xref: /xnu-11215.41.3/bsd/kern/kern_fork.c (revision 33de042d024d46de5ff4e89f2471de6608e37fa4)
1 /*
2  * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 /* Copyright (c) 1995, 1997 Apple Computer, Inc. All Rights Reserved */
29 /*
30  * Copyright (c) 1982, 1986, 1989, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. All advertising materials mentioning features or use of this software
47  *    must display the following acknowledgement:
48  *	This product includes software developed by the University of
49  *	California, Berkeley and its contributors.
50  * 4. Neither the name of the University nor the names of its contributors
51  *    may be used to endorse or promote products derived from this software
52  *    without specific prior written permission.
53  *
54  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64  * SUCH DAMAGE.
65  *
66  *	@(#)kern_fork.c	8.8 (Berkeley) 2/14/95
67  */
68 /*
69  * NOTICE: This file was modified by McAfee Research in 2004 to introduce
70  * support for mandatory and extensible security protections.  This notice
71  * is included in support of clause 2.2 (b) of the Apple Public License,
72  * Version 2.0.
73  */
74 /*
75  * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
76  * support for mandatory and extensible security protections.  This notice
77  * is included in support of clause 2.2 (b) of the Apple Public License,
78  * Version 2.0.
79  */
80 
81 #include <kern/assert.h>
82 #include <kern/bits.h>
83 #include <sys/param.h>
84 #include <sys/systm.h>
85 #include <sys/filedesc.h>
86 #include <sys/kernel.h>
87 #include <sys/malloc.h>
88 #include <sys/proc_internal.h>
89 #include <sys/kauth.h>
90 #include <sys/user.h>
91 #include <sys/reason.h>
92 #include <sys/resourcevar.h>
93 #include <sys/vnode_internal.h>
94 #include <sys/file_internal.h>
95 #include <sys/acct.h>
96 #include <sys/codesign.h>
97 #include <sys/sysent.h>
98 #include <sys/sysproto.h>
99 #include <sys/ulock.h>
100 #if CONFIG_PERSONAS
101 #include <sys/persona.h>
102 #endif
103 #include <sys/doc_tombstone.h>
104 #if CONFIG_DTRACE
105 /* Do not include dtrace.h, it redefines kmem_[alloc/free] */
106 extern void (*dtrace_proc_waitfor_exec_ptr)(proc_t);
107 extern void dtrace_proc_fork(proc_t, proc_t, int);
108 
109 /*
110  * Since dtrace_proc_waitfor_exec_ptr can be added/removed in dtrace_subr.c,
111  * we will store its value before actually calling it.
112  */
113 static void (*dtrace_proc_waitfor_hook)(proc_t) = NULL;
114 
115 #include <sys/dtrace_ptss.h>
116 #endif
117 
118 #include <security/audit/audit.h>
119 
120 #include <mach/mach_types.h>
121 #include <kern/coalition.h>
122 #include <kern/ipc_kobject.h>
123 #include <kern/kern_types.h>
124 #include <kern/kalloc.h>
125 #include <kern/mach_param.h>
126 #include <kern/task.h>
127 #include <kern/thread.h>
128 #include <kern/thread_call.h>
129 #include <kern/zalloc.h>
130 
131 #if CONFIG_MACF
132 #include <security/mac_framework.h>
133 #include <security/mac_mach_internal.h>
134 #endif
135 
136 #include <vm/vm_map.h>
137 #include <vm/vm_protos.h>
138 #include <vm/vm_shared_region.h>
139 #include <vm/vm_pageout_xnu.h>
140 
141 #include <sys/shm_internal.h>   /* for shmfork() */
142 #include <mach/task.h>          /* for thread_create() */
143 #include <mach/thread_act.h>    /* for thread_resume() */
144 
145 #include <sys/sdt.h>
146 
147 #if CONFIG_MEMORYSTATUS
148 #include <sys/kern_memorystatus.h>
149 #endif
150 
151 static const uint64_t startup_serial_num_procs = 300;
152 bool startup_serial_logging_active = true;
153 
154 /* XXX routines which should have Mach prototypes, but don't */
155 extern void act_thread_catt(void *ctx);
156 void thread_set_child(thread_t child, int pid);
157 boolean_t thread_is_active(thread_t thread);
158 void *act_thread_csave(void);
159 extern boolean_t task_is_exec_copy(task_t);
160 int nextpidversion = 0;
161 
162 void ipc_task_enable(task_t task);
163 
164 proc_t forkproc(proc_t, cloneproc_flags_t);
165 void forkproc_free(proc_t);
166 thread_t fork_create_child(task_t parent_task,
167     coalition_t *parent_coalitions,
168     proc_t child,
169     int is_64bit_addr,
170     int is_64bit_data,
171     cloneproc_flags_t clone_flags);
172 
173 __private_extern__ const size_t uthread_size = sizeof(struct uthread);
174 static LCK_GRP_DECLARE(rethrottle_lock_grp, "rethrottle");
175 
176 os_refgrp_decl(, p_refgrp, "proc", NULL);
177 
178 extern const size_t task_alignment;
179 const size_t proc_alignment = _Alignof(struct proc);
180 
181 extern size_t task_struct_size;
182 size_t proc_struct_size = sizeof(struct proc);
183 size_t proc_and_task_size;
184 
185 ZONE_DECLARE_ID(ZONE_ID_PROC_TASK, struct proc);
186 SECURITY_READ_ONLY_LATE(zone_t) proc_task_zone;
187 
188 KALLOC_TYPE_DEFINE(proc_stats_zone, struct pstats, KT_DEFAULT);
189 
190 /*
191  * fork1
192  *
193  * Description:	common code used by all new process creation other than the
194  *		bootstrap of the initial process on the system
195  *
196  * Parameters: parent_proc		parent process of the process being
197  *		child_threadp		pointer to location to receive the
198  *					Mach thread_t of the child process
199  *					created
200  *		kind			kind of creation being requested
201  *		coalitions		if spawn, the set of coalitions the
202  *					child process should join, or NULL to
203  *					inherit the parent's. On non-spawns,
204  *					this param is ignored and the child
205  *					always inherits the parent's
206  *					coalitions.
207  *
208  * Notes:	Permissable values for 'kind':
209  *
210  *		PROC_CREATE_FORK	Create a complete process which will
211  *					return actively running in both the
212  *					parent and the child; the child copies
213  *					the parent address space.
214  *		PROC_CREATE_SPAWN	Create a complete process which will
215  *					return actively running in the parent
216  *					only after returning actively running
217  *					in the child; the child address space
218  *					is newly created by an image activator,
219  *					after which the child is run.
220  *
221  *		At first it may seem strange that we return the child thread
222  *		address rather than process structure, since the process is
223  *		the only part guaranteed to be "new"; however, since we do
224  *		not actualy adjust other references between Mach and BSD, this
225  *		is the only method which guarantees us the ability to get
226  *		back to the other information.
227  */
228 int
fork1(proc_t parent_proc,thread_t * child_threadp,int kind,coalition_t * coalitions)229 fork1(proc_t parent_proc, thread_t *child_threadp, int kind, coalition_t *coalitions)
230 {
231 	proc_t child_proc = NULL;       /* set in switch, but compiler... */
232 	thread_t child_thread = NULL;
233 	uid_t uid;
234 	size_t count;
235 	int err = 0;
236 	int spawn = 0;
237 	rlim_t rlimit_nproc_cur;
238 
239 	/*
240 	 * Although process entries are dynamically created, we still keep
241 	 * a global limit on the maximum number we will create.  Don't allow
242 	 * a nonprivileged user to use the last process; don't let root
243 	 * exceed the limit. The variable nprocs is the current number of
244 	 * processes, maxproc is the limit.
245 	 */
246 	uid = kauth_getruid();
247 	proc_list_lock();
248 	if ((nprocs >= maxproc - 1 && uid != 0) || nprocs >= maxproc) {
249 #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX)
250 		/*
251 		 * On the development kernel, panic so that the fact that we hit
252 		 * the process limit is obvious, as this may very well wedge the
253 		 * system.
