procfs: mem permission cleanup
[linux-2.6.git] / fs / proc / base.c
1 /*
2  *  linux/fs/proc/base.c
3  *
4  *  Copyright (C) 1991, 1992 Linus Torvalds
5  *
6  *  proc base directory handling functions
7  *
8  *  1999, Al Viro. Rewritten. Now it covers the whole per-process part.
9  *  Instead of using magical inumbers to determine the kind of object
10  *  we allocate and fill in-core inodes upon lookup. They don't even
11  *  go into icache. We cache the reference to task_struct upon lookup too.
12  *  Eventually it should become a filesystem in its own. We don't use the
13  *  rest of procfs anymore.
14  *
15  *
16  *  Changelog:
17  *  17-Jan-2005
18  *  Allan Bezerra
19  *  Bruna Moreira <bruna.moreira@indt.org.br>
20  *  Edjard Mota <edjard.mota@indt.org.br>
21  *  Ilias Biris <ilias.biris@indt.org.br>
22  *  Mauricio Lin <mauricio.lin@indt.org.br>
23  *
24  *  Embedded Linux Lab - 10LE Instituto Nokia de Tecnologia - INdT
25  *
26  *  A new process specific entry (smaps) included in /proc. It shows the
27  *  size of rss for each memory area. The maps entry lacks information
28  *  about physical memory size (rss) for each mapped file, i.e.,
29  *  rss information for executables and library files.
30  *  This additional information is useful for any tools that need to know
31  *  about physical memory consumption for a process specific library.
32  *
33  *  Changelog:
34  *  21-Feb-2005
35  *  Embedded Linux Lab - 10LE Instituto Nokia de Tecnologia - INdT
36  *  Pud inclusion in the page table walking.
37  *
38  *  ChangeLog:
39  *  10-Mar-2005
40  *  10LE Instituto Nokia de Tecnologia - INdT:
41  *  A better way to walks through the page table as suggested by Hugh Dickins.
42  *
43  *  Simo Piiroinen <simo.piiroinen@nokia.com>:
44  *  Smaps information related to shared, private, clean and dirty pages.
45  *
46  *  Paul Mundt <paul.mundt@nokia.com>:
47  *  Overall revision about smaps.
48  */
49
50 #include <asm/uaccess.h>
51
52 #include <linux/errno.h>
53 #include <linux/time.h>
54 #include <linux/proc_fs.h>
55 #include <linux/stat.h>
56 #include <linux/init.h>
57 #include <linux/capability.h>
58 #include <linux/file.h>
59 #include <linux/string.h>
60 #include <linux/seq_file.h>
61 #include <linux/namei.h>
62 #include <linux/mnt_namespace.h>
63 #include <linux/mm.h>
64 #include <linux/rcupdate.h>
65 #include <linux/kallsyms.h>
66 #include <linux/resource.h>
67 #include <linux/module.h>
68 #include <linux/mount.h>
69 #include <linux/security.h>
70 #include <linux/ptrace.h>
71 #include <linux/cgroup.h>
72 #include <linux/cpuset.h>
73 #include <linux/audit.h>
74 #include <linux/poll.h>
75 #include <linux/nsproxy.h>
76 #include <linux/oom.h>
77 #include <linux/elf.h>
78 #include <linux/pid_namespace.h>
79 #include "internal.h"
80
81 /* NOTE:
82  *      Implementing inode permission operations in /proc is almost
83  *      certainly an error.  Permission checks need to happen during
84  *      each system call not at open time.  The reason is that most of
85  *      what we wish to check for permissions in /proc varies at runtime.
86  *
87  *      The classic example of a problem is opening file descriptors
88  *      in /proc for a task before it execs a suid executable.
89  */
90
91 struct pid_entry {
92         char *name;
93         int len;
94         mode_t mode;
95         const struct inode_operations *iop;
96         const struct file_operations *fop;
97         union proc_op op;
98 };
99
100 #define NOD(NAME, MODE, IOP, FOP, OP) {                 \
101         .name = (NAME),                                 \
102         .len  = sizeof(NAME) - 1,                       \
103         .mode = MODE,                                   \
104         .iop  = IOP,                                    \
105         .fop  = FOP,                                    \
106         .op   = OP,                                     \
107 }
108
109 #define DIR(NAME, MODE, OTYPE)                                                  \
110         NOD(NAME, (S_IFDIR|(MODE)),                                             \
111                 &proc_##OTYPE##_inode_operations, &proc_##OTYPE##_operations,   \
112                 {} )
113 #define LNK(NAME, OTYPE)                                        \
114         NOD(NAME, (S_IFLNK|S_IRWXUGO),                          \
115                 &proc_pid_link_inode_operations, NULL,          \
116                 { .proc_get_link = &proc_##OTYPE##_link } )
117 #define REG(NAME, MODE, OTYPE)                          \
118         NOD(NAME, (S_IFREG|(MODE)), NULL,               \
119                 &proc_##OTYPE##_operations, {})
120 #define INF(NAME, MODE, OTYPE)                          \
121         NOD(NAME, (S_IFREG|(MODE)),                     \
122                 NULL, &proc_info_file_operations,       \
123                 { .proc_read = &proc_##OTYPE } )
124 #define ONE(NAME, MODE, OTYPE)                          \
125         NOD(NAME, (S_IFREG|(MODE)),                     \
126                 NULL, &proc_single_file_operations,     \
127                 { .proc_show = &proc_##OTYPE } )
128
129 int maps_protect;
130 EXPORT_SYMBOL(maps_protect);
131
132 static struct fs_struct *get_fs_struct(struct task_struct *task)
133 {
134         struct fs_struct *fs;
135         task_lock(task);
136         fs = task->fs;
137         if(fs)
138                 atomic_inc(&fs->count);
139         task_unlock(task);
140         return fs;
141 }
142
143 static int get_nr_threads(struct task_struct *tsk)
144 {
145         /* Must be called with the rcu_read_lock held */
146         unsigned long flags;
147         int count = 0;
148
149         if (lock_task_sighand(tsk, &flags)) {
150                 count = atomic_read(&tsk->signal->count);
151                 unlock_task_sighand(tsk, &flags);
152         }
153         return count;
154 }
155
156 static int proc_cwd_link(struct inode *inode, struct path *path)
157 {
158         struct task_struct *task = get_proc_task(inode);
159         struct fs_struct *fs = NULL;
160         int result = -ENOENT;
161
162         if (task) {
163                 fs = get_fs_struct(task);
164                 put_task_struct(task);
165         }
166         if (fs) {
167                 read_lock(&fs->lock);
168                 *path = fs->pwd;
169                 path_get(&fs->pwd);
170                 read_unlock(&fs->lock);
171                 result = 0;
172                 put_fs_struct(fs);
173         }
174         return result;
175 }
176
177 static int proc_root_link(struct inode *inode, struct path *path)
178 {
179         struct task_struct *task = get_proc_task(inode);
180         struct fs_struct *fs = NULL;
181         int result = -ENOENT;
182
183         if (task) {
184                 fs = get_fs_struct(task);
185                 put_task_struct(task);
186         }
187         if (fs) {
188                 read_lock(&fs->lock);
189                 *path = fs->root;
190                 path_get(&fs->root);
191                 read_unlock(&fs->lock);
192                 result = 0;
193                 put_fs_struct(fs);
194         }
195         return result;
196 }
197
198 /*
199  * Return zero if current may access user memory in @task, -error if not.
200  */
201 static int check_mem_permission(struct task_struct *task)
202 {
203         /*
204          * A task can always look at itself, in case it chooses
205          * to use system calls instead of load instructions.
206          */
207         if (task == current)
208                 return 0;
209
210         /*
211          * If current is actively ptrace'ing, and would also be
212          * permitted to freshly attach with ptrace now, permit it.
213          */
214         if (task->parent == current && (task->ptrace & PT_PTRACED) &&
215             task_is_stopped_or_traced(task) &&
216             ptrace_may_attach(task))
217                 return 0;
218
219         /*
220          * Noone else is allowed.
221          */
222         return -EPERM;
223 }
224
225 struct mm_struct *mm_for_maps(struct task_struct *task)
226 {
227         struct mm_struct *mm = get_task_mm(task);
228         if (!mm)
229                 return NULL;
230         down_read(&mm->mmap_sem);
231         task_lock(task);
232         if (task->mm != mm)
233                 goto out;
234         if (task->mm != current->mm && __ptrace_may_attach(task) < 0)
235                 goto out;
236         task_unlock(task);
237         return mm;
238 out:
239         task_unlock(task);
240         up_read(&mm->mmap_sem);
241         mmput(mm);
242         return NULL;
243 }
244
245 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
246 {
247         int res = 0;
248         unsigned int len;
249         struct mm_struct *mm = get_task_mm(task);
250         if (!mm)
251                 goto out;
252         if (!mm->arg_end)
253                 goto out_mm;    /* Shh! No looking before we're done */
254
255         len = mm->arg_end - mm->arg_start;
256  
257         if (len > PAGE_SIZE)
258                 len = PAGE_SIZE;
259  
260         res = access_process_vm(task, mm->arg_start, buffer, len, 0);
261
262         // If the nul at the end of args has been overwritten, then
263         // assume application is using setproctitle(3).
264         if (res > 0 && buffer[res-1] != '\0' && len < PAGE_SIZE) {
265                 len = strnlen(buffer, res);
266                 if (len < res) {
267                     res = len;
268                 } else {
269                         len = mm->env_end - mm->env_start;
270                         if (len > PAGE_SIZE - res)
271                                 len = PAGE_SIZE - res;
272                         res += access_process_vm(task, mm->env_start, buffer+res, len, 0);
273                         res = strnlen(buffer, res);
274                 }
275         }
276 out_mm:
277         mmput(mm);
278 out:
279         return res;
280 }
281
282 static int proc_pid_auxv(struct task_struct *task, char *buffer)
283 {
284         int res = 0;
285         struct mm_struct *mm = get_task_mm(task);
286         if (mm) {
287                 unsigned int nwords = 0;
288                 do
289                         nwords += 2;
290                 while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
291                 res = nwords * sizeof(mm->saved_auxv[0]);
292                 if (res > PAGE_SIZE)
293                         res = PAGE_SIZE;
294                 memcpy(buffer, mm->saved_auxv, res);
295                 mmput(mm);
296         }
297         return res;
298 }
299
300
301 #ifdef CONFIG_KALLSYMS
302 /*
303  * Provides a wchan file via kallsyms in a proper one-value-per-file format.
304  * Returns the resolved symbol.  If that fails, simply return the address.
