1 files changed, 345 insertions, 158 deletions

diff --git a/kernel/sys.c b/kernel/sys.c
index e7006eb6c1e4..2d39a84cd857 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -36,6 +36,8 @@
 #include <linux/personality.h>
 #include <linux/ptrace.h>
 #include <linux/fs_struct.h>
+#include <linux/file.h>
+#include <linux/mount.h>
 #include <linux/gfp.h>
 #include <linux/syscore_ops.h>
 #include <linux/version.h>
@@ -93,10 +95,8 @@
 int overflowuid = DEFAULT_OVERFLOWUID;
 int overflowgid = DEFAULT_OVERFLOWGID;
 
-#ifdef CONFIG_UID16
 EXPORT_SYMBOL(overflowuid);
 EXPORT_SYMBOL(overflowgid);
-#endif
 
 /*
  * the same as above, but for filesystems which can only store a 16-bit
@@ -133,11 +133,10 @@ static bool set_one_prio_perm(struct task_struct *p)
 {
         const struct cred *cred = current_cred(), *pcred = __task_cred(p);
 
-        if (pcred->user->user_ns == cred->user->user_ns &&
-            (pcred->uid  == cred->euid ||
-             pcred->euid == cred->euid))
+        if (uid_eq(pcred->uid,  cred->euid) ||
+            uid_eq(pcred->euid, cred->euid))
                 return true;
-        if (ns_capable(pcred->user->user_ns, CAP_SYS_NICE))
+        if (ns_capable(pcred->user_ns, CAP_SYS_NICE))
                 return true;
         return false;
 }
@@ -177,6 +176,7 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
         const struct cred *cred = current_cred();
         int error = -EINVAL;
         struct pid *pgrp;
+        kuid_t uid;
 
         if (which > PRIO_USER || which < PRIO_PROCESS)
                 goto out;
@@ -209,18 +209,19 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
                         } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
                         break;
                 case PRIO_USER:
-                        user = (struct user_struct *) cred->user;
+                        uid = make_kuid(cred->user_ns, who);
+                        user = cred->user;
                         if (!who)
-                                who = cred->uid;
-                        else if ((who != cred->uid) &&
-                                 !(user = find_user(who)))
+                                uid = cred->uid;
+                        else if (!uid_eq(uid, cred->uid) &&
+                                 !(user = find_user(uid)))
                                 goto out_unlock;        /* No processes for this user */
 
                         do_each_thread(g, p) {
-                                if (__task_cred(p)->uid == who)
+                                if (uid_eq(task_uid(p), uid))
                                         error = set_one_prio(p, niceval, error);
                         } while_each_thread(g, p);
-                        if (who != cred->uid)
+                        if (!uid_eq(uid, cred->uid))
                                 free_uid(user);         /* For find_user() */
                         break;
         }
@@ -244,6 +245,7 @@ SYSCALL_DEFINE2(getpriority, int, which, int, who)
         const struct cred *cred = current_cred();
         long niceval, retval = -ESRCH;
         struct pid *pgrp;
+        kuid_t uid;
 
         if (which > PRIO_USER || which < PRIO_PROCESS)
                 return -EINVAL;
@@ -274,21 +276,22 @@ SYSCALL_DEFINE2(getpriority, int, which, int, who)
                         } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
                         break;
                 case PRIO_USER:
-                        user = (struct user_struct *) cred->user;
+                        uid = make_kuid(cred->user_ns, who);
+                        user = cred->user;
                         if (!who)
-                                who = cred->uid;
-                        else if ((who != cred->uid) &&
-                                 !(user = find_user(who)))
+                                uid = cred->uid;
+                        else if (!uid_eq(uid, cred->uid) &&
+                                 !(user = find_user(uid)))
                                 goto out_unlock;        /* No processes for this user */
 