254 		 */
255 		panic("The process table is full; parent pid=%d", proc_getpid(parent_proc));
256 #endif
257 		proc_list_unlock();
258 		tablefull("proc");
259 		return EAGAIN;
260 	}
261 	proc_list_unlock();
262 
263 	/*
264 	 * Increment the count of procs running with this uid. Don't allow
265 	 * a nonprivileged user to exceed their current limit, which is
266 	 * always less than what an rlim_t can hold.
267 	 * (locking protection is provided by list lock held in chgproccnt)
268 	 */
269 	count = chgproccnt(uid, 1);
270 	rlimit_nproc_cur = proc_limitgetcur(parent_proc, RLIMIT_NPROC);
271 	if (uid != 0 &&
272 	    (rlim_t)count > rlimit_nproc_cur) {
273 #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX)
274 		/*
275 		 * On the development kernel, panic so that the fact that we hit
276 		 * the per user process limit is obvious.  This may be less dire
277 		 * than hitting the global process limit, but we cannot rely on
278 		 * that.
279 		 */
280 		panic("The per-user process limit has been hit; parent pid=%d, uid=%d", proc_getpid(parent_proc), uid);
281 #endif
282 		err = EAGAIN;
283 		goto bad;
284 	}
285 
286 #if CONFIG_MACF
287 	/*
288 	 * Determine if MAC policies applied to the process will allow
289 	 * it to fork.  This is an advisory-only check.
290 	 */
291 	err = mac_proc_check_fork(parent_proc);
292 	if (err != 0) {
293 		goto bad;
294 	}
295 #endif
296 
297 	switch (kind) {
298 	case PROC_CREATE_SPAWN:
299 		/*
300 		 * A spawned process differs from a forked process in that
301 		 * the spawned process does not carry around the parents
302 		 * baggage with regard to address space copying, dtrace,
303 		 * and so on.
304 		 */
305 		spawn = 1;
306 
307 		OS_FALLTHROUGH;
308 
309 	case PROC_CREATE_FORK:
310 		/*
311 		 * When we clone the parent process, we are going to inherit
312 		 * its task attributes and memory, since when we fork, we
313 		 * will, in effect, create a duplicate of it, with only minor
314 		 * differences.  Contrarily, spawned processes do not inherit.
315 		 */
316 		if ((child_thread = cloneproc(proc_task(parent_proc),
317 		    spawn ? coalitions : NULL,
318 		    parent_proc,
319 		    spawn ? CLONEPROC_SPAWN : CLONEPROC_FORK)) == NULL) {
320 			/* Failed to create thread */
321 			err = EAGAIN;
322 			goto bad;
323 		}
324 
325 		/* child_proc = child_thread->task->proc; */
326 		child_proc = (proc_t)(get_bsdtask_info(get_threadtask(child_thread)));
327 
328 		if (!spawn) {
329 			/* Copy current thread state into the child thread (only for fork) */
330 			thread_dup(child_thread);
331 		}
332 
333 // XXX BEGIN: wants to move to be common code (and safe)
334 #if CONFIG_MACF
335 		/*
336 		 * allow policies to associate the credential/label that
337 		 * we referenced from the parent ... with the child
338 		 * JMM - this really isn't safe, as we can drop that
339 		 *       association without informing the policy in other
340 		 *       situations (keep long enough to get policies changed)
341 		 */
342 		mac_cred_label_associate_fork(proc_ucred_unsafe(child_proc),
343 		    child_proc);
344 #endif
345 
346 		/*
347 		 * Propogate change of PID - may get new cred if auditing.
348 		 */
349 		set_security_token(child_proc, proc_ucred_unsafe(child_proc));
350 
351 		AUDIT_ARG(pid, proc_getpid(child_proc));
352 
353 // XXX END: wants to move to be common code (and safe)
354 
355 		/*
356 		 * Blow thread state information; this is what gives the child
357 		 * process its "return" value from a fork() call.
358 		 *
359 		 * Note: this should probably move to fork() proper, since it
360 		 * is not relevent to spawn, and the value won't matter
361 		 * until we resume the child there.  If you are in here
362 		 * refactoring code, consider doing this at the same time.
363 		 */
364 		thread_set_child(child_thread, proc_getpid(child_proc));
365 
366 		child_proc->p_acflag = AFORK;   /* forked but not exec'ed */
367 
368 #if CONFIG_DTRACE
369 		dtrace_proc_fork(parent_proc, child_proc, spawn);
370 #endif  /* CONFIG_DTRACE */
371 		if (!spawn) {
372 			/*
373 			 * Of note, we need to initialize the bank context behind
374 			 * the protection of the proc_trans lock to prevent a race with exit.
375 			 */
376 			task_bank_init(get_threadtask(child_thread));
377 		}
378 
379 		break;
380 
381 	default:
382 		panic("fork1 called with unknown kind %d", kind);
383 		break;
384 	}
385 
386 
387 	/* return the thread pointer to the caller */
388 	*child_threadp = child_thread;
389 
390 bad:
391 	/*
392 	 * In the error case, we return a 0 value for the returned pid (but
393 	 * it is ignored in the trampoline due to the error return); this
394 	 * is probably not necessary.
395 	 */
396 	if (err) {
397 		(void)chgproccnt(uid, -1);
398 	}
399 
400 	return err;
401 }
402 
403 
404 
405 
406 /*
407  * fork_create_child
408  *
409  * Description:	Common operations associated with the creation of a child
410  *		process. Return with new task and first thread's control port movable
411  *      and not pinned.
412  *
413  * Parameters:	parent_task		parent task
414  *		parent_coalitions	parent's set of coalitions
415  *		child_proc			child process
416  *		inherit_memory		TRUE, if the parents address space is
417  *							to be inherited by the child
418  *		is_64bit_addr		TRUE, if the child being created will
419  *							be associated with a 64 bit address space
420  *		is_64bit_data		TRUE if the child being created will use a
421  *                                                       64-bit register state
422  *		in_exec				TRUE, if called from execve or posix spawn set exec
423  *							FALSE, if called from fork or vfexec
424  *
425  * Note:	This code is called in the fork() case, from the execve() call
426  *		graph, from the posix_spawn() call graph (which implicitly
427  *		includes a vfork() equivalent call, and in the system
428  *		bootstrap case.
429  *
430  *		It creates a new task and thread (and as a side effect of the
431  *		thread creation, a uthread) in the parent coalition set, which is
432  *		then associated with the process 'child'.  If the parent
433  *		process address space is to be inherited, then a flag
434  *		indicates that the newly created task should inherit this from
435  *		the child task.
436  *
437  *		As a special concession to bootstrapping the initial process
438  *		in the system, it's possible for 'parent_task' to be TASK_NULL;
439  *		in this case, 'inherit_memory' MUST be FALSE.
440  */
441 thread_t
fork_create_child(task_t parent_task,coalition_t * parent_coalitions,proc_t child_proc,int is_64bit_addr,int is_64bit_data,cloneproc_flags_t clone_flags)442 fork_create_child(task_t parent_task,
443     coalition_t *parent_coalitions,
444     proc_t child_proc,
445     int is_64bit_addr,
446     int is_64bit_data,
447     cloneproc_flags_t clone_flags)
448 {
449 	thread_t        child_thread = NULL;
450 	task_t          child_task;
451 	kern_return_t   result;
452 	proc_ro_t       proc_ro;
453 	bool inherit_memory = !!(clone_flags & CLONEPROC_FORK);
454 	bool in_exec = !!(clone_flags & CLONEPROC_EXEC);
455 	/*
456 	 * Exec complete hook should be called for spawn and exec, but not for fork.