305  */
306 static int proc_pid_wchan(struct task_struct *task, char *buffer)
307 {
308         unsigned long wchan;
309         char symname[KSYM_NAME_LEN];
310
311         wchan = get_wchan(task);
312
313         if (lookup_symbol_name(wchan, symname) < 0)
314                 return sprintf(buffer, "%lu", wchan);
315         else
316                 return sprintf(buffer, "%s", symname);
317 }
318 #endif /* CONFIG_KALLSYMS */
319
320 #ifdef CONFIG_SCHEDSTATS
321 /*
322  * Provides /proc/PID/schedstat
323  */
324 static int proc_pid_schedstat(struct task_struct *task, char *buffer)
325 {
326         return sprintf(buffer, "%llu %llu %lu\n",
327                         task->sched_info.cpu_time,
328                         task->sched_info.run_delay,
329                         task->sched_info.pcount);
330 }
331 #endif
332
333 #ifdef CONFIG_LATENCYTOP
334 static int lstats_show_proc(struct seq_file *m, void *v)
335 {
336         int i;
337         struct inode *inode = m->private;
338         struct task_struct *task = get_proc_task(inode);
339
340         if (!task)
341                 return -ESRCH;
342         seq_puts(m, "Latency Top version : v0.1\n");
343         for (i = 0; i < 32; i++) {
344                 if (task->latency_record[i].backtrace[0]) {
345                         int q;
346                         seq_printf(m, "%i %li %li ",
347                                 task->latency_record[i].count,
348                                 task->latency_record[i].time,
349                                 task->latency_record[i].max);
350                         for (q = 0; q < LT_BACKTRACEDEPTH; q++) {
351                                 char sym[KSYM_NAME_LEN];
352                                 char *c;
353                                 if (!task->latency_record[i].backtrace[q])
354                                         break;
355                                 if (task->latency_record[i].backtrace[q] == ULONG_MAX)
356                                         break;
357                                 sprint_symbol(sym, task->latency_record[i].backtrace[q]);
358                                 c = strchr(sym, '+');
359                                 if (c)
360                                         *c = 0;
361                                 seq_printf(m, "%s ", sym);
362                         }
363                         seq_printf(m, "\n");
364                 }
365
366         }
367         put_task_struct(task);
368         return 0;
369 }
370
371 static int lstats_open(struct inode *inode, struct file *file)
372 {
373         return single_open(file, lstats_show_proc, inode);
374 }
375
376 static ssize_t lstats_write(struct file *file, const char __user *buf,
377                             size_t count, loff_t *offs)
378 {
379         struct task_struct *task = get_proc_task(file->f_dentry->d_inode);
380
381         if (!task)
382                 return -ESRCH;
383         clear_all_latency_tracing(task);
384         put_task_struct(task);
385
386         return count;
387 }
388
389 static const struct file_operations proc_lstats_operations = {
390         .open           = lstats_open,
391         .read           = seq_read,
392         .write          = lstats_write,
393         .llseek         = seq_lseek,
394         .release        = single_release,
395 };
396
397 #endif
398
399 /* The badness from the OOM killer */
400 unsigned long badness(struct task_struct *p, unsigned long uptime);
401 static int proc_oom_score(struct task_struct *task, char *buffer)
402 {
403         unsigned long points;
404         struct timespec uptime;
405
406         do_posix_clock_monotonic_gettime(&uptime);
407         read_lock(&tasklist_lock);
408         points = badness(task, uptime.tv_sec);
409         read_unlock(&tasklist_lock);
410         return sprintf(buffer, "%lu\n", points);
411 }
412
413 struct limit_names {
414         char *name;
415         char *unit;
416 };
417
418 static const struct limit_names lnames[RLIM_NLIMITS] = {
419         [RLIMIT_CPU] = {"Max cpu time", "ms"},
420         [RLIMIT_FSIZE] = {"Max file size", "bytes"},
421         [RLIMIT_DATA] = {"Max data size", "bytes"},
422         [RLIMIT_STACK] = {"Max stack size", "bytes"},
423         [RLIMIT_CORE] = {"Max core file size", "bytes"},
424         [RLIMIT_RSS] = {"Max resident set", "bytes"},
425         [RLIMIT_NPROC] = {"Max processes", "processes"},
426         [RLIMIT_NOFILE] = {"Max open files", "files"},
427         [RLIMIT_MEMLOCK] = {"Max locked memory", "bytes"},
428         [RLIMIT_AS] = {"Max address space", "bytes"},
429         [RLIMIT_LOCKS] = {"Max file locks", "locks"},
430         [RLIMIT_SIGPENDING] = {"Max pending signals", "signals"},
431         [RLIMIT_MSGQUEUE] = {"Max msgqueue size", "bytes"},
432         [RLIMIT_NICE] = {"Max nice priority", NULL},
433         [RLIMIT_RTPRIO] = {"Max realtime priority", NULL},
434         [RLIMIT_RTTIME] = {"Max realtime timeout", "us"},
435 };
436
437 /* Display limits for a process */
438 static int proc_pid_limits(struct task_struct *task, char *buffer)
439 {
440         unsigned int i;
441         int count = 0;
442         unsigned long flags;
443         char *bufptr = buffer;
444
445         struct rlimit rlim[RLIM_NLIMITS];
446
447         rcu_read_lock();
448         if (!lock_task_sighand(task,&flags)) {
449                 rcu_read_unlock();
450                 return 0;
451         }
452         memcpy(rlim, task->signal->rlim, sizeof(struct rlimit) * RLIM_NLIMITS);
453         unlock_task_sighand(task, &flags);
454         rcu_read_unlock();
455
456         /*
457          * print the file header
458          */
459         count += sprintf(&bufptr[count], "%-25s %-20s %-20s %-10s\n",
460                         "Limit", "Soft Limit", "Hard Limit", "Units");
461
462         for (i = 0; i < RLIM_NLIMITS; i++) {
463                 if (rlim[i].rlim_cur == RLIM_INFINITY)
464                         count += sprintf(&bufptr[count], "%-25s %-20s ",
465                                          lnames[i].name, "unlimited");
466                 else
467                         count += sprintf(&bufptr[count], "%-25s %-20lu ",
468                                          lnames[i].name, rlim[i].rlim_cur);
469
470                 if (rlim[i].rlim_max == RLIM_INFINITY)
471                         count += sprintf(&bufptr[count], "%-20s ", "unlimited");
472                 else
473                         count += sprintf(&bufptr[count], "%-20lu ",
474                                          rlim[i].rlim_max);
475
476                 if (lnames[i].unit)
477                         count += sprintf(&bufptr[count], "%-10s\n",
478                                          lnames[i].unit);
479                 else
480                         count += sprintf(&bufptr[count], "\n");
481         }
482
483         return count;
484 }
485
486 /************************************************************************/
487 /*                       Here the fs part begins                        */
488 /************************************************************************/
489
490 /* permission checks */
491 static int proc_fd_access_allowed(struct inode *inode)
492 {
493         struct task_struct *task;
494         int allowed = 0;
495         /* Allow access to a task's file descriptors if it is us or we
496          * may use ptrace attach to the process and find out that
497          * information.
498          */
499         task = get_proc_task(inode);
500         if (task) {
501                 allowed = ptrace_may_attach(task);
502                 put_task_struct(task);
503         }
504         return allowed;
505 }
506
507 static int proc_setattr(struct dentry *dentry, struct iattr *attr)
508 {
509         int error;
510         struct inode *inode = dentry->d_inode;
511
512         if (attr->ia_valid & ATTR_MODE)
513                 return -EPERM;
514
515         error = inode_change_ok(inode, attr);
516         if (!error)
517                 error = inode_setattr(inode, attr);
518         return error;
519 }
520
521 static const struct inode_operations proc_def_inode_operations = {
522         .setattr        = proc_setattr,
523 };
524
525 static int mounts_open_common(struct inode *inode, struct file *file,
526                               const struct seq_operations *op)
527 {
528         struct task_struct *task = get_proc_task(inode);
529         struct nsproxy *nsp;
530         struct mnt_namespace *ns = NULL;
531         struct fs_struct *fs = NULL;
532         struct path root;
533         struct proc_mounts *p;
534         int ret = -EINVAL;
535
536         if (task) {
537                 rcu_read_lock();
538                 nsp = task_nsproxy(task);
539                 if (nsp) {
540                         ns = nsp->mnt_ns;
541                         if (ns)
542                                 get_mnt_ns(ns);
543                 }
544                 rcu_read_unlock();
545                 if (ns)
546                         fs = get_fs_struct(task);
547                 put_task_struct(task);
548         }
549
550         if (!ns)
551                 goto err;
552         if (!fs)
553                 goto err_put_ns;
554
555         read_lock(&fs->lock);
556         root = fs->root;
557         path_get(&root);
558         read_unlock(&fs->lock);
559         put_fs_struct(fs);
560
561         ret = -ENOMEM;
562         p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
563         if (!p)
564                 goto err_put_path;
565
566         file->private_data = &p->m;
567         ret = seq_open(file, op);
568         if (ret)
569                 goto err_free;
570
571         p->m.private = p;
572         p->ns = ns;
573         p->root = root;
574         p->event = ns->event;
575
576         return 0;
577
578  err_free:
579         kfree(p);
580  err_put_path:
581         path_put(&root);
582  err_put_ns:
583         put_mnt_ns(ns);
584  err:
585         return ret;
586 }
587
588 static int mounts_release(struct inode *inode, struct file *file)
589 {
590         struct proc_mounts *p = file->private_data;
591         path_put(&p->root);
592         put_mnt_ns(p->ns);
593         return seq_release(inode, file);
594 }
595
596 static unsigned mounts_poll(struct file *file, poll_table *wait)
597 {
598         struct proc_mounts *p = file->private_data;
599         struct mnt_namespace *ns = p->ns;
600         unsigned res = 0;
601
602         poll_wait(file, &ns->poll, wait);
603
604         spin_lock(&vfsmount_lock);
605         if (p->event != ns->event) {
606                 p->event = ns->event;
607                 res = POLLERR;
608         }
609         spin_unlock(&vfsmount_lock);
610
611         return res;
612 }
613
614 static int mounts_open(struct inode *inode, struct file *file)
615 {
616         return mounts_open_common(inode, file, &mounts_op);
617 }
618
619 static const struct file_operations proc_mounts_operations = {
620         .open           = mounts_open,
621         .read           = seq_read,
622         .llseek         = seq_lseek,
623         .release        = mounts_release,
624         .poll           = mounts_poll,
625 };
626
627 static int mountinfo_open(struct inode *inode, struct file *file)
628 {
629         return mounts_open_common(inode, file, &mountinfo_op);
630 }
631
632 static const struct file_operations proc_mountinfo_operations = {
633         .open           = mountinfo_open,
634         .read           = seq_read,
635         .llseek         = seq_lseek,
636         .release        = mounts_release,
637         .poll           = mounts_poll,
638 };
639
640 static int mountstats_open(struct inode *inode, struct file *file)
641 {
642         return mounts_open_common(inode, file, &mountstats_op);
643 }
644
645 static const struct file_operations proc_mountstats_operations = {
646         .open           = mountstats_open,
647         .read           = seq_read,
648         .llseek         = seq_lseek,
649         .release        = mounts_release,
650 };
651
652 #define PROC_BLOCK_SIZE (3*1024)                /* 4K page size but our output routines use some slack for overruns */
653
654 static ssize_t proc_info_read(struct file * file, char __user * buf,
655                           size_t count, loff_t *ppos)
656 {
657         struct inode * inode = file->f_path.dentry->d_inode;
658         unsigned long page;
659         ssize_t length;
660         struct task_struct *task = get_proc_task(inode);
661
662         length = -ESRCH;
663         if (!task)
664                 goto out_no_task;
665
666         if (count > PROC_BLOCK_SIZE)
667                 count = PROC_BLOCK_SIZE;
668
669         length = -ENOMEM;
670         if (!(page = __get_free_page(GFP_TEMPORARY)))
671                 goto out;
672
673         length = PROC_I(inode)->op.proc_read(task, (char*)page);
674
675         if (length >= 0)
676                 length = simple_read_from_buffer(buf, count, ppos, (char *)page, length);
677         free_page(page);
678 out:
679         put_task_struct(task);
680 out_no_task:
681         return length;
682 }
683
684 static const struct file_operations proc_info_file_operations = {
685         .read           = proc_info_read,
686 };
687
688 static int proc_single_show(struct seq_file *m, void *v)
689 {
690         struct inode *inode = m->private;
691         struct pid_namespace *ns;
692         struct pid *pid;
693         struct task_struct *task;
694         int ret;
695
696         ns = inode->i_sb->s_fs_info;
697         pid = proc_pid(inode);
698         task = get_pid_task(pid, PIDTYPE_PID);
699         if (!task)
700                 return -ESRCH;
701
702         ret = PROC_I(inode)->op.proc_show(m, ns, pid, task);
703
704         put_task_struct(task);
705         return ret;
706 }
707
708 static int proc_single_open(struct inode *inode, struct file *filp)
709 {
710         int ret;
711         ret = single_open(filp, proc_single_show, NULL);
712         if (!ret) {
713                 struct seq_file *m = filp->private_data;
714
715                 m->private = inode;
716         }
717         return ret;
718 }
719
720 static const struct file_operations proc_single_file_operations = {
721         .open           = proc_single_open,
722         .read           = seq_read,
723         .llseek         = seq_lseek,
724         .release        = single_release,
725 };
726
727 static int mem_open(struct inode* inode, struct file* file)
728 {
729         file->private_data = (void*)((long)current->self_exec_id);
730         return 0;
731 }
732
733 static ssize_t mem_read(struct file * file, char __user * buf,
734                         size_t count, loff_t *ppos)
735 {
736         struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
737         char *page;
738         unsigned long src = *ppos;
739         int ret = -ESRCH;
