8 files changed, 233 insertions, 147 deletions

diff --git a/fs/proc/array.c b/fs/proc/array.c
index 7c99c1cf7e5c..5e4f776b0917 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -489,8 +489,8 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 vsize,
                 mm ? get_mm_rss(mm) : 0,
                 rsslim,
-                mm ? mm->start_code : 0,
-                mm ? mm->end_code : 0,
+                mm ? (permitted ? mm->start_code : 1) : 0,
+                mm ? (permitted ? mm->end_code : 1) : 0,
                 (permitted && mm) ? mm->start_stack : 0,
                 esp,
                 eip,
diff --git a/fs/proc/base.c b/fs/proc/base.c
index d49c4b5d2c3e..dfa532730e55 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -191,17 +191,20 @@ static int proc_root_link(struct inode *inode, struct path *path)
         return result;
 }
 
-/*
- * Return zero if current may access user memory in @task, -error if not.
- */
-static int check_mem_permission(struct task_struct *task)
+static struct mm_struct *__check_mem_permission(struct task_struct *task)
 {
+        struct mm_struct *mm;
+
+        mm = get_task_mm(task);
+        if (!mm)
+                return ERR_PTR(-EINVAL);
+
         /*
          * A task can always look at itself, in case it chooses
          * to use system calls instead of load instructions.
          */
         if (task == current)
-                return 0;
+                return mm;
 
         /*
          * If current is actively ptrace'ing, and would also be
@@ -213,27 +216,53 @@ static int check_mem_permission(struct task_struct *task)
                 match = (tracehook_tracer_task(task) == current);
                 rcu_read_unlock();
                 if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
-                        return 0;
+                        return mm;
         }
 
         /*
-         * Noone else is allowed.
+         * No one else is allowed.
+         */
+        mmput(mm);
+        return ERR_PTR(-EPERM);
+}
+
+/*
+ * If current may access user memory in @task return a reference to the
+ * corresponding mm, otherwise ERR_PTR.
+ */
+static struct mm_struct *check_mem_permission(struct task_struct *task)
+{
+        struct mm_struct *mm;
+        int err;
+
+        /*
+         * Avoid racing if task exec's as we might get a new mm but validate
+         * against old credentials.
          */
-        return -EPERM;
+        err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+        if (err)
+                return ERR_PTR(err);
+
+        mm = __check_mem_permission(task);
+        mutex_unlock(&task->signal->cred_guard_mutex);
+
+        return mm;
 }
 
 struct mm_struct *mm_for_maps(struct task_struct *task)
 {
         struct mm_struct *mm;
+        int err;
 
-        if (mutex_lock_killable(&task->signal->cred_guard_mutex))
-                return NULL;
+        err =  mutex_lock_killable(&task->signal->cred_guard_mutex);
+        if (err)
+                return ERR_PTR(err);
 
         mm = get_task_mm(task);
         if (mm && mm != current->mm &&
                         !ptrace_may_access(task, PTRACE_MODE_READ)) {
                 mmput(mm);
-                mm = NULL;
+                mm = ERR_PTR(-EACCES);
         }
         mutex_unlock(&task->signal->cred_guard_mutex);
 
@@ -279,9 +308,9 @@ out:
 
 static int proc_pid_auxv(struct task_struct *task, char *buffer)
 {
-        int res = 0;
-        struct mm_struct *mm = get_task_mm(task);
-        if (mm) {
+        struct mm_struct *mm = mm_for_maps(task);
+        int res = PTR_ERR(mm);
+        if (mm && !IS_ERR(mm)) {
                 unsigned int nwords = 0;
                 do {
                         nwords += 2;
@@ -318,6 +347,23 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
 }
 #endif /* CONFIG_KALLSYMS */
 
+static int lock_trace(struct task_struct *task)
+{
+        int err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+        if (err)
+                return err;
+        if (!ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
+                mutex_unlock(&task->signal->cred_guard_mutex);
+                return -EPERM;
+        }
+        return 0;
+}
+
+static void unlock_trace(struct task_struct *task)
+{
+        mutex_unlock(&task->signal->cred_guard_mutex);
+}
+
 #ifdef CONFIG_STACKTRACE
 