457 	 */
458 	uint8_t returnwaitflags = (!inherit_memory ? TRW_LEXEC_COMPLETE : 0) |
459 	    (TRW_LRETURNWAIT | TRW_LRETURNWAITER);
460 
461 	proc_ro = proc_get_ro(child_proc);
462 	if (proc_ro_task(proc_ro) != NULL) {
463 		panic("Proc_ro_task for newly created proc %p is not NULL", child_proc);
464 	}
465 
466 	child_task = proc_get_task_raw(child_proc);
467 
468 	/*
469 	 * Create a new task for the child process, IPC access to the new task will
470 	 * be set up after task has been fully initialized.
471 	 */
472 	result = task_create_internal(parent_task,
473 	    proc_ro,
474 	    parent_coalitions,
475 	    inherit_memory,
476 	    is_64bit_addr,
477 	    is_64bit_data,
478 	    TF_NONE,
479 	    TF_NONE,
480 	    in_exec ? TPF_EXEC_COPY : TPF_NONE,           /* Mark the task exec copy if in execve */
481 	    returnwaitflags,                              /* All created threads will wait in task_wait_to_return */
482 	    child_task);
483 	if (result != KERN_SUCCESS) {
484 		printf("%s: task_create_internal failed.  Code: %d\n",
485 		    __func__, result);
486 		goto bad;
487 	}
488 
489 	/* Set the child proc process to child task */
490 	proc_set_task(child_proc, child_task);
491 
492 	/* Set child task process to child proc */
493 	set_bsdtask_info(child_task, child_proc);
494 
495 	/* Propagate CPU limit timer from parent */
496 	if (timerisset(&child_proc->p_rlim_cpu)) {
497 		task_vtimer_set(child_task, TASK_VTIMER_RLIM);
498 	}
499 
500 	/*
501 	 * Set child process BSD visible scheduler priority if nice value
502 	 * inherited from parent
503 	 */
504 	if (child_proc->p_nice != 0) {
505 		resetpriority(child_proc);
506 	}
507 
508 	/*
509 	 * Create main thread for the child process. Its control port is not immovable/pinned
510 	 * until main_thread_set_immovable_pinned().
511 	 *
512 	 * The new thread is waiting on the event triggered by 'task_clear_return_wait'
513 	 */
514 	result = main_thread_create_waiting(child_task,
515 	    (thread_continue_t)task_wait_to_return,
516 	    task_get_return_wait_event(child_task),
517 	    &child_thread);
518 
519 	if (result != KERN_SUCCESS) {
520 		printf("%s: thread_create failed. Code: %d\n",
521 		    __func__, result);
522 		task_deallocate(child_task);
523 		child_task = NULL;
524 	}
525 
526 	/*
527 	 * Tag thread as being the first thread in its task.
528 	 */
529 	thread_set_tag(child_thread, THREAD_TAG_MAINTHREAD);
530 
531 bad:
532 	thread_yield_internal(1);
533 
534 	return child_thread;
535 }
536 
537 
538 /*
539  * fork
540  *
541  * Description:	fork system call.
542  *
543  * Parameters:	parent			Parent process to fork
544  *		uap (void)		[unused]
545  *		retval			Return value
546  *
547  * Returns:	0			Success
548  *		EAGAIN			Resource unavailable, try again
549  *
550  * Notes:	Attempts to create a new child process which inherits state
551  *		from the parent process.  If successful, the call returns
552  *		having created an initially suspended child process with an
553  *		extra Mach task and thread reference, for which the thread
554  *		is initially suspended.  Until we resume the child process,
555  *		it is not yet running.
556  *
557  *		The return information to the child is contained in the
558  *		thread state structure of the new child, and does not
559  *		become visible to the child through a normal return process,
560  *		since it never made the call into the kernel itself in the
561  *		first place.
562  *
563  *		After resuming the thread, this function returns directly to
564  *		the parent process which invoked the fork() system call.
565  *
566  * Important:	The child thread_resume occurs before the parent returns;
567  *		depending on scheduling latency, this means that it is not
568  *		deterministic as to whether the parent or child is scheduled
569  *		to run first.  It is entirely possible that the child could
570  *		run to completion prior to the parent running.
571  */
572 int
fork(proc_t parent_proc,__unused struct fork_args * uap,int32_t * retval)573 fork(proc_t parent_proc, __unused struct fork_args *uap, int32_t *retval)
574 {
575 	thread_t child_thread;
576 	int err;
577 
578 	retval[1] = 0;          /* flag parent return for user space */
579 
580 	if ((err = fork1(parent_proc, &child_thread, PROC_CREATE_FORK, NULL)) == 0) {
581 		task_t child_task;
582 		proc_t child_proc;
583 
584 		/* Return to the parent */
585 		child_proc = (proc_t)get_bsdthreadtask_info(child_thread);
586 		retval[0] = proc_getpid(child_proc);
587 
588 		child_task = (task_t)get_threadtask(child_thread);
589 		assert(child_task != TASK_NULL);
590 
591 		/* task_control_port_options has been inherited from parent, apply it */
592 		task_set_immovable_pinned(child_task);
593 		main_thread_set_immovable_pinned(child_thread);
594 
595 		/*
596 		 * Since the task ports for this new task are now set to be immovable,
597 		 * we can enable them.
598 		 */
599 		ipc_task_enable(get_threadtask(child_thread));
600 
601 		/*
602 		 * Drop the signal lock on the child which was taken on our
603 		 * behalf by forkproc()/cloneproc() to prevent signals being
604 		 * received by the child in a partially constructed state.
605 		 */
606 		proc_signalend(child_proc, 0);
607 		proc_transend(child_proc, 0);
608 
609 		/* flag the fork has occurred */
610 		proc_knote(parent_proc, NOTE_FORK | proc_getpid(child_proc));
611 		DTRACE_PROC1(create, proc_t, child_proc);
612 
613 #if CONFIG_DTRACE
614 		if ((dtrace_proc_waitfor_hook = dtrace_proc_waitfor_exec_ptr) != NULL) {
615 			(*dtrace_proc_waitfor_hook)(child_proc);
616 		}
617 #endif
618 
619 		/*
620 		 * If current process died during the fork, the child would contain
621 		 * non consistent vmmap, kill the child and reap it internally.
622 		 */
623 		if (parent_proc->p_lflag & P_LEXIT || !thread_is_active(current_thread())) {
624 			task_terminate_internal(child_task);
625 			proc_list_lock();
626 			child_proc->p_listflag |= P_LIST_DEADPARENT;
627 			proc_list_unlock();
628 		}
629 
630 		/* "Return" to the child */
631 		task_clear_return_wait(get_threadtask(child_thread), TCRW_CLEAR_ALL_WAIT);
632 
633 		/* drop the extra references we got during the creation */
634 		task_deallocate(child_task);
635 		thread_deallocate(child_thread);
636 	}
637 
638 	return err;
639 }
640 
641 
642 /*
643  * cloneproc
644  *
645  * Description: Create a new process from a specified process.
646  *
647  * Parameters:	parent_task		The parent task to be cloned, or
648  *					TASK_NULL is task characteristics
649  *					are not to be inherited
650  *					be cloned, or TASK_NULL if the new
651  *					task is not to inherit the VM
652  *					characteristics of the parent
653  *		parent_proc		The parent process to be cloned
654  *		clone_flags		Clone flags to specify if the cloned
655  *					process should inherit memory,
656  *					marked as memory stat internal,
657  *					or if the cloneproc is called for exec.
658  *
659  * Returns:	!NULL			pointer to new child thread
660  *		NULL			Failure (unspecified)
661  *
662  * Note:	On return newly created child process has signal lock held
663  *		to block delivery of signal to it if called with lock set.
664  *		fork() code needs to explicity remove this lock before
665  *		signals can be delivered
666  *
667  *		In the case of bootstrap, this function can be called from
668  *		bsd_utaskbootstrap() in order to bootstrap the first process;
669  *		the net effect is to provide a uthread structure for the
670  *		kernel process associated with the kernel task.
671  *
672  * XXX:		Tristating using the value parent_task as the major key
673  *		and inherit_memory as the minor key is something we should
674  *		refactor later; we owe the current semantics, ultimately,
675  *		to the semantics of task_create_internal.  For now, we will
676  *		live with this being somewhat awkward.