740         struct mm_struct *mm;
741
742         if (!task)
743                 goto out_no_task;
744
745         if (check_mem_permission(task))
746                 goto out;
747
748         ret = -ENOMEM;
749         page = (char *)__get_free_page(GFP_TEMPORARY);
750         if (!page)
751                 goto out;
752
753         ret = 0;
754  
755         mm = get_task_mm(task);
756         if (!mm)
757                 goto out_free;
758
759         ret = -EIO;
760  
761         if (file->private_data != (void*)((long)current->self_exec_id))
762                 goto out_put;
763
764         ret = 0;
765  
766         while (count > 0) {
767                 int this_len, retval;
768
769                 this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
770                 retval = access_process_vm(task, src, page, this_len, 0);
771                 if (!retval || check_mem_permission(task)) {
772                         if (!ret)
773                                 ret = -EIO;
774                         break;
775                 }
776
777                 if (copy_to_user(buf, page, retval)) {
778                         ret = -EFAULT;
779                         break;
780                 }
781  
782                 ret += retval;
783                 src += retval;
784                 buf += retval;
785                 count -= retval;
786         }
787         *ppos = src;
788
789 out_put:
790         mmput(mm);
791 out_free:
792         free_page((unsigned long) page);
793 out:
794         put_task_struct(task);
795 out_no_task:
796         return ret;
797 }
798
799 #define mem_write NULL
800
801 #ifndef mem_write
802 /* This is a security hazard */
803 static ssize_t mem_write(struct file * file, const char __user *buf,
804                          size_t count, loff_t *ppos)
805 {
806         int copied;
807         char *page;
808         struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
809         unsigned long dst = *ppos;
810
811         copied = -ESRCH;
812         if (!task)
813                 goto out_no_task;
814
815         if (check_mem_permission(task))
816                 goto out;
817
818         copied = -ENOMEM;
819         page = (char *)__get_free_page(GFP_TEMPORARY);
820         if (!page)
821                 goto out;
822
823         copied = 0;
824         while (count > 0) {
825                 int this_len, retval;
826
827                 this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
828                 if (copy_from_user(page, buf, this_len)) {
829                         copied = -EFAULT;
830                         break;
831                 }
832                 retval = access_process_vm(task, dst, page, this_len, 1);
833                 if (!retval) {
834                         if (!copied)
835                                 copied = -EIO;
836                         break;
837                 }
838                 copied += retval;
839                 buf += retval;
840                 dst += retval;
841                 count -= retval;                        
842         }
843         *ppos = dst;
844         free_page((unsigned long) page);
845 out:
846         put_task_struct(task);
847 out_no_task:
848         return copied;
849 }
850 #endif
851
852 loff_t mem_lseek(struct file *file, loff_t offset, int orig)
853 {
854         switch (orig) {
855         case 0:
856                 file->f_pos = offset;
857                 break;
858         case 1:
859                 file->f_pos += offset;
860                 break;
861         default:
862                 return -EINVAL;
863         }
864         force_successful_syscall_return();
865         return file->f_pos;
866 }
867
868 static const struct file_operations proc_mem_operations = {
869         .llseek         = mem_lseek,
870         .read           = mem_read,
871         .write          = mem_write,
872         .open           = mem_open,
873 };
874
875 static ssize_t environ_read(struct file *file, char __user *buf,
876                         size_t count, loff_t *ppos)
877 {
878         struct task_struct *task = get_proc_task(file->f_dentry->d_inode);
879         char *page;
880         unsigned long src = *ppos;
881         int ret = -ESRCH;
882         struct mm_struct *mm;
883
884         if (!task)
885                 goto out_no_task;
886
887         if (!ptrace_may_attach(task))
888                 goto out;
889
890         ret = -ENOMEM;
891         page = (char *)__get_free_page(GFP_TEMPORARY);
892         if (!page)
893                 goto out;
894
895         ret = 0;
896
897         mm = get_task_mm(task);
898         if (!mm)
899                 goto out_free;
900
901         while (count > 0) {
902                 int this_len, retval, max_len;
903
904                 this_len = mm->env_end - (mm->env_start + src);
905
906                 if (this_len <= 0)
907                         break;
908
909                 max_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
910                 this_len = (this_len > max_len) ? max_len : this_len;
911
912                 retval = access_process_vm(task, (mm->env_start + src),
913                         page, this_len, 0);
914
915                 if (retval <= 0) {
916                         ret = retval;
917                         break;
918                 }
919
920                 if (copy_to_user(buf, page, retval)) {
921                         ret = -EFAULT;
922                         break;
923                 }
924
925                 ret += retval;
926                 src += retval;
927                 buf += retval;
928                 count -= retval;
929         }
930         *ppos = src;
931
932         mmput(mm);
933 out_free:
934         free_page((unsigned long) page);
935 out:
936         put_task_struct(task);
937 out_no_task:
938         return ret;
939 }
940
941 static const struct file_operations proc_environ_operations = {
942         .read           = environ_read,
943 };
944
945 static ssize_t oom_adjust_read(struct file *file, char __user *buf,
946                                 size_t count, loff_t *ppos)
947 {
948         struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
949         char buffer[PROC_NUMBUF];
950         size_t len;
951         int oom_adjust;
952
953         if (!task)
954                 return -ESRCH;
955         oom_adjust = task->oomkilladj;
956         put_task_struct(task);
957
958         len = snprintf(buffer, sizeof(buffer), "%i\n", oom_adjust);
959
960         return simple_read_from_buffer(buf, count, ppos, buffer, len);
961 }
962
963 static ssize_t oom_adjust_write(struct file *file, const char __user *buf,
964                                 size_t count, loff_t *ppos)
965 {
966         struct task_struct *task;
967         char buffer[PROC_NUMBUF], *end;
968         int oom_adjust;
969
970         memset(buffer, 0, sizeof(buffer));
971         if (count > sizeof(buffer) - 1)
972                 count = sizeof(buffer) - 1;
973         if (copy_from_user(buffer, buf, count))
974                 return -EFAULT;
975         oom_adjust = simple_strtol(buffer, &end, 0);
976         if ((oom_adjust < OOM_ADJUST_MIN || oom_adjust > OOM_ADJUST_MAX) &&
977              oom_adjust != OOM_DISABLE)
978                 return -EINVAL;
979         if (*end == '\n')
980                 end++;
981         task = get_proc_task(file->f_path.dentry->d_inode);
982         if (!task)
983                 return -ESRCH;
984         if (oom_adjust < task->oomkilladj && !capable(CAP_SYS_RESOURCE)) {
985                 put_task_struct(task);
986                 return -EACCES;
987         }
988         task->oomkilladj = oom_adjust;
989         put_task_struct(task);
990         if (end - buffer == 0)
991                 return -EIO;
992         return end - buffer;
993 }
994
995 static const struct file_operations proc_oom_adjust_operations = {
996         .read           = oom_adjust_read,
997         .write          = oom_adjust_write,
998 };
999
1000 #ifdef CONFIG_AUDITSYSCALL
1001 #define TMPBUFLEN 21
1002 static ssize_t proc_loginuid_read(struct file * file, char __user * buf,
1003                                   size_t count, loff_t *ppos)
1004 {
1005         struct inode * inode = file->f_path.dentry->d_inode;
1006         struct task_struct *task = get_proc_task(inode);
1007         ssize_t length;
1008         char tmpbuf[TMPBUFLEN];
1009
1010         if (!task)
1011                 return -ESRCH;
1012         length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
1013                                 audit_get_loginuid(task));
1014         put_task_struct(task);
1015         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1016 }
1017
1018 static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
1019                                    size_t count, loff_t *ppos)
1020 {
1021         struct inode * inode = file->f_path.dentry->d_inode;
1022         char *page, *tmp;
1023         ssize_t length;
1024         uid_t loginuid;
1025
1026         if (!capable(CAP_AUDIT_CONTROL))
1027                 return -EPERM;
1028
1029         if (current != pid_task(proc_pid(inode), PIDTYPE_PID))
1030                 return -EPERM;
1031
1032         if (count >= PAGE_SIZE)
1033                 count = PAGE_SIZE - 1;
1034
1035         if (*ppos != 0) {
1036                 /* No partial writes. */
1037                 return -EINVAL;
1038         }
1039         page = (char*)__get_free_page(GFP_TEMPORARY);
1040         if (!page)
1041                 return -ENOMEM;
1042         length = -EFAULT;
1043         if (copy_from_user(page, buf, count))
1044                 goto out_free_page;
1045
1046         page[count] = '\0';
1047         loginuid = simple_strtoul(page, &tmp, 10);
1048         if (tmp == page) {
1049                 length = -EINVAL;
1050                 goto out_free_page;
1051
1052         }
1053         length = audit_set_loginuid(current, loginuid);
1054         if (likely(length == 0))
1055                 length = count;
1056
1057 out_free_page:
1058         free_page((unsigned long) page);
1059         return length;
1060 }
1061
1062 static const struct file_operations proc_loginuid_operations = {
1063         .read           = proc_loginuid_read,
1064         .write          = proc_loginuid_write,
1065 };
1066
1067 static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
1068                                   size_t count, loff_t *ppos)
1069 {
1070         struct inode * inode = file->f_path.dentry->d_inode;
1071         struct task_struct *task = get_proc_task(inode);
1072         ssize_t length;
1073         char tmpbuf[TMPBUFLEN];
1074
1075         if (!task)
1076                 return -ESRCH;
1077         length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
1078                                 audit_get_sessionid(task));
1079         put_task_struct(task);
1080         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1081 }
1082
1083 static const struct file_operations proc_sessionid_operations = {
1084         .read           = proc_sessionid_read,
1085 };
1086 #endif
1087
1088 #ifdef CONFIG_FAULT_INJECTION
1089 static ssize_t proc_fault_inject_read(struct file * file, char __user * buf,
1090                                       size_t count, loff_t *ppos)
1091 {
1092         struct task_struct *task = get_proc_task(file->f_dentry->d_inode);
1093         char buffer[PROC_NUMBUF];
1094         size_t len;
1095         int make_it_fail;
1096
1097         if (!task)
1098                 return -ESRCH;
1099         make_it_fail = task->make_it_fail;
1100         put_task_struct(task);
1101
1102         len = snprintf(buffer, sizeof(buffer), "%i\n", make_it_fail);
1103
1104         return simple_read_from_buffer(buf, count, ppos, buffer, len);
1105 }
1106
1107 static ssize_t proc_fault_inject_write(struct file * file,
1108                         const char __user * buf, size_t count, loff_t *ppos)
1109 {
1110         struct task_struct *task;
1111         char buffer[PROC_NUMBUF], *end;
1112         int make_it_fail;
1113
1114         if (!capable(CAP_SYS_RESOURCE))
1115                 return -EPERM;
1116         memset(buffer, 0, sizeof(buffer));
1117         if (count > sizeof(buffer) - 1)
1118                 count = sizeof(buffer) - 1;
1119         if (copy_from_user(buffer, buf, count))
1120                 return -EFAULT;
1121         make_it_fail = simple_strtol(buffer, &end, 0);
1122         if (*end == '\n')
1123                 end++;
1124         task = get_proc_task(file->f_dentry->d_inode);
1125         if (!task)
1126                 return -ESRCH;
1127         task->make_it_fail = make_it_fail;
1128         put_task_struct(task);
1129         if (end - buffer == 0)
1130                 return -EIO;
1131         return end - buffer;
1132 }
1133
1134 static const struct file_operations proc_fault_inject_operations = {
1135         .read           = proc_fault_inject_read,
1136         .write          = proc_fault_inject_write,
1137 };
1138 #endif
1139
1140
1141 #ifdef CONFIG_SCHED_DEBUG
1142 /*
1143  * Print out various scheduling related per-task fields:
1144  */
1145 static int sched_show(struct seq_file *m, void *v)
1146 {
1147         struct inode *inode = m->private;
1148         struct task_struct *p;
1149
1150         WARN_ON(!inode);
1151
1152         p = get_proc_task(inode);
1153         if (!p)
1154                 return -ESRCH;
1155         proc_sched_show_task(p, m);
1156
1157         put_task_struct(p);
1158
1159         return 0;
1160 }
1161
1162 static ssize_t
1163 sched_write(struct file *file, const char __user *buf,
1164             size_t count, loff_t *offset)
1165 {
1166         struct inode *inode = file->f_path.dentry->d_inode;
1167         struct task_struct *p;
1168
1169         WARN_ON(!inode);
1170
1171         p = get_proc_task(inode);
1172         if (!p)
1173                 return -ESRCH;
1174         proc_sched_set_task(p);
1175
1176         put_task_struct(p);
1177
1178         return count;
1179 }
1180
1181 static int sched_open(struct inode *inode, struct file *filp)
1182 {
1183         int ret;
1184
1185         ret = single_open(filp, sched_show, NULL);
1186         if (!ret) {
1187                 struct seq_file *m = filp->private_data;
1188
1189                 m->private = inode;
1190         }
1191         return ret;
1192 }
1193
1194 static const struct file_operations proc_pid_sched_operations = {
1195         .open           = sched_open,
1196         .read           = seq_read,
1197         .write          = sched_write,
1198         .llseek         = seq_lseek,
1199         .release        = single_release,
1200 };
1201
1202 #endif
1203
1204 /*
1205  * We added or removed a vma mapping the executable. The vmas are only mapped
1206  * during exec and are not mapped with the mmap system call.