                         do_each_thread(g, p) {
-                                if (__task_cred(p)->uid == who) {
+                                if (uid_eq(task_uid(p), uid)) {
                                         niceval = 20 - task_nice(p);
                                         if (niceval > retval)
                                                 retval = niceval;
                                 }
                         } while_each_thread(g, p);
-                        if (who != cred->uid)
+                        if (!uid_eq(uid, cred->uid))
                                 free_uid(user);         /* for find_user() */
                         break;
         }
@@ -553,9 +556,19 @@ void ctrl_alt_del(void)
  */
 SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
 {
+        struct user_namespace *ns = current_user_ns();
         const struct cred *old;
         struct cred *new;
         int retval;
+        kgid_t krgid, kegid;
+
+        krgid = make_kgid(ns, rgid);
+        kegid = make_kgid(ns, egid);
+
+        if ((rgid != (gid_t) -1) && !gid_valid(krgid))
+                return -EINVAL;
+        if ((egid != (gid_t) -1) && !gid_valid(kegid))
+                return -EINVAL;
 
         new = prepare_creds();
         if (!new)
@@ -564,25 +577,25 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
 
         retval = -EPERM;
         if (rgid != (gid_t) -1) {
-                if (old->gid == rgid ||
-                    old->egid == rgid ||
+                if (gid_eq(old->gid, krgid) ||
+                    gid_eq(old->egid, krgid) ||
                     nsown_capable(CAP_SETGID))
-                        new->gid = rgid;
+                        new->gid = krgid;
                 else
                         goto error;
         }
         if (egid != (gid_t) -1) {
-                if (old->gid == egid ||
-                    old->egid == egid ||
-                    old->sgid == egid ||
+                if (gid_eq(old->gid, kegid) ||
+                    gid_eq(old->egid, kegid) ||
+                    gid_eq(old->sgid, kegid) ||
                     nsown_capable(CAP_SETGID))
-                        new->egid = egid;
+                        new->egid = kegid;
                 else
                         goto error;
         }
 
         if (rgid != (gid_t) -1 ||
-            (egid != (gid_t) -1 && egid != old->gid))
+            (egid != (gid_t) -1 && !gid_eq(kegid, old->gid)))
                 new->sgid = new->egid;
         new->fsgid = new->egid;
 
@@ -600,9 +613,15 @@ error:
  */
 SYSCALL_DEFINE1(setgid, gid_t, gid)
 {
+        struct user_namespace *ns = current_user_ns();
         const struct cred *old;
         struct cred *new;
         int retval;
+        kgid_t kgid;
+
+        kgid = make_kgid(ns, gid);
+        if (!gid_valid(kgid))
+                return -EINVAL;
 
         new = prepare_creds();
         if (!new)
@@ -611,9 +630,9 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
 
         retval = -EPERM;
         if (nsown_capable(CAP_SETGID))
-                new->gid = new->egid = new->sgid = new->fsgid = gid;
-        else if (gid == old->gid || gid == old->sgid)
-                new->egid = new->fsgid = gid;
+                new->gid = new->egid = new->sgid = new->fsgid = kgid;
+        else if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->sgid))
+                new->egid = new->fsgid = kgid;
         else
                 goto error;
 
@@ -631,7 +650,7 @@ static int set_user(struct cred *new)
 {
         struct user_struct *new_user;
 
-        new_user = alloc_uid(current_user_ns(), new->uid);
+        new_user = alloc_uid(new->uid);
         if (!new_user)
                 return -EAGAIN;
 
@@ -670,9 +689,19 @@ static int set_user(struct cred *new)
  */
 SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
 {
+        struct user_namespace *ns = current_user_ns();
         const struct cred *old;
         struct cred *new;
         int retval;
+        kuid_t kruid, keuid;
+
+        kruid = make_kuid(ns, ruid);
+        keuid = make_kuid(ns, euid);
+
+        if ((ruid != (uid_t) -1) && !uid_valid(kruid))
+                return -EINVAL;
+        if ((euid != (uid_t) -1) && !uid_valid(keuid))
+                return -EINVAL;
 
         new = prepare_creds();
         if (!new)
@@ -681,29 +710,29 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
 
