mm_for_maps: take ->cred_guard_mutex to fix the race with exec
[safe/jmp/linux-2.6] / fs / proc / base.c
index 9a4da0a..175db25 100644 (file)
 #include <linux/time.h>
 #include <linux/proc_fs.h>
 #include <linux/stat.h>
+#include <linux/task_io_accounting_ops.h>
 #include <linux/init.h>
 #include <linux/capability.h>
 #include <linux/file.h>
+#include <linux/fdtable.h>
 #include <linux/string.h>
 #include <linux/seq_file.h>
 #include <linux/namei.h>
 #include <linux/mm.h>
 #include <linux/rcupdate.h>
 #include <linux/kallsyms.h>
+#include <linux/stacktrace.h>
 #include <linux/resource.h>
 #include <linux/module.h>
 #include <linux/mount.h>
 #include <linux/security.h>
 #include <linux/ptrace.h>
+#include <linux/tracehook.h>
 #include <linux/cgroup.h>
 #include <linux/cpuset.h>
 #include <linux/audit.h>
@@ -76,6 +80,7 @@
 #include <linux/oom.h>
 #include <linux/elf.h>
 #include <linux/pid_namespace.h>
+#include <linux/fs_struct.h>
 #include "internal.h"
 
 /* NOTE:
@@ -106,43 +111,62 @@ struct pid_entry {
        .op   = OP,                                     \
 }
 
-#define DIR(NAME, MODE, OTYPE)                                                 \
-       NOD(NAME, (S_IFDIR|(MODE)),                                             \
-               &proc_##OTYPE##_inode_operations, &proc_##OTYPE##_operations,   \
-               {} )
-#define LNK(NAME, OTYPE)                                       \
+#define DIR(NAME, MODE, iops, fops)    \
+       NOD(NAME, (S_IFDIR|(MODE)), &iops, &fops, {} )
+#define LNK(NAME, get_link)                                    \
        NOD(NAME, (S_IFLNK|S_IRWXUGO),                          \
                &proc_pid_link_inode_operations, NULL,          \
-               { .proc_get_link = &proc_##OTYPE##_link } )
-#define REG(NAME, MODE, OTYPE)                         \
-       NOD(NAME, (S_IFREG|(MODE)), NULL,               \
-               &proc_##OTYPE##_operations, {})
-#define INF(NAME, MODE, OTYPE)                         \
+               { .proc_get_link = get_link } )
+#define REG(NAME, MODE, fops)                          \
+       NOD(NAME, (S_IFREG|(MODE)), NULL, &fops, {})
+#define INF(NAME, MODE, read)                          \
        NOD(NAME, (S_IFREG|(MODE)),                     \
                NULL, &proc_info_file_operations,       \
-               { .proc_read = &proc_##OTYPE } )
-#define ONE(NAME, MODE, OTYPE)                         \
+               { .proc_read = read } )
+#define ONE(NAME, MODE, show)                          \
        NOD(NAME, (S_IFREG|(MODE)),                     \
                NULL, &proc_single_file_operations,     \
-               { .proc_show = &proc_##OTYPE } )
+               { .proc_show = show } )
 
-int maps_protect;
-EXPORT_SYMBOL(maps_protect);
+/*
+ * Count the number of hardlinks for the pid_entry table, excluding the .
+ * and .. links.
+ */
+static unsigned int pid_entry_count_dirs(const struct pid_entry *entries,
+       unsigned int n)
+{
+       unsigned int i;
+       unsigned int count;
+
+       count = 0;
+       for (i = 0; i < n; ++i) {
+               if (S_ISDIR(entries[i].mode))
+                       ++count;
+       }
+
+       return count;
+}
 
-static struct fs_struct *get_fs_struct(struct task_struct *task)
+static int get_fs_path(struct task_struct *task, struct path *path, bool root)
 {
        struct fs_struct *fs;
+       int result = -ENOENT;
+
        task_lock(task);
        fs = task->fs;
-       if(fs)
-               atomic_inc(&fs->count);
+       if (fs) {
+               read_lock(&fs->lock);
+               *path = root ? fs->root : fs->pwd;
+               path_get(path);
+               read_unlock(&fs->lock);
+               result = 0;
+       }
        task_unlock(task);
-       return fs;
+       return result;
 }
 
 static int get_nr_threads(struct task_struct *tsk)
 {
-       /* Must be called with the rcu_read_lock held */
        unsigned long flags;
        int count = 0;
 
@@ -156,70 +180,74 @@ static int get_nr_threads(struct task_struct *tsk)
 static int proc_cwd_link(struct inode *inode, struct path *path)
 {
        struct task_struct *task = get_proc_task(inode);
-       struct fs_struct *fs = NULL;
        int result = -ENOENT;
 
        if (task) {
-               fs = get_fs_struct(task);
+               result = get_fs_path(task, path, 0);
                put_task_struct(task);
        }
-       if (fs) {
-               read_lock(&fs->lock);
-               *path = fs->pwd;
-               path_get(&fs->pwd);
-               read_unlock(&fs->lock);
-               result = 0;
-               put_fs_struct(fs);
-       }
        return result;
 }
 
 static int proc_root_link(struct inode *inode, struct path *path)
 {
        struct task_struct *task = get_proc_task(inode);
-       struct fs_struct *fs = NULL;
        int result = -ENOENT;
 
        if (task) {
-               fs = get_fs_struct(task);
+               result = get_fs_path(task, path, 1);
                put_task_struct(task);
        }
-       if (fs) {
-               read_lock(&fs->lock);
-               *path = fs->root;
-               path_get(&fs->root);
-               read_unlock(&fs->lock);
-               result = 0;
-               put_fs_struct(fs);
-       }
        return result;
 }
 