 #define MAX_STACK_TRACE_DEPTH   64
@@ -327,6 +373,7 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
 {
         struct stack_trace trace;
         unsigned long *entries;
+        int err;
         int i;
 
         entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL);
@@ -337,15 +384,20 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
         trace.max_entries       = MAX_STACK_TRACE_DEPTH;
         trace.entries           = entries;
         trace.skip              = 0;
-        save_stack_trace_tsk(task, &trace);
 
-        for (i = 0; i < trace.nr_entries; i++) {
-                seq_printf(m, "[<%p>] %pS\n",
-                           (void *)entries[i], (void *)entries[i]);
+        err = lock_trace(task);
+        if (!err) {
+                save_stack_trace_tsk(task, &trace);
+
+                for (i = 0; i < trace.nr_entries; i++) {
+                        seq_printf(m, "[<%pK>] %pS\n",
+                                   (void *)entries[i], (void *)entries[i]);
+                }
+                unlock_trace(task);
         }
         kfree(entries);
 
-        return 0;
+        return err;
 }
 #endif
 
@@ -508,18 +560,22 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
 {
         long nr;
         unsigned long args[6], sp, pc;
+        int res = lock_trace(task);
+        if (res)
+                return res;
 
         if (task_current_syscall(task, &nr, args, 6, &sp, &pc))
-                return sprintf(buffer, "running\n");
-
-        if (nr < 0)
-                return sprintf(buffer, "%ld 0x%lx 0x%lx\n", nr, sp, pc);
-
-        return sprintf(buffer,
+                res = sprintf(buffer, "running\n");
+        else if (nr < 0)
+                res = sprintf(buffer, "%ld 0x%lx 0x%lx\n", nr, sp, pc);
+        else
+                res = sprintf(buffer,
                        "%ld 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx\n",
                        nr,
                        args[0], args[1], args[2], args[3], args[4], args[5],
                        sp, pc);
+        unlock_trace(task);
+        return res;
 }
 #endif /* CONFIG_HAVE_ARCH_TRACEHOOK */
 
@@ -775,18 +831,14 @@ static ssize_t mem_read(struct file * file, char __user * buf,
         if (!task)
                 goto out_no_task;
 
-        if (check_mem_permission(task))
-                goto out;
-
         ret = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
                 goto out;
 
-        ret = 0;
- 
-        mm = get_task_mm(task);
-        if (!mm)
+        mm = check_mem_permission(task);
+        ret = PTR_ERR(mm);
+        if (IS_ERR(mm))
                 goto out_free;
 
         ret = -EIO;
@@ -800,8 +852,8 @@ static ssize_t mem_read(struct file * file, char __user * buf,
                 int this_len, retval;
 
                 this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
-                retval = access_process_vm(task, src, page, this_len, 0);
-                if (!retval || check_mem_permission(task)) {
+                retval = access_remote_vm(mm, src, page, this_len, 0);
+                if (!retval) {
                         if (!ret)
                                 ret = -EIO;
                         break;
@@ -829,10 +881,6 @@ out_no_task:
         return ret;
 }
 
-#define mem_write NULL
-
-#ifndef mem_write
-/* This is a security hazard */
 static ssize_t mem_write(struct file * file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
@@ -840,18 +888,25 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
         char *page;
         struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
         unsigned long dst = *ppos;
+        struct mm_struct *mm;
 
         copied = -ESRCH;
         if (!task)
                 goto out_no_task;
 
