1 files changed, 56 insertions, 26 deletions

diff --git a/fs/exec.c b/fs/exec.c
index 153dee14fe55..52c9e2ff6e6b 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -59,10 +59,13 @@
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
 #include <asm/tlb.h>
+#include <asm/exec.h>
 
 #include <trace/events/task.h>
 #include "internal.h"
 
+#include <trace/events/sched.h>
+
 int core_uses_pid;
 char core_pattern[CORENAME_MAX_SIZE] = "core";
 unsigned int core_pipe_limit;
@@ -79,15 +82,13 @@ static atomic_t call_count = ATOMIC_INIT(1);
 static LIST_HEAD(formats);
 static DEFINE_RWLOCK(binfmt_lock);
 
-int __register_binfmt(struct linux_binfmt * fmt, int insert)
+void __register_binfmt(struct linux_binfmt * fmt, int insert)
 {
-        if (!fmt)
-                return -EINVAL;
+        BUG_ON(!fmt);
         write_lock(&binfmt_lock);
         insert ? list_add(&fmt->lh, &formats) :
                  list_add_tail(&fmt->lh, &formats);
         write_unlock(&binfmt_lock);
-        return 0;       
 }
 
 EXPORT_SYMBOL(__register_binfmt);
@@ -822,7 +823,7 @@ static int exec_mmap(struct mm_struct *mm)
         /* Notify parent that we're no longer interested in the old VM */
         tsk = current;
         old_mm = current->mm;
-        sync_mm_rss(tsk, old_mm);
+        sync_mm_rss(old_mm);
         mm_release(tsk, old_mm);
 
         if (old_mm) {
@@ -848,6 +849,7 @@ static int exec_mmap(struct mm_struct *mm)
         if (old_mm) {
                 up_read(&old_mm->mmap_sem);
                 BUG_ON(active_mm != old_mm);
+                setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm);
                 mm_update_next_owner(old_mm);
                 mmput(old_mm);
                 return 0;
@@ -975,8 +977,8 @@ static int de_thread(struct task_struct *tsk)
         sig->notify_count = 0;
 
 no_thread_group:
-        if (current->mm)
-                setmax_mm_hiwater_rss(&sig->maxrss, current->mm);
+        /* we have changed execution domain */
+        tsk->exit_signal = SIGCHLD;
 
         exit_itimers(sig);
         flush_itimer_signals();
@@ -1026,10 +1028,10 @@ static void flush_old_files(struct files_struct * files)
                 fdt = files_fdtable(files);
                 if (i >= fdt->max_fds)
                         break;
-                set = fdt->close_on_exec->fds_bits[j];
+                set = fdt->close_on_exec[j];
                 if (!set)
                         continue;
-                fdt->close_on_exec->fds_bits[j] = 0;
+                fdt->close_on_exec[j] = 0;
                 spin_unlock(&files->file_lock);
                 for ( ; set ; i++,set >>= 1) {
                         if (set & 1) {
@@ -1112,7 +1114,7 @@ int flush_old_exec(struct linux_binprm * bprm)
         bprm->mm = NULL;                /* We're using it now */
 
         set_fs(USER_DS);
-        current->flags &= ~(PF_RANDOMIZE | PF_KTHREAD);
+        current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD);
         flush_thread();
         current->personality &= ~bprm->per_clear;
 
@@ -1137,7 +1139,7 @@ void setup_new_exec(struct linux_binprm * bprm)
         /* This is the point of no return */
         current->sas_ss_sp = current->sas_ss_size = 0;
 
-        if (current_euid() == current_uid() && current_egid() == current_gid())
+        if (uid_eq(current_euid(), current_uid()) && gid_eq(current_egid(), current_gid()))
                 set_dumpable(current->mm, 1);
         else
                 set_dumpable(current->mm, suid_dumpable);
@@ -1151,8 +1153,8 @@ void setup_new_exec(struct linux_binprm * bprm)
         current->mm->task_size = TASK_SIZE;
 
         /* install the new credentials */
-        if (bprm->cred->uid != current_euid() ||
-            bprm->cred->gid != current_egid()) {
+        if (!uid_eq(bprm->cred->uid, current_euid()) ||
+            !gid_eq(bprm->cred->gid, current_egid())) {
                 current->pdeath_signal = 0;
         } else {
                 would_dump(bprm, bprm->file);
@@ -1243,6 +1245,13 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
                         bprm->unsafe |= LSM_UNSAFE_PTRACE;
         }
 
