linux/fs/proc/base.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 *  linux/fs/proc/base.c
   4 *
   5 *  Copyright (C) 1991, 1992 Linus Torvalds
   6 *
   7 *  proc base directory handling functions
   8 *
   9 *  1999, Al Viro. Rewritten. Now it covers the whole per-process part.
  10 *  Instead of using magical inumbers to determine the kind of object
  11 *  we allocate and fill in-core inodes upon lookup. They don't even
  12 *  go into icache. We cache the reference to task_struct upon lookup too.
  13 *  Eventually it should become a filesystem in its own. We don't use the
  14 *  rest of procfs anymore.
  15 *
  16 *
  17 *  Changelog:
  18 *  17-Jan-2005
  19 *  Allan Bezerra
  20 *  Bruna Moreira <bruna.moreira@indt.org.br>
  21 *  Edjard Mota <edjard.mota@indt.org.br>
  22 *  Ilias Biris <ilias.biris@indt.org.br>
  23 *  Mauricio Lin <mauricio.lin@indt.org.br>
  24 *
  25 *  Embedded Linux Lab - 10LE Instituto Nokia de Tecnologia - INdT
  26 *
  27 *  A new process specific entry (smaps) included in /proc. It shows the
  28 *  size of rss for each memory area. The maps entry lacks information
  29 *  about physical memory size (rss) for each mapped file, i.e.,
  30 *  rss information for executables and library files.
  31 *  This additional information is useful for any tools that need to know
  32 *  about physical memory consumption for a process specific library.
  33 *
  34 *  Changelog:
  35 *  21-Feb-2005
  36 *  Embedded Linux Lab - 10LE Instituto Nokia de Tecnologia - INdT
  37 *  Pud inclusion in the page table walking.
  38 *
  39 *  ChangeLog:
  40 *  10-Mar-2005
  41 *  10LE Instituto Nokia de Tecnologia - INdT:
  42 *  A better way to walks through the page table as suggested by Hugh Dickins.
  43 *
  44 *  Simo Piiroinen <simo.piiroinen@nokia.com>:
  45 *  Smaps information related to shared, private, clean and dirty pages.
  46 *
  47 *  Paul Mundt <paul.mundt@nokia.com>:
  48 *  Overall revision about smaps.
  49 */
  50
  51#include <linux/uaccess.h>
  52
  53#include <linux/errno.h>
  54#include <linux/time.h>
  55#include <linux/proc_fs.h>
  56#include <linux/stat.h>
  57#include <linux/task_io_accounting_ops.h>
  58#include <linux/init.h>
  59#include <linux/capability.h>
  60#include <linux/file.h>
  61#include <linux/fdtable.h>
  62#include <linux/generic-radix-tree.h>
  63#include <linux/string.h>
  64#include <linux/seq_file.h>
  65#include <linux/namei.h>
  66#include <linux/mnt_namespace.h>
  67#include <linux/mm.h>
  68#include <linux/swap.h>
  69#include <linux/rcupdate.h>
  70#include <linux/stacktrace.h>
  71#include <linux/resource.h>
  72#include <linux/module.h>
  73#include <linux/mount.h>
  74#include <linux/security.h>
  75#include <linux/ptrace.h>
  76#include <linux/tracehook.h>
  77#include <linux/printk.h>
  78#include <linux/cache.h>
  79#include <linux/cgroup.h>
  80#include <linux/cpuset.h>
  81#include <linux/audit.h>
  82#include <linux/poll.h>
  83#include <linux/nsproxy.h>
  84#include <linux/oom.h>
  85#include <linux/elf.h>
  86#include <linux/pid_namespace.h>
  87#include <linux/user_namespace.h>
  88#include <linux/fs_struct.h>
  89#include <linux/slab.h>
  90#include <linux/sched/autogroup.h>
  91#include <linux/sched/mm.h>
  92#include <linux/sched/coredump.h>
  93#include <linux/sched/debug.h>
  94#include <linux/sched/stat.h>
  95#include <linux/posix-timers.h>
  96#include <linux/time_namespace.h>
  97#include <linux/resctrl.h>
  98#include <trace/events/oom.h>
  99#include "internal.h"
 100#include "fd.h"
 101
 102#include "../../lib/kstrtox.h"
 103
 104/* NOTE:
 105 *      Implementing inode permission operations in /proc is almost
 106 *      certainly an error.  Permission checks need to happen during
 107 *      each system call not at open time.  The reason is that most of
 108 *      what we wish to check for permissions in /proc varies at runtime.
 109 *
 110 *      The classic example of a problem is opening file descriptors
 111 *      in /proc for a task before it execs a suid executable.
 112 */
 113
 114static u8 nlink_tid __ro_after_init;
 115static u8 nlink_tgid __ro_after_init;
 116
 117struct pid_entry {
 118        const char *name;
 119        unsigned int len;
 120        umode_t mode;
 121        const struct inode_operations *iop;
 122        const struct file_operations *fop;
 123        union proc_op op;
 124};
 125
 126#define NOD(NAME, MODE, IOP, FOP, OP) {                 \
 127        .name = (NAME),                                 \
 128        .len  = sizeof(NAME) - 1,                       \
 129        .mode = MODE,                                   \
 130        .iop  = IOP,                                    \
 131        .fop  = FOP,                                    \
 132        .op   = OP,                                     \
 133}
 134
 135#define DIR(NAME, MODE, iops, fops)     \
 136        NOD(NAME, (S_IFDIR|(MODE)), &iops, &fops, {} )
 137#define LNK(NAME, get_link)                                     \
 138        NOD(NAME, (S_IFLNK|S_IRWXUGO),                          \
 139                &proc_pid_link_inode_operations, NULL,          \
 140                { .proc_get_link = get_link } )
 141#define REG(NAME, MODE, fops)                           \
 142        NOD(NAME, (S_IFREG|(MODE)), NULL, &fops, {})
 143#define ONE(NAME, MODE, show)                           \
 144        NOD(NAME, (S_IFREG|(MODE)),                     \
 145                NULL, &proc_single_file_operations,     \
 146                { .proc_show = show } )
 147#define ATTR(LSM, NAME, MODE)                           \
 148        NOD(NAME, (S_IFREG|(MODE)),                     \
 149                NULL, &proc_pid_attr_operations,        \
 150                { .lsm = LSM })
 151
 152/*
 153 * Count the number of hardlinks for the pid_entry table, excluding the .
 154 * and .. links.
 155 */
 156static unsigned int __init pid_entry_nlink(const struct pid_entry *entries,
 157        unsigned int n)
 158{
 159        unsigned int i;
 160        unsigned int count;
 161
 162        count = 2;
 163        for (i = 0; i < n; ++i) {
 164                if (S_ISDIR(entries[i].mode))
 165                        ++count;
 166        }
 167
 168        return count;
 169}
 170
 171static int get_task_root(struct task_struct *task, struct path *root)
 172{
 173        int result = -ENOENT;
 174
 175        task_lock(task);
 176        if (task->fs) {
 177                get_fs_root(task->fs, root);
 178                result = 0;
 179        }
 180        task_unlock(task);
 181        return result;
 182}
 183
 184static int proc_cwd_link(struct dentry *dentry, struct path *path)
 185{
 186        struct task_struct *task = get_proc_task(d_inode(dentry));
 187        int result = -ENOENT;
 188
 189        if (task) {
 190                task_lock(task);
 191                if (task->fs) {
 192                        get_fs_pwd(task->fs, path);
 193                        result = 0;
 194                }
 195                task_unlock(task);
 196                put_task_struct(task);
 197        }
 198        return result;
 199}
 200
 201static int proc_root_link(struct dentry *dentry, struct path *path)
 202{
 203        struct task_struct *task = get_proc_task(d_inode(dentry));
 204        int result = -ENOENT;
 205
 206        if (task) {
 207                result = get_task_root(task, path);
 208                put_task_struct(task);
 209        }
 210        return result;
 211}
 212
 213/*
 214 * If the user used setproctitle(), we just get the string from
 215 * user space at arg_start, and limit it to a maximum of one page.
 216 */
 217static ssize_t get_mm_proctitle(struct mm_struct *mm, char __user *buf,
 218                                size_t count, unsigned long pos,
 219                                unsigned long arg_start)
 220{
 221        char *page;
 222        int ret, got;
 223
 224        if (pos >= PAGE_SIZE)
 225                return 0;
 226
 227        page = (char *)__get_free_page(GFP_KERNEL);
 228        if (!page)
 229                return -ENOMEM;
 230
 231        ret = 0;
 232        got = access_remote_vm(mm, arg_start, page, PAGE_SIZE, FOLL_ANON);
 233        if (got > 0) {
 234                int len = strnlen(page, got);
 235
 236                /* Include the NUL character if it was found */
 237                if (len < got)
 238                        len++;
 239
 240                if (len > pos) {
 241                        len -= pos;
 242                        if (len > count)
 243                                len = count;
 244                        len -= copy_to_user(buf, page+pos, len);
 245                        if (!len)
 246                                len = -EFAULT;
 247                        ret = len;
 248                }
 249        }
 250        free_page((unsigned long)page);
 251        return ret;
 252}
 253
 254static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
 255                              size_t count, loff_t *ppos)
 256{
 257        unsigned long arg_start, arg_end, env_start, env_end;
 258        unsigned long pos, len;
 259        char *page, c;
 260
 261        /* Check if process spawned far enough to have cmdline. */
 262        if (!mm->env_end)
 263                return 0;
 264
 265        spin_lock(&mm->arg_lock);
 266        arg_start = mm->arg_start;
 267        arg_end = mm->arg_end;
 268        env_start = mm->env_start;
 269        env_end = mm->env_end;
 270        spin_unlock(&mm->arg_lock);
 271
 272        if (arg_start >= arg_end)
 273                return 0;
 274
 275        /*
 276         * We allow setproctitle() to overwrite the argument
 277         * strings, and overflow past the original end. But
 278         * only when it overflows into the environment area.