         retval = -EPERM;
         if (ruid != (uid_t) -1) {
-                new->uid = ruid;
-                if (old->uid != ruid &&
-                    old->euid != ruid &&
+                new->uid = kruid;
+                if (!uid_eq(old->uid, kruid) &&
+                    !uid_eq(old->euid, kruid) &&
                     !nsown_capable(CAP_SETUID))
                         goto error;
         }
 
         if (euid != (uid_t) -1) {
-                new->euid = euid;
-                if (old->uid != euid &&
-                    old->euid != euid &&
-                    old->suid != euid &&
+                new->euid = keuid;
+                if (!uid_eq(old->uid, keuid) &&
+                    !uid_eq(old->euid, keuid) &&
+                    !uid_eq(old->suid, keuid) &&
                     !nsown_capable(CAP_SETUID))
                         goto error;
         }
 
-        if (new->uid != old->uid) {
+        if (!uid_eq(new->uid, old->uid)) {
                 retval = set_user(new);
                 if (retval < 0)
                         goto error;
         }
         if (ruid != (uid_t) -1 ||
-            (euid != (uid_t) -1 && euid != old->uid))
+            (euid != (uid_t) -1 && !uid_eq(keuid, old->uid)))
                 new->suid = new->euid;
         new->fsuid = new->euid;
 
@@ -731,9 +760,15 @@ error:
  */
 SYSCALL_DEFINE1(setuid, uid_t, uid)
 {
+        struct user_namespace *ns = current_user_ns();
         const struct cred *old;
         struct cred *new;
         int retval;
+        kuid_t kuid;
+
+        kuid = make_kuid(ns, uid);
+        if (!uid_valid(kuid))
+                return -EINVAL;
 
         new = prepare_creds();
         if (!new)
@@ -742,17 +777,17 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
 
         retval = -EPERM;
         if (nsown_capable(CAP_SETUID)) {
-                new->suid = new->uid = uid;
-                if (uid != old->uid) {
+                new->suid = new->uid = kuid;
+                if (!uid_eq(kuid, old->uid)) {
                         retval = set_user(new);
                         if (retval < 0)
                                 goto error;
                 }
-        } else if (uid != old->uid && uid != new->suid) {
+        } else if (!uid_eq(kuid, old->uid) && !uid_eq(kuid, new->suid)) {
                 goto error;
         }
 
-        new->fsuid = new->euid = uid;
+        new->fsuid = new->euid = kuid;
 
         retval = security_task_fix_setuid(new, old, LSM_SETID_ID);
         if (retval < 0)
@@ -772,9 +807,24 @@ error:
  */
 SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
 {
+        struct user_namespace *ns = current_user_ns();
         const struct cred *old;
         struct cred *new;
         int retval;
+        kuid_t kruid, keuid, ksuid;
+
+        kruid = make_kuid(ns, ruid);
+        keuid = make_kuid(ns, euid);
+        ksuid = make_kuid(ns, suid);
+
+        if ((ruid != (uid_t) -1) && !uid_valid(kruid))
+                return -EINVAL;
+
+        if ((euid != (uid_t) -1) && !uid_valid(keuid))
+                return -EINVAL;
+
+        if ((suid != (uid_t) -1) && !uid_valid(ksuid))
+                return -EINVAL;
 
         new = prepare_creds();
         if (!new)
@@ -784,29 +834,29 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
 
         retval = -EPERM;
         if (!nsown_capable(CAP_SETUID)) {
-                if (ruid != (uid_t) -1 && ruid != old->uid &&
-                    ruid != old->euid  && ruid != old->suid)
+                if (ruid != (uid_t) -1        && !uid_eq(kruid, old->uid) &&
+                    !uid_eq(kruid, old->euid) && !uid_eq(kruid, old->suid))
                         goto error;
-                if (euid != (uid_t) -1 && euid != old->uid &&
-                    euid != old->euid  && euid != old->suid)
+                if (euid != (uid_t) -1        && !uid_eq(keuid, old->uid) &&
+                    !uid_eq(keuid, old->euid) && !uid_eq(keuid, old->suid))
                         goto error;
-                if (suid != (uid_t) -1 && suid != old->uid &&
-                    suid != old->euid  && suid != old->suid)
+                if (suid != (uid_t) -1        && !uid_eq(ksuid, old->uid) &&
+                    !uid_eq(ksuid, old->euid) && !uid_eq(ksuid, old->suid))
                         goto error;
         }
 