-        if (check_mem_permission(task))
-                goto out;
+        mm = check_mem_permission(task);
+        copied = PTR_ERR(mm);
+        if (IS_ERR(mm))
+                goto out_task;
+
+        copied = -EIO;
+        if (file->private_data != (void *)((long)current->self_exec_id))
+                goto out_mm;
 
         copied = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
-                goto out;
+                goto out_mm;
 
         copied = 0;
         while (count > 0) {
@@ -862,7 +917,7 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
                         copied = -EFAULT;
                         break;
                 }
-                retval = access_process_vm(task, dst, page, this_len, 1);
+                retval = access_remote_vm(mm, dst, page, this_len, 1);
                 if (!retval) {
                         if (!copied)
                                 copied = -EIO;
@@ -875,12 +930,13 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
         }
         *ppos = dst;
         free_page((unsigned long) page);
-out:
+out_mm:
+        mmput(mm);
+out_task:
         put_task_struct(task);
 out_no_task:
         return copied;
 }
-#endif
 
 loff_t mem_lseek(struct file *file, loff_t offset, int orig)
 {
@@ -917,20 +973,18 @@ static ssize_t environ_read(struct file *file, char __user *buf,
         if (!task)
                 goto out_no_task;
 
-        if (!ptrace_may_access(task, PTRACE_MODE_READ))
-                goto out;
-
         ret = -ENOMEM;
         page = (char *)__get_free_page(GFP_TEMPORARY);
         if (!page)
                 goto out;
 
-        ret = 0;
 
-        mm = get_task_mm(task);
-        if (!mm)
+        mm = mm_for_maps(task);
+        ret = PTR_ERR(mm);
+        if (!mm || IS_ERR(mm))
                 goto out_free;
 
+        ret = 0;
         while (count > 0) {
                 int this_len, retval, max_len;
 
@@ -2748,8 +2802,12 @@ static int proc_tgid_io_accounting(struct task_struct *task, char *buffer)
 static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
                                 struct pid *pid, struct task_struct *task)
 {
-        seq_printf(m, "%08x\n", task->personality);
-        return 0;
+        int err = lock_trace(task);
+        if (!err) {
+                seq_printf(m, "%08x\n", task->personality);
+                unlock_trace(task);
+        }
+        return err;
 }
 
 /*
@@ -2768,7 +2826,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         REG("environ",    S_IRUSR, proc_environ_operations),
         INF("auxv",       S_IRUSR, proc_pid_auxv),
         ONE("status",     S_IRUGO, proc_pid_status),
-        ONE("personality", S_IRUSR, proc_pid_personality),
+        ONE("personality", S_IRUGO, proc_pid_personality),
         INF("limits",     S_IRUGO, proc_pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
         REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
@@ -2778,7 +2836,7 @@ static const struct pid_entry tgid_base_stuff[] = {
 #endif
         REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-        INF("syscall",    S_IRUSR, proc_pid_syscall),
+        INF("syscall",    S_IRUGO, proc_pid_syscall),
 #endif
         INF("cmdline",    S_IRUGO, proc_pid_cmdline),
         ONE("stat",       S_IRUGO, proc_tgid_stat),
@@ -2797,7 +2855,7 @@ static const struct pid_entry tgid_base_stuff[] = {
 #ifdef CONFIG_PROC_PAGE_MONITOR
         REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
         REG("smaps",      S_IRUGO, proc_smaps_operations),
-        REG("pagemap",    S_IRUSR, proc_pagemap_operations),
+        REG("pagemap",    S_IRUGO, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
         DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
@@ -2806,7 +2864,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         INF("wchan",      S_IRUGO, proc_pid_wchan),
 #endif
 #ifdef CONFIG_STACKTRACE
-        ONE("stack",      S_IRUSR, proc_pid_stack),
+        ONE("stack",      S_IRUGO, proc_pid_stack),
 #endif
 #ifdef CONFIG_SCHEDSTATS
         INF("schedstat",  S_IRUGO, proc_pid_schedstat),
@@ -3066,11 +3124,16 @@ static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldi
 /* for the /proc/ directory itself, after non-process stuff has been done */
 int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
 {
-        unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
-        struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
+        unsigned int nr;
+        struct task_struct *reaper;
         struct tgid_iter iter;
         struct pid_namespace *ns;
 
+        if (filp->f_pos >= PID_MAX_LIMIT + TGID_OFFSET)
+                goto out_no_task;
+        nr = filp->f_pos - FIRST_PROCESS_ENTRY;
+
+        reaper = get_proc_task(filp->f_path.dentry->d_inode);
         if (!reaper)
                 goto out_no_task;
 