 279         */
 280        if (env_start != arg_end || env_end < env_start)
 281                env_start = env_end = arg_end;
 282        len = env_end - arg_start;
 283
 284        /* We're not going to care if "*ppos" has high bits set */
 285        pos = *ppos;
 286        if (pos >= len)
 287                return 0;
 288        if (count > len - pos)
 289                count = len - pos;
 290        if (!count)
 291                return 0;
 292
 293        /*
 294         * Magical special case: if the argv[] end byte is not
 295         * zero, the user has overwritten it with setproctitle(3).
 296         *
 297         * Possible future enhancement: do this only once when
 298         * pos is 0, and set a flag in the 'struct file'.
 299         */
 300        if (access_remote_vm(mm, arg_end-1, &c, 1, FOLL_ANON) == 1 && c)
 301                return get_mm_proctitle(mm, buf, count, pos, arg_start);
 302
 303        /*
 304         * For the non-setproctitle() case we limit things strictly
 305         * to the [arg_start, arg_end[ range.
 306         */
 307        pos += arg_start;
 308        if (pos < arg_start || pos >= arg_end)
 309                return 0;
 310        if (count > arg_end - pos)
 311                count = arg_end - pos;
 312
 313        page = (char *)__get_free_page(GFP_KERNEL);
 314        if (!page)
 315                return -ENOMEM;
 316
 317        len = 0;
 318        while (count) {
 319                int got;
 320                size_t size = min_t(size_t, PAGE_SIZE, count);
 321
 322                got = access_remote_vm(mm, pos, page, size, FOLL_ANON);
 323                if (got <= 0)
 324                        break;
 325                got -= copy_to_user(buf, page, got);
 326                if (unlikely(!got)) {
 327                        if (!len)
 328                                len = -EFAULT;
 329                        break;
 330                }
 331                pos += got;
 332                buf += got;
 333                len += got;
 334                count -= got;
 335        }
 336
 337        free_page((unsigned long)page);
 338        return len;
 339}
 340
 341static ssize_t get_task_cmdline(struct task_struct *tsk, char __user *buf,
 342                                size_t count, loff_t *pos)
 343{
 344        struct mm_struct *mm;
 345        ssize_t ret;
 346
 347        mm = get_task_mm(tsk);
 348        if (!mm)
 349                return 0;
 350
 351        ret = get_mm_cmdline(mm, buf, count, pos);
 352        mmput(mm);
 353        return ret;
 354}
 355
 356static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
 357                                     size_t count, loff_t *pos)
 358{
 359        struct task_struct *tsk;
 360        ssize_t ret;
 361
 362        BUG_ON(*pos < 0);
 363
 364        tsk = get_proc_task(file_inode(file));
 365        if (!tsk)
 366                return -ESRCH;
 367        ret = get_task_cmdline(tsk, buf, count, pos);
 368        put_task_struct(tsk);
 369        if (ret > 0)
 370                *pos += ret;
 371        return ret;
 372}
 373
 374static const struct file_operations proc_pid_cmdline_ops = {
 375        .read   = proc_pid_cmdline_read,
 376        .llseek = generic_file_llseek,
 377};
 378
 379#ifdef CONFIG_KALLSYMS
 380/*
 381 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
 382 * Returns the resolved symbol.  If that fails, simply return the address.
 383 */
 384static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
 385                          struct pid *pid, struct task_struct *task)
 386{
 387        unsigned long wchan;
 388
 389        if (ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
 390                wchan = get_wchan(task);
 391        else
 392                wchan = 0;
 393
 394        if (wchan)
 395                seq_printf(m, "%ps", (void *) wchan);
 396        else
 397                seq_putc(m, '0');
 398
 399        return 0;
 400}
 401#endif /* CONFIG_KALLSYMS */
 402
 403static int lock_trace(struct task_struct *task)
 404{
 405        int err = down_read_killable(&task->signal->exec_update_lock);
 406        if (err)
 407                return err;
 408        if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_FSCREDS)) {
 409                up_read(&task->signal->exec_update_lock);
 410                return -EPERM;
 411        }
 412        return 0;
 413}
 414
 415static void unlock_trace(struct task_struct *task)
 416{
 417        up_read(&task->signal->exec_update_lock);
 418}
 419
 420#ifdef CONFIG_STACKTRACE
 421
 422#define MAX_STACK_TRACE_DEPTH   64
 423
 424static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
 425                          struct pid *pid, struct task_struct *task)
 426{
 427        unsigned long *entries;
 428        int err;
 429
 430        /*
 431         * The ability to racily run the kernel stack unwinder on a running task
 432         * and then observe the unwinder output is scary; while it is useful for
 433         * debugging kernel issues, it can also allow an attacker to leak kernel
 434         * stack contents.
 435         * Doing this in a manner that is at least safe from races would require
 436         * some work to ensure that the remote task can not be scheduled; and
 437         * even then, this would still expose the unwinder as local attack
 438         * surface.
 439         * Therefore, this interface is restricted to root.
 440         */
 441        if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
 442                return -EACCES;
 443
 444        entries = kmalloc_array(MAX_STACK_TRACE_DEPTH, sizeof(*entries),
 445                                GFP_KERNEL);
 446        if (!entries)
 447                return -ENOMEM;
 448
 449        err = lock_trace(task);
 450        if (!err) {
 451                unsigned int i, nr_entries;
 452
 453                nr_entries = stack_trace_save_tsk(task, entries,
 454                                                  MAX_STACK_TRACE_DEPTH, 0);
 455
 456                for (i = 0; i < nr_entries; i++) {
 457                        seq_printf(m, "[<0>] %pB\n", (void *)entries[i]);
 458                }
 459
 460                unlock_trace(task);
 461        }
 462        kfree(entries);
 463
 464        return err;
 465}
 466#endif
 467
 468#ifdef CONFIG_SCHED_INFO
 469/*
 470 * Provides /proc/PID/schedstat
 471 */
 472static int proc_pid_schedstat(struct seq_file *m, struct pid_namespace *ns,
 473                              struct pid *pid, struct task_struct *task)
 474{
 475        if (unlikely(!sched_info_on()))
 476                seq_puts(m, "0 0 0\n");
 477        else
 478                seq_printf(m, "%llu %llu %lu\n",
 479                   (unsigned long long)task->se.sum_exec_runtime,
 480                   (unsigned long long)task->sched_info.run_delay,
 481                   task->sched_info.pcount);
 482
 483        return 0;
 484}
 485#endif
 486
 487#ifdef CONFIG_LATENCYTOP
 488static int lstats_show_proc(struct seq_file *m, void *v)
 489{
 490        int i;
 491        struct inode *inode = m->private;
 492        struct task_struct *task = get_proc_task(inode);
 493
 494        if (!task)
 495                return -ESRCH;
 496        seq_puts(m, "Latency Top version : v0.1\n");
 497        for (i = 0; i < LT_SAVECOUNT; i++) {
 498                struct latency_record *lr = &task->latency_record[i];
 499                if (lr->backtrace[0]) {
 500                        int q;
 501                        seq_printf(m, "%i %li %li",
 502                                   lr->count, lr->time, lr->max);
 503                        for (q = 0; q < LT_BACKTRACEDEPTH; q++) {
 504                                unsigned long bt = lr->backtrace[q];
 505
 506                                if (!bt)
 507                                        break;
 508                                seq_printf(m, " %ps", (void *)bt);
 509                        }
 510                        seq_putc(m, '\n');
 511                }
 512
 513        }
 514        put_task_struct(task);
 515        return 0;
 516}
 517
 518static int lstats_open(struct inode *inode, struct file *file)
 519{
 520        return single_open(file, lstats_show_proc, inode);
 521}
 522
 523static ssize_t lstats_write(struct file *file, const char __user *buf,
 524                            size_t count, loff_t *offs)
 525{
 526        struct task_struct *task = get_proc_task(file_inode(file));
 527
 528        if (!task)
 529                return -ESRCH;
 530        clear_tsk_latency_tracing(task);
 531        put_task_struct(task);
 532
 533        return count;
 534}
 535
 536static const struct file_operations proc_lstats_operations = {
 537        .open           = lstats_open,
 538        .read           = seq_read,
 539        .write          = lstats_write,
 540        .llseek         = seq_lseek,
 541        .release        = single_release,
 542};
 543
 544#endif
 545
 546static int proc_oom_score(struct seq_file *m, struct pid_namespace *ns,
 547                          struct pid *pid, struct task_struct *task)
 548{
 549        unsigned long totalpages = totalram_pages() + total_swap_pages;
 550        unsigned long points = 0;
 551        long badness;
 552
 553        badness = oom_badness(task, totalpages);
 554        /*
 555         * Special case OOM_SCORE_ADJ_MIN for all others scale the
 556         * badness value into [0, 2000] range which we have been
 557         * exporting for a long time so userspace might depend on it.