         if (ruid != (uid_t) -1) {
-                new->uid = ruid;
-                if (ruid != old->uid) {
+                new->uid = kruid;
+                if (!uid_eq(kruid, old->uid)) {
                         retval = set_user(new);
                         if (retval < 0)
                                 goto error;
                 }
         }
         if (euid != (uid_t) -1)
-                new->euid = euid;
+                new->euid = keuid;
         if (suid != (uid_t) -1)
-                new->suid = suid;
+                new->suid = ksuid;
         new->fsuid = new->euid;
 
         retval = security_task_fix_setuid(new, old, LSM_SETID_RES);
@@ -820,14 +870,19 @@ error:
         return retval;
 }
 
-SYSCALL_DEFINE3(getresuid, uid_t __user *, ruid, uid_t __user *, euid, uid_t __user *, suid)
+SYSCALL_DEFINE3(getresuid, uid_t __user *, ruidp, uid_t __user *, euidp, uid_t __user *, suidp)
 {
         const struct cred *cred = current_cred();
         int retval;
+        uid_t ruid, euid, suid;
+
+        ruid = from_kuid_munged(cred->user_ns, cred->uid);
+        euid = from_kuid_munged(cred->user_ns, cred->euid);
+        suid = from_kuid_munged(cred->user_ns, cred->suid);
 
-        if (!(retval   = put_user(cred->uid,  ruid)) &&
-            !(retval   = put_user(cred->euid, euid)))
-                retval = put_user(cred->suid, suid);
+        if (!(retval   = put_user(ruid, ruidp)) &&
+            !(retval   = put_user(euid, euidp)))
+                retval = put_user(suid, suidp);
 
         return retval;
 }
@@ -837,9 +892,22 @@ SYSCALL_DEFINE3(getresuid, uid_t __user *, ruid, uid_t __user *, euid, uid_t __u
  */
 SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
 {
+        struct user_namespace *ns = current_user_ns();
         const struct cred *old;
         struct cred *new;
         int retval;
+        kgid_t krgid, kegid, ksgid;
+
+        krgid = make_kgid(ns, rgid);
+        kegid = make_kgid(ns, egid);
+        ksgid = make_kgid(ns, sgid);
+
+        if ((rgid != (gid_t) -1) && !gid_valid(krgid))
+                return -EINVAL;
+        if ((egid != (gid_t) -1) && !gid_valid(kegid))
+                return -EINVAL;
+        if ((sgid != (gid_t) -1) && !gid_valid(ksgid))
+                return -EINVAL;
 
         new = prepare_creds();
         if (!new)
@@ -848,23 +916,23 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
 
         retval = -EPERM;
         if (!nsown_capable(CAP_SETGID)) {
-                if (rgid != (gid_t) -1 && rgid != old->gid &&
-                    rgid != old->egid  && rgid != old->sgid)
+                if (rgid != (gid_t) -1        && !gid_eq(krgid, old->gid) &&
+                    !gid_eq(krgid, old->egid) && !gid_eq(krgid, old->sgid))
                         goto error;
-                if (egid != (gid_t) -1 && egid != old->gid &&
-                    egid != old->egid  && egid != old->sgid)
+                if (egid != (gid_t) -1        && !gid_eq(kegid, old->gid) &&
+                    !gid_eq(kegid, old->egid) && !gid_eq(kegid, old->sgid))
                         goto error;
-                if (sgid != (gid_t) -1 && sgid != old->gid &&
-                    sgid != old->egid  && sgid != old->sgid)
+                if (sgid != (gid_t) -1        && !gid_eq(ksgid, old->gid) &&
+                    !gid_eq(ksgid, old->egid) && !gid_eq(ksgid, old->sgid))
                         goto error;
         }
 
         if (rgid != (gid_t) -1)
-                new->gid = rgid;
+                new->gid = krgid;
         if (egid != (gid_t) -1)
-                new->egid = egid;
+                new->egid = kegid;
         if (sgid != (gid_t) -1)
-                new->sgid = sgid;
+                new->sgid = ksgid;
         new->fsgid = new->egid;
 
         return commit_creds(new);
@@ -874,14 +942,19 @@ error:
         return retval;
 }
 