677  */
678 thread_t
cloneproc(task_t parent_task,coalition_t * parent_coalitions,proc_t parent_proc,cloneproc_flags_t clone_flags)679 cloneproc(task_t parent_task, coalition_t *parent_coalitions, proc_t parent_proc, cloneproc_flags_t clone_flags)
680 {
681 #if !CONFIG_MEMORYSTATUS
682 #pragma unused(cloning_initproc)
683 #endif
684 	task_t child_task;
685 	proc_t child_proc;
686 	thread_t child_thread = NULL;
687 	bool cloning_initproc = !!(clone_flags & CLONEPROC_INITPROC);
688 	bool in_exec = !!(clone_flags & CLONEPROC_EXEC);
689 
690 	if ((child_proc = forkproc(parent_proc, clone_flags)) == NULL) {
691 		/* Failed to allocate new process */
692 		goto bad;
693 	}
694 
695 	/*
696 	 * In the case where the parent_task is TASK_NULL (during the init path)
697 	 * we make the assumption that the register size will be the same as the
698 	 * address space size since there's no way to determine the possible
699 	 * register size until an image is exec'd.
700 	 *
701 	 * The only architecture that has different address space and register sizes
702 	 * (arm64_32) isn't being used within kernel-space, so the above assumption
703 	 * always holds true for the init path.
704 	 */
705 	const int parent_64bit_addr = parent_proc->p_flag & P_LP64;
706 	const int parent_64bit_data = (parent_task == TASK_NULL) ? parent_64bit_addr : task_get_64bit_data(parent_task);
707 
708 	child_thread = fork_create_child(parent_task,
709 	    parent_coalitions,
710 	    child_proc,
711 	    parent_64bit_addr,
712 	    parent_64bit_data,
713 	    clone_flags);
714 
715 	if (child_thread == NULL) {
716 		/*
717 		 * Failed to create thread; now we must deconstruct the new
718 		 * process previously obtained from forkproc().
719 		 */
720 		forkproc_free(child_proc);
721 		goto bad;
722 	}
723 
724 	child_task = get_threadtask(child_thread);
725 	if (parent_64bit_addr) {
726 		OSBitOrAtomic(P_LP64, (UInt32 *)&child_proc->p_flag);
727 		get_bsdthread_info(child_thread)->uu_flag |= UT_LP64;
728 	} else {
729 		OSBitAndAtomic(~((uint32_t)P_LP64), (UInt32 *)&child_proc->p_flag);
730 		get_bsdthread_info(child_thread)->uu_flag &= ~UT_LP64;
731 	}
732 
733 #if CONFIG_MEMORYSTATUS
734 	if (cloning_initproc ||
735 	    (in_exec && (parent_proc->p_memstat_state & P_MEMSTAT_INTERNAL))) {
736 		proc_list_lock();
737 		child_proc->p_memstat_state |= P_MEMSTAT_INTERNAL;
738 		child_proc->p_memstat_effectivepriority = JETSAM_PRIORITY_INTERNAL;
739 		child_proc->p_memstat_requestedpriority = JETSAM_PRIORITY_INTERNAL;
740 		proc_list_unlock();
741 	}
742 	if (in_exec && parent_proc->p_memstat_relaunch_flags != P_MEMSTAT_RELAUNCH_UNKNOWN) {
743 		memorystatus_relaunch_flags_update(child_proc, parent_proc->p_memstat_relaunch_flags);
744 	}
745 #endif
746 
747 	/* make child visible */
748 	pinsertchild(parent_proc, child_proc, in_exec);
749 
750 	/*
751 	 * Make child runnable, set start time.
752 	 */
753 	child_proc->p_stat = SRUN;
754 bad:
755 	return child_thread;
756 }
757 
758 void
proc_set_sigact(proc_t p,int sig,user_addr_t sigact)759 proc_set_sigact(proc_t p, int sig, user_addr_t sigact)
760 {
761 	assert((sig > 0) && (sig < NSIG));
762 
763 	p->p_sigacts.ps_sigact[sig] = sigact;
764 }
765 
766 void
proc_set_trampact(proc_t p,int sig,user_addr_t trampact)767 proc_set_trampact(proc_t p, int sig, user_addr_t trampact)
768 {
769 	assert((sig > 0) && (sig < NSIG));
770 
771 	p->p_sigacts.ps_trampact[sig] = trampact;
772 }
773 
774 void
proc_set_sigact_trampact(proc_t p,int sig,user_addr_t sigact,user_addr_t trampact)775 proc_set_sigact_trampact(proc_t p, int sig, user_addr_t sigact, user_addr_t trampact)
776 {
777 	assert((sig > 0) && (sig < NSIG));
778 
779 	p->p_sigacts.ps_sigact[sig] = sigact;
780 	p->p_sigacts.ps_trampact[sig] = trampact;
781 }
782 
783 void
proc_reset_sigact(proc_t p,sigset_t sigs)784 proc_reset_sigact(proc_t p, sigset_t sigs)
785 {
786 	user_addr_t *sigacts = p->p_sigacts.ps_sigact;
787 	int nc;
788 
789 	while (sigs) {
790 		nc = ffs((unsigned int)sigs);
791 		if (sigacts[nc] != SIG_DFL) {
792 			sigacts[nc] = SIG_DFL;
793 		}
794 		sigs &= ~sigmask(nc);
795 	}
796 }
797 
798 /*
799  * Destroy a process structure that resulted from a call to forkproc(), but
800  * which must be returned to the system because of a subsequent failure
801  * preventing it from becoming active.
802  *
803  * Parameters:	p			The incomplete process from forkproc()
804  *
805  * Returns:	(void)
806  *
807  * Note:	This function should only be used in an error handler following
808  *		a call to forkproc().
809  *
810  *		Operations occur in reverse order of those in forkproc().
811  */
812 void
forkproc_free(proc_t p)813 forkproc_free(proc_t p)
814 {
815 	struct pgrp *pg;
816 
817 #if CONFIG_PERSONAS
818 	persona_proc_drop(p);
819 #endif /* CONFIG_PERSONAS */
820 
821 #if PSYNCH
822 	pth_proc_hashdelete(p);
823 #endif /* PSYNCH */
824 
825 	/* We held signal and a transition locks; drop them */
826 	proc_signalend(p, 0);
827 	proc_transend(p, 0);
828 
829 	/*
830 	 * If we have our own copy of the resource limits structure, we
831 	 * need to free it.  If it's a shared copy, we need to drop our
832 	 * reference on it.
833 	 */
834 	proc_limitdrop(p);
835 
836 #if SYSV_SHM
837 	/* Need to drop references to the shared memory segment(s), if any */
838 	if (p->vm_shm) {
839 		/*
840 		 * Use shmexec(): we have no address space, so no mappings
841 		 *
842 		 * XXX Yes, the routine is badly named.
843 		 */
844 		shmexec(p);
845 	}
846 #endif
847 
848 	/* Need to undo the effects of the fdt_fork(), if any */
849 	fdt_invalidate(p);
850 	fdt_destroy(p);
851 
852 	/*
853 	 * Drop the reference on a text vnode pointer, if any
854 	 * XXX This code is broken in forkproc(); see <rdar://4256419>;
855 	 * XXX if anyone ever uses this field, we will be extremely unhappy.
