {
+                tty = sig->tty;
+                sig->tty = NULL;
+        } else {
                 /*
                  * If there is any task waiting for the group exit
                  * then notify it:
                  */
-                if (sig->group_exit_task && atomic_read(&sig->count) == sig->notify_count)
+                if (sig->notify_count > 0 && !--sig->notify_count)
                         wake_up_process(sig->group_exit_task);
 
                 if (tsk == sig->curr_target)
@@ -122,32 +124,24 @@ static void __exit_signal(struct task_struct *tsk)
                 sig->oublock += task_io_get_oublock(tsk);
                 task_io_accounting_add(&sig->ioac, &tsk->ioac);
                 sig->sum_sched_runtime += tsk->se.sum_exec_runtime;
-                sig = NULL; /* Marker for below. */
         }
 
-        __unhash_process(tsk);
+        sig->nr_threads--;
+        __unhash_process(tsk, group_dead);
 
         /*
          * Do this under ->siglock, we can race with another thread
          * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
          */
         flush_sigqueue(&tsk->pending);
-
-        tsk->signal = NULL;
         tsk->sighand = NULL;
         spin_unlock(&sighand->siglock);
 
         __cleanup_sighand(sighand);
         clear_tsk_thread_flag(tsk,TIF_SIGPENDING);
-        if (sig) {
+        if (group_dead) {
                 flush_sigqueue(&sig->shared_pending);
-                taskstats_tgid_free(sig);
-                /*
-                 * Make sure ->signal can't go away under rq->lock,
-                 * see account_group_exec_runtime().
-                 */
-                task_rq_unlock_wait(tsk);
-                __cleanup_signal(sig);
+                tty_kref_put(tty);
         }
 }
 
@@ -170,8 +164,10 @@ void release_task(struct task_struct * p)
 repeat:
         tracehook_prepare_release_task(p);
         /* don't need to get the RCU readlock here - the process is dead and
-         * can't be modifying its own credentials */
+         * can't be modifying its own credentials. But shut RCU-lockdep up */
+        rcu_read_lock();
         atomic_dec(&__task_cred(p)->user->processes);
+        rcu_read_unlock();
 
         proc_flush_task(p);
 
@@ -473,9 +469,11 @@ static void close_files(struct files_struct * files)
         /*
          * It is safe to dereference the fd table without RCU or
          * ->file_lock because this is the last reference to the
-         * files structure.
+         * files structure.  But use RCU to shut RCU-lockdep up.
          */
+        rcu_read_lock();
         fdt = files_fdtable(files);
+        rcu_read_unlock();
         for (;;) {
                 unsigned long set;
                 i = j * __NFDBITS;
@@ -521,10 +519,12 @@ void put_files_struct(struct files_struct *files)
                  * at the end of the RCU grace period. Otherwise,
                  * you can free files immediately.
                  */
+                rcu_read_lock();
                 fdt = files_fdtable(files);
                 if (fdt != &files->fdtab)
                         kmem_cache_free(files_cachep, files);
                 free_fdtable(fdt);
+                rcu_read_unlock();
         }
 }
 
@@ -849,12 +849,9 @@ static void exit_notify(struct task_struct *tsk, int group_dead)
 
         tsk->exit_state = signal == DEATH_REAP ? EXIT_DEAD : EXIT_ZOMBIE;
 
-        /* mt-exec, de_thread() is waiting for us */
-        if (thread_group_leader(tsk) &&
-            tsk->signal->group_exit_task &&
-            tsk->signal->notify_count < 0)
+        /* mt-exec, de_thread() is waiting for group leader */
+        if (unlikely(tsk->signal->notify_count < 0))
                 wake_up_process(tsk->signal->group_exit_task);
-
         write_unlock_irq(&tasklist_lock);
 
         tracehook_report_death(tsk, signal, cookie, group_dead);
@@ -944,7 +941,9 @@ NORET_TYPE void do_exit(long code)
                                 preempt_count());
 
         acct_update_integrals(tsk);
-
+        /* sync mm's RSS info before statistics gathering */
+        if (tsk->mm)
+                sync_mm_rss(tsk, tsk->mm);
         group_dead = atomic_dec_and_test(&tsk->signal->live);
         if (group_dead) {
                 hrtimer_cancel(&tsk->signal->real_timer);
@@ -993,8 +992,10 @@ NORET_TYPE void do_exit(long code)
 
         exit_notify(tsk, group_dead);
 #ifdef CONFIG_NUMA
+        task_lock(tsk);
         mpol_put(tsk->mempolicy);
         tsk->mempolicy = NULL;
+        task_unlock(tsk);
 #endif
 #ifdef CONFIG_FUTEX
         if (unlikely(current->pi_state_cache))
@@ -1180,7 +1181,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
 
         if (unlikely(wo->wo_flags & WNOWAIT)) {
                 int exit_code = p->exit_code;
-                int why, status;
+                int why;
 
                 get_task_struct(p);
                 read_unlock(&tasklist_lock);