 558         */
 559        if (badness != LONG_MIN)
 560                points = (1000 + badness * 1000 / (long)totalpages) * 2 / 3;
 561
 562        seq_printf(m, "%lu\n", points);
 563
 564        return 0;
 565}
 566
 567struct limit_names {
 568        const char *name;
 569        const char *unit;
 570};
 571
 572static const struct limit_names lnames[RLIM_NLIMITS] = {
 573        [RLIMIT_CPU] = {"Max cpu time", "seconds"},
 574        [RLIMIT_FSIZE] = {"Max file size", "bytes"},
 575        [RLIMIT_DATA] = {"Max data size", "bytes"},
 576        [RLIMIT_STACK] = {"Max stack size", "bytes"},
 577        [RLIMIT_CORE] = {"Max core file size", "bytes"},
 578        [RLIMIT_RSS] = {"Max resident set", "bytes"},
 579        [RLIMIT_NPROC] = {"Max processes", "processes"},
 580        [RLIMIT_NOFILE] = {"Max open files", "files"},
 581        [RLIMIT_MEMLOCK] = {"Max locked memory", "bytes"},
 582        [RLIMIT_AS] = {"Max address space", "bytes"},
 583        [RLIMIT_LOCKS] = {"Max file locks", "locks"},
 584        [RLIMIT_SIGPENDING] = {"Max pending signals", "signals"},
 585        [RLIMIT_MSGQUEUE] = {"Max msgqueue size", "bytes"},
 586        [RLIMIT_NICE] = {"Max nice priority", NULL},
 587        [RLIMIT_RTPRIO] = {"Max realtime priority", NULL},
 588        [RLIMIT_RTTIME] = {"Max realtime timeout", "us"},
 589};
 590
 591/* Display limits for a process */
 592static int proc_pid_limits(struct seq_file *m, struct pid_namespace *ns,
 593                           struct pid *pid, struct task_struct *task)
 594{
 595        unsigned int i;
 596        unsigned long flags;
 597
 598        struct rlimit rlim[RLIM_NLIMITS];
 599
 600        if (!lock_task_sighand(task, &flags))
 601                return 0;
 602        memcpy(rlim, task->signal->rlim, sizeof(struct rlimit) * RLIM_NLIMITS);
 603        unlock_task_sighand(task, &flags);
 604
 605        /*
 606         * print the file header
 607         */
 608        seq_puts(m, "Limit                     "
 609                "Soft Limit           "
 610                "Hard Limit           "
 611                "Units     \n");
 612
 613        for (i = 0; i < RLIM_NLIMITS; i++) {
 614                if (rlim[i].rlim_cur == RLIM_INFINITY)
 615                        seq_printf(m, "%-25s %-20s ",
 616                                   lnames[i].name, "unlimited");
 617                else
 618                        seq_printf(m, "%-25s %-20lu ",
 619                                   lnames[i].name, rlim[i].rlim_cur);
 620
 621                if (rlim[i].rlim_max == RLIM_INFINITY)
 622                        seq_printf(m, "%-20s ", "unlimited");
 623                else
 624                        seq_printf(m, "%-20lu ", rlim[i].rlim_max);
 625
 626                if (lnames[i].unit)
 627                        seq_printf(m, "%-10s\n", lnames[i].unit);
 628                else
 629                        seq_putc(m, '\n');
 630        }
 631
 632        return 0;
 633}
 634
 635#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
 636static int proc_pid_syscall(struct seq_file *m, struct pid_namespace *ns,
 637                            struct pid *pid, struct task_struct *task)
 638{
 639        struct syscall_info info;
 640        u64 *args = &info.data.args[0];
 641        int res;
 642
 643        res = lock_trace(task);
 644        if (res)
 645                return res;
 646
 647        if (task_current_syscall(task, &info))
 648                seq_puts(m, "running\n");
 649        else if (info.data.nr < 0)
 650                seq_printf(m, "%d 0x%llx 0x%llx\n",
 651                           info.data.nr, info.sp, info.data.instruction_pointer);
 652        else
 653                seq_printf(m,
 654                       "%d 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx\n",
 655                       info.data.nr,
 656                       args[0], args[1], args[2], args[3], args[4], args[5],
 657                       info.sp, info.data.instruction_pointer);
 658        unlock_trace(task);
 659
 660        return 0;
 661}
 662#endif /* CONFIG_HAVE_ARCH_TRACEHOOK */
 663
 664/************************************************************************/
 665/*                       Here the fs part begins                        */
 666/************************************************************************/
 667
 668/* permission checks */
 669static int proc_fd_access_allowed(struct inode *inode)
 670{
 671        struct task_struct *task;
 672        int allowed = 0;
 673        /* Allow access to a task's file descriptors if it is us or we
 674         * may use ptrace attach to the process and find out that
 675         * information.
 676         */
 677        task = get_proc_task(inode);
 678        if (task) {
 679                allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
 680                put_task_struct(task);
 681        }
 682        return allowed;
 683}
 684
 685int proc_setattr(struct user_namespace *mnt_userns, struct dentry *dentry,
 686                 struct iattr *attr)
 687{
 688        int error;
 689        struct inode *inode = d_inode(dentry);
 690
 691        if (attr->ia_valid & ATTR_MODE)
 692                return -EPERM;
 693
 694        error = setattr_prepare(&init_user_ns, dentry, attr);
 695        if (error)
 696                return error;
 697
 698        setattr_copy(&init_user_ns, inode, attr);
 699        mark_inode_dirty(inode);
 700        return 0;
 701}
 702
 703/*
 704 * May current process learn task's sched/cmdline info (for hide_pid_min=1)
 705 * or euid/egid (for hide_pid_min=2)?
 706 */
 707static bool has_pid_permissions(struct proc_fs_info *fs_info,
 708                                 struct task_struct *task,
 709                                 enum proc_hidepid hide_pid_min)
 710{
 711        /*
 712         * If 'hidpid' mount option is set force a ptrace check,
 713         * we indicate that we are using a filesystem syscall
 714         * by passing PTRACE_MODE_READ_FSCREDS
 715         */
 716        if (fs_info->hide_pid == HIDEPID_NOT_PTRACEABLE)
 717                return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
 718
 719        if (fs_info->hide_pid < hide_pid_min)
 720                return true;
 721        if (in_group_p(fs_info->pid_gid))
 722                return true;
 723        return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
 724}
 725
 726
 727static int proc_pid_permission(struct user_namespace *mnt_userns,
 728                               struct inode *inode, int mask)
 729{
 730        struct proc_fs_info *fs_info = proc_sb_info(inode->i_sb);
 731        struct task_struct *task;
 732        bool has_perms;
 733
 734        task = get_proc_task(inode);
 735        if (!task)
 736                return -ESRCH;
 737        has_perms = has_pid_permissions(fs_info, task, HIDEPID_NO_ACCESS);
 738        put_task_struct(task);
 739
 740        if (!has_perms) {
 741                if (fs_info->hide_pid == HIDEPID_INVISIBLE) {
 742                        /*
 743                         * Let's make getdents(), stat(), and open()
 744                         * consistent with each other.  If a process
 745                         * may not stat() a file, it shouldn't be seen
 746                         * in procfs at all.
 747                         */
 748                        return -ENOENT;
 749                }
 750
 751                return -EPERM;
 752        }
 753        return generic_permission(&init_user_ns, inode, mask);
 754}
 755
 756
 757
 758static const struct inode_operations proc_def_inode_operations = {
 759        .setattr        = proc_setattr,
 760};
 761
 762static int proc_single_show(struct seq_file *m, void *v)
 763{
 764        struct inode *inode = m->private;
 765        struct pid_namespace *ns = proc_pid_ns(inode->i_sb);
 766        struct pid *pid = proc_pid(inode);
 767        struct task_struct *task;
 768        int ret;
 769
 770        task = get_pid_task(pid, PIDTYPE_PID);
 771        if (!task)
 772                return -ESRCH;
 773
 774        ret = PROC_I(inode)->op.proc_show(m, ns, pid, task);
 775
 776        put_task_struct(task);
 777        return ret;
 778}
 779
 780static int proc_single_open(struct inode *inode, struct file *filp)
 781{
 782        return single_open(filp, proc_single_show, inode);
 783}
 784
 785static const struct file_operations proc_single_file_operations = {
 786        .open           = proc_single_open,
 787        .read           = seq_read,
 788        .llseek         = seq_lseek,
 789        .release        = single_release,
 790};
 791
 792
 793struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
 794{
 795        struct task_struct *task = get_proc_task(inode);
 796        struct mm_struct *mm = ERR_PTR(-ESRCH);
 797
 798        if (task) {
 799                mm = mm_access(task, mode | PTRACE_MODE_FSCREDS);
 800                put_task_struct(task);
 801
 802                if (!IS_ERR_OR_NULL(mm)) {
 803                        /* ensure this mm_struct can't be freed */
 804                        mmgrab(mm);
 805                        /* but do not pin its memory */
 806                        mmput(mm);
 807                }
 808        }
 809
 810        return mm;
 811}
 812
 813static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
 814{
 815        struct mm_struct *mm = proc_mem_open(inode, mode);
 816
 817        if (IS_ERR(mm))
 818                return PTR_ERR(mm);
 819
 820        file->private_data = mm;
 821        return 0;
 822}
 823
 824static int mem_open(struct inode *inode, struct file *file)
 825{
 826        int ret = __mem_open(inode, file, PTRACE_MODE_ATTACH);
 827
 828        /* OK to pass negative loff_t, we can catch out-of-range */
 829        file->f_mode |= FMODE_UNSIGNED_OFFSET;
 830
 831        return ret;
 832}
 833
 834static ssize_t mem_rw(struct file *file, char __user *buf,
 835                        size_t count, loff_t *ppos, int write)
 836{
 837        struct mm_struct *mm = file->private_data;
 838        unsigned long addr = *ppos;
 839        ssize_t copied;
 840        char *page;
 841        unsigned int flags;
 842
 843        if (!mm)
 844                return 0;
 845
 846        page = (char *)__get_free_page(GFP_KERNEL);
 847        if (!page)
 848                return -ENOMEM;
 849
 850        copied = 0;
 851        if (!mmget_not_zero(mm))
 852                goto free;
 853
 854        flags = FOLL_FORCE | (write ? FOLL_WRITE : 0);
 855
 856        while (count > 0) {
 857                size_t this_len = min_t(size_t, count, PAGE_SIZE);
 858
 859                if (write && copy_from_user(page, buf, this_len)) {
 860                        copied = -EFAULT;
 861                        break;
 862                }
 863
 864                this_len = access_remote_vm(mm, addr, page, this_len, flags);
 865                if (!this_len) {
 866                        if (!copied)
