5 files changed, 32 insertions, 8 deletions

diff --git a/fs/exec.c b/fs/exec.c
index da80612a35f4..25dcbe5fc356 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1459,6 +1459,23 @@ static int do_execve_common(const char *filename,
         struct files_struct *displaced;
         bool clear_in_exec;
         int retval;
+        const struct cred *cred = current_cred();
+
+        /*
+         * We move the actual failure in case of RLIMIT_NPROC excess from
+         * set*uid() to execve() because too many poorly written programs
+         * don't check setuid() return code.  Here we additionally recheck
+         * whether NPROC limit is still exceeded.
+         */
+        if ((current->flags & PF_NPROC_EXCEEDED) &&
+            atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) {
+                retval = -EAGAIN;
+                goto out_ret;
+        }
+
+        /* We're below the limit (still or again), so we don't want to make
+         * further execve() calls fail. */
+        current->flags &= ~PF_NPROC_EXCEEDED;
 
         retval = unshare_files(&displaced);
         if (retval)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 20b03bf94748..4ac2c0578e0f 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1767,6 +1767,7 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
 #define PF_DUMPCORE     0x00000200      /* dumped core */
 #define PF_SIGNALED     0x00000400      /* killed by a signal */
 #define PF_MEMALLOC     0x00000800      /* Allocating memory */
+#define PF_NPROC_EXCEEDED 0x00001000    /* set_user noticed that RLIMIT_NPROC was exceeded */
 #define PF_USED_MATH    0x00002000      /* if unset the fpu must be initialized before use */
 #define PF_FREEZING     0x00004000      /* freeze in progress. do not account to load */
 #define PF_NOFREEZE     0x00008000      /* this thread should not be frozen */
diff --git a/kernel/cred.c b/kernel/cred.c
index 174fa84eca30..8ef31f53c44c 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -508,10 +508,8 @@ int commit_creds(struct cred *new)
                 key_fsgid_changed(task);
 
         /* do it
-         * - What if a process setreuid()'s and this brings the
-         *   new uid over his NPROC rlimit?  We can check this now
-         *   cheaply with the new uid cache, so if it matters
-         *   we should be checking for it.  -DaveM
+         * RLIMIT_NPROC limits on user->processes have already been checked
+         * in set_user().
          */
         alter_cred_subscribers(new, 2);
         if (new->user != old->user)
diff --git a/kernel/fork.c b/kernel/fork.c
index e7ceaca89609..8e6b6f4fb272 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1111,6 +1111,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                     p->real_cred->user != INIT_USER)
                         goto bad_fork_free;
         }
+        current->flags &= ~PF_NPROC_EXCEEDED;
 
         retval = copy_creds(p, clone_flags);
         if (retval < 0)
diff --git a/kernel/sys.c b/kernel/sys.c
index a101ba36c444..dd948a1fca4c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -621,11 +621,18 @@ static int set_user(struct cred *new)
         if (!new_user)
                 return -EAGAIN;
 
+        /*
+         * We don't fail in case of NPROC limit excess here because too many
+         * poorly written programs don't check set*uid() return code, assuming
+         * it never fails if called by root.  We may still enforce NPROC limit
+         * for programs doing set*uid()+execve() by harmlessly deferring the
+         * failure to the execve() stage.
+         */
         if (atomic_read(&new_user->processes) >= rlimit(RLIMIT_NPROC) &&
-                        new_user != INIT_USER) {
-                free_uid(new_user);
-                return -EAGAIN;
-        }
+                        new_user != INIT_USER)
+                current->flags |= PF_NPROC_EXCEEDED;
+        else
+                current->flags &= ~PF_NPROC_EXCEEDED;
 
         free_uid(new->user);
         new->user = new_user;