-#define MAY_PTRACE(task) \
-       (task == current || \
-       (task->parent == current && \
-       (task->ptrace & PT_PTRACED) && \
-        (task_is_stopped_or_traced(task)) && \
-        security_ptrace(current,task) == 0))
+/*
+ * Return zero if current may access user memory in @task, -error if not.
+ */
+static int check_mem_permission(struct task_struct *task)
+{
+       /*
+        * A task can always look at itself, in case it chooses
+        * to use system calls instead of load instructions.
+        */
+       if (task == current)
+               return 0;
+
+       /*
+        * If current is actively ptrace'ing, and would also be
+        * permitted to freshly attach with ptrace now, permit it.
+        */
+       if (task_is_stopped_or_traced(task)) {
+               int match;
+               rcu_read_lock();
+               match = (tracehook_tracer_task(task) == current);
+               rcu_read_unlock();
+               if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
+                       return 0;
+       }
+
+       /*
+        * Noone else is allowed.
+        */
+       return -EPERM;
+}
 
 struct mm_struct *mm_for_maps(struct task_struct *task)
 {
-       struct mm_struct *mm = get_task_mm(task);
-       if (!mm)
+       struct mm_struct *mm;
+
+       if (mutex_lock_killable(&task->cred_guard_mutex))
                return NULL;
-       down_read(&mm->mmap_sem);
-       task_lock(task);
-       if (task->mm != mm)
-               goto out;
-       if (task->mm != current->mm && __ptrace_may_attach(task) < 0)
-               goto out;
-       task_unlock(task);
+
+       mm = get_task_mm(task);
+       if (mm && mm != current->mm &&
+                       !ptrace_may_access(task, PTRACE_MODE_READ)) {
+               mmput(mm);
+               mm = NULL;
+       }
+       mutex_unlock(&task->cred_guard_mutex);
+
        return mm;
-out:
-       task_unlock(task);
-       up_read(&mm->mmap_sem);
-       mmput(mm);
-       return NULL;
 }
 
 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
@@ -265,9 +293,9 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
        struct mm_struct *mm = get_task_mm(task);
        if (mm) {
                unsigned int nwords = 0;
-               do
+               do {
                        nwords += 2;
-               while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
+               while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
                res = nwords * sizeof(mm->saved_auxv[0]);
                if (res > PAGE_SIZE)
                        res = PAGE_SIZE;
@@ -291,12 +319,46 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
        wchan = get_wchan(task);
 
        if (lookup_symbol_name(wchan, symname) < 0)
-               return sprintf(buffer, "%lu", wchan);
+               if (!ptrace_may_access(task, PTRACE_MODE_READ))
+                       return 0;
+               else
+                       return sprintf(buffer, "%lu", wchan);
        else
                return sprintf(buffer, "%s", symname);
 }
 #endif /* CONFIG_KALLSYMS */
 
+#ifdef CONFIG_STACKTRACE
+
+#define MAX_STACK_TRACE_DEPTH  64
+
+static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
+                         struct pid *pid, struct task_struct *task)
+{
+       struct stack_trace trace;
+       unsigned long *entries;
+       int i;
+
+       entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL);
+       if (!entries)
+               return -ENOMEM;
+
+       trace.nr_entries        = 0;
+       trace.max_entries       = MAX_STACK_TRACE_DEPTH;
+       trace.entries           = entries;
+       trace.skip              = 0;
+       save_stack_trace_tsk(task, &trace);
+
+       for (i = 0; i < trace.nr_entries; i++) {
+               seq_printf(m, "[<%p>] %pS\n",
+                          (void *)entries[i], (void *)entries[i]);
+       }
+       kfree(entries);
+
+       return 0;
+}
+#endif
+
 #ifdef CONFIG_SCHEDSTATS
 /*
  * Provides /proc/PID/schedstat
@@ -304,8 +366,8 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
 static int proc_pid_schedstat(struct task_struct *task, char *buffer)
 {
        return sprintf(buffer, "%llu %llu %lu\n",
-                       task->sched_info.cpu_time,
-                       task->sched_info.run_delay,
+                       (unsigned long long)task->se.sum_exec_runtime,
+                       (unsigned long long)task->sched_info.run_delay,
                        task->sched_info.pcount);
 }
 #endif
@@ -328,7 +390,7 @@ static int lstats_show_proc(struct seq_file *m, void *v)
                                task->latency_record[i].time,
                                task->latency_record[i].max);
                        for (q = 0; q < LT_BACKTRACEDEPTH; q++) {
-                               char sym[KSYM_NAME_LEN];
+                               char sym[KSYM_SYMBOL_LEN];
                                char *c;
                                if (!task->latency_record[i].backtrace[q])
                                        break;
@@ -424,14 +486,10 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
 
        struct rlimit rlim[RLIM_NLIMITS];
 
-       rcu_read_lock();
-       if (!lock_task_sighand(task,&flags)) {
-               rcu_read_unlock();
+       if (!lock_task_sighand(task, &flags))
                return 0;
-       }
        memcpy(rlim, task->signal->rlim, sizeof(struct rlimit) * RLIM_NLIMITS);
        unlock_task_sighand(task, &flags);
-       rcu_read_unlock();
 
        /*
         * print the file header
@@ -463,6 +521,26 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
        return count;
 }
 
+#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
+static int proc_pid_syscall(struct task_struct *task, char *buffer)
+{
+       long nr;
+       unsigned long args[6], sp, pc;
+
+       if (task_current_syscall(task, &nr, args, 6, &sp, &pc))
+               return sprintf(buffer, "running\n");
+
+       if (nr < 0)
+               return sprintf(buffer, "%ld 0x%lx 0x%lx\n", nr, sp, pc);
+
+       return sprintf(buffer,
+                      "%ld 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx\n",
+                      nr,
+                      args[0], args[1], args[2], args[3], args[4], args[5],
+                      sp, pc);
+}
+#endif /* CONFIG_HAVE_ARCH_TRACEHOOK */
+
 /************************************************************************/
 /*                       Here the fs part begins                        */
 /************************************************************************/
@@ -478,7 +556,7 @@ static int proc_fd_access_allowed(struct inode *inode)
         */
        task = get_proc_task(inode);
        if (task) {
-               allowed = ptrace_may_attach(task);
+               allowed = ptrace_may_access(task, PTRACE_MODE_READ);
                put_task_struct(task);
        }
        return allowed;
@@ -502,17 +580,13 @@ static const struct inode_operations proc_def_inode_operations = {
        .setattr        = proc_setattr,
 };
 