 867                                copied = -EIO;
 868                        break;
 869                }
 870
 871                if (!write && copy_to_user(buf, page, this_len)) {
 872                        copied = -EFAULT;
 873                        break;
 874                }
 875
 876                buf += this_len;
 877                addr += this_len;
 878                copied += this_len;
 879                count -= this_len;
 880        }
 881        *ppos = addr;
 882
 883        mmput(mm);
 884free:
 885        free_page((unsigned long) page);
 886        return copied;
 887}
 888
 889static ssize_t mem_read(struct file *file, char __user *buf,
 890                        size_t count, loff_t *ppos)
 891{
 892        return mem_rw(file, buf, count, ppos, 0);
 893}
 894
 895static ssize_t mem_write(struct file *file, const char __user *buf,
 896                         size_t count, loff_t *ppos)
 897{
 898        return mem_rw(file, (char __user*)buf, count, ppos, 1);
 899}
 900
 901loff_t mem_lseek(struct file *file, loff_t offset, int orig)
 902{
 903        switch (orig) {
 904        case 0:
 905                file->f_pos = offset;
 906                break;
 907        case 1:
 908                file->f_pos += offset;
 909                break;
 910        default:
 911                return -EINVAL;
 912        }
 913        force_successful_syscall_return();
 914        return file->f_pos;
 915}
 916
 917static int mem_release(struct inode *inode, struct file *file)
 918{
 919        struct mm_struct *mm = file->private_data;
 920        if (mm)
 921                mmdrop(mm);
 922        return 0;
 923}
 924
 925static const struct file_operations proc_mem_operations = {
 926        .llseek         = mem_lseek,
 927        .read           = mem_read,
 928        .write          = mem_write,
 929        .open           = mem_open,
 930        .release        = mem_release,
 931};
 932
 933static int environ_open(struct inode *inode, struct file *file)
 934{
 935        return __mem_open(inode, file, PTRACE_MODE_READ);
 936}
 937
 938static ssize_t environ_read(struct file *file, char __user *buf,
 939                        size_t count, loff_t *ppos)
 940{
 941        char *page;
 942        unsigned long src = *ppos;
 943        int ret = 0;
 944        struct mm_struct *mm = file->private_data;
 945        unsigned long env_start, env_end;
 946
 947        /* Ensure the process spawned far enough to have an environment. */
 948        if (!mm || !mm->env_end)
 949                return 0;
 950
 951        page = (char *)__get_free_page(GFP_KERNEL);
 952        if (!page)
 953                return -ENOMEM;
 954
 955        ret = 0;
 956        if (!mmget_not_zero(mm))
 957                goto free;
 958
 959        spin_lock(&mm->arg_lock);
 960        env_start = mm->env_start;
 961        env_end = mm->env_end;
 962        spin_unlock(&mm->arg_lock);
 963
 964        while (count > 0) {
 965                size_t this_len, max_len;
 966                int retval;
 967
 968                if (src >= (env_end - env_start))
 969                        break;
 970
 971                this_len = env_end - (env_start + src);
 972
 973                max_len = min_t(size_t, PAGE_SIZE, count);
 974                this_len = min(max_len, this_len);
 975
 976                retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON);
 977
 978                if (retval <= 0) {
 979                        ret = retval;
 980                        break;
 981                }
 982
 983                if (copy_to_user(buf, page, retval)) {
 984                        ret = -EFAULT;
 985                        break;
 986                }
 987
 988                ret += retval;
 989                src += retval;
 990                buf += retval;
 991                count -= retval;
 992        }
 993        *ppos = src;
 994        mmput(mm);
 995
 996free:
 997        free_page((unsigned long) page);
 998        return ret;
 999}
1000
1001static const struct file_operations proc_environ_operations = {
1002        .open           = environ_open,
1003        .read           = environ_read,
1004        .llseek         = generic_file_llseek,
1005        .release        = mem_release,
1006};
1007
1008static int auxv_open(struct inode *inode, struct file *file)
1009{
1010        return __mem_open(inode, file, PTRACE_MODE_READ_FSCREDS);
1011}
1012
1013static ssize_t auxv_read(struct file *file, char __user *buf,
1014                        size_t count, loff_t *ppos)
1015{
1016        struct mm_struct *mm = file->private_data;
1017        unsigned int nwords = 0;
1018
1019        if (!mm)
1020                return 0;
1021        do {
1022                nwords += 2;
1023        } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
1024        return simple_read_from_buffer(buf, count, ppos, mm->saved_auxv,
1025                                       nwords * sizeof(mm->saved_auxv[0]));
1026}
1027
1028static const struct file_operations proc_auxv_operations = {
1029        .open           = auxv_open,
1030        .read           = auxv_read,
1031        .llseek         = generic_file_llseek,
1032        .release        = mem_release,
1033};
1034
1035static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count,
1036                            loff_t *ppos)
1037{
1038        struct task_struct *task = get_proc_task(file_inode(file));
1039        char buffer[PROC_NUMBUF];
1040        int oom_adj = OOM_ADJUST_MIN;
1041        size_t len;
1042
1043        if (!task)
1044                return -ESRCH;
1045        if (task->signal->oom_score_adj == OOM_SCORE_ADJ_MAX)
1046                oom_adj = OOM_ADJUST_MAX;
1047        else
1048                oom_adj = (task->signal->oom_score_adj * -OOM_DISABLE) /
1049                          OOM_SCORE_ADJ_MAX;
1050        put_task_struct(task);
1051        if (oom_adj > OOM_ADJUST_MAX)
1052                oom_adj = OOM_ADJUST_MAX;
1053        len = snprintf(buffer, sizeof(buffer), "%d\n", oom_adj);
1054        return simple_read_from_buffer(buf, count, ppos, buffer, len);
1055}
1056
1057static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
1058{
1059        struct mm_struct *mm = NULL;
1060        struct task_struct *task;
1061        int err = 0;
1062
1063        task = get_proc_task(file_inode(file));
1064        if (!task)
1065                return -ESRCH;
1066
1067        mutex_lock(&oom_adj_mutex);
1068        if (legacy) {
1069                if (oom_adj < task->signal->oom_score_adj &&
1070                                !capable(CAP_SYS_RESOURCE)) {
1071                        err = -EACCES;
1072                        goto err_unlock;
1073                }
1074                /*
1075                 * /proc/pid/oom_adj is provided for legacy purposes, ask users to use
1076                 * /proc/pid/oom_score_adj instead.
1077                 */
1078                pr_warn_once("%s (%d): /proc/%d/oom_adj is deprecated, please use /proc/%d/oom_score_adj instead.\n",
1079                          current->comm, task_pid_nr(current), task_pid_nr(task),
1080                          task_pid_nr(task));
1081        } else {
1082                if ((short)oom_adj < task->signal->oom_score_adj_min &&
1083                                !capable(CAP_SYS_RESOURCE)) {
1084                        err = -EACCES;
1085                        goto err_unlock;
1086                }
1087        }
1088
1089        /*
1090         * Make sure we will check other processes sharing the mm if this is
1091         * not vfrok which wants its own oom_score_adj.
1092         * pin the mm so it doesn't go away and get reused after task_unlock
1093         */
1094        if (!task->vfork_done) {
1095                struct task_struct *p = find_lock_task_mm(task);
1096
1097                if (p) {
1098                        if (test_bit(MMF_MULTIPROCESS, &p->mm->flags)) {
1099                                mm = p->mm;
1100                                mmgrab(mm);
1101                        }
1102                        task_unlock(p);
1103                }
1104        }
1105
1106        task->signal->oom_score_adj = oom_adj;
1107        if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE))
1108                task->signal->oom_score_adj_min = (short)oom_adj;
1109        trace_oom_score_adj_update(task);
1110
1111        if (mm) {
1112                struct task_struct *p;
1113
1114                rcu_read_lock();
1115                for_each_process(p) {
1116                        if (same_thread_group(task, p))
1117                                continue;
1118
1119                        /* do not touch kernel threads or the global init */
1120                        if (p->flags & PF_KTHREAD || is_global_init(p))
1121                                continue;
1122
1123                        task_lock(p);
1124                        if (!p->vfork_done && process_shares_mm(p, mm)) {
1125                                p->signal->oom_score_adj = oom_adj;
1126                                if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE))
1127                                        p->signal->oom_score_adj_min = (short)oom_adj;
1128                        }
1129                        task_unlock(p);
1130                }
1131                rcu_read_unlock();
1132                mmdrop(mm);
1133        }
1134err_unlock:
1135        mutex_unlock(&oom_adj_mutex);
1136        put_task_struct(task);
1137        return err;
1138}
1139
1140/*
1141 * /proc/pid/oom_adj exists solely for backwards compatibility with previous
1142 * kernels.  The effective policy is defined by oom_score_adj, which has a
1143 * different scale: oom_adj grew exponentially and oom_score_adj grows linearly.
1144 * Values written to oom_adj are simply mapped linearly to oom_score_adj.
1145 * Processes that become oom disabled via oom_adj will still be oom disabled
1146 * with this implementation.
1147 *
1148 * oom_adj cannot be removed since existing userspace binaries use it.
1149 */
1150static ssize_t oom_adj_write(struct file *file, const char __user *buf,
1151                             size_t count, loff_t *ppos)
1152{
1153        char buffer[PROC_NUMBUF];
1154        int oom_adj;
1155        int err;
1156
1157        memset(buffer, 0, sizeof(buffer));
1158        if (count > sizeof(buffer) - 1)
1159                count = sizeof(buffer) - 1;
1160        if (copy_from_user(buffer, buf, count)) {
1161                err = -EFAULT;
1162                goto out;
1163        }
1164
1165        err = kstrtoint(strstrip(buffer), 0, &oom_adj);
1166        if (err)
1167                goto out;
1168        if ((oom_adj < OOM_ADJUST_MIN || oom_adj > OOM_ADJUST_MAX) &&
1169             oom_adj != OOM_DISABLE) {
1170                err = -EINVAL;
1171                goto out;
1172        }
1173
1174        /*
1175         * Scale /proc/pid/oom_score_adj appropriately ensuring that a maximum
1176         * value is always attainable.