-SYSCALL_DEFINE3(getresgid, gid_t __user *, rgid, gid_t __user *, egid, gid_t __user *, sgid)
+SYSCALL_DEFINE3(getresgid, gid_t __user *, rgidp, gid_t __user *, egidp, gid_t __user *, sgidp)
 {
         const struct cred *cred = current_cred();
         int retval;
+        gid_t rgid, egid, sgid;
+
+        rgid = from_kgid_munged(cred->user_ns, cred->gid);
+        egid = from_kgid_munged(cred->user_ns, cred->egid);
+        sgid = from_kgid_munged(cred->user_ns, cred->sgid);
 
-        if (!(retval   = put_user(cred->gid,  rgid)) &&
-            !(retval   = put_user(cred->egid, egid)))
-                retval = put_user(cred->sgid, sgid);
+        if (!(retval   = put_user(rgid, rgidp)) &&
+            !(retval   = put_user(egid, egidp)))
+                retval = put_user(sgid, sgidp);
 
         return retval;
 }
@@ -898,18 +971,24 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
         const struct cred *old;
         struct cred *new;
         uid_t old_fsuid;
+        kuid_t kuid;
+
+        old = current_cred();
+        old_fsuid = from_kuid_munged(old->user_ns, old->fsuid);
+
+        kuid = make_kuid(old->user_ns, uid);
+        if (!uid_valid(kuid))
+                return old_fsuid;
 
         new = prepare_creds();
         if (!new)
-                return current_fsuid();
-        old = current_cred();
-        old_fsuid = old->fsuid;
+                return old_fsuid;
 
-        if (uid == old->uid  || uid == old->euid  ||
-            uid == old->suid || uid == old->fsuid ||
+        if (uid_eq(kuid, old->uid)  || uid_eq(kuid, old->euid)  ||
+            uid_eq(kuid, old->suid) || uid_eq(kuid, old->fsuid) ||
             nsown_capable(CAP_SETUID)) {
-                if (uid != old_fsuid) {
-                        new->fsuid = uid;
+                if (!uid_eq(kuid, old->fsuid)) {
+                        new->fsuid = kuid;
                         if (security_task_fix_setuid(new, old, LSM_SETID_FS) == 0)
                                 goto change_okay;
                 }
@@ -931,18 +1010,24 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
         const struct cred *old;
         struct cred *new;
         gid_t old_fsgid;
+        kgid_t kgid;
+
+        old = current_cred();
+        old_fsgid = from_kgid_munged(old->user_ns, old->fsgid);
+
+        kgid = make_kgid(old->user_ns, gid);
+        if (!gid_valid(kgid))
+                return old_fsgid;
 
         new = prepare_creds();
         if (!new)
-                return current_fsgid();
-        old = current_cred();
-        old_fsgid = old->fsgid;
+                return old_fsgid;
 
-        if (gid == old->gid  || gid == old->egid  ||
-            gid == old->sgid || gid == old->fsgid ||
+        if (gid_eq(kgid, old->gid)  || gid_eq(kgid, old->egid)  ||
+            gid_eq(kgid, old->sgid) || gid_eq(kgid, old->fsgid) ||
             nsown_capable(CAP_SETGID)) {
-                if (gid != old_fsgid) {
-                        new->fsgid = gid;
+                if (!gid_eq(kgid, old->fsgid)) {
+                        new->fsgid = kgid;
                         goto change_okay;
                 }
         }
@@ -1295,8 +1380,8 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
                 memcpy(u->nodename, tmp, len);
                 memset(u->nodename + len, 0, sizeof(u->nodename) - len);
                 errno = 0;
+                uts_proc_notify(UTS_PROC_HOSTNAME);
         }
-        uts_proc_notify(UTS_PROC_HOSTNAME);
         up_write(&uts_sem);
         return errno;
 }
@@ -1346,8 +1431,8 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
                 memcpy(u->domainname, tmp, len);
                 memset(u->domainname + len, 0, sizeof(u->domainname) - len);
                 errno = 0;
+                uts_proc_notify(UTS_PROC_DOMAINNAME);
         }
-        uts_proc_notify(UTS_PROC_DOMAINNAME);
         up_write(&uts_sem);
         return errno;
 }
@@ -1498,15 +1583,14 @@ static int check_prlimit_permission(struct task_struct *task)
                 return 0;
 