-extern const struct seq_operations mounts_op;
-struct proc_mounts {
-       struct seq_file m;
-       int event;
-};
-
-static int mounts_open(struct inode *inode, struct file *file)
+static int mounts_open_common(struct inode *inode, struct file *file,
+                             const struct seq_operations *op)
 {
        struct task_struct *task = get_proc_task(inode);
        struct nsproxy *nsp;
        struct mnt_namespace *ns = NULL;
+       struct path root;
        struct proc_mounts *p;
        int ret = -EINVAL;
 
@@ -525,54 +599,74 @@ static int mounts_open(struct inode *inode, struct file *file)
                                get_mnt_ns(ns);
                }
                rcu_read_unlock();
-
+               if (ns && get_fs_path(task, &root, 1) == 0)
+                       ret = 0;
                put_task_struct(task);
        }
 
-       if (ns) {
-               ret = -ENOMEM;
-               p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
-               if (p) {
-                       file->private_data = &p->m;
-                       ret = seq_open(file, &mounts_op);
-                       if (!ret) {
-                               p->m.private = ns;
-                               p->event = ns->event;
-                               return 0;
-                       }
-                       kfree(p);
-               }
-               put_mnt_ns(ns);
-       }
+       if (!ns)
+               goto err;
+       if (ret)
+               goto err_put_ns;
+
+       ret = -ENOMEM;
+       p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
+       if (!p)
+               goto err_put_path;
+
+       file->private_data = &p->m;
+       ret = seq_open(file, op);
+       if (ret)
+               goto err_free;
+
+       p->m.private = p;
+       p->ns = ns;
+       p->root = root;
+       p->event = ns->event;
+
+       return 0;
+
+ err_free:
+       kfree(p);
+ err_put_path:
+       path_put(&root);
+ err_put_ns:
+       put_mnt_ns(ns);
+ err:
        return ret;
 }
 
 static int mounts_release(struct inode *inode, struct file *file)
 {
-       struct seq_file *m = file->private_data;
-       struct mnt_namespace *ns = m->private;
-       put_mnt_ns(ns);
+       struct proc_mounts *p = file->private_data;
+       path_put(&p->root);
+       put_mnt_ns(p->ns);
        return seq_release(inode, file);
 }
 
 static unsigned mounts_poll(struct file *file, poll_table *wait)
 {
        struct proc_mounts *p = file->private_data;
-       struct mnt_namespace *ns = p->m.private;
-       unsigned res = 0;
+       struct mnt_namespace *ns = p->ns;
+       unsigned res = POLLIN | POLLRDNORM;
 
        poll_wait(file, &ns->poll, wait);
 
        spin_lock(&vfsmount_lock);
        if (p->event != ns->event) {
                p->event = ns->event;
-               res = POLLERR;
+               res |= POLLERR | POLLPRI;
        }
        spin_unlock(&vfsmount_lock);
 
        return res;
 }
 
+static int mounts_open(struct inode *inode, struct file *file)
+{
+       return mounts_open_common(inode, file, &mounts_op);
+}
+
 static const struct file_operations proc_mounts_operations = {
        .open           = mounts_open,
        .read           = seq_read,
@@ -581,38 +675,22 @@ static const struct file_operations proc_mounts_operations = {
        .poll           = mounts_poll,
 };
 
-extern const struct seq_operations mountstats_op;
-static int mountstats_open(struct inode *inode, struct file *file)
+static int mountinfo_open(struct inode *inode, struct file *file)
 {
-       int ret = seq_open(file, &mountstats_op);
-
-       if (!ret) {
-               struct seq_file *m = file->private_data;
-               struct nsproxy *nsp;
-               struct mnt_namespace *mnt_ns = NULL;
-               struct task_struct *task = get_proc_task(inode);
-
-               if (task) {
-                       rcu_read_lock();
-                       nsp = task_nsproxy(task);
-                       if (nsp) {
-                               mnt_ns = nsp->mnt_ns;
-                               if (mnt_ns)
-                                       get_mnt_ns(mnt_ns);
-                       }
-                       rcu_read_unlock();
+       return mounts_open_common(inode, file, &mountinfo_op);
+}
 
-                       put_task_struct(task);
-               }
+static const struct file_operations proc_mountinfo_operations = {
+       .open           = mountinfo_open,
+       .read           = seq_read,
+       .llseek         = seq_lseek,
+       .release        = mounts_release,
+       .poll           = mounts_poll,
+};
 
-               if (mnt_ns)
-                       m->private = mnt_ns;
-               else {
-                       seq_release(inode, file);
-                       ret = -EINVAL;
-               }
-       }
-       return ret;
+static int mountstats_open(struct inode *inode, struct file *file)
+{
+       return mounts_open_common(inode, file, &mountstats_op);
 }
 
 static const struct file_operations proc_mountstats_operations = {
@@ -715,7 +793,7 @@ static ssize_t mem_read(struct file * file, char __user * buf,
        if (!task)
                goto out_no_task;
 
-       if (!MAY_PTRACE(task) || !ptrace_may_attach(task))
+       if (check_mem_permission(task))
                goto out;
 
        ret = -ENOMEM;
@@ -741,7 +819,7 @@ static ssize_t mem_read(struct file * file, char __user * buf,
 
                this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
                retval = access_process_vm(task, src, page, this_len, 0);
-               if (!retval || !MAY_PTRACE(task) || !ptrace_may_attach(task)) {
+               if (!retval || check_mem_permission(task)) {
                        if (!ret)
                                ret = -EIO;
                        break;
@@ -785,7 +863,7 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
        if (!task)
                goto out_no_task;
 
-       if (!MAY_PTRACE(task) || !ptrace_may_attach(task))
+       if (check_mem_permission(task))
                goto out;
 
        copied = -ENOMEM;
@@ -857,7 +935,7 @@ static ssize_t environ_read(struct file *file, char __user *buf,
        if (!task)
                goto out_no_task;
 