+        /*
+         * This isn't strictly necessary, but it makes it harder for LSMs to
+         * mess up.
+         */
+        if (current->no_new_privs)
+                bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;
+
         n_fs = 1;
         spin_lock(&p->fs->lock);
         rcu_read_lock();
@@ -1286,11 +1295,15 @@ int prepare_binprm(struct linux_binprm *bprm)
         bprm->cred->euid = current_euid();
         bprm->cred->egid = current_egid();
 
-        if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
+        if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&
+            !current->no_new_privs) {
                 /* Set-uid? */
                 if (mode & S_ISUID) {
+                        if (!kuid_has_mapping(bprm->cred->user_ns, inode->i_uid))
+                                return -EPERM;
                         bprm->per_clear |= PER_CLEAR_ON_SETID;
                         bprm->cred->euid = inode->i_uid;
+
                 }
 
                 /* Set-gid? */
@@ -1300,6 +1313,8 @@ int prepare_binprm(struct linux_binprm *bprm)
                  * executable.
                  */
                 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
+                        if (!kgid_has_mapping(bprm->cred->user_ns, inode->i_gid))
+                                return -EPERM;
                         bprm->per_clear |= PER_CLEAR_ON_SETID;
                         bprm->cred->egid = inode->i_gid;
                 }
@@ -1339,13 +1354,13 @@ int remove_arg_zero(struct linux_binprm *bprm)
                         ret = -EFAULT;
                         goto out;
                 }
-                kaddr = kmap_atomic(page, KM_USER0);
+                kaddr = kmap_atomic(page);
 
                 for (; offset < PAGE_SIZE && kaddr[offset];
                                 offset++, bprm->p++)
                         ;
 
-                kunmap_atomic(kaddr, KM_USER0);
+                kunmap_atomic(kaddr);
                 put_arg_page(page);
 
                 if (offset == PAGE_SIZE)
@@ -1369,7 +1384,7 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
         unsigned int depth = bprm->recursion_depth;
         int try,retval;
         struct linux_binfmt *fmt;
-        pid_t old_pid;
+        pid_t old_pid, old_vpid;
 
         retval = security_bprm_check(bprm);
         if (retval)
@@ -1380,8 +1395,9 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
                 return retval;
 
         /* Need to fetch pid before load_binary changes it */
+        old_pid = current->pid;
         rcu_read_lock();
-        old_pid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
+        old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
         rcu_read_unlock();
 
         retval = -ENOENT;
@@ -1402,9 +1418,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
                          */
                         bprm->recursion_depth = depth;
                         if (retval >= 0) {
-                                if (depth == 0)
-                                        ptrace_event(PTRACE_EVENT_EXEC,
-                                                        old_pid);
+                                if (depth == 0) {
+                                        trace_sched_process_exec(current, old_pid, bprm);
+                                        ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
+                                }
                                 put_binfmt(fmt);
                                 allow_write_access(bprm->file);
                                 if (bprm->file)
@@ -1926,8 +1943,21 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
                 core_waiters = zap_threads(tsk, mm, core_state, exit_code);
         up_write(&mm->mmap_sem);
 
-        if (core_waiters > 0)
+        if (core_waiters > 0) {
+                struct core_thread *ptr;
+
                 wait_for_completion(&core_state->startup);
+                /*
+                 * Wait for all the threads to become inactive, so that
+                 * all the thread context (extended register state, like
+                 * fpu etc) gets copied to the memory.
+                 */
+                ptr = core_state->dumper.next;
+                while (ptr != NULL) {
+                        wait_task_inactive(ptr->task, 0);
+                        ptr = ptr->next;
+                }
+        }
 
         return core_waiters;
 }
@@ -2064,8 +2094,8 @@ static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
         fd_install(0, rp);
         spin_lock(&cf->file_lock);
         fdt = files_fdtable(cf);
-        FD_SET(0, fdt->open_fds);
-        FD_CLR(0, fdt->close_on_exec);
+        __set_open_fd(0, fdt);
+        __clear_close_on_exec(0, fdt);
         spin_unlock(&cf->file_lock);
 
         /* and disallow core files too */
@@ -2117,7 +2147,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
         if (__get_dumpable(cprm.mm_flags) == 2) {
                 /* Setuid core dump mode */
                 flag = O_EXCL;          /* Stop rewrite attacks */
-                cred->fsuid = 0;        /* Dump root private */
+                cred->fsuid = GLOBAL_ROOT_UID;  /* Dump root private */
         }
 
         retval = coredump_wait(exit_code, &core_state);
@@ -2218,7 +2248,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
                  * Dont allow local users get cute and trick others to coredump
                  * into their pre-created files.
                  */
-                if (inode->i_uid != current_fsuid())
+                if (!uid_eq(inode->i_uid, current_fsuid()))
                         goto close_fail;
                 if (!cprm.file->f_op || !cprm.file->f_op->write)
                         goto close_fail;