         tcred = __task_cred(task);
-        if (cred->user->user_ns == tcred->user->user_ns &&
-            (cred->uid == tcred->euid &&
-             cred->uid == tcred->suid &&
-             cred->uid == tcred->uid  &&
-             cred->gid == tcred->egid &&
-             cred->gid == tcred->sgid &&
-             cred->gid == tcred->gid))
+        if (uid_eq(cred->uid, tcred->euid) &&
+            uid_eq(cred->uid, tcred->suid) &&
+            uid_eq(cred->uid, tcred->uid)  &&
+            gid_eq(cred->gid, tcred->egid) &&
+            gid_eq(cred->gid, tcred->sgid) &&
+            gid_eq(cred->gid, tcred->gid))
                 return 0;
-        if (ns_capable(tcred->user->user_ns, CAP_SYS_RESOURCE))
+        if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE))
                 return 0;
 
         return -EPERM;
@@ -1702,77 +1786,105 @@ SYSCALL_DEFINE1(umask, int, mask)
 }
 
 #ifdef CONFIG_CHECKPOINT_RESTORE
+static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
+{
+        struct file *exe_file;
+        struct dentry *dentry;
+        int err;
+
+        exe_file = fget(fd);
+        if (!exe_file)
+                return -EBADF;
+
+        dentry = exe_file->f_path.dentry;
+
+        /*
+         * Because the original mm->exe_file points to executable file, make
+         * sure that this one is executable as well, to avoid breaking an
+         * overall picture.
+         */
+        err = -EACCES;
+        if (!S_ISREG(dentry->d_inode->i_mode)   ||
+            exe_file->f_path.mnt->mnt_flags & MNT_NOEXEC)
+                goto exit;
+
+        err = inode_permission(dentry->d_inode, MAY_EXEC);
+        if (err)
+                goto exit;
+
+        down_write(&mm->mmap_sem);
+
+        /*
+         * Forbid mm->exe_file change if old file still mapped.
+         */
+        err = -EBUSY;
+        if (mm->exe_file) {
+                struct vm_area_struct *vma;
+
+                for (vma = mm->mmap; vma; vma = vma->vm_next)
+                        if (vma->vm_file &&
+                            path_equal(&vma->vm_file->f_path,
+                                       &mm->exe_file->f_path))
+                                goto exit_unlock;
+        }
+
+        /*
+         * The symlink can be changed only once, just to disallow arbitrary
+         * transitions malicious software might bring in. This means one
+         * could make a snapshot over all processes running and monitor
+         * /proc/pid/exe changes to notice unusual activity if needed.
+         */
+        err = -EPERM;
+        if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags))
+                goto exit_unlock;
+
+        err = 0;
+        set_mm_exe_file(mm, exe_file);
+exit_unlock:
+        up_write(&mm->mmap_sem);
+
+exit:
+        fput(exe_file);
+        return err;
+}
+
 static int prctl_set_mm(int opt, unsigned long addr,
                         unsigned long arg4, unsigned long arg5)
 {
         unsigned long rlim = rlimit(RLIMIT_DATA);
-        unsigned long vm_req_flags;
-        unsigned long vm_bad_flags;
-        struct vm_area_struct *vma;
-        int error = 0;
         struct mm_struct *mm = current->mm;
+        struct vm_area_struct *vma;
+        int error;
 
-        if (arg4 | arg5)
+        if (arg5 || (arg4 && opt != PR_SET_MM_AUXV))
                 return -EINVAL;
 
         if (!capable(CAP_SYS_RESOURCE))
                 return -EPERM;
 
