3 files changed, 49 insertions, 30 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 0f3527d6184a..72fcd3069a90 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -896,10 +896,13 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                 mutex_unlock(&cgroup_mutex);
 
                 /*
-                 * Drop the active superblock reference that we took when we
-                 * created the cgroup
+                 * We want to drop the active superblock reference from the
+                 * cgroup creation after all the dentry refs are gone -
+                 * kill_sb gets mighty unhappy otherwise.  Mark
+                 * dentry->d_fsdata with cgroup_diput() to tell
+                 * cgroup_d_release() to call deactivate_super().
                  */
-                deactivate_super(cgrp->root->sb);
+                dentry->d_fsdata = cgroup_diput;
 
                 /*
                  * if we're getting rid of the cgroup, refcount should ensure
@@ -925,6 +928,13 @@ static int cgroup_delete(const struct dentry *d)
         return 1;
 }
 
+static void cgroup_d_release(struct dentry *dentry)
+{
+        /* did cgroup_diput() tell me to deactivate super? */
+        if (dentry->d_fsdata == cgroup_diput)
+                deactivate_super(dentry->d_sb);
+}
+
 static void remove_dir(struct dentry *d)
 {
         struct dentry *parent = dget(d->d_parent);
@@ -1532,6 +1542,7 @@ static int cgroup_get_rootdir(struct super_block *sb)
         static const struct dentry_operations cgroup_dops = {
                 .d_iput = cgroup_diput,
                 .d_delete = cgroup_delete,
+                .d_release = cgroup_d_release,
         };
 
         struct inode *inode =
diff --git a/kernel/sys.c b/kernel/sys.c
index 9ff89cb9657a..f0ec44dcd415 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1786,27 +1786,13 @@ SYSCALL_DEFINE1(umask, int, mask)
 }
 
 #ifdef CONFIG_CHECKPOINT_RESTORE
-static bool vma_flags_mismatch(struct vm_area_struct *vma,
-                               unsigned long required,
-                               unsigned long banned)
-{
-        return (vma->vm_flags & required) != required ||
-                (vma->vm_flags & banned);
-}
-
 static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
 {
+        struct vm_area_struct *vma;
         struct file *exe_file;
         struct dentry *dentry;
         int err;
 
-        /*
-         * Setting new mm::exe_file is only allowed when no VM_EXECUTABLE vma's
-         * remain. So perform a quick test first.
-         */
-        if (mm->num_exe_file_vmas)
-                return -EBUSY;
-
         exe_file = fget(fd);
         if (!exe_file)
                 return -EBADF;
@@ -1827,17 +1813,30 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
         if (err)
                 goto exit;
 
+        down_write(&mm->mmap_sem);
+
+        /*
+         * Forbid mm->exe_file change if there are mapped other files.
+         */
+        err = -EBUSY;
+        for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                if (vma->vm_file && !path_equal(&vma->vm_file->f_path,
+                                                &exe_file->f_path))
+                        goto exit_unlock;
+        }
+
         /*
          * The symlink can be changed only once, just to disallow arbitrary
          * transitions malicious software might bring in. This means one
          * could make a snapshot over all processes running and monitor
          * /proc/pid/exe changes to notice unusual activity if needed.
          */
-        down_write(&mm->mmap_sem);
-        if (likely(!mm->exe_file))
-                set_mm_exe_file(mm, exe_file);
-        else
-                err = -EBUSY;
+        err = -EPERM;
+        if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags))
+                goto exit_unlock;
+
+        set_mm_exe_file(mm, exe_file);
+exit_unlock:
         up_write(&mm->mmap_sem);
 
 exit:
@@ -1862,7 +1861,7 @@ static int prctl_set_mm(int opt, unsigned long addr,
         if (opt == PR_SET_MM_EXE_FILE)
                 return prctl_set_mm_exe_file(mm, (unsigned int)addr);
 
-        if (addr >= TASK_SIZE)
+        if (addr >= TASK_SIZE || addr < mmap_min_addr)
                 return -EINVAL;
 
         error = -EINVAL;
@@ -1924,12 +1923,6 @@ static int prctl_set_mm(int opt, unsigned long addr,
                         error = -EFAULT;
                         goto out;
                 }
-#ifdef CONFIG_STACK_GROWSUP
-                if (vma_flags_mismatch(vma, VM_READ | VM_WRITE | VM_GROWSUP, 0))
-#else
-                if (vma_flags_mismatch(vma, VM_READ | VM_WRITE | VM_GROWSDOWN, 0))
-#endif
-                        goto out;
                 if (opt == PR_SET_MM_START_STACK)
                         mm->start_stack = addr;
                 else if (opt == PR_SET_MM_ARG_START)
@@ -1981,12 +1974,22 @@ out:
         up_read(&mm->mmap_sem);
         return error;
 }
+
+static int prctl_get_tid_address(struct task_struct *me, int __user **tid_addr)
+{
+        return put_user(me->clear_child_tid, tid_addr);
+}
+
 #else /* CONFIG_CHECKPOINT_RESTORE */
 static int prctl_set_mm(int opt, unsigned long addr,
                         unsigned long arg4, unsigned long arg5)
 {
         return -EINVAL;
 }
+static int prctl_get_tid_address(struct task_struct *me, int __user **tid_addr)
+{
+        return -EINVAL;
+}
 #endif
 
 SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
@@ -2124,6 +2127,9 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                                 else
                                         return -EINVAL;
                                 break;
+                case PR_GET_TID_ADDRESS:
+                        error = prctl_get_tid_address(me, (int __user **)arg2);
+                        break;
                         default:
                                 return -EINVAL;
                         }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 6e46cacf5969..6f46a00a1e8a 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -962,6 +962,7 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
                 timekeeper.xtime.tv_sec++;
                 leap = second_overflow(timekeeper.xtime.tv_sec);
                 timekeeper.xtime.tv_sec += leap;
+                timekeeper.wall_to_monotonic.tv_sec -= leap;
         }
 
         /* Accumulate raw time */
@@ -1077,6 +1078,7 @@ static void update_wall_time(void)
                 timekeeper.xtime.tv_sec++;
                 leap = second_overflow(timekeeper.xtime.tv_sec);
                 timekeeper.xtime.tv_sec += leap;
+                timekeeper.wall_to_monotonic.tv_sec -= leap;
         }
 
         timekeeping_update(false);