@@ -3108,14 +3171,14 @@ static const struct pid_entry tid_base_stuff[] = {
         REG("environ",   S_IRUSR, proc_environ_operations),
         INF("auxv",      S_IRUSR, proc_pid_auxv),
         ONE("status",    S_IRUGO, proc_pid_status),
-        ONE("personality", S_IRUSR, proc_pid_personality),
+        ONE("personality", S_IRUGO, proc_pid_personality),
         INF("limits",    S_IRUGO, proc_pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
         REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
 #endif
         REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-        INF("syscall",   S_IRUSR, proc_pid_syscall),
+        INF("syscall",   S_IRUGO, proc_pid_syscall),
 #endif
         INF("cmdline",   S_IRUGO, proc_pid_cmdline),
         ONE("stat",      S_IRUGO, proc_tid_stat),
@@ -3133,7 +3196,7 @@ static const struct pid_entry tid_base_stuff[] = {
 #ifdef CONFIG_PROC_PAGE_MONITOR
         REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
         REG("smaps",     S_IRUGO, proc_smaps_operations),
-        REG("pagemap",    S_IRUSR, proc_pagemap_operations),
+        REG("pagemap",    S_IRUGO, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
         DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
@@ -3142,7 +3205,7 @@ static const struct pid_entry tid_base_stuff[] = {
         INF("wchan",     S_IRUGO, proc_pid_wchan),
 #endif
 #ifdef CONFIG_STACKTRACE
-        ONE("stack",      S_IRUSR, proc_pid_stack),
+        ONE("stack",      S_IRUGO, proc_pid_stack),
 #endif
 #ifdef CONFIG_SCHEDSTATS
         INF("schedstat", S_IRUGO, proc_pid_schedstat),
@@ -3161,7 +3224,7 @@ static const struct pid_entry tid_base_stuff[] = {
         REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),
 #ifdef CONFIG_AUDITSYSCALL
         REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
-        REG("sessionid",  S_IRUSR, proc_sessionid_operations),
+        REG("sessionid",  S_IRUGO, proc_sessionid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
         REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 01e07f2a188f..f1281339b6fa 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -28,7 +28,7 @@
 
 DEFINE_SPINLOCK(proc_subdir_lock);
 
-static int proc_match(int len, const char *name, struct proc_dir_entry *de)
+static int proc_match(unsigned int len, const char *name, struct proc_dir_entry *de)
 {
         if (de->namelen != len)
                 return 0;
@@ -303,7 +303,7 @@ static int __xlate_proc_name(const char *name, struct proc_dir_entry **ret,
 {
         const char              *cp = name, *next;
         struct proc_dir_entry   *de;
-        int                     len;
+        unsigned int            len;
 
         de = *ret;
         if (!de)
@@ -602,7 +602,7 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
 {
         struct proc_dir_entry *ent = NULL;
         const char *fn = name;
-        int len;
+        unsigned int len;
 
         /* make sure name is valid */
         if (!name || !strlen(name)) goto out;
@@ -786,7 +786,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
         struct proc_dir_entry **p;
         struct proc_dir_entry *de = NULL;
         const char *fn = name;
-        int len;
+        unsigned int len;
 
         spin_lock(&proc_subdir_lock);
         if (__xlate_proc_name(name, &parent, &fn) != 0) {
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index d6a7ca1fdac5..d15aa1b1cc8f 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -46,8 +46,6 @@ static void proc_evict_inode(struct inode *inode)
         }
 }
 
-struct vfsmount *proc_mnt;
-
 static struct kmem_cache * proc_inode_cachep;
 
 static struct inode *proc_alloc_inode(struct super_block *sb)
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 9ad561ded409..c03e8d3a3a5b 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -107,7 +107,6 @@ static inline struct proc_dir_entry *pde_get(struct proc_dir_entry *pde)
 }
 void pde_put(struct proc_dir_entry *pde);
 
-extern struct vfsmount *proc_mnt;
 int proc_fill_super(struct super_block *);
 struct inode *proc_get_inode(struct super_block *, struct proc_dir_entry *);
 
diff --git a/fs/proc/root.c b/fs/proc/root.c
index ef9fa8e24ad6..a9000e9cfee5 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -43,17 +43,6 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
         struct pid_namespace *ns;
         struct proc_inode *ei;
 