1177         */
1178        if (oom_adj == OOM_ADJUST_MAX)
1179                oom_adj = OOM_SCORE_ADJ_MAX;
1180        else
1181                oom_adj = (oom_adj * OOM_SCORE_ADJ_MAX) / -OOM_DISABLE;
1182
1183        err = __set_oom_adj(file, oom_adj, true);
1184out:
1185        return err < 0 ? err : count;
1186}
1187
1188static const struct file_operations proc_oom_adj_operations = {
1189        .read           = oom_adj_read,
1190        .write          = oom_adj_write,
1191        .llseek         = generic_file_llseek,
1192};
1193
1194static ssize_t oom_score_adj_read(struct file *file, char __user *buf,
1195                                        size_t count, loff_t *ppos)
1196{
1197        struct task_struct *task = get_proc_task(file_inode(file));
1198        char buffer[PROC_NUMBUF];
1199        short oom_score_adj = OOM_SCORE_ADJ_MIN;
1200        size_t len;
1201
1202        if (!task)
1203                return -ESRCH;
1204        oom_score_adj = task->signal->oom_score_adj;
1205        put_task_struct(task);
1206        len = snprintf(buffer, sizeof(buffer), "%hd\n", oom_score_adj);
1207        return simple_read_from_buffer(buf, count, ppos, buffer, len);
1208}
1209
1210static ssize_t oom_score_adj_write(struct file *file, const char __user *buf,
1211                                        size_t count, loff_t *ppos)
1212{
1213        char buffer[PROC_NUMBUF];
1214        int oom_score_adj;
1215        int err;
1216
1217        memset(buffer, 0, sizeof(buffer));
1218        if (count > sizeof(buffer) - 1)
1219                count = sizeof(buffer) - 1;
1220        if (copy_from_user(buffer, buf, count)) {
1221                err = -EFAULT;
1222                goto out;
1223        }
1224
1225        err = kstrtoint(strstrip(buffer), 0, &oom_score_adj);
1226        if (err)
1227                goto out;
1228        if (oom_score_adj < OOM_SCORE_ADJ_MIN ||
1229                        oom_score_adj > OOM_SCORE_ADJ_MAX) {
1230                err = -EINVAL;
1231                goto out;
1232        }
1233
1234        err = __set_oom_adj(file, oom_score_adj, false);
1235out:
1236        return err < 0 ? err : count;
1237}
1238
1239static const struct file_operations proc_oom_score_adj_operations = {
1240        .read           = oom_score_adj_read,
1241        .write          = oom_score_adj_write,
1242        .llseek         = default_llseek,
1243};
1244
1245#ifdef CONFIG_AUDIT
1246#define TMPBUFLEN 11
1247static ssize_t proc_loginuid_read(struct file * file, char __user * buf,
1248                                  size_t count, loff_t *ppos)
1249{
1250        struct inode * inode = file_inode(file);
1251        struct task_struct *task = get_proc_task(inode);
1252        ssize_t length;
1253        char tmpbuf[TMPBUFLEN];
1254
1255        if (!task)
1256                return -ESRCH;
1257        length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
1258                           from_kuid(file->f_cred->user_ns,
1259                                     audit_get_loginuid(task)));
1260        put_task_struct(task);
1261        return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1262}
1263
1264static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
1265                                   size_t count, loff_t *ppos)
1266{
1267        struct inode * inode = file_inode(file);
1268        uid_t loginuid;
1269        kuid_t kloginuid;
1270        int rv;
1271
1272        /* Don't let kthreads write their own loginuid */
1273        if (current->flags & PF_KTHREAD)
1274                return -EPERM;
1275
1276        rcu_read_lock();
1277        if (current != pid_task(proc_pid(inode), PIDTYPE_PID)) {
1278                rcu_read_unlock();
1279                return -EPERM;
1280        }
1281        rcu_read_unlock();
1282
1283        if (*ppos != 0) {
1284                /* No partial writes. */
1285                return -EINVAL;
1286        }
1287
1288        rv = kstrtou32_from_user(buf, count, 10, &loginuid);
1289        if (rv < 0)
1290                return rv;
1291
1292        /* is userspace tring to explicitly UNSET the loginuid? */
1293        if (loginuid == AUDIT_UID_UNSET) {
1294                kloginuid = INVALID_UID;
1295        } else {
1296                kloginuid = make_kuid(file->f_cred->user_ns, loginuid);
1297                if (!uid_valid(kloginuid))
1298                        return -EINVAL;
1299        }
1300
1301        rv = audit_set_loginuid(kloginuid);
1302        if (rv < 0)
1303                return rv;
1304        return count;
1305}
1306
1307static const struct file_operations proc_loginuid_operations = {
1308        .read           = proc_loginuid_read,
1309        .write          = proc_loginuid_write,
1310        .llseek         = generic_file_llseek,
1311};
1312
1313static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
1314                                  size_t count, loff_t *ppos)
1315{
1316        struct inode * inode = file_inode(file);
1317        struct task_struct *task = get_proc_task(inode);
1318        ssize_t length;
1319        char tmpbuf[TMPBUFLEN];
1320
1321        if (!task)
1322                return -ESRCH;
1323        length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
1324                                audit_get_sessionid(task));
1325        put_task_struct(task);
1326        return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1327}
1328
1329static const struct file_operations proc_sessionid_operations = {
1330        .read           = proc_sessionid_read,
1331        .llseek         = generic_file_llseek,
1332};
1333#endif
1334
1335#ifdef CONFIG_FAULT_INJECTION
1336static ssize_t proc_fault_inject_read(struct file * file, char __user * buf,
1337                                      size_t count, loff_t *ppos)
1338{
1339        struct task_struct *task = get_proc_task(file_inode(file));
1340        char buffer[PROC_NUMBUF];
1341        size_t len;
1342        int make_it_fail;
1343
1344        if (!task)
1345                return -ESRCH;
1346        make_it_fail = task->make_it_fail;
1347        put_task_struct(task);
1348
1349        len = snprintf(buffer, sizeof(buffer), "%i\n", make_it_fail);
1350
1351        return simple_read_from_buffer(buf, count, ppos, buffer, len);
1352}
1353
1354static ssize_t proc_fault_inject_write(struct file * file,
1355                        const char __user * buf, size_t count, loff_t *ppos)
1356{
1357        struct task_struct *task;
1358        char buffer[PROC_NUMBUF];
1359        int make_it_fail;
1360        int rv;
1361
1362        if (!capable(CAP_SYS_RESOURCE))
1363                return -EPERM;
1364        memset(buffer, 0, sizeof(buffer));
1365        if (count > sizeof(buffer) - 1)
1366                count = sizeof(buffer) - 1;
1367        if (copy_from_user(buffer, buf, count))
1368                return -EFAULT;
1369        rv = kstrtoint(strstrip(buffer), 0, &make_it_fail);
1370        if (rv < 0)
1371                return rv;
1372        if (make_it_fail < 0 || make_it_fail > 1)
1373                return -EINVAL;
1374
1375        task = get_proc_task(file_inode(file));
1376        if (!task)
1377                return -ESRCH;
1378        task->make_it_fail = make_it_fail;
1379        put_task_struct(task);
1380
1381        return count;
1382}
1383
1384static const struct file_operations proc_fault_inject_operations = {
1385        .read           = proc_fault_inject_read,
1386        .write          = proc_fault_inject_write,
1387        .llseek         = generic_file_llseek,
1388};
1389
1390static ssize_t proc_fail_nth_write(struct file *file, const char __user *buf,
1391                                   size_t count, loff_t *ppos)
1392{
1393        struct task_struct *task;
1394        int err;
1395        unsigned int n;
1396
1397        err = kstrtouint_from_user(buf, count, 0, &n);
1398        if (err)
1399                return err;
1400
1401        task = get_proc_task(file_inode(file));
1402        if (!task)
1403                return -ESRCH;
1404        task->fail_nth = n;
1405        put_task_struct(task);
1406
1407        return count;
1408}
1409
1410static ssize_t proc_fail_nth_read(struct file *file, char __user *buf,
1411                                  size_t count, loff_t *ppos)
1412{
1413        struct task_struct *task;
1414        char numbuf[PROC_NUMBUF];
1415        ssize_t len;
1416
1417        task = get_proc_task(file_inode(file));
1418        if (!task)
1419                return -ESRCH;
1420        len = snprintf(numbuf, sizeof(numbuf), "%u\n", task->fail_nth);
1421        put_task_struct(task);
1422        return simple_read_from_buffer(buf, count, ppos, numbuf, len);
1423}
1424
1425static const struct file_operations proc_fail_nth_operations = {
1426        .read           = proc_fail_nth_read,
1427        .write          = proc_fail_nth_write,
1428};
1429#endif
1430
1431
1432#ifdef CONFIG_SCHED_DEBUG
1433/*
1434 * Print out various scheduling related per-task fields:
1435 */
1436static int sched_show(struct seq_file *m, void *v)
1437{
1438        struct inode *inode = m->private;
1439        struct pid_namespace *ns = proc_pid_ns(inode->i_sb);
1440        struct task_struct *p;
1441
1442        p = get_proc_task(inode);
1443        if (!p)
1444                return -ESRCH;
1445        proc_sched_show_task(p, ns, m);
1446
1447        put_task_struct(p);
1448
1449        return 0;
1450}
1451
1452static ssize_t
1453sched_write(struct file *file, const char __user *buf,
1454            size_t count, loff_t *offset)
1455{
1456        struct inode *inode = file_inode(file);
1457        struct task_struct *p;
1458
1459        p = get_proc_task(inode);
1460        if (!p)
1461                return -ESRCH;
1462        proc_sched_set_task(p);
1463
1464        put_task_struct(p);
1465
1466        return count;
1467}
1468
1469static int sched_open(struct inode *inode, struct file *filp)
1470{
1471        return single_open(filp, sched_show, inode);
1472}
1473
1474static const struct file_operations proc_pid_sched_operations = {
1475        .open           = sched_open,
1476        .read           = seq_read,
1477        .write          = sched_write,
1478        .llseek         = seq_lseek,
1479        .release        = single_release,
1480};
1481
1482#endif
1483
1484#ifdef CONFIG_SCHED_AUTOGROUP
1485/*
1486 * Print out autogroup related information:
1487 */
1488static int sched_autogroup_show(struct seq_file *m, void *v)