1207  * Callers must hold down_write() on the mm's mmap_sem for these
1208  */
1209 void added_exe_file_vma(struct mm_struct *mm)
1210 {
1211         mm->num_exe_file_vmas++;
1212 }
1213
1214 void removed_exe_file_vma(struct mm_struct *mm)
1215 {
1216         mm->num_exe_file_vmas--;
1217         if ((mm->num_exe_file_vmas == 0) && mm->exe_file){
1218                 fput(mm->exe_file);
1219                 mm->exe_file = NULL;
1220         }
1221
1222 }
1223
1224 void set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file)
1225 {
1226         if (new_exe_file)
1227                 get_file(new_exe_file);
1228         if (mm->exe_file)
1229                 fput(mm->exe_file);
1230         mm->exe_file = new_exe_file;
1231         mm->num_exe_file_vmas = 0;
1232 }
1233
1234 struct file *get_mm_exe_file(struct mm_struct *mm)
1235 {
1236         struct file *exe_file;
1237
1238         /* We need mmap_sem to protect against races with removal of
1239          * VM_EXECUTABLE vmas */
1240         down_read(&mm->mmap_sem);
1241         exe_file = mm->exe_file;
1242         if (exe_file)
1243                 get_file(exe_file);
1244         up_read(&mm->mmap_sem);
1245         return exe_file;
1246 }
1247
1248 void dup_mm_exe_file(struct mm_struct *oldmm, struct mm_struct *newmm)
1249 {
1250         /* It's safe to write the exe_file pointer without exe_file_lock because
1251          * this is called during fork when the task is not yet in /proc */
1252         newmm->exe_file = get_mm_exe_file(oldmm);
1253 }
1254
1255 static int proc_exe_link(struct inode *inode, struct path *exe_path)
1256 {
1257         struct task_struct *task;
1258         struct mm_struct *mm;
1259         struct file *exe_file;
1260
1261         task = get_proc_task(inode);
1262         if (!task)
1263                 return -ENOENT;
1264         mm = get_task_mm(task);
1265         put_task_struct(task);
1266         if (!mm)
1267                 return -ENOENT;
1268         exe_file = get_mm_exe_file(mm);
1269         mmput(mm);
1270         if (exe_file) {
1271                 *exe_path = exe_file->f_path;
1272                 path_get(&exe_file->f_path);
1273                 fput(exe_file);
1274                 return 0;
1275         } else
1276                 return -ENOENT;
1277 }
1278
1279 static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
1280 {
1281         struct inode *inode = dentry->d_inode;
1282         int error = -EACCES;
1283
1284         /* We don't need a base pointer in the /proc filesystem */
1285         path_put(&nd->path);
1286
1287         /* Are we allowed to snoop on the tasks file descriptors? */
1288         if (!proc_fd_access_allowed(inode))
1289                 goto out;
1290
1291         error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
1292         nd->last_type = LAST_BIND;
1293 out:
1294         return ERR_PTR(error);
1295 }
1296
1297 static int do_proc_readlink(struct path *path, char __user *buffer, int buflen)
1298 {
1299         char *tmp = (char*)__get_free_page(GFP_TEMPORARY);
1300         char *pathname;
1301         int len;
1302
1303         if (!tmp)
1304                 return -ENOMEM;
1305
1306         pathname = d_path(path, tmp, PAGE_SIZE);
1307         len = PTR_ERR(pathname);
1308         if (IS_ERR(pathname))
1309                 goto out;
1310         len = tmp + PAGE_SIZE - 1 - pathname;
1311
1312         if (len > buflen)
1313                 len = buflen;
1314         if (copy_to_user(buffer, pathname, len))
1315                 len = -EFAULT;
1316  out:
1317         free_page((unsigned long)tmp);
1318         return len;
1319 }
1320
1321 static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int buflen)
1322 {
1323         int error = -EACCES;
1324         struct inode *inode = dentry->d_inode;
1325         struct path path;
1326
1327         /* Are we allowed to snoop on the tasks file descriptors? */
1328         if (!proc_fd_access_allowed(inode))
1329                 goto out;
1330
1331         error = PROC_I(inode)->op.proc_get_link(inode, &path);
1332         if (error)
1333                 goto out;
1334
1335         error = do_proc_readlink(&path, buffer, buflen);
1336         path_put(&path);
1337 out:
1338         return error;
1339 }
1340
1341 static const struct inode_operations proc_pid_link_inode_operations = {
1342         .readlink       = proc_pid_readlink,
1343         .follow_link    = proc_pid_follow_link,
1344         .setattr        = proc_setattr,
1345 };
1346
1347
1348 /* building an inode */
1349
1350 static int task_dumpable(struct task_struct *task)
1351 {
1352         int dumpable = 0;
1353         struct mm_struct *mm;
1354
1355         task_lock(task);
1356         mm = task->mm;
1357         if (mm)
1358                 dumpable = get_dumpable(mm);
1359         task_unlock(task);
1360         if(dumpable == 1)
1361                 return 1;
1362         return 0;
1363 }
1364
1365
1366 static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *task)
1367 {
1368         struct inode * inode;
1369         struct proc_inode *ei;
1370
1371         /* We need a new inode */
1372
1373         inode = new_inode(sb);
1374         if (!inode)
1375                 goto out;
1376
1377         /* Common stuff */
1378         ei = PROC_I(inode);
1379         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
1380         inode->i_op = &proc_def_inode_operations;
1381
1382         /*
1383          * grab the reference to task.
1384          */
1385         ei->pid = get_task_pid(task, PIDTYPE_PID);
1386         if (!ei->pid)
1387                 goto out_unlock;
1388
1389         inode->i_uid = 0;
1390         inode->i_gid = 0;
1391         if (task_dumpable(task)) {
1392                 inode->i_uid = task->euid;
1393                 inode->i_gid = task->egid;
1394         }
1395         security_task_to_inode(task, inode);
1396
1397 out:
1398         return inode;
1399
1400 out_unlock:
1401         iput(inode);
1402         return NULL;
1403 }
1404
1405 static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
1406 {
1407         struct inode *inode = dentry->d_inode;
1408         struct task_struct *task;
1409         generic_fillattr(inode, stat);
1410
1411         rcu_read_lock();
1412         stat->uid = 0;
1413         stat->gid = 0;
1414         task = pid_task(proc_pid(inode), PIDTYPE_PID);
1415         if (task) {
1416                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
1417                     task_dumpable(task)) {
1418                         stat->uid = task->euid;
1419                         stat->gid = task->egid;
1420                 }
1421         }
1422         rcu_read_unlock();
1423         return 0;
1424 }
1425
1426 /* dentry stuff */
1427
1428 /*
1429  *      Exceptional case: normally we are not allowed to unhash a busy
1430  * directory. In this case, however, we can do it - no aliasing problems
1431  * due to the way we treat inodes.
1432  *
1433  * Rewrite the inode's ownerships here because the owning task may have
1434  * performed a setuid(), etc.
1435  *
1436  * Before the /proc/pid/status file was created the only way to read
1437  * the effective uid of a /process was to stat /proc/pid.  Reading
1438  * /proc/pid/status is slow enough that procps and other packages
1439  * kept stating /proc/pid.  To keep the rules in /proc simple I have
1440  * made this apply to all per process world readable and executable
1441  * directories.
1442  */
1443 static int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
1444 {
1445         struct inode *inode = dentry->d_inode;
1446         struct task_struct *task = get_proc_task(inode);
1447         if (task) {
1448                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
1449                     task_dumpable(task)) {
1450                         inode->i_uid = task->euid;
1451                         inode->i_gid = task->egid;
1452                 } else {
1453                         inode->i_uid = 0;
1454                         inode->i_gid = 0;
1455                 }
1456                 inode->i_mode &= ~(S_ISUID | S_ISGID);
1457                 security_task_to_inode(task, inode);
1458                 put_task_struct(task);
1459                 return 1;
1460         }
1461         d_drop(dentry);
1462         return 0;
1463 }
1464
1465 static int pid_delete_dentry(struct dentry * dentry)
1466 {
1467         /* Is the task we represent dead?
1468          * If so, then don't put the dentry on the lru list,
1469          * kill it immediately.
1470          */
1471         return !proc_pid(dentry->d_inode)->tasks[PIDTYPE_PID].first;
1472 }
1473
1474 static struct dentry_operations pid_dentry_operations =
1475 {
1476         .d_revalidate   = pid_revalidate,
1477         .d_delete       = pid_delete_dentry,
1478 };
1479
1480 /* Lookups */
1481
1482 typedef struct dentry *instantiate_t(struct inode *, struct dentry *,
1483                                 struct task_struct *, const void *);
1484
1485 /*
1486  * Fill a directory entry.
1487  *
1488  * If possible create the dcache entry and derive our inode number and
1489  * file type from dcache entry.
1490  *
1491  * Since all of the proc inode numbers are dynamically generated, the inode
1492  * numbers do not exist until the inode is cache.  This means creating the
1493  * the dcache entry in readdir is necessary to keep the inode numbers
1494  * reported by readdir in sync with the inode numbers reported
1495  * by stat.
1496  */
1497 static int proc_fill_cache(struct file *filp, void *dirent, filldir_t filldir,
1498         char *name, int len,
1499         instantiate_t instantiate, struct task_struct *task, const void *ptr)
1500 {
1501         struct dentry *child, *dir = filp->f_path.dentry;
1502         struct inode *inode;
1503         struct qstr qname;
1504         ino_t ino = 0;
1505         unsigned type = DT_UNKNOWN;
1506
1507         qname.name = name;
1508         qname.len  = len;
1509         qname.hash = full_name_hash(name, len);
1510
1511         child = d_lookup(dir, &qname);
1512         if (!child) {
1513                 struct dentry *new;
1514                 new = d_alloc(dir, &qname);
1515                 if (new) {
1516                         child = instantiate(dir->d_inode, new, task, ptr);
1517                         if (child)
1518                                 dput(new);
1519                         else
1520                                 child = new;
1521                 }
1522         }
1523         if (!child || IS_ERR(child) || !child->d_inode)
1524                 goto end_instantiate;
1525         inode = child->d_inode;
1526         if (inode) {
1527                 ino = inode->i_ino;
1528                 type = inode->i_mode >> 12;
1529         }
1530         dput(child);
1531 end_instantiate:
1532         if (!ino)
1533                 ino = find_inode_number(dir, &qname);
1534         if (!ino)
1535                 ino = 1;
1536         return filldir(dirent, name, len, filp->f_pos, ino, type);
1537 }
1538
1539 static unsigned name_to_int(struct dentry *dentry)
1540 {
1541         const char *name = dentry->d_name.name;
1542         int len = dentry->d_name.len;
1543         unsigned n = 0;
1544
1545         if (len > 1 && *name == '0')
1546                 goto out;
1547         while (len-- > 0) {
1548                 unsigned c = *name++ - '0';
1549                 if (c > 9)
1550                         goto out;
1551                 if (n >= (~0U-9)/10)
1552                         goto out;
1553                 n *= 10;
1554                 n += c;
1555         }
1556         return n;
1557 out:
1558         return ~0U;
1559 }
1560
1561 #define PROC_FDINFO_MAX 64
1562
1563 static int proc_fd_info(struct inode *inode, struct path *path, char *info)
1564 {
1565         struct task_struct *task = get_proc_task(inode);
1566         struct files_struct *files = NULL;
1567         struct file *file;
1568         int fd = proc_fd(inode);
1569
1570         if (task) {
1571                 files = get_files_struct(task);
1572                 put_task_struct(task);
1573         }
1574         if (files) {
1575                 /*
1576                  * We are not taking a ref to the file structure, so we must
1577                  * hold ->file_lock.
1578                  */
1579                 spin_lock(&files->file_lock);
1580                 file = fcheck_files(files, fd);
1581                 if (file) {
1582                         if (path) {
1583                                 *path = file->f_path;
1584                                 path_get(&file->f_path);
1585                         }
1586                         if (info)
1587                                 snprintf(info, PROC_FDINFO_MAX,
1588                                          "pos:\t%lli\n"
1589                                          "flags:\t0%o\n",
1590                                          (long long) file->f_pos,
1591                                          file->f_flags);
1592                         spin_unlock(&files->file_lock);
1593                         put_files_struct(files);
1594                         return 0;
1595                 }
1596                 spin_unlock(&files->file_lock);
1597                 put_files_struct(files);
1598         }
1599         return -ENOENT;
1600 }
1601
1602 static int proc_fd_link(struct inode *inode, struct path *path)
1603 {
1604         return proc_fd_info(inode, path, NULL);
1605 }
1606
1607 static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
1608 {
1609         struct inode *inode = dentry->d_inode;
1610         struct task_struct *task = get_proc_task(inode);
1611         int fd = proc_fd(inode);
1612         struct files_struct *files;
1613
1614         if (task) {
1615                 files = get_files_struct(task);
1616                 if (files) {
1617                         rcu_read_lock();
1618                         if (fcheck_files(files, fd)) {
1619                                 rcu_read_unlock();
1620                                 put_files_struct(files);
1621                                 if (task_dumpable(task)) {
1622                                         inode->i_uid = task->euid;
1623                                         inode->i_gid = task->egid;
1624                                 } else {
1625                                         inode->i_uid = 0;
1626                                         inode->i_gid = 0;
1627                                 }
1628                                 inode->i_mode &= ~(S_ISUID | S_ISGID);
1629                                 security_task_to_inode(task, inode);
1630                                 put_task_struct(task);
1631                                 return 1;
1632                         }
1633                         rcu_read_unlock();
1634                         put_files_struct(files);
1635                 }
1636                 put_task_struct(task);
1637         }
1638         d_drop(dentry);
1639         return 0;
1640 }
1641
1642 static struct dentry_operations tid_fd_dentry_operations =
1643 {
1644         .d_revalidate   = tid_fd_revalidate,
1645         .d_delete       = pid_delete_dentry,
1646 };
1647
1648 static struct dentry *proc_fd_instantiate(struct inode *dir,
1649         struct dentry *dentry, struct task_struct *task, const void *ptr)
1650 {
1651         unsigned fd = *(const unsigned *)ptr;
1652         struct file *file;
1653         struct files_struct *files;
1654         struct inode *inode;
1655         struct proc_inode *ei;
1656         struct dentry *error = ERR_PTR(-ENOENT);
1657
1658         inode = proc_pid_make_inode(dir->i_sb, task);
1659         if (!inode)
1660                 goto out;
1661         ei = PROC_I(inode);
1662         ei->fd = fd;
1663         files = get_files_struct(task);
1664         if (!files)
1665                 goto out_iput;
1666         inode->i_mode = S_IFLNK;
1667
1668         /*
1669          * We are not taking a ref to the file structure, so we must
1670          * hold ->file_lock.
