- Add a new global mutex 'ppeers_lock' to protect the p_peers list of

  processes forked with RFTHREAD.
- Use a goto to a label for common code when exiting from fork1() in case
  of an error.
- Move the RFTHREAD linkage setup code later in fork since the ppeers_lock
  cannot be locked while holding a proc lock.  Handle the race of a task
  leader exiting and killing its peers while a peer is forking a new child.
  In that case, go ahead and let the peer process proceed normally as the
  parent is about to kill it.  However, the task leader may have already
  gone to sleep to wait for the peers to die, so the new child process may
  not receive a SIGKILL from the task leader.  Rather than try to destruct
  the new child process, just go ahead and send it a SIGKILL directly and
  add it to the p_peers list.  This ensures that the task leader will wait
  until both the peer process doing the fork() and the new child process
  have received their KILL signals and exited.

Discussed with:	truckman (earlier versions)

1 files changed, 6 insertions, 6 deletions

diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index 6c83432..68bebfc 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -207,8 +207,8 @@ exit1(td, rv)
 	PROC_UNLOCK(p);
 
 	/* Are we a task leader? */
-	PROC_LOCK(p);
 	if (p == p->p_leader) {
+		mtx_lock(&ppeers_lock);
 		q = p->p_peers;
 		while (q != NULL) {
 			PROC_LOCK(q);
@@ -216,10 +216,10 @@ exit1(td, rv)
 			PROC_UNLOCK(q);
 			q = q->p_peers;
 		}
-		while (p->p_peers) 
-			msleep(p, &p->p_mtx, PWAIT, "exit1", 0);
+		while (p->p_peers != NULL) 
+			msleep(p, &ppeers_lock, PWAIT, "exit1", 0);
+		mtx_unlock(&ppeers_lock);
 	}
-	PROC_UNLOCK(p);
 
 #ifdef PGINPROF
 	vmsizmon();
@@ -265,7 +265,7 @@ exit1(td, rv)
 	/*
 	 * Remove ourself from our leader's peer list and wake our leader.
 	 */
-	PROC_LOCK(p->p_leader);
+	mtx_lock(&ppeers_lock);
 	if (p->p_leader->p_peers) {
 		q = p->p_leader;
 		while (q->p_peers != p)
@@ -273,7 +273,7 @@ exit1(td, rv)
 		q->p_peers = p->p_peers;
 		wakeup(p->p_leader);
 	}
-	PROC_UNLOCK(p->p_leader);
+	mtx_unlock(&ppeers_lock);
 
 	/* The next two chunks should probably be moved to vmspace_exit. */
 	vm = p->p_vmspace;