1489{
1490        struct inode *inode = m->private;
1491        struct task_struct *p;
1492
1493        p = get_proc_task(inode);
1494        if (!p)
1495                return -ESRCH;
1496        proc_sched_autogroup_show_task(p, m);
1497
1498        put_task_struct(p);
1499
1500        return 0;
1501}
1502
1503static ssize_t
1504sched_autogroup_write(struct file *file, const char __user *buf,
1505            size_t count, loff_t *offset)
1506{
1507        struct inode *inode = file_inode(file);
1508        struct task_struct *p;
1509        char buffer[PROC_NUMBUF];
1510        int nice;
1511        int err;
1512
1513        memset(buffer, 0, sizeof(buffer));
1514        if (count > sizeof(buffer) - 1)
1515                count = sizeof(buffer) - 1;
1516        if (copy_from_user(buffer, buf, count))
1517                return -EFAULT;
1518
1519        err = kstrtoint(strstrip(buffer), 0, &nice);
1520        if (err < 0)
1521                return err;
1522
1523        p = get_proc_task(inode);
1524        if (!p)
1525                return -ESRCH;
1526
1527        err = proc_sched_autogroup_set_nice(p, nice);
1528        if (err)
1529                count = err;
1530
1531        put_task_struct(p);
1532
1533        return count;
1534}
1535
1536static int sched_autogroup_open(struct inode *inode, struct file *filp)
1537{
1538        int ret;
1539
1540        ret = single_open(filp, sched_autogroup_show, NULL);
1541        if (!ret) {
1542                struct seq_file *m = filp->private_data;
1543
1544                m->private = inode;
1545        }
1546        return ret;
1547}
1548
1549static const struct file_operations proc_pid_sched_autogroup_operations = {
1550        .open           = sched_autogroup_open,
1551        .read           = seq_read,
1552        .write          = sched_autogroup_write,
1553        .llseek         = seq_lseek,
1554        .release        = single_release,
1555};
1556
1557#endif /* CONFIG_SCHED_AUTOGROUP */
1558
1559#ifdef CONFIG_TIME_NS
1560static int timens_offsets_show(struct seq_file *m, void *v)
1561{
1562        struct task_struct *p;
1563
1564        p = get_proc_task(file_inode(m->file));
1565        if (!p)
1566                return -ESRCH;
1567        proc_timens_show_offsets(p, m);
1568
1569        put_task_struct(p);
1570
1571        return 0;
1572}
1573
1574static ssize_t timens_offsets_write(struct file *file, const char __user *buf,
1575                                    size_t count, loff_t *ppos)
1576{
1577        struct inode *inode = file_inode(file);
1578        struct proc_timens_offset offsets[2];
1579        char *kbuf = NULL, *pos, *next_line;
1580        struct task_struct *p;
1581        int ret, noffsets;
1582
1583        /* Only allow < page size writes at the beginning of the file */
1584        if ((*ppos != 0) || (count >= PAGE_SIZE))
1585                return -EINVAL;
1586
1587        /* Slurp in the user data */
1588        kbuf = memdup_user_nul(buf, count);
1589        if (IS_ERR(kbuf))
1590                return PTR_ERR(kbuf);
1591
1592        /* Parse the user data */
1593        ret = -EINVAL;
1594        noffsets = 0;
1595        for (pos = kbuf; pos; pos = next_line) {
1596                struct proc_timens_offset *off = &offsets[noffsets];
1597                char clock[10];
1598                int err;
1599
1600                /* Find the end of line and ensure we don't look past it */
1601                next_line = strchr(pos, '\n');
1602                if (next_line) {
1603                        *next_line = '\0';
1604                        next_line++;
1605                        if (*next_line == '\0')
1606                                next_line = NULL;
1607                }
1608
1609                err = sscanf(pos, "%9s %lld %lu", clock,
1610                                &off->val.tv_sec, &off->val.tv_nsec);
1611                if (err != 3 || off->val.tv_nsec >= NSEC_PER_SEC)
1612                        goto out;
1613
1614                clock[sizeof(clock) - 1] = 0;
1615                if (strcmp(clock, "monotonic") == 0 ||
1616                    strcmp(clock, __stringify(CLOCK_MONOTONIC)) == 0)
1617                        off->clockid = CLOCK_MONOTONIC;
1618                else if (strcmp(clock, "boottime") == 0 ||
1619                         strcmp(clock, __stringify(CLOCK_BOOTTIME)) == 0)
1620                        off->clockid = CLOCK_BOOTTIME;
1621                else
1622                        goto out;
1623
1624                noffsets++;
1625                if (noffsets == ARRAY_SIZE(offsets)) {
1626                        if (next_line)
1627                                count = next_line - kbuf;
1628                        break;
1629                }
1630        }
1631
1632        ret = -ESRCH;
1633        p = get_proc_task(inode);
1634        if (!p)
1635                goto out;
1636        ret = proc_timens_set_offset(file, p, offsets, noffsets);
1637        put_task_struct(p);
1638        if (ret)
1639                goto out;
1640
1641        ret = count;
1642out:
1643        kfree(kbuf);
1644        return ret;
1645}
1646
1647static int timens_offsets_open(struct inode *inode, struct file *filp)
1648{
1649        return single_open(filp, timens_offsets_show, inode);
1650}
1651
1652static const struct file_operations proc_timens_offsets_operations = {
1653        .open           = timens_offsets_open,
1654        .read           = seq_read,
1655        .write          = timens_offsets_write,
1656        .llseek         = seq_lseek,
1657        .release        = single_release,
1658};
1659#endif /* CONFIG_TIME_NS */
1660
1661static ssize_t comm_write(struct file *file, const char __user *buf,
1662                                size_t count, loff_t *offset)
1663{
1664        struct inode *inode = file_inode(file);
1665        struct task_struct *p;
1666        char buffer[TASK_COMM_LEN];
1667        const size_t maxlen = sizeof(buffer) - 1;
1668
1669        memset(buffer, 0, sizeof(buffer));
1670        if (copy_from_user(buffer, buf, count > maxlen ? maxlen : count))
1671                return -EFAULT;
1672
1673        p = get_proc_task(inode);
1674        if (!p)
1675                return -ESRCH;
1676
1677        if (same_thread_group(current, p))
1678                set_task_comm(p, buffer);
1679        else
1680                count = -EINVAL;
1681
1682        put_task_struct(p);
1683
1684        return count;
1685}
1686
1687static int comm_show(struct seq_file *m, void *v)
1688{
1689        struct inode *inode = m->private;
1690        struct task_struct *p;
1691
1692        p = get_proc_task(inode);
1693        if (!p)
1694                return -ESRCH;
1695
1696        proc_task_name(m, p, false);
1697        seq_putc(m, '\n');
1698
1699        put_task_struct(p);
1700
1701        return 0;
1702}
1703
1704static int comm_open(struct inode *inode, struct file *filp)
1705{
1706        return single_open(filp, comm_show, inode);
1707}
1708
1709static const struct file_operations proc_pid_set_comm_operations = {
1710        .open           = comm_open,
1711        .read           = seq_read,
1712        .write          = comm_write,
1713        .llseek         = seq_lseek,
1714        .release        = single_release,
1715};
1716
1717static int proc_exe_link(struct dentry *dentry, struct path *exe_path)
1718{
1719        struct task_struct *task;
1720        struct file *exe_file;
1721
1722        task = get_proc_task(d_inode(dentry));
1723        if (!task)
1724                return -ENOENT;
1725        exe_file = get_task_exe_file(task);
1726        put_task_struct(task);
1727        if (exe_file) {
1728                *exe_path = exe_file->f_path;
1729                path_get(&exe_file->f_path);
1730                fput(exe_file);
1731                return 0;
1732        } else
1733                return -ENOENT;
1734}
1735
1736static const char *proc_pid_get_link(struct dentry *dentry,
1737                                     struct inode *inode,
1738                                     struct delayed_call *done)
1739{
1740        struct path path;
1741        int error = -EACCES;
1742
1743        if (!dentry)
1744                return ERR_PTR(-ECHILD);
1745
1746        /* Are we allowed to snoop on the tasks file descriptors? */
1747        if (!proc_fd_access_allowed(inode))
1748                goto out;
1749
1750        error = PROC_I(inode)->op.proc_get_link(dentry, &path);
1751        if (error)
1752                goto out;
1753
1754        error = nd_jump_link(&path);
1755out:
1756        return ERR_PTR(error);
1757}
1758
1759static int do_proc_readlink(struct path *path, char __user *buffer, int buflen)
1760{
1761        char *tmp = (char *)__get_free_page(GFP_KERNEL);
1762        char *pathname;
1763        int len;
1764
1765        if (!tmp)
1766                return -ENOMEM;
1767
1768        pathname = d_path(path, tmp, PAGE_SIZE);
1769        len = PTR_ERR(pathname);
1770        if (IS_ERR(pathname))
1771                goto out;
1772        len = tmp + PAGE_SIZE - 1 - pathname;
1773
1774        if (len > buflen)
1775                len = buflen;
1776        if (copy_to_user(buffer, pathname, len))
1777                len = -EFAULT;
1778 out:
1779        free_page((unsigned long)tmp);
1780        return len;
1781}
1782
1783static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int buflen)
1784{
1785        int error = -EACCES;
1786        struct inode *inode = d_inode(dentry);
1787        struct path path;
1788
1789        /* Are we allowed to snoop on the tasks file descriptors? */
1790        if (!proc_fd_access_allowed(inode))
1791                goto out;
1792
1793        error = PROC_I(inode)->op.proc_get_link(dentry, &path);
1794        if (error)
1795                goto out;
1796
1797        error = do_proc_readlink(&path, buffer, buflen);
1798        path_put(&path);
1799out:
1800        return error;
1801}
1802
1803const struct inode_operations proc_pid_link_inode_operations = {
1804        .readlink       = proc_pid_readlink,
1805        .get_link       = proc_pid_get_link,
1806        .setattr        = proc_setattr,
1807};
1808
1809
1810/* building an inode */
1811
1812void task_dump_owner(struct task_struct *task, umode_t mode,
1813                     kuid_t *ruid, kgid_t *rgid)
1814{
1815        /* Depending on the state of dumpable compute who should own a
1816         * proc file for a task.
