1 files changed, 88 insertions, 31 deletions

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8e4addaa5424..f3d02ca461ec 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -226,7 +226,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
 {
         struct mm_struct *mm;
 
-        if (mutex_lock_killable(&task->cred_guard_mutex))
+        if (mutex_lock_killable(&task->signal->cred_guard_mutex))
                 return NULL;
 
         mm = get_task_mm(task);
@@ -235,7 +235,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
                 mmput(mm);
                 mm = NULL;
         }
-        mutex_unlock(&task->cred_guard_mutex);
+        mutex_unlock(&task->signal->cred_guard_mutex);
 
         return mm;
 }
@@ -771,6 +771,8 @@ static const struct file_operations proc_single_file_operations = {
 static int mem_open(struct inode* inode, struct file* file)
 {
         file->private_data = (void*)((long)current->self_exec_id);
+        /* OK to pass negative loff_t, we can catch out-of-range */
+        file->f_mode |= FMODE_UNSIGNED_OFFSET;
         return 0;
 }
 
@@ -1023,28 +1025,47 @@ static ssize_t oom_adjust_write(struct file *file, const char __user *buf,
         memset(buffer, 0, sizeof(buffer));
         if (count > sizeof(buffer) - 1)
                 count = sizeof(buffer) - 1;
-        if (copy_from_user(buffer, buf, count))
-                return -EFAULT;
+        if (copy_from_user(buffer, buf, count)) {
+                err = -EFAULT;
+                goto out;
+        }
 
         err = strict_strtol(strstrip(buffer), 0, &oom_adjust);
         if (err)
-                return -EINVAL;
+                goto out;
         if ((oom_adjust < OOM_ADJUST_MIN || oom_adjust > OOM_ADJUST_MAX) &&
-             oom_adjust != OOM_DISABLE)
-                return -EINVAL;
+             oom_adjust != OOM_DISABLE) {
+                err = -EINVAL;
+                goto out;
+        }
 
         task = get_proc_task(file->f_path.dentry->d_inode);
-        if (!task)
-                return -ESRCH;
+        if (!task) {
+                err = -ESRCH;
+                goto out;
+        }
+
+        task_lock(task);
+        if (!task->mm) {
+                err = -EINVAL;
+                goto err_task_lock;
+        }
+
         if (!lock_task_sighand(task, &flags)) {
-                put_task_struct(task);
-                return -ESRCH;
+                err = -ESRCH;
+                goto err_task_lock;
         }
 
         if (oom_adjust < task->signal->oom_adj && !capable(CAP_SYS_RESOURCE)) {
-                unlock_task_sighand(task, &flags);
-                put_task_struct(task);
-                return -EACCES;
+                err = -EACCES;
+                goto err_sighand;
+        }
+
+        if (oom_adjust != task->signal->oom_adj) {
+                if (oom_adjust == OOM_DISABLE)
+                        atomic_inc(&task->mm->oom_disable_count);
+                if (task->signal->oom_adj == OOM_DISABLE)
+                        atomic_dec(&task->mm->oom_disable_count);
         }
 
         /*
@@ -1065,10 +1086,13 @@ static ssize_t oom_adjust_write(struct file *file, const char __user *buf,
         else
                 task->signal->oom_score_adj = (oom_adjust * OOM_SCORE_ADJ_MAX) /
                                                                 -OOM_DISABLE;
+err_sighand:
         unlock_task_sighand(task, &flags);
+err_task_lock:
+        task_unlock(task);
         put_task_struct(task);
-
-        return count;
+out:
+        return err < 0 ? err : count;
 }
 
 static const struct file_operations proc_oom_adjust_operations = {
@@ -1109,30 +1133,49 @@ static ssize_t oom_score_adj_write(struct file *file, const char __user *buf,
         memset(buffer, 0, sizeof(buffer));
         if (count > sizeof(buffer) - 1)
                 count = sizeof(buffer) - 1;
-        if (copy_from_user(buffer, buf, count))
-                return -EFAULT;
+        if (copy_from_user(buffer, buf, count)) {
+                err = -EFAULT;
+                goto out;
+        }
 
         err = strict_strtol(strstrip(buffer), 0, &oom_score_adj);
         if (err)
-                return -EINVAL;
+                goto out;
         if (oom_score_adj < OOM_SCORE_ADJ_MIN ||
-                        oom_score_adj > OOM_SCORE_ADJ_MAX)
-                return -EINVAL;
+                        oom_score_adj > OOM_SCORE_ADJ_MAX) {
+                err = -EINVAL;
+                goto out;
+        }
 
         task = get_proc_task(file->f_path.dentry->d_inode);
-        if (!task)
-                return -ESRCH;
+        if (!task) {
+                err = -ESRCH;
+                goto out;
+        }
+
+        task_lock(task);
+        if (!task->mm) {
+                err = -EINVAL;
+                goto err_task_lock;
+        }
+
         if (!lock_task_sighand(task, &flags)) {
-                put_task_struct(task);
-                return -ESRCH;
+                err = -ESRCH;
+                goto err_task_lock;
         }
+
         if (oom_score_adj < task->signal->oom_score_adj &&
                         !capable(CAP_SYS_RESOURCE)) {
-                unlock_task_sighand(task, &flags);
-                put_task_struct(task);
-                return -EACCES;
+                err = -EACCES;
+                goto err_sighand;
         }
 