-       if (!ptrace_may_attach(task))
+       if (!ptrace_may_access(task, PTRACE_MODE_READ))
                goto out;
 
        ret = -ENOMEM;
@@ -925,7 +1003,12 @@ static ssize_t oom_adjust_read(struct file *file, char __user *buf,
 
        if (!task)
                return -ESRCH;
-       oom_adjust = task->oomkilladj;
+       task_lock(task);
+       if (task->mm)
+               oom_adjust = task->mm->oom_adj;
+       else
+               oom_adjust = OOM_DISABLE;
+       task_unlock(task);
        put_task_struct(task);
 
        len = snprintf(buffer, sizeof(buffer), "%i\n", oom_adjust);
@@ -954,11 +1037,19 @@ static ssize_t oom_adjust_write(struct file *file, const char __user *buf,
        task = get_proc_task(file->f_path.dentry->d_inode);
        if (!task)
                return -ESRCH;
-       if (oom_adjust < task->oomkilladj && !capable(CAP_SYS_RESOURCE)) {
+       task_lock(task);
+       if (!task->mm) {
+               task_unlock(task);
+               put_task_struct(task);
+               return -EINVAL;
+       }
+       if (oom_adjust < task->mm->oom_adj && !capable(CAP_SYS_RESOURCE)) {
+               task_unlock(task);
                put_task_struct(task);
                return -EACCES;
        }
-       task->oomkilladj = oom_adjust;
+       task->mm->oom_adj = oom_adjust;
+       task_unlock(task);
        put_task_struct(task);
        if (end - buffer == 0)
                return -EIO;
@@ -1036,6 +1127,26 @@ static const struct file_operations proc_loginuid_operations = {
        .read           = proc_loginuid_read,
        .write          = proc_loginuid_write,
 };
+
+static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
+                                 size_t count, loff_t *ppos)
+{
+       struct inode * inode = file->f_path.dentry->d_inode;
+       struct task_struct *task = get_proc_task(inode);
+       ssize_t length;
+       char tmpbuf[TMPBUFLEN];
+
+       if (!task)
+               return -ESRCH;
+       length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
+                               audit_get_sessionid(task));
+       put_task_struct(task);
+       return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
+}
+
+static const struct file_operations proc_sessionid_operations = {
+       .read           = proc_sessionid_read,
+};
 #endif
 
 #ifdef CONFIG_FAULT_INJECTION
@@ -1100,8 +1211,6 @@ static int sched_show(struct seq_file *m, void *v)
        struct inode *inode = m->private;
        struct task_struct *p;
 
-       WARN_ON(!inode);
-
        p = get_proc_task(inode);
        if (!p)
                return -ESRCH;
@@ -1119,8 +1228,6 @@ sched_write(struct file *file, const char __user *buf,
        struct inode *inode = file->f_path.dentry->d_inode;
        struct task_struct *p;
 
-       WARN_ON(!inode);
-
        p = get_proc_task(inode);
        if (!p)
                return -ESRCH;
@@ -1154,6 +1261,81 @@ static const struct file_operations proc_pid_sched_operations = {
 
 #endif
 
+/*
+ * We added or removed a vma mapping the executable. The vmas are only mapped
+ * during exec and are not mapped with the mmap system call.
+ * Callers must hold down_write() on the mm's mmap_sem for these
+ */
+void added_exe_file_vma(struct mm_struct *mm)
+{
+       mm->num_exe_file_vmas++;
+}
+
+void removed_exe_file_vma(struct mm_struct *mm)
+{
+       mm->num_exe_file_vmas--;
+       if ((mm->num_exe_file_vmas == 0) && mm->exe_file){
+               fput(mm->exe_file);
+               mm->exe_file = NULL;
+       }
+
+}
+
+void set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file)
+{
+       if (new_exe_file)
+               get_file(new_exe_file);
+       if (mm->exe_file)
+               fput(mm->exe_file);
+       mm->exe_file = new_exe_file;
+       mm->num_exe_file_vmas = 0;
+}
+
+struct file *get_mm_exe_file(struct mm_struct *mm)
+{
+       struct file *exe_file;
+
+       /* We need mmap_sem to protect against races with removal of
+        * VM_EXECUTABLE vmas */
+       down_read(&mm->mmap_sem);
+       exe_file = mm->exe_file;
+       if (exe_file)
+               get_file(exe_file);
+       up_read(&mm->mmap_sem);
+       return exe_file;
+}
+
+void dup_mm_exe_file(struct mm_struct *oldmm, struct mm_struct *newmm)
+{
+       /* It's safe to write the exe_file pointer without exe_file_lock because
+        * this is called during fork when the task is not yet in /proc */
+       newmm->exe_file = get_mm_exe_file(oldmm);
+}
+
+static int proc_exe_link(struct inode *inode, struct path *exe_path)
+{
+       struct task_struct *task;
+       struct mm_struct *mm;
+       struct file *exe_file;
+
+       task = get_proc_task(inode);
+       if (!task)
+               return -ENOENT;
+       mm = get_task_mm(task);
+       put_task_struct(task);
+       if (!mm)
+               return -ENOENT;
+       exe_file = get_mm_exe_file(mm);
+       mmput(mm);
+       if (exe_file) {
+               *exe_path = exe_file->f_path;
+               path_get(&exe_file->f_path);
+               fput(exe_file);
+               return 0;
+       } else
+               return -ENOENT;
+}
+
 static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
        struct inode *inode = dentry->d_inode;
@@ -1245,6 +1427,7 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st
 {
        struct inode * inode;
        struct proc_inode *ei;
+       const struct cred *cred;
 
        /* We need a new inode */
 
@@ -1264,11 +1447,12 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st
        if (!ei->pid)
                goto out_unlock;
 
-       inode->i_uid = 0;
-       inode->i_gid = 0;
        if (task_dumpable(task)) {
-               inode->i_uid = task->euid;
-               inode->i_gid = task->egid;
+               rcu_read_lock();
+               cred = __task_cred(task);
+               inode->i_uid = cred->euid;
+               inode->i_gid = cred->egid;
+               rcu_read_unlock();
        }
        security_task_to_inode(task, inode);
 