1671          */
1672         spin_lock(&files->file_lock);
1673         file = fcheck_files(files, fd);
1674         if (!file)
1675                 goto out_unlock;
1676         if (file->f_mode & 1)
1677                 inode->i_mode |= S_IRUSR | S_IXUSR;
1678         if (file->f_mode & 2)
1679                 inode->i_mode |= S_IWUSR | S_IXUSR;
1680         spin_unlock(&files->file_lock);
1681         put_files_struct(files);
1682
1683         inode->i_op = &proc_pid_link_inode_operations;
1684         inode->i_size = 64;
1685         ei->op.proc_get_link = proc_fd_link;
1686         dentry->d_op = &tid_fd_dentry_operations;
1687         d_add(dentry, inode);
1688         /* Close the race of the process dying before we return the dentry */
1689         if (tid_fd_revalidate(dentry, NULL))
1690                 error = NULL;
1691
1692  out:
1693         return error;
1694 out_unlock:
1695         spin_unlock(&files->file_lock);
1696         put_files_struct(files);
1697 out_iput:
1698         iput(inode);
1699         goto out;
1700 }
1701
1702 static struct dentry *proc_lookupfd_common(struct inode *dir,
1703                                            struct dentry *dentry,
1704                                            instantiate_t instantiate)
1705 {
1706         struct task_struct *task = get_proc_task(dir);
1707         unsigned fd = name_to_int(dentry);
1708         struct dentry *result = ERR_PTR(-ENOENT);
1709
1710         if (!task)
1711                 goto out_no_task;
1712         if (fd == ~0U)
1713                 goto out;
1714
1715         result = instantiate(dir, dentry, task, &fd);
1716 out:
1717         put_task_struct(task);
1718 out_no_task:
1719         return result;
1720 }
1721
1722 static int proc_readfd_common(struct file * filp, void * dirent,
1723                               filldir_t filldir, instantiate_t instantiate)
1724 {
1725         struct dentry *dentry = filp->f_path.dentry;
1726         struct inode *inode = dentry->d_inode;
1727         struct task_struct *p = get_proc_task(inode);
1728         unsigned int fd, ino;
1729         int retval;
1730         struct files_struct * files;
1731
1732         retval = -ENOENT;
1733         if (!p)
1734                 goto out_no_task;
1735         retval = 0;
1736
1737         fd = filp->f_pos;
1738         switch (fd) {
1739                 case 0:
1740                         if (filldir(dirent, ".", 1, 0, inode->i_ino, DT_DIR) < 0)
1741                                 goto out;
1742                         filp->f_pos++;
1743                 case 1:
1744                         ino = parent_ino(dentry);
1745                         if (filldir(dirent, "..", 2, 1, ino, DT_DIR) < 0)
1746                                 goto out;
1747                         filp->f_pos++;
1748                 default:
1749                         files = get_files_struct(p);
1750                         if (!files)
1751                                 goto out;
1752                         rcu_read_lock();
1753                         for (fd = filp->f_pos-2;
1754                              fd < files_fdtable(files)->max_fds;
1755                              fd++, filp->f_pos++) {
1756                                 char name[PROC_NUMBUF];
1757                                 int len;
1758
1759                                 if (!fcheck_files(files, fd))
1760                                         continue;
1761                                 rcu_read_unlock();
1762
1763                                 len = snprintf(name, sizeof(name), "%d", fd);
1764                                 if (proc_fill_cache(filp, dirent, filldir,
1765                                                     name, len, instantiate,
1766                                                     p, &fd) < 0) {
1767                                         rcu_read_lock();
1768                                         break;
1769                                 }
1770                                 rcu_read_lock();
1771                         }
1772                         rcu_read_unlock();
1773                         put_files_struct(files);
1774         }
1775 out:
1776         put_task_struct(p);
1777 out_no_task:
1778         return retval;
1779 }
1780
1781 static struct dentry *proc_lookupfd(struct inode *dir, struct dentry *dentry,
1782                                     struct nameidata *nd)
1783 {
1784         return proc_lookupfd_common(dir, dentry, proc_fd_instantiate);
1785 }
1786
1787 static int proc_readfd(struct file *filp, void *dirent, filldir_t filldir)
1788 {
1789         return proc_readfd_common(filp, dirent, filldir, proc_fd_instantiate);
1790 }
1791
1792 static ssize_t proc_fdinfo_read(struct file *file, char __user *buf,
1793                                       size_t len, loff_t *ppos)
1794 {
1795         char tmp[PROC_FDINFO_MAX];
1796         int err = proc_fd_info(file->f_path.dentry->d_inode, NULL, tmp);
1797         if (!err)
1798                 err = simple_read_from_buffer(buf, len, ppos, tmp, strlen(tmp));
1799         return err;
1800 }
1801
1802 static const struct file_operations proc_fdinfo_file_operations = {
1803         .open           = nonseekable_open,
1804         .read           = proc_fdinfo_read,
1805 };
1806
1807 static const struct file_operations proc_fd_operations = {
1808         .read           = generic_read_dir,
1809         .readdir        = proc_readfd,
1810 };
1811
1812 /*
1813  * /proc/pid/fd needs a special permission handler so that a process can still
1814  * access /proc/self/fd after it has executed a setuid().
1815  */
1816 static int proc_fd_permission(struct inode *inode, int mask,
1817                                 struct nameidata *nd)
1818 {
1819         int rv;
1820
1821         rv = generic_permission(inode, mask, NULL);
1822         if (rv == 0)
1823                 return 0;
1824         if (task_pid(current) == proc_pid(inode))
1825                 rv = 0;
1826         return rv;
1827 }
1828
1829 /*
1830  * proc directories can do almost nothing..
1831  */
1832 static const struct inode_operations proc_fd_inode_operations = {
1833         .lookup         = proc_lookupfd,
1834         .permission     = proc_fd_permission,
1835         .setattr        = proc_setattr,
1836 };
1837
1838 static struct dentry *proc_fdinfo_instantiate(struct inode *dir,
1839         struct dentry *dentry, struct task_struct *task, const void *ptr)
1840 {
1841         unsigned fd = *(unsigned *)ptr;
1842         struct inode *inode;
1843         struct proc_inode *ei;
1844         struct dentry *error = ERR_PTR(-ENOENT);
1845
1846         inode = proc_pid_make_inode(dir->i_sb, task);
1847         if (!inode)
1848                 goto out;
1849         ei = PROC_I(inode);
1850         ei->fd = fd;
1851         inode->i_mode = S_IFREG | S_IRUSR;
1852         inode->i_fop = &proc_fdinfo_file_operations;
1853         dentry->d_op = &tid_fd_dentry_operations;
1854         d_add(dentry, inode);
1855         /* Close the race of the process dying before we return the dentry */
1856         if (tid_fd_revalidate(dentry, NULL))
1857                 error = NULL;
1858
1859  out:
1860         return error;
1861 }
1862
1863 static struct dentry *proc_lookupfdinfo(struct inode *dir,
1864                                         struct dentry *dentry,
1865                                         struct nameidata *nd)
1866 {
1867         return proc_lookupfd_common(dir, dentry, proc_fdinfo_instantiate);
1868 }
1869
1870 static int proc_readfdinfo(struct file *filp, void *dirent, filldir_t filldir)
1871 {
1872         return proc_readfd_common(filp, dirent, filldir,
1873                                   proc_fdinfo_instantiate);
1874 }
1875
1876 static const struct file_operations proc_fdinfo_operations = {
1877         .read           = generic_read_dir,
1878         .readdir        = proc_readfdinfo,
1879 };
1880
1881 /*
1882  * proc directories can do almost nothing..
1883  */
1884 static const struct inode_operations proc_fdinfo_inode_operations = {
1885         .lookup         = proc_lookupfdinfo,
1886         .setattr        = proc_setattr,
1887 };
1888
1889
1890 static struct dentry *proc_pident_instantiate(struct inode *dir,
1891         struct dentry *dentry, struct task_struct *task, const void *ptr)
1892 {
1893         const struct pid_entry *p = ptr;
1894         struct inode *inode;
1895         struct proc_inode *ei;
1896         struct dentry *error = ERR_PTR(-EINVAL);
1897
1898         inode = proc_pid_make_inode(dir->i_sb, task);
1899         if (!inode)
1900                 goto out;
1901
1902         ei = PROC_I(inode);
1903         inode->i_mode = p->mode;
1904         if (S_ISDIR(inode->i_mode))
1905                 inode->i_nlink = 2;     /* Use getattr to fix if necessary */
1906         if (p->iop)
1907                 inode->i_op = p->iop;
1908         if (p->fop)
1909                 inode->i_fop = p->fop;
1910         ei->op = p->op;
1911         dentry->d_op = &pid_dentry_operations;
1912         d_add(dentry, inode);
1913         /* Close the race of the process dying before we return the dentry */
1914         if (pid_revalidate(dentry, NULL))
1915                 error = NULL;
1916 out:
1917         return error;
1918 }
1919
1920 static struct dentry *proc_pident_lookup(struct inode *dir, 
1921                                          struct dentry *dentry,
1922                                          const struct pid_entry *ents,
1923                                          unsigned int nents)
1924 {
1925         struct inode *inode;
1926         struct dentry *error;
1927         struct task_struct *task = get_proc_task(dir);
1928         const struct pid_entry *p, *last;
1929
1930         error = ERR_PTR(-ENOENT);
1931         inode = NULL;
1932
1933         if (!task)
1934                 goto out_no_task;
1935
1936         /*
1937          * Yes, it does not scale. And it should not. Don't add
1938          * new entries into /proc/<tgid>/ without very good reasons.