1817         */
1818        const struct cred *cred;
1819        kuid_t uid;
1820        kgid_t gid;
1821
1822        if (unlikely(task->flags & PF_KTHREAD)) {
1823                *ruid = GLOBAL_ROOT_UID;
1824                *rgid = GLOBAL_ROOT_GID;
1825                return;
1826        }
1827
1828        /* Default to the tasks effective ownership */
1829        rcu_read_lock();
1830        cred = __task_cred(task);
1831        uid = cred->euid;
1832        gid = cred->egid;
1833        rcu_read_unlock();
1834
1835        /*
1836         * Before the /proc/pid/status file was created the only way to read
1837         * the effective uid of a /process was to stat /proc/pid.  Reading
1838         * /proc/pid/status is slow enough that procps and other packages
1839         * kept stating /proc/pid.  To keep the rules in /proc simple I have
1840         * made this apply to all per process world readable and executable
1841         * directories.
1842         */
1843        if (mode != (S_IFDIR|S_IRUGO|S_IXUGO)) {
1844                struct mm_struct *mm;
1845                task_lock(task);
1846                mm = task->mm;
1847                /* Make non-dumpable tasks owned by some root */
1848                if (mm) {
1849                        if (get_dumpable(mm) != SUID_DUMP_USER) {
1850                                struct user_namespace *user_ns = mm->user_ns;
1851
1852                                uid = make_kuid(user_ns, 0);
1853                                if (!uid_valid(uid))
1854                                        uid = GLOBAL_ROOT_UID;
1855
1856                                gid = make_kgid(user_ns, 0);
1857                                if (!gid_valid(gid))
1858                                        gid = GLOBAL_ROOT_GID;
1859                        }
1860                } else {
1861                        uid = GLOBAL_ROOT_UID;
1862                        gid = GLOBAL_ROOT_GID;
1863                }
1864                task_unlock(task);
1865        }
1866        *ruid = uid;
1867        *rgid = gid;
1868}
1869
1870void proc_pid_evict_inode(struct proc_inode *ei)
1871{
1872        struct pid *pid = ei->pid;
1873
1874        if (S_ISDIR(ei->vfs_inode.i_mode)) {
1875                spin_lock(&pid->lock);
1876                hlist_del_init_rcu(&ei->sibling_inodes);
1877                spin_unlock(&pid->lock);
1878        }
1879
1880        put_pid(pid);
1881}
1882
1883struct inode *proc_pid_make_inode(struct super_block * sb,
1884                                  struct task_struct *task, umode_t mode)
1885{
1886        struct inode * inode;
1887        struct proc_inode *ei;
1888        struct pid *pid;
1889
1890        /* We need a new inode */
1891
1892        inode = new_inode(sb);
1893        if (!inode)
1894                goto out;
1895
1896        /* Common stuff */
1897        ei = PROC_I(inode);
1898        inode->i_mode = mode;
1899        inode->i_ino = get_next_ino();
1900        inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
1901        inode->i_op = &proc_def_inode_operations;
1902
1903        /*
1904         * grab the reference to task.
1905         */
1906        pid = get_task_pid(task, PIDTYPE_PID);
1907        if (!pid)
1908                goto out_unlock;
1909
1910        /* Let the pid remember us for quick removal */
1911        ei->pid = pid;
1912        if (S_ISDIR(mode)) {
1913                spin_lock(&pid->lock);
1914                hlist_add_head_rcu(&ei->sibling_inodes, &pid->inodes);
1915                spin_unlock(&pid->lock);
1916        }
1917
1918        task_dump_owner(task, 0, &inode->i_uid, &inode->i_gid);
1919        security_task_to_inode(task, inode);
1920
1921out:
1922        return inode;
1923
1924out_unlock:
1925        iput(inode);
1926        return NULL;
1927}
1928
1929int pid_getattr(struct user_namespace *mnt_userns, const struct path *path,
1930                struct kstat *stat, u32 request_mask, unsigned int query_flags)
1931{
1932        struct inode *inode = d_inode(path->dentry);
1933        struct proc_fs_info *fs_info = proc_sb_info(inode->i_sb);
1934        struct task_struct *task;
1935
1936        generic_fillattr(&init_user_ns, inode, stat);
1937
1938        stat->uid = GLOBAL_ROOT_UID;
1939        stat->gid = GLOBAL_ROOT_GID;
1940        rcu_read_lock();
1941        task = pid_task(proc_pid(inode), PIDTYPE_PID);
1942        if (task) {
1943                if (!has_pid_permissions(fs_info, task, HIDEPID_INVISIBLE)) {
1944                        rcu_read_unlock();
1945                        /*
1946                         * This doesn't prevent learning whether PID exists,
1947                         * it only makes getattr() consistent with readdir().
1948                         */
1949                        return -ENOENT;
1950                }
1951                task_dump_owner(task, inode->i_mode, &stat->uid, &stat->gid);
1952        }
1953        rcu_read_unlock();
1954        return 0;
1955}
1956
1957/* dentry stuff */
1958
1959/*
1960 * Set <pid>/... inode ownership (can change due to setuid(), etc.)
1961 */
1962void pid_update_inode(struct task_struct *task, struct inode *inode)
1963{
1964        task_dump_owner(task, inode->i_mode, &inode->i_uid, &inode->i_gid);
1965
1966        inode->i_mode &= ~(S_ISUID | S_ISGID);
1967        security_task_to_inode(task, inode);
1968}
1969
1970/*
1971 * Rewrite the inode's ownerships here because the owning task may have
1972 * performed a setuid(), etc.
1973 *
1974 */
1975static int pid_revalidate(struct dentry *dentry, unsigned int flags)
1976{
1977        struct inode *inode;
1978        struct task_struct *task;
1979
1980        if (flags & LOOKUP_RCU)
1981                return -ECHILD;
1982
1983        inode = d_inode(dentry);
1984        task = get_proc_task(inode);
1985
1986        if (task) {
1987                pid_update_inode(task, inode);
1988                put_task_struct(task);
1989                return 1;
1990        }
1991        return 0;
1992}
1993
1994static inline bool proc_inode_is_dead(struct inode *inode)
1995{
1996        return !proc_pid(inode)->tasks[PIDTYPE_PID].first;
1997}
1998
1999int pid_delete_dentry(const struct dentry *dentry)
2000{
2001        /* Is the task we represent dead?
2002         * If so, then don't put the dentry on the lru list,
2003         * kill it immediately.
2004         */
2005        return proc_inode_is_dead(d_inode(dentry));
2006}
2007
2008const struct dentry_operations pid_dentry_operations =
2009{
2010        .d_revalidate   = pid_revalidate,
2011        .d_delete       = pid_delete_dentry,
2012};
2013
2014/* Lookups */
2015
2016/*
2017 * Fill a directory entry.
2018 *
2019 * If possible create the dcache entry and derive our inode number and
2020 * file type from dcache entry.
2021 *
2022 * Since all of the proc inode numbers are dynamically generated, the inode
2023 * numbers do not exist until the inode is cache.  This means creating
2024 * the dcache entry in readdir is necessary to keep the inode numbers
2025 * reported by readdir in sync with the inode numbers reported
2026 * by stat.
2027 */
2028bool proc_fill_cache(struct file *file, struct dir_context *ctx,
2029        const char *name, unsigned int len,
2030        instantiate_t instantiate, struct task_struct *task, const void *ptr)
2031{
2032        struct dentry *child, *dir = file->f_path.dentry;
2033        struct qstr qname = QSTR_INIT(name, len);
2034        struct inode *inode;
2035        unsigned type = DT_UNKNOWN;
2036        ino_t ino = 1;
2037
2038        child = d_hash_and_lookup(dir, &qname);
2039        if (!child) {
2040                DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
2041                child = d_alloc_parallel(dir, &qname, &wq);
2042                if (IS_ERR(child))
2043                        goto end_instantiate;
2044                if (d_in_lookup(child)) {
2045                        struct dentry *res;
2046                        res = instantiate(child, task, ptr);
2047                        d_lookup_done(child);
2048                        if (unlikely(res)) {
2049                                dput(child);
2050                                child = res;
2051                                if (IS_ERR(child))
2052                                        goto end_instantiate;
2053                        }
2054                }
2055        }
2056        inode = d_inode(child);
2057        ino = inode->i_ino;
2058        type = inode->i_mode >> 12;
2059        dput(child);
2060end_instantiate:
2061        return dir_emit(ctx, name, len, ino, type);
2062}
2063
2064/*
2065 * dname_to_vma_addr - maps a dentry name into two unsigned longs
2066 * which represent vma start and end addresses.