-        if (proc_mnt) {
-                /* Seed the root directory with a pid so it doesn't need
-                 * to be special in base.c.  I would do this earlier but
-                 * the only task alive when /proc is mounted the first time
-                 * is the init_task and it doesn't have any pids.
-                 */
-                ei = PROC_I(proc_mnt->mnt_sb->s_root->d_inode);
-                if (!ei->pid)
-                        ei->pid = find_get_pid(1);
-        }
-
         if (flags & MS_KERNMOUNT)
                 ns = (struct pid_namespace *)data;
         else
@@ -71,16 +60,16 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
                         return ERR_PTR(err);
                 }
 
-                ei = PROC_I(sb->s_root->d_inode);
-                if (!ei->pid) {
-                        rcu_read_lock();
-                        ei->pid = get_pid(find_pid_ns(1, ns));
-                        rcu_read_unlock();
-                }
-
                 sb->s_flags |= MS_ACTIVE;
         }
 
+        ei = PROC_I(sb->s_root->d_inode);
+        if (!ei->pid) {
+                rcu_read_lock();
+                ei->pid = get_pid(find_pid_ns(1, ns));
+                rcu_read_unlock();
+        }
+
         return dget(sb->s_root);
 }
 
@@ -101,19 +90,20 @@ static struct file_system_type proc_fs_type = {
 
 void __init proc_root_init(void)
 {
+        struct vfsmount *mnt;
         int err;
 
         proc_init_inodecache();
         err = register_filesystem(&proc_fs_type);
         if (err)
                 return;
-        proc_mnt = kern_mount_data(&proc_fs_type, &init_pid_ns);
-        if (IS_ERR(proc_mnt)) {
+        mnt = kern_mount_data(&proc_fs_type, &init_pid_ns);
+        if (IS_ERR(mnt)) {
                 unregister_filesystem(&proc_fs_type);
                 return;
         }
 
-        init_pid_ns.proc_mnt = proc_mnt;
+        init_pid_ns.proc_mnt = mnt;
         proc_symlink("mounts", NULL, "self/mounts");
 
         proc_net_init();
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 60b914860f81..2e7addfd9803 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1,5 +1,6 @@
 #include <linux/mm.h>
 #include <linux/hugetlb.h>
+#include <linux/huge_mm.h>
 #include <linux/mount.h>
 #include <linux/seq_file.h>
 #include <linux/highmem.h>
@@ -7,6 +8,7 @@
 #include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/mempolicy.h>
+#include <linux/rmap.h>
 #include <linux/swap.h>
 #include <linux/swapops.h>
 
@@ -119,14 +121,14 @@ static void *m_start(struct seq_file *m, loff_t *pos)
 
         priv->task = get_pid_task(priv->pid, PIDTYPE_PID);
         if (!priv->task)
-                return NULL;
+                return ERR_PTR(-ESRCH);
 
         mm = mm_for_maps(priv->task);
-        if (!mm)
-                return NULL;
+        if (!mm || IS_ERR(mm))
+                return mm;
         down_read(&mm->mmap_sem);
 
-        tail_vma = get_gate_vma(priv->task);
+        tail_vma = get_gate_vma(priv->task->mm);
         priv->tail_vma = tail_vma;
 
         /* Start with last addr hint */
@@ -180,7 +182,8 @@ static void m_stop(struct seq_file *m, void *v)
         struct proc_maps_private *priv = m->private;
         struct vm_area_struct *vma = v;
 