@@ -1284,6 +1468,8 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
 {
        struct inode *inode = dentry->d_inode;
        struct task_struct *task;
+       const struct cred *cred;
+
        generic_fillattr(inode, stat);
 
        rcu_read_lock();
@@ -1293,8 +1479,9 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
        if (task) {
                if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
                    task_dumpable(task)) {
-                       stat->uid = task->euid;
-                       stat->gid = task->egid;
+                       cred = __task_cred(task);
+                       stat->uid = cred->euid;
+                       stat->gid = cred->egid;
                }
        }
        rcu_read_unlock();
@@ -1322,11 +1509,16 @@ static int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
        struct inode *inode = dentry->d_inode;
        struct task_struct *task = get_proc_task(inode);
+       const struct cred *cred;
+
        if (task) {
                if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
                    task_dumpable(task)) {
-                       inode->i_uid = task->euid;
-                       inode->i_gid = task->egid;
+                       rcu_read_lock();
+                       cred = __task_cred(task);
+                       inode->i_uid = cred->euid;
+                       inode->i_gid = cred->egid;
+                       rcu_read_unlock();
                } else {
                        inode->i_uid = 0;
                        inode->i_gid = 0;
@@ -1349,7 +1541,7 @@ static int pid_delete_dentry(struct dentry * dentry)
        return !proc_pid(dentry->d_inode)->tasks[PIDTYPE_PID].first;
 }
 
-static struct dentry_operations pid_dentry_operations =
+static const struct dentry_operations pid_dentry_operations =
 {
        .d_revalidate   = pid_revalidate,
        .d_delete       = pid_delete_dentry,
@@ -1488,6 +1680,7 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
        struct task_struct *task = get_proc_task(inode);
        int fd = proc_fd(inode);
        struct files_struct *files;
+       const struct cred *cred;
 
        if (task) {
                files = get_files_struct(task);
@@ -1497,8 +1690,11 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
                                rcu_read_unlock();
                                put_files_struct(files);
                                if (task_dumpable(task)) {
-                                       inode->i_uid = task->euid;
-                                       inode->i_gid = task->egid;
+                                       rcu_read_lock();
+                                       cred = __task_cred(task);
+                                       inode->i_uid = cred->euid;
+                                       inode->i_gid = cred->egid;
+                                       rcu_read_unlock();
                                } else {
                                        inode->i_uid = 0;
                                        inode->i_gid = 0;
@@ -1517,7 +1713,7 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
        return 0;
 }
 
-static struct dentry_operations tid_fd_dentry_operations =
+static const struct dentry_operations tid_fd_dentry_operations =
 {
        .d_revalidate   = tid_fd_revalidate,
        .d_delete       = pid_delete_dentry,
@@ -1551,9 +1747,9 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
        file = fcheck_files(files, fd);
        if (!file)
                goto out_unlock;
-       if (file->f_mode & 1)
+       if (file->f_mode & FMODE_READ)
                inode->i_mode |= S_IRUSR | S_IXUSR;
-       if (file->f_mode & 2)
+       if (file->f_mode & FMODE_WRITE)
                inode->i_mode |= S_IWUSR | S_IXUSR;
        spin_unlock(&files->file_lock);
        put_files_struct(files);
@@ -1606,7 +1802,6 @@ static int proc_readfd_common(struct file * filp, void * dirent,
        unsigned int fd, ino;
        int retval;
        struct files_struct * files;
-       struct fdtable *fdt;
 
        retval = -ENOENT;
        if (!p)
@@ -1629,9 +1824,8 @@ static int proc_readfd_common(struct file * filp, void * dirent,
                        if (!files)
                                goto out;
                        rcu_read_lock();
-                       fdt = files_fdtable(files);
                        for (fd = filp->f_pos-2;
-                            fd < fdt->max_fds;
+                            fd < files_fdtable(files)->max_fds;
                             fd++, filp->f_pos++) {
                                char name[PROC_NUMBUF];
                                int len;
@@ -1693,8 +1887,7 @@ static const struct file_operations proc_fd_operations = {
  * /proc/pid/fd needs a special permission handler so that a process can still
  * access /proc/self/fd after it has executed a setuid().
  */
-static int proc_fd_permission(struct inode *inode, int mask,
-                               struct nameidata *nd)
+static int proc_fd_permission(struct inode *inode, int mask)
 {
        int rv;
 
@@ -1773,7 +1966,7 @@ static struct dentry *proc_pident_instantiate(struct inode *dir,
        const struct pid_entry *p = ptr;
        struct inode *inode;
        struct proc_inode *ei;
-       struct dentry *error = ERR_PTR(-EINVAL);
+       struct dentry *error = ERR_PTR(-ENOENT);
 
        inode = proc_pid_make_inode(dir->i_sb, task);
        if (!inode)
@@ -1802,13 +1995,11 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
                                         const struct pid_entry *ents,
                                         unsigned int nents)
 {
-       struct inode *inode;
        struct dentry *error;
        struct task_struct *task = get_proc_task(dir);
        const struct pid_entry *p, *last;
 
        error = ERR_PTR(-ENOENT);
-       inode = NULL;
 
        if (!task)
                goto out_no_task;
@@ -1947,9 +2138,15 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
        if (copy_from_user(page, buf, count))
                goto out_free;
 