856 	 */
857 	if (p->p_textvp) {
858 		vnode_rele(p->p_textvp);
859 		p->p_textvp = NULL;
860 	}
861 
862 	/* Update the audit session proc count */
863 	AUDIT_SESSION_PROCEXIT(p);
864 
865 	lck_mtx_destroy(&p->p_mlock, &proc_mlock_grp);
866 	lck_mtx_destroy(&p->p_ucred_mlock, &proc_ucred_mlock_grp);
867 #if CONFIG_AUDIT
868 	lck_mtx_destroy(&p->p_audit_mlock, &proc_ucred_mlock_grp);
869 #endif /* CONFIG_AUDIT */
870 #if CONFIG_DTRACE
871 	lck_mtx_destroy(&p->p_dtrace_sprlock, &proc_lck_grp);
872 #endif
873 	lck_spin_destroy(&p->p_slock, &proc_slock_grp);
874 
875 	proc_list_lock();
876 	/* Decrement the count of processes in the system */
877 	nprocs--;
878 
879 	/* quit the group */
880 	pg = pgrp_leave_locked(p);
881 
882 	/* Take it out of process hash */
883 	assert((os_ref_get_raw_mask(&p->p_refcount) >> P_REF_BITS) == 1);
884 	assert((os_ref_get_raw_mask(&p->p_refcount) & P_REF_NEW) == P_REF_NEW);
885 	os_atomic_xor(&p->p_refcount, P_REF_NEW | P_REF_DEAD, relaxed);
886 
887 	/* Remove from hash if not a shadow proc */
888 	if (!proc_is_shadow(p)) {
889 		phash_remove_locked(p);
890 	}
891 
892 	proc_list_unlock();
893 
894 	pgrp_rele(pg);
895 
896 	thread_call_free(p->p_rcall);
897 
898 	/* Free allocated memory */
899 	zfree(proc_stats_zone, p->p_stats);
900 	p->p_stats = NULL;
901 	if (p->p_subsystem_root_path) {
902 		zfree(ZV_NAMEI, p->p_subsystem_root_path);
903 		p->p_subsystem_root_path = NULL;
904 	}
905 
906 	proc_checkdeadrefs(p);
907 	proc_wait_release(p);
908 }
909 
910 
911 /*
912  * forkproc
913  *
914  * Description:	Create a new process structure, given a parent process
915  *		structure.
916  *
917  * Parameters:	parent_proc		The parent process
918  *
919  * Returns:	!NULL			The new process structure
920  *		NULL			Error (insufficient free memory)
921  *
922  * Note:	When successful, the newly created process structure is
923  *		partially initialized; if a caller needs to deconstruct the
924  *		returned structure, they must call forkproc_free() to do so.
925  */
926 proc_t
forkproc(proc_t parent_proc,cloneproc_flags_t clone_flags)927 forkproc(proc_t parent_proc, cloneproc_flags_t clone_flags)
928 {
929 	static uint64_t nextuniqueid = 0;
930 	static pid_t lastpid = 0;
931 
932 	proc_t child_proc;      /* Our new process */
933 	int error = 0;
934 	struct pgrp *pg;
935 	uthread_t parent_uthread = current_uthread();
936 	rlim_t rlimit_cpu_cur;
937 	pid_t pid;
938 	struct proc_ro_data proc_ro_data = {};
939 	bool in_exec = !!(clone_flags & CLONEPROC_EXEC);
940 	bool in_fork = !!(clone_flags & CLONEPROC_FORK);
941 
942 	child_proc = zalloc_flags(proc_task_zone, Z_WAITOK | Z_ZERO);
943 
944 	child_proc->p_stats = zalloc_flags(proc_stats_zone, Z_WAITOK | Z_ZERO);
945 	child_proc->p_sigacts = parent_proc->p_sigacts;
946 	os_ref_init_mask(&child_proc->p_refcount, P_REF_BITS, &p_refgrp, P_REF_NEW);
947 	os_ref_init_raw(&child_proc->p_waitref, &p_refgrp);
948 	proc_ref_hold_proc_task_struct(child_proc);
949 
950 	/* allocate a callout for use by interval timers */
951 	child_proc->p_rcall = thread_call_allocate((thread_call_func_t)realitexpire, child_proc);
952 
953 
954 	/*
955 	 * Find an unused PID.
956 	 */
957 
958 	fdt_init(child_proc);
959 
960 	proc_list_lock();
961 
962 	if (!in_exec) {
963 		pid = lastpid;
964 		do {
965 			/*
966 			 * If the process ID prototype has wrapped around,
967 			 * restart somewhat above 0, as the low-numbered procs
968 			 * tend to include daemons that don't exit.
969 			 */
970 			if (++pid >= PID_MAX) {
971 				pid = 100;
972 			}
973 			if (pid == lastpid) {
974 				panic("Unable to allocate a new pid");
975 			}
976 
977 			/* if the pid stays in hash both for zombie and runniing state */
978 		} while (phash_find_locked(pid) != PROC_NULL ||
979 		    pghash_exists_locked(pid) ||
980 		    session_find_locked(pid) != SESSION_NULL);
981 
982 		lastpid = pid;
983 		nprocs++;
984 
985 		child_proc->p_pid = pid;
986 		proc_ro_data.p_idversion = OSIncrementAtomic(&nextpidversion);
987 		/* kernel process is handcrafted and not from fork, so start from 1 */
988 		proc_ro_data.p_uniqueid = ++nextuniqueid;
989 
990 		/* Insert in the hash, and inherit our group (and session) */
991 		phash_insert_locked(child_proc);
992 
993 		/* Check if the proc is from App Cryptex */
994 		if (parent_proc->p_ladvflag & P_RSR) {
995 			os_atomic_or(&child_proc->p_ladvflag, P_RSR, relaxed);
996 		}
997 	} else {
998 		/* For exec copy of the proc, copy the pid, pidversion and uniqueid of original proc */
999 		pid = parent_proc->p_pid;
1000 		child_proc->p_pid = pid;
1001 		proc_ro_data.p_idversion = parent_proc->p_proc_ro->p_idversion;
1002 		proc_ro_data.p_uniqueid = parent_proc->p_proc_ro->p_uniqueid;
1003 
1004 		nprocs++;
1005 		os_atomic_or(&child_proc->p_refcount, P_REF_SHADOW, relaxed);
1006 	}
1007 	pg = pgrp_enter_locked(parent_proc, child_proc);
1008 	proc_list_unlock();
1009 
1010 	if (proc_ro_data.p_uniqueid == startup_serial_num_procs) {
1011 		/*
1012 		 * Turn off startup serial logging now that we have reached
1013 		 * the defined number of startup processes.
1014 		 */
1015 		startup_serial_logging_active = false;
1016 	}
1017 
1018 	/*
1019 	 * We've identified the PID we are going to use;
1020 	 * initialize the new process structure.
1021 	 */
1022 	child_proc->p_stat = SIDL;
1023 
1024 	/*
1025 	 * The zero'ing of the proc was at the allocation time due to need
1026 	 * for insertion to hash.  Copy the section that is to be copied
1027 	 * directly from the parent.
1028 	 */
1029 	child_proc->p_forkcopy = parent_proc->p_forkcopy;
1030 
1031 	proc_ro_data.syscall_filter_mask = proc_syscall_filter_mask(parent_proc);
1032 	proc_ro_data.p_platform_data = proc_get_ro(parent_proc)->p_platform_data;
1033 
1034 	/*
1035 	 * Some flags are inherited from the parent.
1036 	 * Duplicate sub-structures as needed.
1037 	 * Increase reference counts on shared objects.
1038 	 * The p_stats substruct is set in vm_fork.
1039 	 */
1040 #if CONFIG_DELAY_IDLE_SLEEP
1041 	child_proc->p_flag = (parent_proc->p_flag & (P_LP64 | P_TRANSLATED | P_DISABLE_ASLR | P_DELAYIDLESLEEP | P_SUGID | P_AFFINITY));
1042 #else /* CONFIG_DELAY_IDLE_SLEEP */
1043 	child_proc->p_flag = (parent_proc->p_flag & (P_LP64 | P_TRANSLATED | P_DISABLE_ASLR | P_SUGID | P_AFFINITY));
1044 #endif /* CONFIG_DELAY_IDLE_SLEEP */
1045 
1046 	child_proc->p_vfs_iopolicy = (parent_proc->p_vfs_iopolicy & (P_VFS_IOPOLICY_INHERITED_MASK));
1047 
1048 	proc_set_responsible_pid(child_proc, parent_proc->p_responsible_pid);
1049 
1050 	/*
1051 	 * Note that if the current thread has an assumed identity, this
1052 	 * credential will be granted to the new process.
