4 files changed, 16 insertions, 10 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 7a5fd77f8fb0..e93691e9b325 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -302,12 +302,12 @@ void __set_special_pids(pid_t session, pid_t pgrp)
         if (process_session(curr) != session) {
                 detach_pid(curr, PIDTYPE_SID);
                 set_signal_session(curr->signal, session);
-                attach_pid(curr, PIDTYPE_SID, session);
+                attach_pid(curr, PIDTYPE_SID, find_pid(session));
         }
         if (process_group(curr) != pgrp) {
                 detach_pid(curr, PIDTYPE_PGID);
                 curr->signal->pgrp = pgrp;
-                attach_pid(curr, PIDTYPE_PGID, pgrp);
+                attach_pid(curr, PIDTYPE_PGID, find_pid(pgrp));
         }
 }
 
diff --git a/kernel/fork.c b/kernel/fork.c
index da92e01aba6b..6031800c94cf 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1249,16 +1249,19 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                         __ptrace_link(p, current->parent);
 
                 if (thread_group_leader(p)) {
+                        pid_t pgid = process_group(current);
+                        pid_t sid = process_session(current);
+
                         p->signal->tty = current->signal->tty;
-                        p->signal->pgrp = process_group(current);
+                        p->signal->pgrp = pgid;
                         set_signal_session(p->signal, process_session(current));
-                        attach_pid(p, PIDTYPE_PGID, process_group(p));
-                        attach_pid(p, PIDTYPE_SID, process_session(p));
+                        attach_pid(p, PIDTYPE_PGID, find_pid(pgid));
+                        attach_pid(p, PIDTYPE_SID, find_pid(sid));
 
                         list_add_tail_rcu(&p->tasks, &init_task.tasks);
                         __get_cpu_var(process_counts)++;
                 }
-                attach_pid(p, PIDTYPE_PID, p->pid);
+                attach_pid(p, PIDTYPE_PID, find_pid(p->pid));
                 nr_threads++;
         }
 
diff --git a/kernel/pid.c b/kernel/pid.c
index d3ad724afa83..d76f59326bd4 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -247,13 +247,16 @@ struct pid * fastcall find_pid(int nr)
 }
 EXPORT_SYMBOL_GPL(find_pid);
 
-int fastcall attach_pid(struct task_struct *task, enum pid_type type, int nr)
+/*
+ * attach_pid() must be called with the tasklist_lock write-held.
+ */
+int fastcall attach_pid(struct task_struct *task, enum pid_type type,
+                struct pid *pid)
 {
         struct pid_link *link;
-        struct pid *pid;
 
         link = &task->pids[type];
-        link->pid = pid = find_pid(nr);
+        link->pid = pid;
         hlist_add_head_rcu(&link->node, &pid->tasks[type]);
 
         return 0;
diff --git a/kernel/sys.c b/kernel/sys.c
index df4c3a8f5df9..872271ccc384 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1488,7 +1488,7 @@ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
         if (process_group(p) != pgid) {
                 detach_pid(p, PIDTYPE_PGID);
                 p->signal->pgrp = pgid;
-                attach_pid(p, PIDTYPE_PGID, pgid);
+                attach_pid(p, PIDTYPE_PGID, find_pid(pgid));
         }
 
         err = 0;