-        if (addr >= TASK_SIZE)
+        if (opt == PR_SET_MM_EXE_FILE)
+                return prctl_set_mm_exe_file(mm, (unsigned int)addr);
+
+        if (addr >= TASK_SIZE || addr < mmap_min_addr)
                 return -EINVAL;
 
+        error = -EINVAL;
+
         down_read(&mm->mmap_sem);
         vma = find_vma(mm, addr);
 
-        if (opt != PR_SET_MM_START_BRK && opt != PR_SET_MM_BRK) {
-                /* It must be existing VMA */
-                if (!vma || vma->vm_start > addr)
-                        goto out;
-        }
-
-        error = -EINVAL;
         switch (opt) {
         case PR_SET_MM_START_CODE:
+                mm->start_code = addr;
+                break;
         case PR_SET_MM_END_CODE:
-                vm_req_flags = VM_READ | VM_EXEC;
-                vm_bad_flags = VM_WRITE | VM_MAYSHARE;
-
-                if ((vma->vm_flags & vm_req_flags) != vm_req_flags ||
-                    (vma->vm_flags & vm_bad_flags))
-                        goto out;
-
-                if (opt == PR_SET_MM_START_CODE)
-                        mm->start_code = addr;
-                else
-                        mm->end_code = addr;
+                mm->end_code = addr;
                 break;
-
         case PR_SET_MM_START_DATA:
-        case PR_SET_MM_END_DATA:
-                vm_req_flags = VM_READ | VM_WRITE;
-                vm_bad_flags = VM_EXEC | VM_MAYSHARE;
-
-                if ((vma->vm_flags & vm_req_flags) != vm_req_flags ||
-                    (vma->vm_flags & vm_bad_flags))
-                        goto out;
-
-                if (opt == PR_SET_MM_START_DATA)
-                        mm->start_data = addr;
-                else
-                        mm->end_data = addr;
+                mm->start_data = addr;
                 break;
-
-        case PR_SET_MM_START_STACK:
-
-#ifdef CONFIG_STACK_GROWSUP
-                vm_req_flags = VM_READ | VM_WRITE | VM_GROWSUP;
-#else
-                vm_req_flags = VM_READ | VM_WRITE | VM_GROWSDOWN;
-#endif
-                if ((vma->vm_flags & vm_req_flags) != vm_req_flags)
-                        goto out;
-
-                mm->start_stack = addr;
+        case PR_SET_MM_END_DATA:
+                mm->end_data = addr;
                 break;
 
         case PR_SET_MM_START_BRK:
@@ -1799,24 +1911,89 @@ static int prctl_set_mm(int opt, unsigned long addr,
                 mm->brk = addr;
                 break;
 
+        /*
+         * If command line arguments and environment
+         * are placed somewhere else on stack, we can
+         * set them up here, ARG_START/END to setup
+         * command line argumets and ENV_START/END
+         * for environment.
+         */
+        case PR_SET_MM_START_STACK:
+        case PR_SET_MM_ARG_START:
+        case PR_SET_MM_ARG_END:
+        case PR_SET_MM_ENV_START:
+        case PR_SET_MM_ENV_END:
+                if (!vma) {
+                        error = -EFAULT;
+                        goto out;
+                }
+                if (opt == PR_SET_MM_START_STACK)
+                        mm->start_stack = addr;
+                else if (opt == PR_SET_MM_ARG_START)
+                        mm->arg_start = addr;
+                else if (opt == PR_SET_MM_ARG_END)
+                        mm->arg_end = addr;
+                else if (opt == PR_SET_MM_ENV_START)
+                        mm->env_start = addr;
+                else if (opt == PR_SET_MM_ENV_END)
+                        mm->env_end = addr;
+                break;
+
+        /*
+         * This doesn't move auxiliary vector itself
+         * since it's pinned to mm_struct, but allow
+         * to fill vector with new values. It's up
+         * to a caller to provide sane values here
+         * otherwise user space tools which use this
+         * vector might be unhappy.
+         */
+        case PR_SET_MM_AUXV: {
+                unsigned long user_auxv[AT_VECTOR_SIZE];
+
+                if (arg4 > sizeof(user_auxv))
+                        goto out;
+                up_read(&mm->mmap_sem);
+
+                if (copy_from_user(user_auxv, (const void __user *)addr, arg4))
+                        return -EFAULT;
+
+                /* Make sure the last entry is always AT_NULL */
+                user_auxv[AT_VECTOR_SIZE - 2] = 0;
+                user_auxv[AT_VECTOR_SIZE - 1] = 0;
+
+                BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
+
+                task_lock(current);
+                memcpy(mm->saved_auxv, user_auxv, arg4);
+                task_unlock(current);
+
+                return 0;
+        }
         default:
-                error = -EINVAL;
                 goto out;
         }
 