1053 	 * This is OK to do in exec, because it will be over-written during image activation
1054 	 * before the proc is visible.
1055 	 */
1056 	kauth_cred_set(&proc_ro_data.p_ucred.__smr_ptr, kauth_cred_get());
1057 
1058 	lck_mtx_init(&child_proc->p_mlock, &proc_mlock_grp, &proc_lck_attr);
1059 	lck_mtx_init(&child_proc->p_ucred_mlock, &proc_ucred_mlock_grp, &proc_lck_attr);
1060 #if CONFIG_AUDIT
1061 	lck_mtx_init(&child_proc->p_audit_mlock, &proc_ucred_mlock_grp, &proc_lck_attr);
1062 #endif /* CONFIG_AUDIT */
1063 #if CONFIG_DTRACE
1064 	lck_mtx_init(&child_proc->p_dtrace_sprlock, &proc_lck_grp, &proc_lck_attr);
1065 #endif
1066 	lck_spin_init(&child_proc->p_slock, &proc_slock_grp, &proc_lck_attr);
1067 
1068 	klist_init(&child_proc->p_klist);
1069 
1070 	if (child_proc->p_textvp != NULLVP) {
1071 		/* bump references to the text vnode */
1072 		/* Need to hold iocount across the ref call */
1073 		if ((error = vnode_getwithref(child_proc->p_textvp)) == 0) {
1074 			error = vnode_ref(child_proc->p_textvp);
1075 			vnode_put(child_proc->p_textvp);
1076 		}
1077 
1078 		if (error != 0) {
1079 			child_proc->p_textvp = NULLVP;
1080 		}
1081 	}
1082 	uint64_t csflag_inherit_mask = ~CS_KILLED;
1083 	if (!in_fork) {
1084 		/* All non-fork paths should not inherit GTA flag */
1085 		csflag_inherit_mask &= ~CS_GET_TASK_ALLOW;
1086 	}
1087 	proc_ro_data.p_csflags = ((uint32_t)proc_getcsflags(parent_proc) & csflag_inherit_mask);
1088 
1089 	child_proc->p_proc_ro = proc_ro_alloc(child_proc, &proc_ro_data, NULL, NULL);
1090 
1091 	/* update cred on proc */
1092 	proc_update_creds_onproc(child_proc, proc_ucred_unsafe(child_proc));
1093 
1094 	/* update audit session proc count */
1095 	AUDIT_SESSION_PROCNEW(child_proc);
1096 
1097 	/*
1098 	 * Copy the parents per process open file table to the child; if
1099 	 * there is a per-thread current working directory, set the childs
1100 	 * per-process current working directory to that instead of the
1101 	 * parents.
1102 	 */
1103 	if (fdt_fork(&child_proc->p_fd, parent_proc, parent_uthread->uu_cdir, in_exec) != 0) {
1104 		forkproc_free(child_proc);
1105 		child_proc = NULL;
1106 		goto bad;
1107 	}
1108 
1109 #if SYSV_SHM
1110 	if (parent_proc->vm_shm && !in_exec) {
1111 		/* XXX may fail to attach shm to child */
1112 		(void)shmfork(parent_proc, child_proc);
1113 	}
1114 #endif
1115 
1116 	/*
1117 	 * Child inherits the parent's plimit
1118 	 */
1119 	proc_limitfork(parent_proc, child_proc);
1120 
1121 	rlimit_cpu_cur = proc_limitgetcur(child_proc, RLIMIT_CPU);
1122 	if (rlimit_cpu_cur != RLIM_INFINITY) {
1123 		child_proc->p_rlim_cpu.tv_sec = (rlimit_cpu_cur > __INT_MAX__) ? __INT_MAX__ : rlimit_cpu_cur;
1124 	}
1125 
1126 	if (in_exec) {
1127 		/* Keep the original start time for exec'ed proc */
1128 		child_proc->p_stats->ps_start = parent_proc->p_stats->ps_start;
1129 		child_proc->p_start.tv_sec = parent_proc->p_start.tv_sec;
1130 		child_proc->p_start.tv_usec = parent_proc->p_start.tv_usec;
1131 	} else {
1132 		/* Intialize new process stats, including start time */
1133 		/* <rdar://6640543> non-zeroed portion contains garbage AFAICT */
1134 		microtime_with_abstime(&child_proc->p_start, &child_proc->p_stats->ps_start);
1135 	}
1136 
1137 	if (pg->pg_session->s_ttyvp != NULL && parent_proc->p_flag & P_CONTROLT) {
1138 		os_atomic_or(&child_proc->p_flag, P_CONTROLT, relaxed);
1139 	}
1140 
1141 	/*
1142 	 * block all signals to reach the process.
1143 	 * no transition race should be occuring with the child yet,
1144 	 * but indicate that the process is in (the creation) transition.
1145 	 */
1146 	proc_signalstart(child_proc, 0);
1147 	proc_transstart(child_proc, 0, 0);
1148 
1149 	child_proc->p_pcaction = 0;
1150 
1151 	TAILQ_INIT(&child_proc->p_uthlist);
1152 	TAILQ_INIT(&child_proc->p_aio_activeq);
1153 	TAILQ_INIT(&child_proc->p_aio_doneq);
1154 
1155 	/*
1156 	 * Copy work queue information
1157 	 *
1158 	 * Note: This should probably only happen in the case where we are
1159 	 *	creating a child that is a copy of the parent; since this
1160 	 *	routine is called in the non-duplication case of vfork()
1161 	 *	or posix_spawn(), then this information should likely not
1162 	 *	be duplicated.
1163 	 *
1164 	 * <rdar://6640553> Work queue pointers that no longer point to code
1165 	 */
1166 	child_proc->p_wqthread = parent_proc->p_wqthread;
1167 	child_proc->p_threadstart = parent_proc->p_threadstart;
1168 	child_proc->p_pthsize = parent_proc->p_pthsize;
1169 	if ((parent_proc->p_lflag & P_LREGISTER) != 0) {
1170 		child_proc->p_lflag |= P_LREGISTER;
1171 	}
1172 	child_proc->p_dispatchqueue_offset = parent_proc->p_dispatchqueue_offset;
1173 	child_proc->p_dispatchqueue_serialno_offset = parent_proc->p_dispatchqueue_serialno_offset;
1174 	child_proc->p_dispatchqueue_label_offset = parent_proc->p_dispatchqueue_label_offset;
1175 	child_proc->p_return_to_kernel_offset = parent_proc->p_return_to_kernel_offset;
1176 	child_proc->p_mach_thread_self_offset = parent_proc->p_mach_thread_self_offset;
1177 	child_proc->p_pth_tsd_offset = parent_proc->p_pth_tsd_offset;
1178 	child_proc->p_pthread_wq_quantum_offset = parent_proc->p_pthread_wq_quantum_offset;
1179 #if PSYNCH
1180 	pth_proc_hashinit(child_proc);
1181 #endif /* PSYNCH */
1182 
1183 #if CONFIG_PERSONAS
1184 	child_proc->p_persona = NULL;
1185 	if (parent_proc->p_persona) {
1186 		struct persona *persona = proc_persona_get(parent_proc);
1187 
1188 		if (persona) {
1189 			error = persona_proc_adopt(child_proc, persona, NULL);
1190 			if (error != 0) {
1191 				printf("forkproc: persona_proc_inherit failed (persona %d being destroyed?)\n",
1192 				    persona_get_id(persona));
1193 				forkproc_free(child_proc);
1194 				child_proc = NULL;
1195 				goto bad;
1196 			}
1197 		}
1198 	}
1199 #endif
1200 
1201 #if CONFIG_MEMORYSTATUS
1202 	/* Memorystatus init */
1203 	child_proc->p_memstat_state = 0;
1204 	child_proc->p_memstat_effectivepriority = JETSAM_PRIORITY_DEFAULT;
1205 	child_proc->p_memstat_requestedpriority = JETSAM_PRIORITY_DEFAULT;
1206 	child_proc->p_memstat_assertionpriority = 0;
1207 	child_proc->p_memstat_userdata          = 0;
1208 	child_proc->p_memstat_idle_start        = 0;
1209 	child_proc->p_memstat_idle_delta        = 0;
1210 	child_proc->p_memstat_memlimit          = 0;
1211 	child_proc->p_memstat_memlimit_active   = 0;
1212 	child_proc->p_memstat_memlimit_inactive = 0;
