1 files changed, 39 insertions, 35 deletions

diff --git a/kernel/sched.c b/kernel/sched.c
index 5c848fd4e461..74f169ac0773 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -1755,27 +1755,27 @@ static inline void finish_task_switch(struct rq *rq, struct task_struct *prev)
         __releases(rq->lock)
 {
         struct mm_struct *mm = rq->prev_mm;
-        unsigned long prev_task_flags;
+        long prev_state;
 
         rq->prev_mm = NULL;
 
         /*
          * A task struct has one reference for the use as "current".
-         * If a task dies, then it sets EXIT_ZOMBIE in tsk->exit_state and
-         * calls schedule one last time. The schedule call will never return,
-         * and the scheduled task must drop that reference.
-         * The test for EXIT_ZOMBIE must occur while the runqueue locks are
+         * If a task dies, then it sets TASK_DEAD in tsk->state and calls
+         * schedule one last time. The schedule call will never return, and
+         * the scheduled task must drop that reference.
+         * The test for TASK_DEAD must occur while the runqueue locks are
          * still held, otherwise prev could be scheduled on another cpu, die
          * there before we look at prev->state, and then the reference would
          * be dropped twice.
          *              Manfred Spraul <manfred@colorfullife.com>
          */
-        prev_task_flags = prev->flags;
+        prev_state = prev->state;
         finish_arch_switch(prev);
         finish_lock_switch(rq, prev);
         if (mm)
                 mmdrop(mm);
-        if (unlikely(prev_task_flags & PF_DEAD)) {
+        if (unlikely(prev_state == TASK_DEAD)) {
                 /*
                  * Remove function-return probe instances associated with this
                  * task and put them back on the free list.
@@ -3348,9 +3348,6 @@ need_resched_nonpreemptible:
 
         spin_lock_irq(&rq->lock);
 
-        if (unlikely(prev->flags & PF_DEAD))
-                prev->state = EXIT_DEAD;
-
         switch_count = &prev->nivcsw;
         if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
                 switch_count = &prev->nvcsw;
@@ -4080,6 +4077,8 @@ static void __setscheduler(struct task_struct *p, int policy, int prio)
  * @p: the task in question.
  * @policy: new policy.
  * @param: structure containing the new RT priority.
+ *
+ * NOTE: the task may be already dead
  */
 int sched_setscheduler(struct task_struct *p, int policy,
                        struct sched_param *param)
@@ -4107,28 +4106,32 @@ recheck:
             (p->mm && param->sched_priority > MAX_USER_RT_PRIO-1) ||
             (!p->mm && param->sched_priority > MAX_RT_PRIO-1))
                 return -EINVAL;
-        if ((policy == SCHED_NORMAL || policy == SCHED_BATCH)
-                                        != (param->sched_priority == 0))
+        if (is_rt_policy(policy) != (param->sched_priority != 0))
                 return -EINVAL;
 
         /*
          * Allow unprivileged RT tasks to decrease priority:
          */
         if (!capable(CAP_SYS_NICE)) {
-                /*
-                 * can't change policy, except between SCHED_NORMAL
-                 * and SCHED_BATCH:
-                 */
-                if (((policy != SCHED_NORMAL && p->policy != SCHED_BATCH) &&
-                        (policy != SCHED_BATCH && p->policy != SCHED_NORMAL)) &&
-                                !p->signal->rlim[RLIMIT_RTPRIO].rlim_cur)
-                        return -EPERM;
-                /* can't increase priority */
-                if ((policy != SCHED_NORMAL && policy != SCHED_BATCH) &&
-                    param->sched_priority > p->rt_priority &&
-                    param->sched_priority >
-                                p->signal->rlim[RLIMIT_RTPRIO].rlim_cur)
-                        return -EPERM;
+                if (is_rt_policy(policy)) {
+                        unsigned long rlim_rtprio;
+                        unsigned long flags;
+
+                        if (!lock_task_sighand(p, &flags))
+                                return -ESRCH;
+                        rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
+                        unlock_task_sighand(p, &flags);
+
+                        /* can't set/change the rt policy */
+                        if (policy != p->policy && !rlim_rtprio)
+                                return -EPERM;
+
+                        /* can't increase priority */
+                        if (param->sched_priority > p->rt_priority &&
+                            param->sched_priority > rlim_rtprio)
+                                return -EPERM;
+                }
+
                 /* can't change other user's priorities */
                 if ((current->euid != p->euid) &&
                     (current->euid != p->uid))
@@ -4193,14 +4196,13 @@ do_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
                 return -EINVAL;
         if (copy_from_user(&lparam, param, sizeof(struct sched_param)))
                 return -EFAULT;
-        read_lock_irq(&tasklist_lock);
+
+        rcu_read_lock();
+        retval = -ESRCH;
         p = find_process_by_pid(pid);
-        if (!p) {
-                read_unlock_irq(&tasklist_lock);
-                return -ESRCH;
-        }
-        retval = sched_setscheduler(p, policy, &lparam);
-        read_unlock_irq(&tasklist_lock);
+        if (p != NULL)
+                retval = sched_setscheduler(p, policy, &lparam);
+        rcu_read_unlock();
 
         return retval;
 }
@@ -5151,7 +5153,7 @@ static void migrate_dead(unsigned int dead_cpu, struct task_struct *p)
         BUG_ON(p->exit_state != EXIT_ZOMBIE && p->exit_state != EXIT_DEAD);
 
         /* Cannot have done final schedule yet: would have vanished. */
-        BUG_ON(p->flags & PF_DEAD);
+        BUG_ON(p->state == TASK_DEAD);
 
         get_task_struct(p);
 
@@ -5272,9 +5274,11 @@ static struct notifier_block __cpuinitdata migration_notifier = {
 int __init migration_init(void)
 {
         void *cpu = (void *)(long)smp_processor_id();
+        int err;
 
         /* Start one for the boot CPU: */
-        migration_call(&migration_notifier, CPU_UP_PREPARE, cpu);
+        err = migration_call(&migration_notifier, CPU_UP_PREPARE, cpu);
+        BUG_ON(err == NOTIFY_BAD);
         migration_call(&migration_notifier, CPU_ONLINE, cpu);
         register_cpu_notifier(&migration_notifier);