1 files changed, 16 insertions, 11 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 34867cc5b42a..f65345f9e5bb 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -72,6 +72,18 @@ static void __unhash_process(struct task_struct *p, bool group_dead)
                 list_del_rcu(&p->tasks);
                 list_del_init(&p->sibling);
                 __this_cpu_dec(process_counts);
+                /*
+                 * If we are the last child process in a pid namespace to be
+                 * reaped, notify the reaper sleeping zap_pid_ns_processes().
+                 */
+                if (IS_ENABLED(CONFIG_PID_NS)) {
+                        struct task_struct *parent = p->real_parent;
+
+                        if ((task_active_pid_ns(parent)->child_reaper == parent) &&
+                            list_empty(&parent->children) &&
+                            (parent->flags & PF_EXITING))
+                                wake_up_process(parent);
+                }
         }
         list_del_rcu(&p->thread_group);
 }
@@ -471,7 +483,7 @@ static void close_files(struct files_struct * files)
         rcu_read_unlock();
         for (;;) {
                 unsigned long set;
-                i = j * __NFDBITS;
+                i = j * BITS_PER_LONG;
                 if (i >= fdt->max_fds)
                         break;
                 set = fdt->open_fds[j++];
@@ -643,6 +655,7 @@ static void exit_mm(struct task_struct * tsk)
         mm_release(tsk, mm);
         if (!mm)
                 return;
+        sync_mm_rss(mm);
         /*
          * Serialize with any possible pending coredump.
          * We must hold mmap_sem around checking core_state
@@ -719,12 +732,6 @@ static struct task_struct *find_new_reaper(struct task_struct *father)
 
                 zap_pid_ns_processes(pid_ns);
                 write_lock_irq(&tasklist_lock);
-                /*
-                 * We can not clear ->child_reaper or leave it alone.
-                 * There may by stealth EXIT_DEAD tasks on ->children,
-                 * forget_original_parent() must move them somewhere.
-                 */
-                pid_ns->child_reaper = init_pid_ns.child_reaper;
         } else if (father->signal->has_child_subreaper) {
                 struct task_struct *reaper;
 
@@ -946,14 +953,11 @@ void do_exit(long code)
         exit_signals(tsk);  /* sets PF_EXITING */
         /*
          * tsk->flags are checked in the futex code to protect against
-         * an exiting task cleaning up the robust pi futexes, and in
-         * task_work_add() to avoid the race with exit_task_work().
+         * an exiting task cleaning up the robust pi futexes.
          */
         smp_mb();
         raw_spin_unlock_wait(&tsk->pi_lock);
 
-        exit_task_work(tsk);
-
         if (unlikely(in_atomic()))
                 printk(KERN_INFO "note: %s[%d] exited with preempt_count %d\n",
                                 current->comm, task_pid_nr(current),
@@ -988,6 +992,7 @@ void do_exit(long code)
         exit_shm(tsk);
         exit_files(tsk);
         exit_fs(tsk);
+        exit_task_work(tsk);
         check_stack_usage();
         exit_thread();