__ptrace_unlink(9)

✨ __ptrace_unlink(9) — the kernel API manual glow-up ✨

okay so you're reading the <pink>__ptrace_unlink</pink> page from the Kernel API Manual, and honestly? it's lowkey a banger. it's all about gently letting a traced task go and making sure its execution state is not a whole mess afterwards. let's get into it 🫶

---

🌸 NAME 🌸

__ptrace_unlink — unlink ptracee and restore its execution state

like, unlink your traced buddy and put its vibes (execution state) back where they belong 💅

---

✨ SYNOPSIS ✨

void __ptrace_unlink (struct task_struct *child );

---

🎀 ARGUMENTS 🎀

• child — the ptracee to be unlinked. that's the one getting set free, bestie 🦋

---

💖 DESCRIPTION 💖

So here's the tea: this function removes child from the ptrace list, moves it back to the original parent, and restores the execution state so that it conforms to the group stop state. three little steps, all iconic 👑

Unlinking can happen via two paths — explicit PTRACE_DETACH or ptracer exiting. and ngl these two are not the same vibe:

• for PTRACE_DETACH, unless the ptracee has been killed between ptrace_check_attach and here, it's guaranteed to be in TASK_TRACED.
• if the ptracer is exiting, the ptracee can be in any state. literally any. main character chaos 😭

After detach, the ptracee should be in a state which conforms to the group stop. so:

• if the group is stopped or in the process of stopping, the ptracee should be put into TASK_STOPPED;
• otherwise, it should be woken up from TASK_TRACED.

And now for the part where you gotta pay attention 🔥 If the ptracee is in TASK_TRACED and needs to be moved to TASK_STOPPED, it goes through the TRACED -> RUNNING -> STOPPED transition, which is similar to but in the opposite direction of what happens while attaching to a stopped task. cute symmetry, right?

but in this direction, the intermediate RUNNING state is not hidden even from the current ptracer — and if it immediately re-attaches and performs a WNOHANG wait(2), it may fail. not me warning you twice 💀

---

🔒 CONTEXT 🔒

write_lock_irq(tasklist_lock)

that's the lock situation, no cap. don't forget it 🧚

---

🌈 SEE ALSO 🌈

• Kernel file ./kernel/ptrace.c
• ptracer_access_allowed(9)
• ptrace_check_attach(9)
• ptrace_traceme(9)

go read those next, iykyk 📚✨

---

<div>💜 okay that's the whole page, you ate that 💜</div>

this absolute classic lives in ./kernel, and this particular edition is dated October 2026 — and yes, __ptrace_unlink(9) is still the title, we're just saying it with love at the end. bye bestie, slay your kernel debugging 🎀🌸🫶