1939          */
1940         last = &ents[nents - 1];
1941         for (p = ents; p <= last; p++) {
1942                 if (p->len != dentry->d_name.len)
1943                         continue;
1944                 if (!memcmp(dentry->d_name.name, p->name, p->len))
1945                         break;
1946         }
1947         if (p > last)
1948                 goto out;
1949
1950         error = proc_pident_instantiate(dir, dentry, task, p);
1951 out:
1952         put_task_struct(task);
1953 out_no_task:
1954         return error;
1955 }
1956
1957 static int proc_pident_fill_cache(struct file *filp, void *dirent,
1958         filldir_t filldir, struct task_struct *task, const struct pid_entry *p)
1959 {
1960         return proc_fill_cache(filp, dirent, filldir, p->name, p->len,
1961                                 proc_pident_instantiate, task, p);
1962 }
1963
1964 static int proc_pident_readdir(struct file *filp,
1965                 void *dirent, filldir_t filldir,
1966                 const struct pid_entry *ents, unsigned int nents)
1967 {
1968         int i;
1969         struct dentry *dentry = filp->f_path.dentry;
1970         struct inode *inode = dentry->d_inode;
1971         struct task_struct *task = get_proc_task(inode);
1972         const struct pid_entry *p, *last;
1973         ino_t ino;
1974         int ret;
1975
1976         ret = -ENOENT;
1977         if (!task)
1978                 goto out_no_task;
1979
1980         ret = 0;
1981         i = filp->f_pos;
1982         switch (i) {
1983         case 0:
1984                 ino = inode->i_ino;
1985                 if (filldir(dirent, ".", 1, i, ino, DT_DIR) < 0)
1986                         goto out;
1987                 i++;
1988                 filp->f_pos++;
1989                 /* fall through */
1990         case 1:
1991                 ino = parent_ino(dentry);
1992                 if (filldir(dirent, "..", 2, i, ino, DT_DIR) < 0)
1993                         goto out;
1994                 i++;
1995                 filp->f_pos++;
1996                 /* fall through */
1997         default:
1998                 i -= 2;
1999                 if (i >= nents) {
2000                         ret = 1;
2001                         goto out;
2002                 }
2003                 p = ents + i;
2004                 last = &ents[nents - 1];
2005                 while (p <= last) {
2006                         if (proc_pident_fill_cache(filp, dirent, filldir, task, p) < 0)
2007                                 goto out;
2008                         filp->f_pos++;
2009                         p++;
2010                 }
2011         }
2012
2013         ret = 1;
2014 out:
2015         put_task_struct(task);
2016 out_no_task:
2017         return ret;
2018 }
2019
2020 #ifdef CONFIG_SECURITY
2021 static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,
2022                                   size_t count, loff_t *ppos)
2023 {
2024         struct inode * inode = file->f_path.dentry->d_inode;
2025         char *p = NULL;
2026         ssize_t length;
2027         struct task_struct *task = get_proc_task(inode);
2028
2029         if (!task)
2030                 return -ESRCH;
2031
2032         length = security_getprocattr(task,
2033                                       (char*)file->f_path.dentry->d_name.name,
2034                                       &p);
2035         put_task_struct(task);
2036         if (length > 0)
2037                 length = simple_read_from_buffer(buf, count, ppos, p, length);
2038         kfree(p);
2039         return length;
2040 }
2041
2042 static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
2043                                    size_t count, loff_t *ppos)
2044 {
2045         struct inode * inode = file->f_path.dentry->d_inode;
2046         char *page;
2047         ssize_t length;
2048         struct task_struct *task = get_proc_task(inode);
2049
2050         length = -ESRCH;
2051         if (!task)
2052                 goto out_no_task;
2053         if (count > PAGE_SIZE)
2054                 count = PAGE_SIZE;
2055
2056         /* No partial writes. */
2057         length = -EINVAL;
2058         if (*ppos != 0)
2059                 goto out;
2060
2061         length = -ENOMEM;
2062         page = (char*)__get_free_page(GFP_TEMPORARY);
2063         if (!page)
2064                 goto out;
2065
2066         length = -EFAULT;
2067         if (copy_from_user(page, buf, count))
2068                 goto out_free;
2069
2070         length = security_setprocattr(task,
2071                                       (char*)file->f_path.dentry->d_name.name,
2072                                       (void*)page, count);
2073 out_free:
2074         free_page((unsigned long) page);
2075 out:
2076         put_task_struct(task);
2077 out_no_task:
2078         return length;
2079 }
2080
2081 static const struct file_operations proc_pid_attr_operations = {
2082         .read           = proc_pid_attr_read,
2083         .write          = proc_pid_attr_write,
2084 };
2085
2086 static const struct pid_entry attr_dir_stuff[] = {
2087         REG("current",    S_IRUGO|S_IWUGO, pid_attr),
2088         REG("prev",       S_IRUGO,         pid_attr),
2089         REG("exec",       S_IRUGO|S_IWUGO, pid_attr),
2090         REG("fscreate",   S_IRUGO|S_IWUGO, pid_attr),
2091         REG("keycreate",  S_IRUGO|S_IWUGO, pid_attr),
2092         REG("sockcreate", S_IRUGO|S_IWUGO, pid_attr),
2093 };
2094
2095 static int proc_attr_dir_readdir(struct file * filp,
2096                              void * dirent, filldir_t filldir)
2097 {
2098         return proc_pident_readdir(filp,dirent,filldir,
2099                                    attr_dir_stuff,ARRAY_SIZE(attr_dir_stuff));
2100 }
2101
2102 static const struct file_operations proc_attr_dir_operations = {
2103         .read           = generic_read_dir,
2104         .readdir        = proc_attr_dir_readdir,
2105 };
2106
2107 static struct dentry *proc_attr_dir_lookup(struct inode *dir,
2108                                 struct dentry *dentry, struct nameidata *nd)
2109 {
2110         return proc_pident_lookup(dir, dentry,
2111                                   attr_dir_stuff, ARRAY_SIZE(attr_dir_stuff));
2112 }
2113
2114 static const struct inode_operations proc_attr_dir_inode_operations = {
2115         .lookup         = proc_attr_dir_lookup,
2116         .getattr        = pid_getattr,
2117         .setattr        = proc_setattr,
2118 };
2119
2120 #endif
2121
2122 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
2123 static ssize_t proc_coredump_filter_read(struct file *file, char __user *buf,
2124                                          size_t count, loff_t *ppos)
2125 {
2126         struct task_struct *task = get_proc_task(file->f_dentry->d_inode);
2127         struct mm_struct *mm;
2128         char buffer[PROC_NUMBUF];
2129         size_t len;
2130         int ret;
2131
2132         if (!task)
2133                 return -ESRCH;
2134
2135         ret = 0;
2136         mm = get_task_mm(task);
2137         if (mm) {
2138                 len = snprintf(buffer, sizeof(buffer), "%08lx\n",
2139                                ((mm->flags & MMF_DUMP_FILTER_MASK) >>
2140                                 MMF_DUMP_FILTER_SHIFT));
2141                 mmput(mm);
2142                 ret = simple_read_from_buffer(buf, count, ppos, buffer, len);
2143         }
2144
2145         put_task_struct(task);
2146
2147         return ret;
2148 }
2149
2150 static ssize_t proc_coredump_filter_write(struct file *file,
2151                                           const char __user *buf,
2152                                           size_t count,
2153                                           loff_t *ppos)
2154 {
2155         struct task_struct *task;
2156         struct mm_struct *mm;
2157         char buffer[PROC_NUMBUF], *end;
2158         unsigned int val;
2159         int ret;
2160         int i;
2161         unsigned long mask;
2162
2163         ret = -EFAULT;
2164         memset(buffer, 0, sizeof(buffer));
2165         if (count > sizeof(buffer) - 1)
2166                 count = sizeof(buffer) - 1;
2167         if (copy_from_user(buffer, buf, count))
2168                 goto out_no_task;
2169
2170         ret = -EINVAL;
2171         val = (unsigned int)simple_strtoul(buffer, &end, 0);
2172         if (*end == '\n')
2173                 end++;
2174         if (end - buffer == 0)
2175                 goto out_no_task;
2176
2177         ret = -ESRCH;
2178         task = get_proc_task(file->f_dentry->d_inode);
2179         if (!task)
2180                 goto out_no_task;
2181
2182         ret = end - buffer;
2183         mm = get_task_mm(task);
2184         if (!mm)
2185                 goto out_no_mm;
2186
2187         for (i = 0, mask = 1; i < MMF_DUMP_FILTER_BITS; i++, mask <<= 1) {
2188                 if (val & mask)
2189                         set_bit(i + MMF_DUMP_FILTER_SHIFT, &mm->flags);
2190                 else
2191                         clear_bit(i + MMF_DUMP_FILTER_SHIFT, &mm->flags);
2192         }
2193
2194         mmput(mm);
2195  out_no_mm:
2196         put_task_struct(task);
2197  out_no_task:
2198         return ret;
2199 }
2200
2201 static const struct file_operations proc_coredump_filter_operations = {
2202         .read           = proc_coredump_filter_read,
2203         .write          = proc_coredump_filter_write,
2204 };
2205 #endif
2206
2207 /*
2208  * /proc/self:
2209  */
2210 static int proc_self_readlink(struct dentry *dentry, char __user *buffer,
2211                               int buflen)
2212 {
2213         struct pid_namespace *ns = dentry->d_sb->s_fs_info;
2214         pid_t tgid = task_tgid_nr_ns(current, ns);
2215         char tmp[PROC_NUMBUF];
2216         if (!tgid)
2217                 return -ENOENT;
2218         sprintf(tmp, "%d", tgid);
2219         return vfs_readlink(dentry,buffer,buflen,tmp);
2220 }
2221
2222 static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
2223 {
2224         struct pid_namespace *ns = dentry->d_sb->s_fs_info;
2225         pid_t tgid = task_tgid_nr_ns(current, ns);
2226         char tmp[PROC_NUMBUF];
2227         if (!tgid)
2228                 return ERR_PTR(-ENOENT);
2229         sprintf(tmp, "%d", task_tgid_nr_ns(current, ns));
2230         return ERR_PTR(vfs_follow_link(nd,tmp));
2231 }
2232
2233 static const struct inode_operations proc_self_inode_operations = {
2234         .readlink       = proc_self_readlink,
2235         .follow_link    = proc_self_follow_link,
2236 };
2237
2238 /*
2239  * proc base
2240  *
2241  * These are the directory entries in the root directory of /proc
2242  * that properly belong to the /proc filesystem, as they describe
2243  * describe something that is process related.
2244  */
2245 static const struct pid_entry proc_base_stuff[] = {
2246         NOD("self", S_IFLNK|S_IRWXUGO,
2247                 &proc_self_inode_operations, NULL, {}),
2248 };
2249
2250 /*
2251  *      Exceptional case: normally we are not allowed to unhash a busy
2252  * directory. In this case, however, we can do it - no aliasing problems
2253  * due to the way we treat inodes.
2254  */
2255 static int proc_base_revalidate(struct dentry *dentry, struct nameidata *nd)
2256 {
2257         struct inode *inode = dentry->d_inode;
2258         struct task_struct *task = get_proc_task(inode);
2259         if (task) {
2260                 put_task_struct(task);
2261                 return 1;
2262         }
2263         d_drop(dentry);
2264         return 0;
2265 }
2266
2267 static struct dentry_operations proc_base_dentry_operations =
2268 {
2269         .d_revalidate   = proc_base_revalidate,
2270         .d_delete       = pid_delete_dentry,
2271 };
2272
2273 static struct dentry *proc_base_instantiate(struct inode *dir,
2274         struct dentry *dentry, struct task_struct *task, const void *ptr)
2275 {
2276         const struct pid_entry *p = ptr;
2277         struct inode *inode;
2278         struct proc_inode *ei;
2279         struct dentry *error = ERR_PTR(-EINVAL);
2280
2281         /* Allocate the inode */
2282         error = ERR_PTR(-ENOMEM);
2283         inode = new_inode(dir->i_sb);
2284         if (!inode)
2285                 goto out;
2286
2287         /* Initialize the inode */
2288         ei = PROC_I(inode);
2289         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
2290
2291         /*
2292          * grab the reference to the task.
