1 files changed, 13 insertions, 27 deletions

diff --git a/kernel/fork.c b/kernel/fork.c
index bf46287c91a4..086fe73ad6bd 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -351,7 +351,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
         struct rb_node **rb_link, *rb_parent;
         int retval;
         unsigned long charge;
-        struct mempolicy *pol;
 
         uprobe_start_dup_mmap();
         down_write(&oldmm->mmap_sem);
@@ -400,11 +399,9 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                         goto fail_nomem;
                 *tmp = *mpnt;
                 INIT_LIST_HEAD(&tmp->anon_vma_chain);
-                pol = mpol_dup(vma_policy(mpnt));
-                retval = PTR_ERR(pol);
-                if (IS_ERR(pol))
+                retval = vma_dup_policy(mpnt, tmp);
+                if (retval)
                         goto fail_nomem_policy;
-                vma_set_policy(tmp, pol);
                 tmp->vm_mm = mm;
                 if (anon_vma_fork(tmp, mpnt))
                         goto fail_nomem_anon_vma_fork;
@@ -472,7 +469,7 @@ out:
         uprobe_end_dup_mmap();
         return retval;
 fail_nomem_anon_vma_fork:
-        mpol_put(pol);
+        mpol_put(vma_policy(tmp));
 fail_nomem_policy:
         kmem_cache_free(vm_area_cachep, tmp);
 fail_nomem:
@@ -522,7 +519,7 @@ static void mm_init_aio(struct mm_struct *mm)
 {
 #ifdef CONFIG_AIO
         spin_lock_init(&mm->ioctx_lock);
-        INIT_HLIST_HEAD(&mm->ioctx_list);
+        mm->ioctx_table = NULL;
 #endif
 }
 
@@ -1173,13 +1170,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 return ERR_PTR(-EINVAL);
 
         /*
-         * If the new process will be in a different pid namespace
-         * don't allow the creation of threads.
+         * If the new process will be in a different pid or user namespace
+         * do not allow it to share a thread group or signal handlers or
+         * parent with the forking task.
          */
-        if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&
-            (task_active_pid_ns(current) !=
-             current->nsproxy->pid_ns_for_children))
-                return ERR_PTR(-EINVAL);
+        if (clone_flags & (CLONE_SIGHAND | CLONE_PARENT)) {
+                if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
+                    (task_active_pid_ns(current) !=
+                                current->nsproxy->pid_ns_for_children))
+                        return ERR_PTR(-EINVAL);
+        }
 
         retval = security_task_create(clone_flags);
         if (retval)
@@ -1576,15 +1576,6 @@ long do_fork(unsigned long clone_flags,
         long nr;
 
         /*
-         * Do some preliminary argument and permissions checking before we
-         * actually start allocating stuff
-         */
-        if (clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) {
-                if (clone_flags & (CLONE_THREAD|CLONE_PARENT))
-                        return -EINVAL;
-        }
-
-        /*
          * Determine whether and which event to report to ptracer.  When
          * called from kernel_thread or CLONE_UNTRACED is explicitly
          * requested, no event is reported; otherwise, report if the event
@@ -1825,11 +1816,6 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
         if (unshare_flags & CLONE_NEWUSER)
                 unshare_flags |= CLONE_THREAD | CLONE_FS;
         /*
-         * If unsharing a pid namespace must also unshare the thread.
-         */
-        if (unshare_flags & CLONE_NEWPID)
-                unshare_flags |= CLONE_THREAD;
-        /*
          * If unsharing a thread from a thread group, must also unshare vm.
          */
         if (unshare_flags & CLONE_THREAD)