+        if (oom_score_adj != task->signal->oom_score_adj) {
+                if (oom_score_adj == OOM_SCORE_ADJ_MIN)
+                        atomic_inc(&task->mm->oom_disable_count);
+                if (task->signal->oom_score_adj == OOM_SCORE_ADJ_MIN)
+                        atomic_dec(&task->mm->oom_disable_count);
+        }
         task->signal->oom_score_adj = oom_score_adj;
         /*
          * Scale /proc/pid/oom_adj appropriately ensuring that OOM_DISABLE is
@@ -1143,14 +1186,19 @@ static ssize_t oom_score_adj_write(struct file *file, const char __user *buf,
         else
                 task->signal->oom_adj = (oom_score_adj * OOM_ADJUST_MAX) /
                                                         OOM_SCORE_ADJ_MAX;
+err_sighand:
         unlock_task_sighand(task, &flags);
+err_task_lock:
+        task_unlock(task);
         put_task_struct(task);
-        return count;
+out:
+        return err < 0 ? err : count;
 }
 
 static const struct file_operations proc_oom_score_adj_operations = {
         .read           = oom_score_adj_read,
         .write          = oom_score_adj_write,
+        .llseek         = default_llseek,
 };
 
 #ifdef CONFIG_AUDITSYSCALL
@@ -1600,6 +1648,7 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st
 
         /* Common stuff */
         ei = PROC_I(inode);
+        inode->i_ino = get_next_ino();
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
         inode->i_op = &proc_def_inode_operations;
 
@@ -2039,11 +2088,13 @@ static ssize_t proc_fdinfo_read(struct file *file, char __user *buf,
 static const struct file_operations proc_fdinfo_file_operations = {
         .open           = nonseekable_open,
         .read           = proc_fdinfo_read,
+        .llseek         = no_llseek,
 };
 
 static const struct file_operations proc_fd_operations = {
         .read           = generic_read_dir,
         .readdir        = proc_readfd,
+        .llseek         = default_llseek,
 };
 
 /*
@@ -2112,6 +2163,7 @@ static int proc_readfdinfo(struct file *filp, void *dirent, filldir_t filldir)
 static const struct file_operations proc_fdinfo_operations = {
         .read           = generic_read_dir,
         .readdir        = proc_readfdinfo,
+        .llseek         = default_llseek,
 };
 
 /*
@@ -2302,14 +2354,14 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
                 goto out_free;
 
         /* Guard against adverse ptrace interaction */
-        length = mutex_lock_interruptible(&task->cred_guard_mutex);
+        length = mutex_lock_interruptible(&task->signal->cred_guard_mutex);
         if (length < 0)
                 goto out_free;
 
         length = security_setprocattr(task,
                                       (char*)file->f_path.dentry->d_name.name,
                                       (void*)page, count);
-        mutex_unlock(&task->cred_guard_mutex);
+        mutex_unlock(&task->signal->cred_guard_mutex);
 out_free:
         free_page((unsigned long) page);
 out:
@@ -2343,6 +2395,7 @@ static int proc_attr_dir_readdir(struct file * filp,
 static const struct file_operations proc_attr_dir_operations = {
         .read           = generic_read_dir,
         .readdir        = proc_attr_dir_readdir,
+        .llseek         = default_llseek,
 };
 
 static struct dentry *proc_attr_dir_lookup(struct inode *dir,
@@ -2542,6 +2595,7 @@ static struct dentry *proc_base_instantiate(struct inode *dir,
 
         /* Initialize the inode */
         ei = PROC_I(inode);
+        inode->i_ino = get_next_ino();
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
 
         /*
@@ -2751,6 +2805,7 @@ static int proc_tgid_base_readdir(struct file * filp,
 static const struct file_operations proc_tgid_base_operations = {
         .read           = generic_read_dir,
         .readdir        = proc_tgid_base_readdir,
+        .llseek         = default_llseek,
 };
 
 static struct dentry *proc_tgid_base_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd){
@@ -3088,6 +3143,7 @@ static struct dentry *proc_tid_base_lookup(struct inode *dir, struct dentry *den
 static const struct file_operations proc_tid_base_operations = {
         .read           = generic_read_dir,
         .readdir        = proc_tid_base_readdir,
+        .llseek         = default_llseek,
 };
 
 static const struct inode_operations proc_tid_base_inode_operations = {
@@ -3324,4 +3380,5 @@ static const struct inode_operations proc_task_inode_operations = {
 static const struct file_operations proc_task_operations = {
         .read           = generic_read_dir,
         .readdir        = proc_task_readdir,
+        .llseek         = default_llseek,
 };