-        vma_stop(priv, vma);
+        if (!IS_ERR(vma))
+                vma_stop(priv, vma);
         if (priv->task)
                 put_task_struct(priv->task);
 }
@@ -249,8 +252,8 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
                 const char *name = arch_vma_name(vma);
                 if (!name) {
                         if (mm) {
-                                if (vma->vm_start <= mm->start_brk &&
-                                                vma->vm_end >= mm->brk) {
+                                if (vma->vm_start <= mm->brk &&
+                                                vma->vm_end >= mm->start_brk) {
                                         name = "[heap]";
                                 } else if (vma->vm_start <= mm->start_stack &&
                                            vma->vm_end >= mm->start_stack) {
@@ -277,7 +280,8 @@ static int show_map(struct seq_file *m, void *v)
         show_map_vma(m, vma);
 
         if (m->count < m->size)  /* vma is copied successfully */
-                m->version = (vma != get_gate_vma(task))? vma->vm_start: 0;
+                m->version = (vma != get_gate_vma(task->mm))
+                        ? vma->vm_start : 0;
         return 0;
 }
 
@@ -329,58 +333,86 @@ struct mem_size_stats {
         unsigned long private_dirty;
         unsigned long referenced;
         unsigned long anonymous;
+        unsigned long anonymous_thp;
         unsigned long swap;
         u64 pss;
 };
 
-static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
-                           struct mm_walk *walk)
+
+static void smaps_pte_entry(pte_t ptent, unsigned long addr,
+                unsigned long ptent_size, struct mm_walk *walk)
 {
         struct mem_size_stats *mss = walk->private;
         struct vm_area_struct *vma = mss->vma;
-        pte_t *pte, ptent;
-        spinlock_t *ptl;
         struct page *page;
         int mapcount;
 
-        pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
-        for (; addr != end; pte++, addr += PAGE_SIZE) {
-                ptent = *pte;
-
-                if (is_swap_pte(ptent)) {
-                        mss->swap += PAGE_SIZE;
-                        continue;
-                }
+        if (is_swap_pte(ptent)) {
+                mss->swap += ptent_size;
+                return;
+        }
 
-                if (!pte_present(ptent))
-                        continue;
+        if (!pte_present(ptent))
+                return;
+
+        page = vm_normal_page(vma, addr, ptent);
+        if (!page)
+                return;
+
+        if (PageAnon(page))
+                mss->anonymous += ptent_size;
+
+        mss->resident += ptent_size;
+        /* Accumulate the size in pages that have been accessed. */
+        if (pte_young(ptent) || PageReferenced(page))
+                mss->referenced += ptent_size;
+        mapcount = page_mapcount(page);
+        if (mapcount >= 2) {
+                if (pte_dirty(ptent) || PageDirty(page))
+                        mss->shared_dirty += ptent_size;
+                else
+                        mss->shared_clean += ptent_size;
+                mss->pss += (ptent_size << PSS_SHIFT) / mapcount;
+        } else {
+                if (pte_dirty(ptent) || PageDirty(page))
+                        mss->private_dirty += ptent_size;
+                else
+                        mss->private_clean += ptent_size;
+                mss->pss += (ptent_size << PSS_SHIFT);
+        }
+}
 
-                page = vm_normal_page(vma, addr, ptent);
-                if (!page)
-                        continue;
+static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+                           struct mm_walk *walk)
+{
+        struct mem_size_stats *mss = walk->private;
+        struct vm_area_struct *vma = mss->vma;
+        pte_t *pte;
+        spinlock_t *ptl;
 
