Merge tag 'vfs-7.4-rc1.sync_close' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull file closing updates from Christian Brauner:
 "This makes closing files synchronous for close_range(), exec and exit.

  Since fput() was switched to task work every final __fput() of an
  exiting task is queued on task work and run from exit_task_work().
  exec and close_range() do the same. For a task with a large descriptor
  table that is a cmpxchg() and a TIF_NOTIFY_RESUME test-and-set per
  file plus a list entry for any later task_work_cancel() to search
  under pi_lock, and then a second pass over every struct file that
  isn't cache hot anymore by then. Oleg and Neil have pointed this out
  over the years.

  close_files(), close_range() and close-on-exec now flush and put each
  file inline the way close(2) does. Kernel threads aren't affected.
  They share init_files which init_task pins forever so their
  exit_files() never drops the last reference, and their fput() keeps
  punting to a workqueue. The one place that could put a table from a
  kthread context, a failing copy_process(), can't hold the last
  reference while the source table is alive.

  On a 64 vCPU KVM guest tearing down 4096, 65536 and 1M descriptors
  scattered at random positions in the table:

                           4096 fds        65536 fds        1M fds
    exit                   1045 -> 895 us  18.9 -> 14.9 ms  429 -> 306 ms
    execve, close-on-exec  1393 -> 1190 us 21.4 -> 16.9 ms  471 -> 325 ms
    close_range()          1179 -> 988 us  21.9 -> 17.4 ms  484 -> 337 ms

  So that is 16-21% or 40-150 ns per closed file, largest at 1M
  descriptors. With eight processes tearing down 65536 descriptors each
  at once it stays at 16-21% because the second pass over 16 MB of
  struct file is what gets expensive when CPUs compete for the cache.

  With 32 or 64 processes both kernels are bound by pushing millions of
  files through slab and rcu and the difference shrinks to 4-8%. Files
  whose own release dominates gain less, 13% for eventfds, 11% for
  pipes, 6% for AF_UNIX sockets. close(2) is untouched and will-it-scale
  is within 2%.

  The spufs coredump support is removed. It was the only reason
  do_coredump() unshared the descriptor table. gdb dropped Cell
  debugging in 9.1 and binutils in 2.34, the Cell blades are gone and
  nothing on the PlayStation 3 produces or reads these notes. With that
  unshare_files() goes away, exec installs its private table through the
  new switch_files_struct() and the coredump startup completion becomes
  a plain thread count waited on with the new wait_var_event_state().

  Three fixes for the synchronous close are included. A failed fork
  released its files under scx_fork_rwsem and deadlocked against the bpf
  link's release. A session leader's exit released its tty before
  disassociate_ctty() ran and the foreground job lost its SIGHUP, so the
  tty is hung up before the files are closed now. And descriptor tables
  are walked from the highest descriptor down which restores the order
  the deferred puts had and keeps a few long-standing release ordering
  bugs from deadlocking exit"

* tag 'vfs-7.4-rc1.sync_close' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  fs: close files from the highest descriptor down
  coredump: factor out coredump_wait_inactive()
  exit: hang up the tty before closing the files
  fork: release the files of a failed fork after sched_cancel_fork()
  coredump: replace the startup completion with a thread count
  sched: add wait_var_event_state()
  coredump: drop core_state->dumper
  fs: make close_cloexec_files() synchronous
  fs: rename do_close_on_exec() to close_cloexec_files()
  fs: make close_range() synchronous
  fs: make close_files() synchronous
  fs: add filp_close_sync()
  fs: remove unshare_files()
  fs: move unshare_fd() to fs/file.c
  fs: add switch_files_struct()
  coredump: stop unsharing the file descriptor table
  fs: don't open-code file_close_fd() in close_fd()
  powerpc: remove coredump support

3 files changed, 32 insertions, 5 deletions

diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
index c0cabd9c79ec..ba2536c3b911 100644
--- a/include/linux/fdtable.h
+++ b/include/linux/fdtable.h
@@ -100,7 +100,8 @@ static inline bool close_on_exec(unsigned int fd, const struct files_struct *fil
 struct task_struct;
 
 void put_files_struct(struct files_struct *fs);
-int unshare_files(void);
+void switch_files_struct(struct task_struct *tsk, struct files_struct *files);
+int unshare_fd(unsigned long unshare_flags, struct files_struct **new_fdp);
 enum fd_range_flags {
 	/* Leave behind all descriptors outside of the specified range. */
 	FD_RANGE_EXCEPT		= (1U << 0),
@@ -114,7 +115,7 @@ struct fd_range {
 	enum fd_range_flags flags;
 };
 struct files_struct *dup_fd(struct files_struct *, struct fd_range *) __latent_entropy;
-void do_close_on_exec(struct files_struct *);
+void close_cloexec_files(struct files_struct *);
 int iterate_fd(struct files_struct *, unsigned,
 		int (*)(const void *, struct file *, unsigned),
 		const void *);
diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index f65d97fe199c..0adb51ab1542 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h
@@ -80,9 +80,9 @@ struct core_thread {
 };
 
 struct core_state {
-	atomic_t nr_threads;
-	struct core_thread dumper;
-	struct completion startup;
+	/* Threads the dumper still waits for. */
+	atomic_t threads_remaining;
+	struct core_thread *tasks;
 };
 
 /*
diff --git a/include/linux/wait_bit.h b/include/linux/wait_bit.h
index 553d7b23e3ad..af077ed4caf6 100644
--- a/include/linux/wait_bit.h
+++ b/include/linux/wait_bit.h
@@ -433,6 +433,32 @@ do {									\
 })
 
 /**
+ * wait_var_event_state - wait for a variable to be updated and notified
+ * @var: the address of variable being waited on
+ * @condition: the condition to wait for
+ * @state: the task state to sleep in, %TASK_UNINTERRUPTIBLE etc.
+ *
+ * Wait for a @condition to be true, only re-checking when a wake up is
+ * received for the given @var (an arbitrary kernel address which need
+ * not be directly related to the given condition, but usually is).
+ *
+ * Returns 0 if the condition became true, or %-ERESTARTSYS if a signal
+ * arrived which @state allows to interrupt.
+ *
+ * The condition should normally use smp_load_acquire() or a similarly
+ * ordered access to ensure that any changes to memory made before the
+ * condition became true will be visible after the wait completes.
+ */
+#define wait_var_event_state(var, condition, state)					\
+({											\
+	int __ret = 0;									\
+	might_sleep();									\
+	if (!(condition))								\
+		__ret = ___wait_var_event(var, condition, (state), 0, 0, schedule());	\
+	__ret;										\
+})
+
+/**
  * wait_var_event_any_lock - wait for a variable to be updated under a lock
  * @var: the address of the variable being waited on
  * @condition: condition to wait for