2293          */
2294         ei->pid = get_task_pid(task, PIDTYPE_PID);
2295         if (!ei->pid)
2296                 goto out_iput;
2297
2298         inode->i_uid = 0;
2299         inode->i_gid = 0;
2300         inode->i_mode = p->mode;
2301         if (S_ISDIR(inode->i_mode))
2302                 inode->i_nlink = 2;
2303         if (S_ISLNK(inode->i_mode))
2304                 inode->i_size = 64;
2305         if (p->iop)
2306                 inode->i_op = p->iop;
2307         if (p->fop)
2308                 inode->i_fop = p->fop;
2309         ei->op = p->op;
2310         dentry->d_op = &proc_base_dentry_operations;
2311         d_add(dentry, inode);
2312         error = NULL;
2313 out:
2314         return error;
2315 out_iput:
2316         iput(inode);
2317         goto out;
2318 }
2319
2320 static struct dentry *proc_base_lookup(struct inode *dir, struct dentry *dentry)
2321 {
2322         struct dentry *error;
2323         struct task_struct *task = get_proc_task(dir);
2324         const struct pid_entry *p, *last;
2325
2326         error = ERR_PTR(-ENOENT);
2327
2328         if (!task)
2329                 goto out_no_task;
2330
2331         /* Lookup the directory entry */
2332         last = &proc_base_stuff[ARRAY_SIZE(proc_base_stuff) - 1];
2333         for (p = proc_base_stuff; p <= last; p++) {
2334                 if (p->len != dentry->d_name.len)
2335                         continue;
2336                 if (!memcmp(dentry->d_name.name, p->name, p->len))
2337                         break;
2338         }
2339         if (p > last)
2340                 goto out;
2341
2342         error = proc_base_instantiate(dir, dentry, task, p);
2343
2344 out:
2345         put_task_struct(task);
2346 out_no_task:
2347         return error;
2348 }
2349
2350 static int proc_base_fill_cache(struct file *filp, void *dirent,
2351         filldir_t filldir, struct task_struct *task, const struct pid_entry *p)
2352 {
2353         return proc_fill_cache(filp, dirent, filldir, p->name, p->len,
2354                                 proc_base_instantiate, task, p);
2355 }
2356
2357 #ifdef CONFIG_TASK_IO_ACCOUNTING
2358 static int proc_pid_io_accounting(struct task_struct *task, char *buffer)
2359 {
2360         return sprintf(buffer,
2361 #ifdef CONFIG_TASK_XACCT
2362                         "rchar: %llu\n"
2363                         "wchar: %llu\n"
2364                         "syscr: %llu\n"
2365                         "syscw: %llu\n"
2366 #endif
2367                         "read_bytes: %llu\n"
2368                         "write_bytes: %llu\n"
2369                         "cancelled_write_bytes: %llu\n",
2370 #ifdef CONFIG_TASK_XACCT
2371                         (unsigned long long)task->rchar,
2372                         (unsigned long long)task->wchar,
2373                         (unsigned long long)task->syscr,
2374                         (unsigned long long)task->syscw,
2375 #endif
2376                         (unsigned long long)task->ioac.read_bytes,
2377                         (unsigned long long)task->ioac.write_bytes,
2378                         (unsigned long long)task->ioac.cancelled_write_bytes);
2379 }
2380 #endif
2381
2382 /*
2383  * Thread groups
2384  */
2385 static const struct file_operations proc_task_operations;
2386 static const struct inode_operations proc_task_inode_operations;
2387
2388 static const struct pid_entry tgid_base_stuff[] = {
2389         DIR("task",       S_IRUGO|S_IXUGO, task),
2390         DIR("fd",         S_IRUSR|S_IXUSR, fd),
2391         DIR("fdinfo",     S_IRUSR|S_IXUSR, fdinfo),
2392 #ifdef CONFIG_NET
2393         DIR("net",        S_IRUGO|S_IXUGO, net),
2394 #endif
2395         REG("environ",    S_IRUSR, environ),
2396         INF("auxv",       S_IRUSR, pid_auxv),
2397         ONE("status",     S_IRUGO, pid_status),
2398         INF("limits",     S_IRUSR, pid_limits),
2399 #ifdef CONFIG_SCHED_DEBUG
2400         REG("sched",      S_IRUGO|S_IWUSR, pid_sched),
2401 #endif
2402         INF("cmdline",    S_IRUGO, pid_cmdline),
2403         ONE("stat",       S_IRUGO, tgid_stat),
2404         ONE("statm",      S_IRUGO, pid_statm),
2405         REG("maps",       S_IRUGO, maps),
2406 #ifdef CONFIG_NUMA
2407         REG("numa_maps",  S_IRUGO, numa_maps),
2408 #endif
2409         REG("mem",        S_IRUSR|S_IWUSR, mem),
2410         LNK("cwd",        cwd),
2411         LNK("root",       root),
2412         LNK("exe",        exe),
2413         REG("mounts",     S_IRUGO, mounts),
2414         REG("mountinfo",  S_IRUGO, mountinfo),
2415         REG("mountstats", S_IRUSR, mountstats),
2416 #ifdef CONFIG_PROC_PAGE_MONITOR
2417         REG("clear_refs", S_IWUSR, clear_refs),
2418         REG("smaps",      S_IRUGO, smaps),
2419         REG("pagemap",    S_IRUSR, pagemap),
2420 #endif
2421 #ifdef CONFIG_SECURITY
2422         DIR("attr",       S_IRUGO|S_IXUGO, attr_dir),
2423 #endif
2424 #ifdef CONFIG_KALLSYMS
2425         INF("wchan",      S_IRUGO, pid_wchan),
2426 #endif
2427 #ifdef CONFIG_SCHEDSTATS
2428         INF("schedstat",  S_IRUGO, pid_schedstat),
2429 #endif
2430 #ifdef CONFIG_LATENCYTOP
2431         REG("latency",  S_IRUGO, lstats),
2432 #endif
2433 #ifdef CONFIG_PROC_PID_CPUSET
2434         REG("cpuset",     S_IRUGO, cpuset),
2435 #endif
2436 #ifdef CONFIG_CGROUPS
2437         REG("cgroup",  S_IRUGO, cgroup),
2438 #endif
2439         INF("oom_score",  S_IRUGO, oom_score),
2440         REG("oom_adj",    S_IRUGO|S_IWUSR, oom_adjust),
2441 #ifdef CONFIG_AUDITSYSCALL
2442         REG("loginuid",   S_IWUSR|S_IRUGO, loginuid),
2443         REG("sessionid",  S_IRUSR, sessionid),
2444 #endif
2445 #ifdef CONFIG_FAULT_INJECTION
2446         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
2447 #endif
2448 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
2449         REG("coredump_filter", S_IRUGO|S_IWUSR, coredump_filter),
2450 #endif
2451 #ifdef CONFIG_TASK_IO_ACCOUNTING
2452         INF("io",       S_IRUGO, pid_io_accounting),
2453 #endif
2454 };
2455
2456 static int proc_tgid_base_readdir(struct file * filp,
2457                              void * dirent, filldir_t filldir)
2458 {
2459         return proc_pident_readdir(filp,dirent,filldir,
2460                                    tgid_base_stuff,ARRAY_SIZE(tgid_base_stuff));
2461 }
2462
2463 static const struct file_operations proc_tgid_base_operations = {
2464         .read           = generic_read_dir,
2465         .readdir        = proc_tgid_base_readdir,
2466 };
2467
2468 static struct dentry *proc_tgid_base_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd){
2469         return proc_pident_lookup(dir, dentry,
2470                                   tgid_base_stuff, ARRAY_SIZE(tgid_base_stuff));
2471 }
2472
2473 static const struct inode_operations proc_tgid_base_inode_operations = {
2474         .lookup         = proc_tgid_base_lookup,
2475         .getattr        = pid_getattr,
2476         .setattr        = proc_setattr,
2477 };
2478
2479 static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid)
2480 {
2481         struct dentry *dentry, *leader, *dir;
2482         char buf[PROC_NUMBUF];
2483         struct qstr name;
2484
2485         name.name = buf;
2486         name.len = snprintf(buf, sizeof(buf), "%d", pid);
2487         dentry = d_hash_and_lookup(mnt->mnt_root, &name);
2488         if (dentry) {
2489                 if (!(current->flags & PF_EXITING))
2490                         shrink_dcache_parent(dentry);
2491                 d_drop(dentry);
2492                 dput(dentry);
2493         }
2494
2495         if (tgid == 0)
2496                 goto out;
2497
2498         name.name = buf;
2499         name.len = snprintf(buf, sizeof(buf), "%d", tgid);
2500         leader = d_hash_and_lookup(mnt->mnt_root, &name);
2501         if (!leader)
2502                 goto out;
2503
2504         name.name = "task";
2505         name.len = strlen(name.name);
2506         dir = d_hash_and_lookup(leader, &name);
2507         if (!dir)
2508                 goto out_put_leader;
2509
2510         name.name = buf;
2511         name.len = snprintf(buf, sizeof(buf), "%d", pid);
2512         dentry = d_hash_and_lookup(dir, &name);
2513         if (dentry) {
2514                 shrink_dcache_parent(dentry);
2515                 d_drop(dentry);
2516                 dput(dentry);
2517         }
2518
2519         dput(dir);
2520 out_put_leader:
2521         dput(leader);
2522 out:
2523         return;
2524 }
2525
2526 /**
2527  * proc_flush_task -  Remove dcache entries for @task from the /proc dcache.
2528  * @task: task that should be flushed.
2529  *
2530  * When flushing dentries from proc, one needs to flush them from global
2531  * proc (proc_mnt) and from all the namespaces' procs this task was seen
2532  * in. This call is supposed to do all of this job.
2533  *
2534  * Looks in the dcache for
2535  * /proc/@pid
2536  * /proc/@tgid/task/@pid
2537  * if either directory is present flushes it and all of it'ts children
2538  * from the dcache.
2539  *
2540  * It is safe and reasonable to cache /proc entries for a task until
2541  * that task exits.  After that they just clog up the dcache with
2542  * useless entries, possibly causing useful dcache entries to be
2543  * flushed instead.  This routine is proved to flush those useless
2544  * dcache entries at process exit time.
2545  *
2546  * NOTE: This routine is just an optimization so it does not guarantee
2547  *       that no dcache entries will exist at process exit time it
2548  *       just makes it very unlikely that any will persist.
2549  */
2550
2551 void proc_flush_task(struct task_struct *task)
2552 {
2553         int i;
2554         struct pid *pid, *tgid = NULL;
2555         struct upid *upid;
2556
2557         pid = task_pid(task);
2558         if (thread_group_leader(task))
2559                 tgid = task_tgid(task);
2560
2561         for (i = 0; i <= pid->level; i++) {
2562                 upid = &pid->numbers[i];
2563                 proc_flush_task_mnt(upid->ns->proc_mnt, upid->nr,
2564                         tgid ? tgid->numbers[i].nr : 0);
2565         }
2566
2567         upid = &pid->numbers[pid->level];
2568         if (upid->nr == 1)
2569                 pid_ns_release_proc(upid->ns);
2570 }
2571
2572 static struct dentry *proc_pid_instantiate(struct inode *dir,
2573                                            struct dentry * dentry,
2574                                            struct task_struct *task, const void *ptr)
2575 {
2576         struct dentry *error = ERR_PTR(-ENOENT);
2577         struct inode *inode;
2578
2579         inode = proc_pid_make_inode(dir->i_sb, task);
2580         if (!inode)
2581                 goto out;
2582
2583         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
2584         inode->i_op = &proc_tgid_base_inode_operations;
2585         inode->i_fop = &proc_tgid_base_operations;
2586         inode->i_flags|=S_IMMUTABLE;
2587         inode->i_nlink = 5;
2588 #ifdef CONFIG_SECURITY
2589         inode->i_nlink += 1;
2590 #endif
2591
2592         dentry->d_op = &pid_dentry_operations;
2593
2594         d_add(dentry, inode);
2595         /* Close the race of the process dying before we return the dentry */
2596         if (pid_revalidate(dentry, NULL))
2597                 error = NULL;
2598 out:
2599         return error;
2600 }
2601
2602 struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct nameidata *nd)
2603 {
2604         struct dentry *result = ERR_PTR(-ENOENT);
2605         struct task_struct *task;
2606         unsigned tgid;
2607         struct pid_namespace *ns;
2608
2609         result = proc_base_lookup(dir, dentry);
2610         if (!IS_ERR(result) || PTR_ERR(result) != -ENOENT)
2611                 goto out;
2612
2613         tgid = name_to_int(dentry);
2614         if (tgid == ~0U)
2615                 goto out;
2616
2617         ns = dentry->d_sb->s_fs_info;
2618         rcu_read_lock();
2619         task = find_task_by_pid_ns(tgid, ns);
2620         if (task)
2621                 get_task_struct(task);
2622         rcu_read_unlock();
2623         if (!task)
2624                 goto out;
2625
2626         result = proc_pid_instantiate(dir, dentry, task, NULL);
2627         put_task_struct(task);
2628 out:
2629         return result;
2630 }
2631
2632 /*
2633  * Find the first task with tgid >= tgid
2634  *
2635  */
2636 struct tgid_iter {
2637         unsigned int tgid;
2638         struct task_struct *task;
2639 };
2640 static struct tgid_iter next_tgid(struct pid_namespace *ns, struct tgid_iter iter)
2641 {
2642         struct pid *pid;
2643
2644         if (iter.task)
2645                 put_task_struct(iter.task);
2646         rcu_read_lock();
2647 retry:
2648         iter.task = NULL;
2649         pid = find_ge_pid(iter.tgid, ns);
2650         if (pid) {
2651                 iter.tgid = pid_nr_ns(pid, ns);
2652                 iter.task = pid_task(pid, PIDTYPE_PID);
2653                 /* What we to know is if the pid we have find is the
2654                  * pid of a thread_group_leader.  Testing for task
2655                  * being a thread_group_leader is the obvious thing
2656                  * todo but there is a window when it fails, due to
2657                  * the pid transfer logic in de_thread.
2658                  *
2659                  * So we perform the straight forward test of seeing
2660                  * if the pid we have found is the pid of a thread
2661                  * group leader, and don't worry if the task we have
2662                  * found doesn't happen to be a thread group leader.
2663                  * As we don't care in the case of readdir.