1213 	child_proc->p_memstat_relaunch_flags    = P_MEMSTAT_RELAUNCH_UNKNOWN;
1214 #if CONFIG_FREEZE
1215 	child_proc->p_memstat_freeze_sharedanon_pages = 0;
1216 #endif
1217 	child_proc->p_memstat_dirty = 0;
1218 	child_proc->p_memstat_idledeadline = 0;
1219 #endif /* CONFIG_MEMORYSTATUS */
1220 
1221 	if (parent_proc->p_subsystem_root_path) {
1222 		size_t parent_length = strlen(parent_proc->p_subsystem_root_path) + 1;
1223 		assert(parent_length <= MAXPATHLEN);
1224 		child_proc->p_subsystem_root_path = zalloc_flags(ZV_NAMEI,
1225 		    Z_WAITOK | Z_ZERO);
1226 		memcpy(child_proc->p_subsystem_root_path, parent_proc->p_subsystem_root_path, parent_length);
1227 	}
1228 
1229 bad:
1230 	return child_proc;
1231 }
1232 
1233 void
proc_lock(proc_t p)1234 proc_lock(proc_t p)
1235 {
1236 	LCK_MTX_ASSERT(&proc_list_mlock, LCK_MTX_ASSERT_NOTOWNED);
1237 	lck_mtx_lock(&p->p_mlock);
1238 }
1239 
1240 void
proc_unlock(proc_t p)1241 proc_unlock(proc_t p)
1242 {
1243 	lck_mtx_unlock(&p->p_mlock);
1244 }
1245 
1246 void
proc_spinlock(proc_t p)1247 proc_spinlock(proc_t p)
1248 {
1249 	lck_spin_lock_grp(&p->p_slock, &proc_slock_grp);
1250 }
1251 
1252 void
proc_spinunlock(proc_t p)1253 proc_spinunlock(proc_t p)
1254 {
1255 	lck_spin_unlock(&p->p_slock);
1256 }
1257 
1258 void
proc_list_lock(void)1259 proc_list_lock(void)
1260 {
1261 	lck_mtx_lock(&proc_list_mlock);
1262 }
1263 
1264 void
proc_list_unlock(void)1265 proc_list_unlock(void)
1266 {
1267 	lck_mtx_unlock(&proc_list_mlock);
1268 }
1269 
1270 void
proc_ucred_lock(proc_t p)1271 proc_ucred_lock(proc_t p)
1272 {
1273 	lck_mtx_lock(&p->p_ucred_mlock);
1274 }
1275 
1276 void
proc_ucred_unlock(proc_t p)1277 proc_ucred_unlock(proc_t p)
1278 {
1279 	lck_mtx_unlock(&p->p_ucred_mlock);
1280 }
1281 
1282 void
proc_update_creds_onproc(proc_t p,kauth_cred_t cred)1283 proc_update_creds_onproc(proc_t p, kauth_cred_t cred)
1284 {
1285 	p->p_uid = kauth_cred_getuid(cred);
1286 	p->p_gid = kauth_cred_getgid(cred);
1287 	p->p_ruid = kauth_cred_getruid(cred);
1288 	p->p_rgid = kauth_cred_getrgid(cred);
1289 	p->p_svuid = kauth_cred_getsvuid(cred);
1290 	p->p_svgid = kauth_cred_getsvgid(cred);
1291 }
1292 
1293 
1294 bool
uthread_is64bit(struct uthread * uth)1295 uthread_is64bit(struct uthread *uth)
1296 {
1297 	return uth->uu_flag & UT_LP64;
1298 }
1299 
1300 void
uthread_init(task_t task,uthread_t uth,thread_ro_t tro_tpl,int workq_thread)1301 uthread_init(task_t task, uthread_t uth, thread_ro_t tro_tpl, int workq_thread)
1302 {
1303 	uthread_t uth_parent = current_uthread();
1304 
1305 	lck_spin_init(&uth->uu_rethrottle_lock, &rethrottle_lock_grp,
1306 	    LCK_ATTR_NULL);
1307 
1308 	/*
1309 	 * Lazily set the thread on the kernel VFS context
1310 	 * to the first thread made which will be vm_pageout_scan_thread.
1311 	 */
1312 	if (__improbable(vfs_context0.vc_thread == NULL)) {
1313 		extern thread_t vm_pageout_scan_thread;
1314 
1315 		assert(task == kernel_task);
1316 		assert(get_machthread(uth) == vm_pageout_scan_thread);
1317 		vfs_context0.vc_thread = get_machthread(uth);
1318 	}
1319 
1320 	if (task_get_64bit_addr(task)) {
1321 		uth->uu_flag |= UT_LP64;
1322 	}
1323 
1324 	/*
1325 	 * Thread inherits credential from the creating thread, if both
1326 	 * are in the same task.
1327 	 *
1328 	 * If the creating thread has no credential or is from another
1329 	 * task we can leave the new thread credential NULL.  If it needs
1330 	 * one later, it will be lazily assigned from the task's process.
1331 	 */
1332 	if (task == kernel_task) {
1333 		kauth_cred_set(&tro_tpl->tro_cred, vfs_context0.vc_ucred);
1334 		kauth_cred_set(&tro_tpl->tro_realcred, vfs_context0.vc_ucred);
1335 		tro_tpl->tro_proc = kernproc;
1336 		tro_tpl->tro_proc_ro = kernproc->p_proc_ro;
1337 	} else if (!task_is_a_corpse(task)) {
1338 		thread_ro_t curtro = current_thread_ro();
1339 		proc_t p = get_bsdtask_info(task);
1340 
1341 		if (task == curtro->tro_task) {
1342 			kauth_cred_set(&tro_tpl->tro_realcred,
1343 			    curtro->tro_realcred);
1344 			if (workq_thread) {
1345 				kauth_cred_set(&tro_tpl->tro_cred,
1346 				    curtro->tro_realcred);
1347 			} else {
1348 				kauth_cred_set(&tro_tpl->tro_cred,
1349 				    curtro->tro_cred);
1350 			}
1351 			tro_tpl->tro_proc_ro = curtro->tro_proc_ro;
1352 		} else {
1353 			kauth_cred_t cred = kauth_cred_proc_ref(p);
1354 			kauth_cred_set(&tro_tpl->tro_realcred, cred);
1355 			kauth_cred_set(&tro_tpl->tro_cred, cred);
1356 			kauth_cred_unref(&cred);
1357 			tro_tpl->tro_proc_ro = task_get_ro(task);
1358 		}
1359 		tro_tpl->tro_proc = p;
1360 
1361 		proc_lock(p);
1362 		if (workq_thread) {
1363 			/* workq_thread threads will not inherit masks */
1364 			uth->uu_sigmask = ~workq_threadmask;
1365 		} else if (uth_parent->uu_flag & UT_SAS_OLDMASK) {
1366 			uth->uu_sigmask = uth_parent->uu_oldmask;
1367 		} else {
1368 			uth->uu_sigmask = uth_parent->uu_sigmask;
1369 		}
1370 
1371 		TAILQ_INSERT_TAIL(&p->p_uthlist, uth, uu_list);
1372 		proc_unlock(p);
1373 
1374 #if CONFIG_DTRACE
1375 		if (p->p_dtrace_ptss_pages != NULL) {
1376 			uth->t_dtrace_scratch = dtrace_ptss_claim_entry(p);
1377 		}
1378 #endif
1379 	} else {
1380 		tro_tpl->tro_proc_ro = task_get_ro(task);
1381 	}
1382 
1383 	uth->uu_pending_sigreturn = 0;
1384 	uthread_init_proc_refcount(uth);
1385 }
1386 
1387 mach_port_name_t
uthread_joiner_port(struct uthread * uth)1388 uthread_joiner_port(struct uthread *uth)
1389 {
1390 	return uth->uu_save.uus_bsdthread_terminate.kport;
1391 }
1392 
1393 user_addr_t
uthread_joiner_address(uthread_t uth)1394 uthread_joiner_address(uthread_t uth)
1395 {
1396 	return uth->uu_save.uus_bsdthread_terminate.ulock_addr;
1397 }
1398 
1399 void
uthread_joiner_wake(task_t task,uthread_t uth)1400 uthread_joiner_wake(task_t task, uthread_t uth)
1401 {
1402 	struct _bsdthread_terminate bts = uth->uu_save.uus_bsdthread_terminate;
1403 
1404 	assert(bts.ulock_addr);
1405 	bzero(&uth->uu_save.uus_bsdthread_terminate, sizeof(bts));
1406 
1407 	int flags = UL_UNFAIR_LOCK | ULF_WAKE_ALL | ULF_WAKE_ALLOW_NON_OWNER;
1408 	(void)ulock_wake(task, flags, bts.ulock_addr, 0);
1409 	mach_port_deallocate_kernel(get_task_ipcspace(task), bts.kport,
1410 	    IKOT_SEMAPHORE);
1411 }
1412 
1413 /*
1414  * This routine frees the thread name field of the uthread_t structure. Split out of
1415  * uthread_cleanup() so thread name does not get deallocated while generating a corpse fork.
