fix(process): serialize child ownership handoff

Keep the old leader's children index and every child parent link in one tasklist-like relationship transaction during non-leader exec.

Make release select the current real parent and remove the matching children entry under the same lock, preventing stale virtual PIDs when child reap races the handoff. Reuse the locked reparent helper and remove the now-redundant wrapper.

Signed-off-by: longjin <longjin@dragonos.org>

Author: fslongjin

kernel/src/process/exec.rs

@@ -510,9 +510,12 @@ fn de_thread(pcb: &Arc<ProcessControlBlock>) -> Result<(), SystemError> {
         }
         drop(membership_guard);
 
-        // Transfer the old leader's children list to the new leader.
-        let moved_children = {
-            let leader_pid_ns = leader.active_pid_ns();
+        // Transfer the old leader's children list and parent links as one
+        // tasklist-like transaction. A concurrent release must observe both
+        // the new owner and its index entry, or neither.
+        let _relation_guard = PTRACE_RELATION_LOCK.lock_irqsave();
+        let leader_pid_ns = leader.active_pid_ns();
+        let moved_child_pids = {
             let (first, second) =
                 if (Arc::as_ptr(&current) as usize) <= (Arc::as_ptr(leader) as usize) {
                     (current.clone(), leader.clone())
@@ -532,12 +535,13 @@ fn de_thread(pcb: &Arc<ProcessControlBlock>) -> Result<(), SystemError> {
                 first_children.extend(moved.iter().copied());
                 moved
             }
+        };
+        let moved_children = moved_child_pids
             .into_iter()
             .filter_map(|pid| ProcessManager::find_task_by_pid_ns(pid, &leader_pid_ns))
-            .collect::<Vec<_>>()
-        };
+            .collect::<Vec<_>>();
         for child in moved_children {
-            ProcessControlBlock::reparent_child_links_from_thread_group(
+            ProcessControlBlock::reparent_child_links_from_thread_group_locked(
                 &child,
                 current.tgid,
                 &current,
@@ -546,13 +550,13 @@ fn de_thread(pcb: &Arc<ProcessControlBlock>) -> Result<(), SystemError> {
 
         // Inherit parent process relationships from the old leader.
         {
-            let _relation_guard = PTRACE_RELATION_LOCK.lock_irqsave();
             let leader_parent = leader.real_parent_pcb.read_irqsave().clone();
             *current.parent_pcb.write_irqsave() = leader_parent.clone();
             *current.real_parent_pcb.write_irqsave() = leader_parent.clone();
             *current.wait_parent_pcb.write_irqsave() = leader_parent.clone();
             *current.fork_parent_pcb.write_irqsave() = leader_parent;
         }
+        drop(_relation_guard);
 
         // log::info!("de_thread: reparented current to old leader's parent");
 

kernel/src/process/manager/exit.rs

@@ -540,22 +540,28 @@ impl ProcessManager {
             ProcessManager::exit_ptrace(pcb);
             ProcessManager::ptrace_unlink_tracee(pcb);
 
-            let parent_child_vpid = pcb.real_parent_pcb().and_then(|parent| {
-                // A concurrently exiting parent may already have unhashed its
-                // PID before this nonleader is autoreaped. Its children list
-                // has then been consumed by the adoption transaction, so
-                // there is no attached namespace/list entry left to clean.
-                let parent_ns = parent
-                    .task_pid_ptr(PidType::PID)
-                    .and_then(|pid| pid.try_ns_of_pid())?;
-                pcb.task_pid_nr_ns(PidType::PID, Some(parent_ns))
-                    .map(|vpid| (parent, vpid))
-            });
+            {
+                // Pair parent discovery with children-index removal under the
+                // same tasklist-like transaction used by reparent/de_thread.
+                // Otherwise a concurrent identity handoff can move the list
+                // entry after this release selected the former parent.
+                let _relation_guard = crate::process::PTRACE_RELATION_LOCK.lock_irqsave();
+                let parent_child_vpid = pcb.real_parent_pcb().and_then(|parent| {
+                    // A concurrently exiting parent may already have unhashed
+                    // its PID before this nonleader is autoreaped. Its children
+                    // list has then been consumed by the adoption transaction,
+                    // so no attached namespace/list entry remains to clean.
+                    let parent_ns = parent
+                        .task_pid_ptr(PidType::PID)
+                        .and_then(|pid| pid.try_ns_of_pid())?;
+                    pcb.task_pid_nr_ns(PidType::PID, Some(parent_ns))
+                        .map(|vpid| (parent, vpid))
+                });
 
-            // Remove from the parent's children list.
-            if let Some((parent, vpid)) = parent_child_vpid {
-                let mut children = parent.children.write();
-                children.retain(|&p| p != vpid);
+                if let Some((parent, vpid)) = parent_child_vpid {
+                    let mut children = parent.children.write();
+                    children.retain(|&p| p != vpid);
+                }
             }
 
             // Revoke the old PCB's global numeric lookup before __exit_signal()

kernel/src/process/task.rs

@@ -1013,14 +1013,6 @@ impl ProcessControlBlock {
         }
     }
 
-    pub(crate) fn reparent_child_to(
-        child: &Arc<ProcessControlBlock>,
-        new_parent: &Arc<ProcessControlBlock>,
-    ) {
-        let _relation_guard = PTRACE_RELATION_LOCK.lock_irqsave();
-        ProcessControlBlock::reparent_child_to_locked(child, new_parent);
-    }
-
     fn reparent_child_to_locked(
         child: &Arc<ProcessControlBlock>,
         new_parent: &Arc<ProcessControlBlock>,
@@ -1045,7 +1037,12 @@ impl ProcessControlBlock {
         }
     }
 
-    pub(crate) fn reparent_child_links_from_thread_group(
+    /// Update a child's parent links during a thread-group identity handoff.
+    ///
+    /// The caller must hold `PTRACE_RELATION_LOCK`, DragonOS's tasklist-like
+    /// relationship lock, so the parent pointers and the owning `children`
+    /// index change as one transaction with concurrent release/reparent.
+    pub(crate) fn reparent_child_links_from_thread_group_locked(
         child: &Arc<ProcessControlBlock>,
         old_tgid: RawPid,
         new_parent: &Arc<ProcessControlBlock>,
@@ -1067,7 +1064,7 @@ impl ProcessControlBlock {
                 .unwrap_or(false);
 
         if should_reparent {
-            ProcessControlBlock::reparent_child_to(child, new_parent);
+            ProcessControlBlock::reparent_child_to_locked(child, new_parent);
         }
     }