         error = 0;
-
 out:
         up_read(&mm->mmap_sem);
-
         return error;
 }
+
+static int prctl_get_tid_address(struct task_struct *me, int __user **tid_addr)
+{
+        return put_user(me->clear_child_tid, tid_addr);
+}
+
 #else /* CONFIG_CHECKPOINT_RESTORE */
 static int prctl_set_mm(int opt, unsigned long addr,
                         unsigned long arg4, unsigned long arg5)
 {
         return -EINVAL;
 }
+static int prctl_get_tid_address(struct task_struct *me, int __user **tid_addr)
+{
+        return -EINVAL;
+}
 #endif
 
 SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
@@ -1908,7 +2085,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                         error = prctl_get_seccomp();
                         break;
                 case PR_SET_SECCOMP:
-                        error = prctl_set_seccomp(arg2);
+                        error = prctl_set_seccomp(arg2, (char __user *)arg3);
                         break;
                 case PR_GET_TSC:
                         error = GET_TSC_CTL(arg2);
@@ -1971,6 +2148,9 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                 case PR_SET_MM:
                         error = prctl_set_mm(arg2, arg3, arg4, arg5);
                         break;
+                case PR_GET_TID_ADDRESS:
+                        error = prctl_get_tid_address(me, (int __user **)arg2);
+                        break;
                 case PR_SET_CHILD_SUBREAPER:
                         me->signal->is_child_subreaper = !!arg2;
                         error = 0;
@@ -1979,6 +2159,16 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                         error = put_user(me->signal->is_child_subreaper,
                                          (int __user *) arg2);
                         break;
+                case PR_SET_NO_NEW_PRIVS:
+                        if (arg2 != 1 || arg3 || arg4 || arg5)
+                                return -EINVAL;
+
+                        current->no_new_privs = 1;
+                        break;
+                case PR_GET_NO_NEW_PRIVS:
+                        if (arg2 || arg3 || arg4 || arg5)
+                                return -EINVAL;
+                        return current->no_new_privs ? 1 : 0;
                 default:
                         error = -EINVAL;
                         break;
@@ -2022,7 +2212,6 @@ int orderly_poweroff(bool force)
                 NULL
         };
         int ret = -ENOMEM;
-        struct subprocess_info *info;
 
         if (argv == NULL) {
                 printk(KERN_WARNING "%s failed to allocate memory for \"%s\"\n",
@@ -2030,18 +2219,16 @@ int orderly_poweroff(bool force)
                 goto out;
         }
 
-        info = call_usermodehelper_setup(argv[0], argv, envp, GFP_ATOMIC);
-        if (info == NULL) {
-                argv_free(argv);
-                goto out;
-        }
-
-        call_usermodehelper_setfns(info, NULL, argv_cleanup, NULL);
+        ret = call_usermodehelper_fns(argv[0], argv, envp, UMH_NO_WAIT,
+                                      NULL, argv_cleanup, NULL);
+out:
+        if (likely(!ret))
+                return 0;
 
-        ret = call_usermodehelper_exec(info, UMH_NO_WAIT);
+        if (ret == -ENOMEM)
+                argv_free(argv);
 
-  out:
-        if (ret && force) {
+        if (force) {
                 printk(KERN_WARNING "Failed to start orderly shutdown: "
                        "forcing the issue\n");