+       /* Guard against adverse ptrace interaction */
+       length = mutex_lock_interruptible(&task->cred_guard_mutex);
+       if (length < 0)
+               goto out_free;
+
        length = security_setprocattr(task,
                                      (char*)file->f_path.dentry->d_name.name,
                                      (void*)page, count);
+       mutex_unlock(&task->cred_guard_mutex);
 out_free:
        free_page((unsigned long) page);
 out:
@@ -1964,12 +2161,12 @@ static const struct file_operations proc_pid_attr_operations = {
 };
 
 static const struct pid_entry attr_dir_stuff[] = {
-       REG("current",    S_IRUGO|S_IWUGO, pid_attr),
-       REG("prev",       S_IRUGO,         pid_attr),
-       REG("exec",       S_IRUGO|S_IWUGO, pid_attr),
-       REG("fscreate",   S_IRUGO|S_IWUGO, pid_attr),
-       REG("keycreate",  S_IRUGO|S_IWUGO, pid_attr),
-       REG("sockcreate", S_IRUGO|S_IWUGO, pid_attr),
+       REG("current",    S_IRUGO|S_IWUGO, proc_pid_attr_operations),
+       REG("prev",       S_IRUGO,         proc_pid_attr_operations),
+       REG("exec",       S_IRUGO|S_IWUGO, proc_pid_attr_operations),
+       REG("fscreate",   S_IRUGO|S_IWUGO, proc_pid_attr_operations),
+       REG("keycreate",  S_IRUGO|S_IWUGO, proc_pid_attr_operations),
+       REG("sockcreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations),
 };
 
 static int proc_attr_dir_readdir(struct file * filp,
@@ -2144,7 +2341,7 @@ static int proc_base_revalidate(struct dentry *dentry, struct nameidata *nd)
        return 0;
 }
 
-static struct dentry_operations proc_base_dentry_operations =
+static const struct dentry_operations proc_base_dentry_operations =
 {
        .d_revalidate   = proc_base_revalidate,
        .d_delete       = pid_delete_dentry,
@@ -2175,8 +2372,6 @@ static struct dentry *proc_base_instantiate(struct inode *dir,
        if (!ei->pid)
                goto out_iput;
 
-       inode->i_uid = 0;
-       inode->i_gid = 0;
        inode->i_mode = p->mode;
        if (S_ISDIR(inode->i_mode))
                inode->i_nlink = 2;
@@ -2235,29 +2430,54 @@ static int proc_base_fill_cache(struct file *filp, void *dirent,
 }
 
 #ifdef CONFIG_TASK_IO_ACCOUNTING
-static int proc_pid_io_accounting(struct task_struct *task, char *buffer)
+static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
 {
+       struct task_io_accounting acct = task->ioac;
+       unsigned long flags;
+
+       if (whole && lock_task_sighand(task, &flags)) {
+               struct task_struct *t = task;
+
+               task_io_accounting_add(&acct, &task->signal->ioac);
+               while_each_thread(task, t)
+                       task_io_accounting_add(&acct, &t->ioac);
+
+               unlock_task_sighand(task, &flags);
+       }
        return sprintf(buffer,
-#ifdef CONFIG_TASK_XACCT
                        "rchar: %llu\n"
                        "wchar: %llu\n"
                        "syscr: %llu\n"
                        "syscw: %llu\n"
-#endif
                        "read_bytes: %llu\n"
                        "write_bytes: %llu\n"
                        "cancelled_write_bytes: %llu\n",
-#ifdef CONFIG_TASK_XACCT
-                       (unsigned long long)task->rchar,
-                       (unsigned long long)task->wchar,
-                       (unsigned long long)task->syscr,
-                       (unsigned long long)task->syscw,
-#endif
-                       (unsigned long long)task->ioac.read_bytes,
-                       (unsigned long long)task->ioac.write_bytes,
-                       (unsigned long long)task->ioac.cancelled_write_bytes);
+                       (unsigned long long)acct.rchar,
+                       (unsigned long long)acct.wchar,
+                       (unsigned long long)acct.syscr,
+                       (unsigned long long)acct.syscw,
+                       (unsigned long long)acct.read_bytes,
+                       (unsigned long long)acct.write_bytes,
+                       (unsigned long long)acct.cancelled_write_bytes);
+}
+
+static int proc_tid_io_accounting(struct task_struct *task, char *buffer)
+{
+       return do_io_accounting(task, buffer, 0);
+}
+
+static int proc_tgid_io_accounting(struct task_struct *task, char *buffer)
+{
+       return do_io_accounting(task, buffer, 1);
+}
+#endif /* CONFIG_TASK_IO_ACCOUNTING */
+
+static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
+                               struct pid *pid, struct task_struct *task)
+{
+       seq_printf(m, "%08x\n", task->personality);
+       return 0;
 }
-#endif
 
 /*
  * Thread groups
@@ -2266,68 +2486,77 @@ static const struct file_operations proc_task_operations;
 static const struct inode_operations proc_task_inode_operations;
 