2664                  */
2665                 if (!iter.task || !has_group_leader_pid(iter.task)) {
2666                         iter.tgid += 1;
2667                         goto retry;
2668                 }
2669                 get_task_struct(iter.task);
2670         }
2671         rcu_read_unlock();
2672         return iter;
2673 }
2674
2675 #define TGID_OFFSET (FIRST_PROCESS_ENTRY + ARRAY_SIZE(proc_base_stuff))
2676
2677 static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldir,
2678         struct tgid_iter iter)
2679 {
2680         char name[PROC_NUMBUF];
2681         int len = snprintf(name, sizeof(name), "%d", iter.tgid);
2682         return proc_fill_cache(filp, dirent, filldir, name, len,
2683                                 proc_pid_instantiate, iter.task, NULL);
2684 }
2685
2686 /* for the /proc/ directory itself, after non-process stuff has been done */
2687 int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
2688 {
2689         unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
2690         struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
2691         struct tgid_iter iter;
2692         struct pid_namespace *ns;
2693
2694         if (!reaper)
2695                 goto out_no_task;
2696
2697         for (; nr < ARRAY_SIZE(proc_base_stuff); filp->f_pos++, nr++) {
2698                 const struct pid_entry *p = &proc_base_stuff[nr];
2699                 if (proc_base_fill_cache(filp, dirent, filldir, reaper, p) < 0)
2700                         goto out;
2701         }
2702
2703         ns = filp->f_dentry->d_sb->s_fs_info;
2704         iter.task = NULL;
2705         iter.tgid = filp->f_pos - TGID_OFFSET;
2706         for (iter = next_tgid(ns, iter);
2707              iter.task;
2708              iter.tgid += 1, iter = next_tgid(ns, iter)) {
2709                 filp->f_pos = iter.tgid + TGID_OFFSET;
2710                 if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
2711                         put_task_struct(iter.task);
2712                         goto out;
2713                 }
2714         }
2715         filp->f_pos = PID_MAX_LIMIT + TGID_OFFSET;
2716 out:
2717         put_task_struct(reaper);
2718 out_no_task:
2719         return 0;
2720 }
2721
2722 /*
2723  * Tasks
2724  */
2725 static const struct pid_entry tid_base_stuff[] = {
2726         DIR("fd",        S_IRUSR|S_IXUSR, fd),
2727         DIR("fdinfo",    S_IRUSR|S_IXUSR, fdinfo),
2728         REG("environ",   S_IRUSR, environ),
2729         INF("auxv",      S_IRUSR, pid_auxv),
2730         ONE("status",    S_IRUGO, pid_status),
2731         INF("limits",    S_IRUSR, pid_limits),
2732 #ifdef CONFIG_SCHED_DEBUG
2733         REG("sched",     S_IRUGO|S_IWUSR, pid_sched),
2734 #endif
2735         INF("cmdline",   S_IRUGO, pid_cmdline),
2736         ONE("stat",      S_IRUGO, tid_stat),
2737         ONE("statm",     S_IRUGO, pid_statm),
2738         REG("maps",      S_IRUGO, maps),
2739 #ifdef CONFIG_NUMA
2740         REG("numa_maps", S_IRUGO, numa_maps),
2741 #endif
2742         REG("mem",       S_IRUSR|S_IWUSR, mem),
2743         LNK("cwd",       cwd),
2744         LNK("root",      root),
2745         LNK("exe",       exe),
2746         REG("mounts",    S_IRUGO, mounts),
2747         REG("mountinfo",  S_IRUGO, mountinfo),
2748 #ifdef CONFIG_PROC_PAGE_MONITOR
2749         REG("clear_refs", S_IWUSR, clear_refs),
2750         REG("smaps",     S_IRUGO, smaps),
2751         REG("pagemap",    S_IRUSR, pagemap),
2752 #endif
2753 #ifdef CONFIG_SECURITY
2754         DIR("attr",      S_IRUGO|S_IXUGO, attr_dir),
2755 #endif
2756 #ifdef CONFIG_KALLSYMS
2757         INF("wchan",     S_IRUGO, pid_wchan),
2758 #endif
2759 #ifdef CONFIG_SCHEDSTATS
2760         INF("schedstat", S_IRUGO, pid_schedstat),
2761 #endif
2762 #ifdef CONFIG_LATENCYTOP
2763         REG("latency",  S_IRUGO, lstats),
2764 #endif
2765 #ifdef CONFIG_PROC_PID_CPUSET
2766         REG("cpuset",    S_IRUGO, cpuset),
2767 #endif
2768 #ifdef CONFIG_CGROUPS
2769         REG("cgroup",  S_IRUGO, cgroup),
2770 #endif
2771         INF("oom_score", S_IRUGO, oom_score),
2772         REG("oom_adj",   S_IRUGO|S_IWUSR, oom_adjust),
2773 #ifdef CONFIG_AUDITSYSCALL
2774         REG("loginuid",  S_IWUSR|S_IRUGO, loginuid),
2775         REG("sessionid",  S_IRUSR, sessionid),
2776 #endif
2777 #ifdef CONFIG_FAULT_INJECTION
2778         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
2779 #endif
2780 };
2781
2782 static int proc_tid_base_readdir(struct file * filp,
2783                              void * dirent, filldir_t filldir)
2784 {
2785         return proc_pident_readdir(filp,dirent,filldir,
2786                                    tid_base_stuff,ARRAY_SIZE(tid_base_stuff));
2787 }
2788
2789 static struct dentry *proc_tid_base_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd){
2790         return proc_pident_lookup(dir, dentry,
2791                                   tid_base_stuff, ARRAY_SIZE(tid_base_stuff));
2792 }
2793
2794 static const struct file_operations proc_tid_base_operations = {
2795         .read           = generic_read_dir,
2796         .readdir        = proc_tid_base_readdir,
2797 };
2798
2799 static const struct inode_operations proc_tid_base_inode_operations = {
2800         .lookup         = proc_tid_base_lookup,
2801         .getattr        = pid_getattr,
2802         .setattr        = proc_setattr,
2803 };
2804
2805 static struct dentry *proc_task_instantiate(struct inode *dir,
2806         struct dentry *dentry, struct task_struct *task, const void *ptr)
2807 {
2808         struct dentry *error = ERR_PTR(-ENOENT);
2809         struct inode *inode;
2810         inode = proc_pid_make_inode(dir->i_sb, task);
2811
2812         if (!inode)
2813                 goto out;
2814         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
2815         inode->i_op = &proc_tid_base_inode_operations;
2816         inode->i_fop = &proc_tid_base_operations;
2817         inode->i_flags|=S_IMMUTABLE;
2818         inode->i_nlink = 4;
2819 #ifdef CONFIG_SECURITY
2820         inode->i_nlink += 1;
2821 #endif
2822
2823         dentry->d_op = &pid_dentry_operations;
2824
2825         d_add(dentry, inode);
2826         /* Close the race of the process dying before we return the dentry */
2827         if (pid_revalidate(dentry, NULL))
2828                 error = NULL;
2829 out:
2830         return error;
2831 }
2832
2833 static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry, struct nameidata *nd)
2834 {
2835         struct dentry *result = ERR_PTR(-ENOENT);
2836         struct task_struct *task;
2837         struct task_struct *leader = get_proc_task(dir);
2838         unsigned tid;
2839         struct pid_namespace *ns;
2840
2841         if (!leader)
2842                 goto out_no_task;
2843
2844         tid = name_to_int(dentry);
2845         if (tid == ~0U)
2846                 goto out;
2847
2848         ns = dentry->d_sb->s_fs_info;
2849         rcu_read_lock();
2850         task = find_task_by_pid_ns(tid, ns);
2851         if (task)
2852                 get_task_struct(task);
2853         rcu_read_unlock();
2854         if (!task)
2855                 goto out;
2856         if (!same_thread_group(leader, task))
2857                 goto out_drop_task;
2858
2859         result = proc_task_instantiate(dir, dentry, task, NULL);
2860 out_drop_task:
2861         put_task_struct(task);
2862 out:
2863         put_task_struct(leader);
2864 out_no_task:
2865         return result;
2866 }
2867
2868 /*
2869  * Find the first tid of a thread group to return to user space.
2870  *
2871  * Usually this is just the thread group leader, but if the users
2872  * buffer was too small or there was a seek into the middle of the
2873  * directory we have more work todo.
2874  *
2875  * In the case of a short read we start with find_task_by_pid.
2876  *
2877  * In the case of a seek we start with the leader and walk nr
2878  * threads past it.
2879  */
2880 static struct task_struct *first_tid(struct task_struct *leader,
2881                 int tid, int nr, struct pid_namespace *ns)
2882 {
2883         struct task_struct *pos;
2884
2885         rcu_read_lock();
2886         /* Attempt to start with the pid of a thread */
2887         if (tid && (nr > 0)) {
2888                 pos = find_task_by_pid_ns(tid, ns);
2889                 if (pos && (pos->group_leader == leader))
2890                         goto found;
2891         }
2892
2893         /* If nr exceeds the number of threads there is nothing todo */
2894         pos = NULL;
2895         if (nr && nr >= get_nr_threads(leader))
2896                 goto out;
2897
2898         /* If we haven't found our starting place yet start
2899          * with the leader and walk nr threads forward.
2900          */
2901         for (pos = leader; nr > 0; --nr) {
2902                 pos = next_thread(pos);
2903                 if (pos == leader) {
2904                         pos = NULL;
2905                         goto out;
2906                 }
2907         }
2908 found:
2909         get_task_struct(pos);
2910 out:
2911         rcu_read_unlock();
2912         return pos;
2913 }
2914
2915 /*
2916  * Find the next thread in the thread list.
2917  * Return NULL if there is an error or no next thread.
2918  *
2919  * The reference to the input task_struct is released.
2920  */
2921 static struct task_struct *next_tid(struct task_struct *start)
2922 {
2923         struct task_struct *pos = NULL;
2924         rcu_read_lock();
2925         if (pid_alive(start)) {
2926                 pos = next_thread(start);
2927                 if (thread_group_leader(pos))
2928                         pos = NULL;
2929                 else
2930                         get_task_struct(pos);
2931         }
2932         rcu_read_unlock();
2933         put_task_struct(start);
2934         return pos;
2935 }
2936
2937 static int proc_task_fill_cache(struct file *filp, void *dirent, filldir_t filldir,
2938         struct task_struct *task, int tid)
2939 {
2940         char name[PROC_NUMBUF];
2941         int len = snprintf(name, sizeof(name), "%d", tid);
2942         return proc_fill_cache(filp, dirent, filldir, name, len,
2943                                 proc_task_instantiate, task, NULL);
2944 }
2945
2946 /* for the /proc/TGID/task/ directories */
2947 static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldir)
2948 {
2949         struct dentry *dentry = filp->f_path.dentry;
2950         struct inode *inode = dentry->d_inode;
2951         struct task_struct *leader = NULL;
2952         struct task_struct *task;
2953         int retval = -ENOENT;
2954         ino_t ino;
2955         int tid;
2956         unsigned long pos = filp->f_pos;  /* avoiding "long long" filp->f_pos */
2957         struct pid_namespace *ns;
2958
2959         task = get_proc_task(inode);
2960         if (!task)
2961                 goto out_no_task;
2962         rcu_read_lock();
2963         if (pid_alive(task)) {
2964                 leader = task->group_leader;
2965                 get_task_struct(leader);
2966         }
2967         rcu_read_unlock();
2968         put_task_struct(task);
2969         if (!leader)
2970                 goto out_no_task;
2971         retval = 0;
2972
2973         switch (pos) {
2974         case 0:
2975                 ino = inode->i_ino;
2976                 if (filldir(dirent, ".", 1, pos, ino, DT_DIR) < 0)
2977                         goto out;
2978                 pos++;
2979                 /* fall through */
2980         case 1:
2981                 ino = parent_ino(dentry);
2982                 if (filldir(dirent, "..", 2, pos, ino, DT_DIR) < 0)
2983                         goto out;
2984                 pos++;
2985                 /* fall through */
2986         }
2987
2988         /* f_version caches the tgid value that the last readdir call couldn't
2989          * return. lseek aka telldir automagically resets f_version to 0.
2990          */
2991         ns = filp->f_dentry->d_sb->s_fs_info;
2992         tid = (int)filp->f_version;
2993         filp->f_version = 0;
2994         for (task = first_tid(leader, tid, pos - 2, ns);
2995              task;
2996              task = next_tid(task), pos++) {
2997                 tid = task_pid_nr_ns(task, ns);
2998                 if (proc_task_fill_cache(filp, dirent, filldir, task, tid) < 0) {
2999                         /* returning this tgid failed, save it as the first
3000                          * pid for the next readir call */
3001                         filp->f_version = (u64)tid;
3002                         put_task_struct(task);
3003                         break;
3004                 }
3005         }
3006 out:
3007         filp->f_pos = pos;
3008         put_task_struct(leader);
3009 out_no_task:
3010         return retval;
3011 }
3012
3013 static int proc_task_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
3014 {
3015         struct inode *inode = dentry->d_inode;
3016         struct task_struct *p = get_proc_task(inode);
3017         generic_fillattr(inode, stat);
3018
3019         if (p) {
3020                 rcu_read_lock();
3021                 stat->nlink += get_nr_threads(p);
3022                 rcu_read_unlock();
3023                 put_task_struct(p);
3024         }
3025
3026         return 0;
3027 }
3028
3029 static const struct inode_operations proc_task_inode_operations = {
3030         .lookup         = proc_task_lookup,
3031         .getattr        = proc_task_getattr,
3032         .setattr        = proc_setattr,
3033 };
3034
3035 static const struct file_operations proc_task_operations = {
3036         .read           = generic_read_dir,
3037         .readdir        = proc_task_readdir,
3038 };