-                if (PageAnon(page))
-                        mss->anonymous += PAGE_SIZE;
-
-                mss->resident += PAGE_SIZE;
-                /* Accumulate the size in pages that have been accessed. */
-                if (pte_young(ptent) || PageReferenced(page))
-                        mss->referenced += PAGE_SIZE;
-                mapcount = page_mapcount(page);
-                if (mapcount >= 2) {
-                        if (pte_dirty(ptent) || PageDirty(page))
-                                mss->shared_dirty += PAGE_SIZE;
-                        else
-                                mss->shared_clean += PAGE_SIZE;
-                        mss->pss += (PAGE_SIZE << PSS_SHIFT) / mapcount;
+        spin_lock(&walk->mm->page_table_lock);
+        if (pmd_trans_huge(*pmd)) {
+                if (pmd_trans_splitting(*pmd)) {
+                        spin_unlock(&walk->mm->page_table_lock);
+                        wait_split_huge_page(vma->anon_vma, pmd);
                 } else {
-                        if (pte_dirty(ptent) || PageDirty(page))
-                                mss->private_dirty += PAGE_SIZE;
-                        else
-                                mss->private_clean += PAGE_SIZE;
-                        mss->pss += (PAGE_SIZE << PSS_SHIFT);
+                        smaps_pte_entry(*(pte_t *)pmd, addr,
+                                        HPAGE_PMD_SIZE, walk);
+                        spin_unlock(&walk->mm->page_table_lock);
+                        mss->anonymous_thp += HPAGE_PMD_SIZE;
+                        return 0;
                 }
+        } else {
+                spin_unlock(&walk->mm->page_table_lock);
         }
+        /*
+         * The mmap_sem held all the way back in m_start() is what
+         * keeps khugepaged out of here and from collapsing things
+         * in here.
+         */
+        pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
+        for (; addr != end; pte++, addr += PAGE_SIZE)
+                smaps_pte_entry(*pte, addr, PAGE_SIZE, walk);
         pte_unmap_unlock(pte - 1, ptl);
         cond_resched();
         return 0;
@@ -416,6 +448,7 @@ static int show_smap(struct seq_file *m, void *v)
                    "Private_Dirty:  %8lu kB\n"
                    "Referenced:     %8lu kB\n"
                    "Anonymous:      %8lu kB\n"
+                   "AnonHugePages:  %8lu kB\n"
                    "Swap:           %8lu kB\n"
                    "KernelPageSize: %8lu kB\n"
                    "MMUPageSize:    %8lu kB\n"
@@ -429,6 +462,7 @@ static int show_smap(struct seq_file *m, void *v)
                    mss.private_dirty >> 10,
                    mss.referenced >> 10,
                    mss.anonymous >> 10,
+                   mss.anonymous_thp >> 10,
                    mss.swap >> 10,
                    vma_kernel_pagesize(vma) >> 10,
                    vma_mmu_pagesize(vma) >> 10,
@@ -436,7 +470,8 @@ static int show_smap(struct seq_file *m, void *v)
                         (unsigned long)(mss.pss >> (10 + PSS_SHIFT)) : 0);
 
         if (m->count < m->size)  /* vma is copied successfully */
-                m->version = (vma != get_gate_vma(task)) ? vma->vm_start : 0;
+                m->version = (vma != get_gate_vma(task->mm))
+                        ? vma->vm_start : 0;
         return 0;
 }
 
@@ -467,6 +502,8 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
         spinlock_t *ptl;
         struct page *page;
 
+        split_huge_page_pmd(walk->mm, pmd);
+
         pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
         for (; addr != end; pte++, addr += PAGE_SIZE) {
                 ptent = *pte;
@@ -623,6 +660,8 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
         pte_t *pte;
         int err = 0;
 
+        split_huge_page_pmd(walk->mm, pmd);
+
         /* find the first VMA at or above 'addr' */
         vma = find_vma(walk->mm, addr);
         for (; addr != end; addr += PAGE_SIZE) {
@@ -728,8 +767,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         if (!task)
                 goto out;
 
-        ret = -EACCES;
-        if (!ptrace_may_access(task, PTRACE_MODE_READ))
+        mm = mm_for_maps(task);
+        ret = PTR_ERR(mm);
+        if (!mm || IS_ERR(mm))
                 goto out_task;
 
         ret = -EINVAL;
@@ -742,10 +782,6 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         if (!count)
                 goto out_task;
 
-        mm = get_task_mm(task);
-        if (!mm)
-                goto out_task;
-
         pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
         pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);
         ret = -ENOMEM;
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index b535d3e5d5f1..980de547c070 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -199,13 +199,13 @@ static void *m_start(struct seq_file *m, loff_t *pos)
         /* pin the task and mm whilst we play with them */
         priv->task = get_pid_task(priv->pid, PIDTYPE_PID);
         if (!priv->task)
-                return NULL;
+                return ERR_PTR(-ESRCH);
 
         mm = mm_for_maps(priv->task);
-        if (!mm) {
+        if (!mm || IS_ERR(mm)) {
                 put_task_struct(priv->task);
                 priv->task = NULL;
-                return NULL;
+                return mm;
         }
         down_read(&mm->mmap_sem);