 static const struct pid_entry tgid_base_stuff[] = {
-       DIR("task",       S_IRUGO|S_IXUGO, task),
-       DIR("fd",         S_IRUSR|S_IXUSR, fd),
-       DIR("fdinfo",     S_IRUSR|S_IXUSR, fdinfo),
+       DIR("task",       S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations),
+       DIR("fd",         S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
+       DIR("fdinfo",     S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
 #ifdef CONFIG_NET
-       DIR("net",        S_IRUGO|S_IXUSR, net),
+       DIR("net",        S_IRUGO|S_IXUGO, proc_net_inode_operations, proc_net_operations),
 #endif
-       REG("environ",    S_IRUSR, environ),
-       INF("auxv",       S_IRUSR, pid_auxv),
-       ONE("status",     S_IRUGO, pid_status),
-       INF("limits",     S_IRUSR, pid_limits),
+       REG("environ",    S_IRUSR, proc_environ_operations),
+       INF("auxv",       S_IRUSR, proc_pid_auxv),
+       ONE("status",     S_IRUGO, proc_pid_status),
+       ONE("personality", S_IRUSR, proc_pid_personality),
+       INF("limits",     S_IRUSR, proc_pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
-       REG("sched",      S_IRUGO|S_IWUSR, pid_sched),
+       REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+#endif
+#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
+       INF("syscall",    S_IRUSR, proc_pid_syscall),
 #endif
-       INF("cmdline",    S_IRUGO, pid_cmdline),
-       ONE("stat",       S_IRUGO, tgid_stat),
-       ONE("statm",      S_IRUGO, pid_statm),
-       REG("maps",       S_IRUGO, maps),
+       INF("cmdline",    S_IRUGO, proc_pid_cmdline),
+       ONE("stat",       S_IRUGO, proc_tgid_stat),
+       ONE("statm",      S_IRUGO, proc_pid_statm),
+       REG("maps",       S_IRUGO, proc_maps_operations),
 #ifdef CONFIG_NUMA
-       REG("numa_maps",  S_IRUGO, numa_maps),
+       REG("numa_maps",  S_IRUGO, proc_numa_maps_operations),
 #endif
-       REG("mem",        S_IRUSR|S_IWUSR, mem),
-       LNK("cwd",        cwd),
-       LNK("root",       root),
-       LNK("exe",        exe),
-       REG("mounts",     S_IRUGO, mounts),
-       REG("mountstats", S_IRUSR, mountstats),
+       REG("mem",        S_IRUSR|S_IWUSR, proc_mem_operations),
+       LNK("cwd",        proc_cwd_link),
+       LNK("root",       proc_root_link),
+       LNK("exe",        proc_exe_link),
+       REG("mounts",     S_IRUGO, proc_mounts_operations),
+       REG("mountinfo",  S_IRUGO, proc_mountinfo_operations),
+       REG("mountstats", S_IRUSR, proc_mountstats_operations),
 #ifdef CONFIG_PROC_PAGE_MONITOR
-       REG("clear_refs", S_IWUSR, clear_refs),
-       REG("smaps",      S_IRUGO, smaps),
-       REG("pagemap",    S_IRUSR, pagemap),
+       REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
+       REG("smaps",      S_IRUGO, proc_smaps_operations),
+       REG("pagemap",    S_IRUSR, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
-       DIR("attr",       S_IRUGO|S_IXUGO, attr_dir),
+       DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
 #endif
 #ifdef CONFIG_KALLSYMS
-       INF("wchan",      S_IRUGO, pid_wchan),
+       INF("wchan",      S_IRUGO, proc_pid_wchan),
+#endif
+#ifdef CONFIG_STACKTRACE
+       ONE("stack",      S_IRUSR, proc_pid_stack),
 #endif
 #ifdef CONFIG_SCHEDSTATS
-       INF("schedstat",  S_IRUGO, pid_schedstat),
+       INF("schedstat",  S_IRUGO, proc_pid_schedstat),
 #endif
 #ifdef CONFIG_LATENCYTOP
-       REG("latency",  S_IRUGO, lstats),
+       REG("latency",  S_IRUGO, proc_lstats_operations),
 #endif
 #ifdef CONFIG_PROC_PID_CPUSET
-       REG("cpuset",     S_IRUGO, cpuset),
+       REG("cpuset",     S_IRUGO, proc_cpuset_operations),
 #endif
 #ifdef CONFIG_CGROUPS
-       REG("cgroup",  S_IRUGO, cgroup),
+       REG("cgroup",  S_IRUGO, proc_cgroup_operations),
 #endif
-       INF("oom_score",  S_IRUGO, oom_score),
-       REG("oom_adj",    S_IRUGO|S_IWUSR, oom_adjust),
+       INF("oom_score",  S_IRUGO, proc_oom_score),
+       REG("oom_adj",    S_IRUGO|S_IWUSR, proc_oom_adjust_operations),
 #ifdef CONFIG_AUDITSYSCALL
-       REG("loginuid",   S_IWUSR|S_IRUGO, loginuid),
+       REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
+       REG("sessionid",  S_IRUGO, proc_sessionid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
-       REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
+       REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
 #endif
 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
-       REG("coredump_filter", S_IRUGO|S_IWUSR, coredump_filter),
+       REG("coredump_filter", S_IRUGO|S_IWUSR, proc_coredump_filter_operations),
 #endif
 #ifdef CONFIG_TASK_IO_ACCOUNTING
-       INF("io",       S_IRUGO, pid_io_accounting),
+       INF("io",       S_IRUGO, proc_tgid_io_accounting),
 #endif
 };
 
@@ -2462,10 +2691,9 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
        inode->i_op = &proc_tgid_base_inode_operations;
        inode->i_fop = &proc_tgid_base_operations;
        inode->i_flags|=S_IMMUTABLE;
-       inode->i_nlink = 5;
-#ifdef CONFIG_SECURITY
-       inode->i_nlink += 1;
-#endif
+
+       inode->i_nlink = 2 + pid_entry_count_dirs(tgid_base_stuff,
+               ARRAY_SIZE(tgid_base_stuff));
 
        dentry->d_op = &pid_dentry_operations;
 
