1 files changed, 14 insertions, 7 deletions

diff --git a/fs/proc/base.c b/fs/proc/base.c
index d53246863cfb..eafa39a3a88c 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -388,14 +388,17 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
         unsigned long wchan;
         char symname[KSYM_NAME_LEN];
 
-        wchan = get_wchan(task);
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
+                goto print0;
 
-        if (wchan && ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)
-                        && !lookup_symbol_name(wchan, symname))
-                seq_printf(m, "%s", symname);
-        else
-                seq_putc(m, '0');
+        wchan = get_wchan(task);
+        if (wchan && !lookup_symbol_name(wchan, symname)) {
+                seq_puts(m, symname);
+                return 0;
+        }
 
+print0:
+        seq_putc(m, '0');
         return 0;
 }
 #endif /* CONFIG_KALLSYMS */
@@ -1910,6 +1913,8 @@ static int dname_to_vma_addr(struct dentry *dentry,
         unsigned long long sval, eval;
         unsigned int len;
 
+        if (str[0] == '0' && str[1] != '-')
+                return -EINVAL;
         len = _parse_integer(str, 16, &sval);
         if (len & KSTRTOX_OVERFLOW)
                 return -EINVAL;
@@ -1921,6 +1926,8 @@ static int dname_to_vma_addr(struct dentry *dentry,
                 return -EINVAL;
         str++;
 
+        if (str[0] == '0' && str[1])
+                return -EINVAL;
         len = _parse_integer(str, 16, &eval);
         if (len & KSTRTOX_OVERFLOW)
                 return -EINVAL;
@@ -2204,6 +2211,7 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
                 }
         }
         up_read(&mm->mmap_sem);
+        mmput(mm);
 
         for (i = 0; i < nr_files; i++) {
                 char buf[4 * sizeof(long) + 2]; /* max: %lx-%lx\0 */
@@ -2221,7 +2229,6 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
         }
         if (fa)
                 flex_array_free(fa);
-        mmput(mm);
 
 out_put_task:
         put_task_struct(task);