1416  */
1417 void
uthread_cleanup_name(uthread_t uth)1418 uthread_cleanup_name(uthread_t uth)
1419 {
1420 	/*
1421 	 * <rdar://17834538>
1422 	 * Set pth_name to NULL before calling free().
1423 	 * Previously there was a race condition in the
1424 	 * case this code was executing during a stackshot
1425 	 * where the stackshot could try and copy pth_name
1426 	 * after it had been freed and before if was marked
1427 	 * as null.
1428 	 */
1429 	if (uth->pth_name != NULL) {
1430 		void *pth_name = uth->pth_name;
1431 		uth->pth_name = NULL;
1432 		kfree_data(pth_name, MAXTHREADNAMESIZE);
1433 	}
1434 	return;
1435 }
1436 
1437 /*
1438  * This routine frees all the BSD context in uthread except the credential.
1439  * It does not free the uthread structure as well
1440  */
1441 void
uthread_cleanup(uthread_t uth,thread_ro_t tro)1442 uthread_cleanup(uthread_t uth, thread_ro_t tro)
1443 {
1444 	task_t task = tro->tro_task;
1445 	proc_t p    = tro->tro_proc;
1446 
1447 	uthread_assert_zero_proc_refcount(uth);
1448 
1449 	if (uth->uu_lowpri_window || uth->uu_throttle_info) {
1450 		/*
1451 		 * task is marked as a low priority I/O type
1452 		 * and we've somehow managed to not dismiss the throttle
1453 		 * through the normal exit paths back to user space...
1454 		 * no need to throttle this thread since its going away
1455 		 * but we do need to update our bookeeping w/r to throttled threads
1456 		 *
1457 		 * Calling this routine will clean up any throttle info reference
1458 		 * still inuse by the thread.
1459 		 */
1460 		throttle_lowpri_io(0);
1461 	}
1462 
1463 #if CONFIG_AUDIT
1464 	/*
1465 	 * Per-thread audit state should never last beyond system
1466 	 * call return.  Since we don't audit the thread creation/
1467 	 * removal, the thread state pointer should never be
1468 	 * non-NULL when we get here.
1469 	 */
1470 	assert(uth->uu_ar == NULL);
1471 #endif
1472 
1473 	if (uth->uu_select.nbytes) {
1474 		select_cleanup_uthread(&uth->uu_select);
1475 	}
1476 
1477 	if (uth->uu_cdir) {
1478 		vnode_rele(uth->uu_cdir);
1479 		uth->uu_cdir = NULLVP;
1480 	}
1481 
1482 	if (uth->uu_selset) {
1483 		select_set_free(uth->uu_selset);
1484 		uth->uu_selset = NULL;
1485 	}
1486 
1487 	os_reason_free(uth->uu_exit_reason);
1488 
1489 	if ((task != kernel_task) && p) {
1490 		/*
1491 		 * Remove the thread from the process list and
1492 		 * transfer [appropriate] pending signals to the process.
1493 		 * Do not remove the uthread from proc uthlist for exec
1494 		 * copy task, since they does not have a ref on proc and
1495 		 * would not have been added to the list.
1496 		 */
1497 		if (uth->uu_kqr_bound) {
1498 			kqueue_threadreq_unbind(p, uth->uu_kqr_bound);
1499 		}
1500 
1501 		if (get_bsdtask_info(task) == p) {
1502 			proc_lock(p);
1503 			TAILQ_REMOVE(&p->p_uthlist, uth, uu_list);
1504 			p->p_siglist |= (uth->uu_siglist & execmask & (~p->p_sigignore | sigcantmask));
1505 			proc_unlock(p);
1506 		}
1507 
1508 #if CONFIG_DTRACE
1509 		struct dtrace_ptss_page_entry *tmpptr = uth->t_dtrace_scratch;
1510 		uth->t_dtrace_scratch = NULL;
1511 		if (tmpptr != NULL) {
1512 			dtrace_ptss_release_entry(p, tmpptr);
1513 		}
1514 #endif
1515 	} else {
1516 		assert(!uth->uu_kqr_bound);
1517 	}
1518 }
1519 
1520 /* This routine releases the credential stored in uthread */
1521 void
uthread_cred_ref(struct ucred * ucred)1522 uthread_cred_ref(struct ucred *ucred)
1523 {
1524 	kauth_cred_ref(ucred);
1525 }
1526 
1527 void
uthread_cred_free(struct ucred * ucred)1528 uthread_cred_free(struct ucred *ucred)
1529 {
1530 	kauth_cred_set(&ucred, NOCRED);
1531 }
1532 
1533 /* This routine frees the uthread structure held in thread structure */
1534 void
uthread_destroy(uthread_t uth)1535 uthread_destroy(uthread_t uth)
1536 {
1537 	uthread_destroy_proc_refcount(uth);
1538 
1539 	if (uth->t_tombstone) {
1540 		kfree_type(struct doc_tombstone, uth->t_tombstone);
1541 		uth->t_tombstone = NULL;
1542 	}
1543 
1544 #if CONFIG_DEBUG_SYSCALL_REJECTION
1545 	size_t const bitstr_len = BITMAP_SIZE(mach_trap_count + nsysent);
1546 
1547 	if (uth->syscall_rejection_mask) {
1548 		kfree_data(uth->syscall_rejection_mask, bitstr_len);
1549 		uth->syscall_rejection_mask = NULL;
1550 	}
1551 
1552 	if (uth->syscall_rejection_once_mask) {
1553 		kfree_data(uth->syscall_rejection_once_mask, bitstr_len);
1554 		uth->syscall_rejection_once_mask = NULL;
1555 	}
1556 #endif /* CONFIG_DEBUG_SYSCALL_REJECTION */
1557 
1558 	lck_spin_destroy(&uth->uu_rethrottle_lock, &rethrottle_lock_grp);
1559 
1560 	uthread_cleanup_name(uth);
1561 }
1562 
1563 user_addr_t
thread_get_sigreturn_token(thread_t thread)1564 thread_get_sigreturn_token(thread_t thread)
1565 {
1566 	uthread_t ut = (struct uthread *) get_bsdthread_info(thread);
1567 	return ut->uu_sigreturn_token;
1568 }
1569 
1570 uint32_t
thread_get_sigreturn_diversifier(thread_t thread)1571 thread_get_sigreturn_diversifier(thread_t thread)
1572 {
1573 	uthread_t ut = (struct uthread *) get_bsdthread_info(thread);
1574 	return ut->uu_sigreturn_diversifier;
1575 }
1576