@@ -2601,57 +2829,69 @@ out_no_task:
  * Tasks
  */
 static const struct pid_entry tid_base_stuff[] = {
-       DIR("fd",        S_IRUSR|S_IXUSR, fd),
-       DIR("fdinfo",    S_IRUSR|S_IXUSR, fdinfo),
-       REG("environ",   S_IRUSR, environ),
-       INF("auxv",      S_IRUSR, pid_auxv),
-       ONE("status",    S_IRUGO, pid_status),
-       INF("limits",    S_IRUSR, pid_limits),
+       DIR("fd",        S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
+       DIR("fdinfo",    S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fd_operations),
+       REG("environ",   S_IRUSR, proc_environ_operations),
+       INF("auxv",      S_IRUSR, proc_pid_auxv),
+       ONE("status",    S_IRUGO, proc_pid_status),
+       ONE("personality", S_IRUSR, proc_pid_personality),
+       INF("limits",    S_IRUSR, proc_pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
-       REG("sched",     S_IRUGO|S_IWUSR, pid_sched),
+       REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
 #endif
-       INF("cmdline",   S_IRUGO, pid_cmdline),
-       ONE("stat",      S_IRUGO, tid_stat),
-       ONE("statm",     S_IRUGO, pid_statm),
-       REG("maps",      S_IRUGO, maps),
+#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
+       INF("syscall",   S_IRUSR, proc_pid_syscall),
+#endif
+       INF("cmdline",   S_IRUGO, proc_pid_cmdline),
+       ONE("stat",      S_IRUGO, proc_tid_stat),
+       ONE("statm",     S_IRUGO, proc_pid_statm),
+       REG("maps",      S_IRUGO, proc_maps_operations),
 #ifdef CONFIG_NUMA
-       REG("numa_maps", S_IRUGO, numa_maps),
+       REG("numa_maps", S_IRUGO, proc_numa_maps_operations),
 #endif
-       REG("mem",       S_IRUSR|S_IWUSR, mem),
-       LNK("cwd",       cwd),
-       LNK("root",      root),
-       LNK("exe",       exe),
-       REG("mounts",    S_IRUGO, mounts),
+       REG("mem",       S_IRUSR|S_IWUSR, proc_mem_operations),
+       LNK("cwd",       proc_cwd_link),
+       LNK("root",      proc_root_link),
+       LNK("exe",       proc_exe_link),
+       REG("mounts",    S_IRUGO, proc_mounts_operations),
+       REG("mountinfo",  S_IRUGO, proc_mountinfo_operations),
 #ifdef CONFIG_PROC_PAGE_MONITOR
-       REG("clear_refs", S_IWUSR, clear_refs),
-       REG("smaps",     S_IRUGO, smaps),
-       REG("pagemap",    S_IRUSR, pagemap),
+       REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
+       REG("smaps",     S_IRUGO, proc_smaps_operations),
+       REG("pagemap",    S_IRUSR, proc_pagemap_operations),
 #endif
 #ifdef CONFIG_SECURITY
-       DIR("attr",      S_IRUGO|S_IXUGO, attr_dir),
+       DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
 #endif
 #ifdef CONFIG_KALLSYMS
-       INF("wchan",     S_IRUGO, pid_wchan),
+       INF("wchan",     S_IRUGO, proc_pid_wchan),
+#endif
+#ifdef CONFIG_STACKTRACE
+       ONE("stack",      S_IRUSR, proc_pid_stack),
 #endif
 #ifdef CONFIG_SCHEDSTATS
-       INF("schedstat", S_IRUGO, pid_schedstat),
+       INF("schedstat", S_IRUGO, proc_pid_schedstat),
 #endif
 #ifdef CONFIG_LATENCYTOP
-       REG("latency",  S_IRUGO, lstats),
+       REG("latency",  S_IRUGO, proc_lstats_operations),
 #endif
 #ifdef CONFIG_PROC_PID_CPUSET
-       REG("cpuset",    S_IRUGO, cpuset),
+       REG("cpuset",    S_IRUGO, proc_cpuset_operations),
 #endif
 #ifdef CONFIG_CGROUPS
-       REG("cgroup",  S_IRUGO, cgroup),
+       REG("cgroup",  S_IRUGO, proc_cgroup_operations),
 #endif
-       INF("oom_score", S_IRUGO, oom_score),
-       REG("oom_adj",   S_IRUGO|S_IWUSR, oom_adjust),
+       INF("oom_score", S_IRUGO, proc_oom_score),
+       REG("oom_adj",   S_IRUGO|S_IWUSR, proc_oom_adjust_operations),
 #ifdef CONFIG_AUDITSYSCALL
-       REG("loginuid",  S_IWUSR|S_IRUGO, loginuid),
+       REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
+       REG("sessionid",  S_IRUSR, proc_sessionid_operations),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
-       REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
+       REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
+#endif
+#ifdef CONFIG_TASK_IO_ACCOUNTING
+       INF("io",       S_IRUGO, proc_tid_io_accounting),
 #endif
 };
 
@@ -2691,10 +2931,9 @@ static struct dentry *proc_task_instantiate(struct inode *dir,
        inode->i_op = &proc_tid_base_inode_operations;
        inode->i_fop = &proc_tid_base_operations;
        inode->i_flags|=S_IMMUTABLE;
-       inode->i_nlink = 4;
-#ifdef CONFIG_SECURITY
-       inode->i_nlink += 1;
-#endif
+
+       inode->i_nlink = 2 + pid_entry_count_dirs(tid_base_stuff,
+               ARRAY_SIZE(tid_base_stuff));
 
        dentry->d_op = &pid_dentry_operations;
 
@@ -2829,7 +3068,6 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
        int retval = -ENOENT;
        ino_t ino;
        int tid;
-       unsigned long pos = filp->f_pos;  /* avoiding "long long" filp->f_pos */
        struct pid_namespace *ns;
 
        task = get_proc_task(inode);
@@ -2846,18 +3084,18 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
                goto out_no_task;
        retval = 0;
 
-       switch (pos) {
+       switch ((unsigned long)filp->f_pos) {
        case 0:
                ino = inode->i_ino;
-               if (filldir(dirent, ".", 1, pos, ino, DT_DIR) < 0)
+               if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) < 0)
                        goto out;
-               pos++;
+               filp->f_pos++;
                /* fall through */
        case 1:
                ino = parent_ino(dentry);
-               if (filldir(dirent, "..", 2, pos, ino, DT_DIR) < 0)
+               if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) < 0)
                        goto out;
-               pos++;
+               filp->f_pos++;
                /* fall through */
        }
 
@@ -2867,9 +3105,9 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
        ns = filp->f_dentry->d_sb->s_fs_info;
        tid = (int)filp->f_version;
        filp->f_version = 0;
-       for (task = first_tid(leader, tid, pos - 2, ns);
+       for (task = first_tid(leader, tid, filp->f_pos - 2, ns);
             task;
-            task = next_tid(task), pos++) {
+            task = next_tid(task), filp->f_pos++) {
                tid = task_pid_nr_ns(task, ns);
                if (proc_task_fill_cache(filp, dirent, filldir, task, tid) < 0) {
                        /* returning this tgid failed, save it as the first
@@ -2880,7 +3118,6 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
                }
        }
 out:
-       filp->f_pos = pos;
        put_task_struct(leader);
 out_no_task:
        return retval;
@@ -2893,9 +3130,7 @@ static int proc_task_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
        generic_fillattr(inode, stat);
 
        if (p) {
-               rcu_read_lock();
                stat->nlink += get_nr_threads(p);
-               rcu_read_unlock();
                put_task_struct(p);
        }