2067 */
2068static int dname_to_vma_addr(struct dentry *dentry,
2069                             unsigned long *start, unsigned long *end)
2070{
2071        const char *str = dentry->d_name.name;
2072        unsigned long long sval, eval;
2073        unsigned int len;
2074
2075        if (str[0] == '0' && str[1] != '-')
2076                return -EINVAL;
2077        len = _parse_integer(str, 16, &sval);
2078        if (len & KSTRTOX_OVERFLOW)
2079                return -EINVAL;
2080        if (sval != (unsigned long)sval)
2081                return -EINVAL;
2082        str += len;
2083
2084        if (*str != '-')
2085                return -EINVAL;
2086        str++;
2087
2088        if (str[0] == '0' && str[1])
2089                return -EINVAL;
2090        len = _parse_integer(str, 16, &eval);
2091        if (len & KSTRTOX_OVERFLOW)
2092                return -EINVAL;
2093        if (eval != (unsigned long)eval)
2094                return -EINVAL;
2095        str += len;
2096
2097        if (*str != '\0')
2098                return -EINVAL;
2099
2100        *start = sval;
2101        *end = eval;
2102
2103        return 0;
2104}
2105
2106static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags)
2107{
2108        unsigned long vm_start, vm_end;
2109        bool exact_vma_exists = false;
2110        struct mm_struct *mm = NULL;
2111        struct task_struct *task;
2112        struct inode *inode;
2113        int status = 0;
2114
2115        if (flags & LOOKUP_RCU)
2116                return -ECHILD;
2117
2118        inode = d_inode(dentry);
2119        task = get_proc_task(inode);
2120        if (!task)
2121                goto out_notask;
2122
2123        mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
2124        if (IS_ERR_OR_NULL(mm))
2125                goto out;
2126
2127        if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) {
2128                status = mmap_read_lock_killable(mm);
2129                if (!status) {
2130                        exact_vma_exists = !!find_exact_vma(mm, vm_start,
2131                                                            vm_end);
2132                        mmap_read_unlock(mm);
2133                }
2134        }
2135
2136        mmput(mm);
2137
2138        if (exact_vma_exists) {
2139                task_dump_owner(task, 0, &inode->i_uid, &inode->i_gid);
2140
2141                security_task_to_inode(task, inode);
2142                status = 1;
2143        }
2144
2145out:
2146        put_task_struct(task);
2147
2148out_notask:
2149        return status;
2150}
2151
2152static const struct dentry_operations tid_map_files_dentry_operations = {
2153        .d_revalidate   = map_files_d_revalidate,
2154        .d_delete       = pid_delete_dentry,
2155};
2156
2157static int map_files_get_link(struct dentry *dentry, struct path *path)
2158{
2159        unsigned long vm_start, vm_end;
2160        struct vm_area_struct *vma;
2161        struct task_struct *task;
2162        struct mm_struct *mm;
2163        int rc;
2164
2165        rc = -ENOENT;
2166        task = get_proc_task(d_inode(dentry));
2167        if (!task)
2168                goto out;
2169
2170        mm = get_task_mm(task);
2171        put_task_struct(task);
2172        if (!mm)
2173                goto out;
2174
2175        rc = dname_to_vma_addr(dentry, &vm_start, &vm_end);
2176        if (rc)
2177                goto out_mmput;
2178
2179        rc = mmap_read_lock_killable(mm);
2180        if (rc)
2181                goto out_mmput;
2182
2183        rc = -ENOENT;
2184        vma = find_exact_vma(mm, vm_start, vm_end);
2185        if (vma && vma->vm_file) {
2186                *path = vma->vm_file->f_path;
2187                path_get(path);
2188                rc = 0;
2189        }
2190        mmap_read_unlock(mm);
2191
2192out_mmput:
2193        mmput(mm);
2194out:
2195        return rc;
2196}
2197
2198struct map_files_info {
2199        unsigned long   start;
2200        unsigned long   end;
2201        fmode_t         mode;
2202};
2203
2204/*
2205 * Only allow CAP_SYS_ADMIN and CAP_CHECKPOINT_RESTORE to follow the links, due
2206 * to concerns about how the symlinks may be used to bypass permissions on
2207 * ancestor directories in the path to the file in question.
2208 */
2209static const char *
2210proc_map_files_get_link(struct dentry *dentry,
2211                        struct inode *inode,
2212                        struct delayed_call *done)
2213{
2214        if (!checkpoint_restore_ns_capable(&init_user_ns))
2215                return ERR_PTR(-EPERM);
2216
2217        return proc_pid_get_link(dentry, inode, done);
2218}
2219
2220/*
2221 * Identical to proc_pid_link_inode_operations except for get_link()
2222 */
2223static const struct inode_operations proc_map_files_link_inode_operations = {
2224        .readlink       = proc_pid_readlink,
2225        .get_link       = proc_map_files_get_link,
2226        .setattr        = proc_setattr,
2227};
2228
2229static struct dentry *
2230proc_map_files_instantiate(struct dentry *dentry,
2231                           struct task_struct *task, const void *ptr)
2232{
2233        fmode_t mode = (fmode_t)(unsigned long)ptr;
2234        struct proc_inode *ei;
2235        struct inode *inode;
2236
2237        inode = proc_pid_make_inode(dentry->d_sb, task, S_IFLNK |
2238                                    ((mode & FMODE_READ ) ? S_IRUSR : 0) |
2239                                    ((mode & FMODE_WRITE) ? S_IWUSR : 0));
2240        if (!inode)
2241                return ERR_PTR(-ENOENT);
2242
2243        ei = PROC_I(inode);
2244        ei->op.proc_get_link = map_files_get_link;
2245
2246        inode->i_op = &proc_map_files_link_inode_operations;
2247        inode->i_size = 64;
2248
2249        d_set_d_op(dentry, &tid_map_files_dentry_operations);
2250        return d_splice_alias(inode, dentry);
2251}
2252
2253static struct dentry *proc_map_files_lookup(struct inode *dir,
2254                struct dentry *dentry, unsigned int flags)
2255{
2256        unsigned long vm_start, vm_end;
2257        struct vm_area_struct *vma;
2258        struct task_struct *task;
2259        struct dentry *result;
2260        struct mm_struct *mm;
2261
2262        result = ERR_PTR(-ENOENT);
2263        task = get_proc_task(dir);
2264        if (!task)
2265                goto out;
2266
2267        result = ERR_PTR(-EACCES);
2268        if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
2269                goto out_put_task;
2270
2271        result = ERR_PTR(-ENOENT);
2272        if (dname_to_vma_addr(dentry, &vm_start, &vm_end))
2273                goto out_put_task;
2274
2275        mm = get_task_mm(task);
2276        if (!mm)
2277                goto out_put_task;
2278
2279        result = ERR_PTR(-EINTR);
2280        if (mmap_read_lock_killable(mm))
2281                goto out_put_mm;
2282
2283        result = ERR_PTR(-ENOENT);
2284        vma = find_exact_vma(mm, vm_start, vm_end);
2285        if (!vma)
2286                goto out_no_vma;
2287
2288        if (vma->vm_file)
2289                result = proc_map_files_instantiate(dentry, task,
2290                                (void *)(unsigned long)vma->vm_file->f_mode);
2291
2292out_no_vma:
2293        mmap_read_unlock(mm);
2294out_put_mm:
2295        mmput(mm);
2296out_put_task:
2297        put_task_struct(task);
2298out:
2299        return result;
2300}
2301
2302static const struct inode_operations proc_map_files_inode_operations = {
2303        .lookup         = proc_map_files_lookup,
2304        .permission     = proc_fd_permission,
2305        .setattr        = proc_setattr,
2306};
2307
2308static int
2309proc_map_files_readdir(struct file *file, struct dir_context *ctx)
2310{
2311        struct vm_area_struct *vma;
2312        struct task_struct *task;
2313        struct mm_struct *mm;
2314        unsigned long nr_files, pos, i;
2315        GENRADIX(struct map_files_info) fa;
2316        struct map_files_info *p;
2317        int ret;
2318
2319        genradix_init(&fa);
2320
2321        ret = -ENOENT;
2322        task = get_proc_task(file_inode(file));
2323        if (!task)
2324                goto out;
2325
2326        ret = -EACCES;
2327        if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
2328                goto out_put_task;
2329
2330        ret = 0;
2331        if (!dir_emit_dots(file, ctx))
2332                goto out_put_task;
2333
2334        mm = get_task_mm(task);
2335        if (!mm)
2336                goto out_put_task;
2337
2338        ret = mmap_read_lock_killable(mm);
2339        if (ret) {
2340                mmput(mm);
2341                goto out_put_task;
2342        }
2343
2344        nr_files = 0;
2345
2346        /*
2347         * We need two passes here:
2348         *
2349         *  1) Collect vmas of mapped files with mmap_lock taken
2350         *  2) Release mmap_lock and instantiate entries
2351         *
2352         * otherwise we get lockdep complained, since filldir()
2353         * routine might require mmap_lock taken in might_fault().
2354         */
2355
2356        for (vma = mm->mmap, pos = 2; vma; vma = vma->vm_next) {
2357                if (!vma->vm_file)
2358                        continue;
2359                if (++pos <= ctx->pos)
2360                        continue;
2361
2362                p = genradix_ptr_alloc(&fa, nr_files++, GFP_KERNEL);
2363                if (!p) {
2364                        ret = -ENOMEM;
2365                        mmap_read_unlock(mm);
2366                        mmput(mm);
2367                        goto out_put_task;
2368                }
2369
2370                p->start = vma->vm_start;
2371                p->end = vma->vm_end;
2372                p->mode = vma->vm_file->f_mode;
2373        }
2374        mmap_read_unlock(mm);
2375        mmput(mm);
2376
2377        for (i = 0; i < nr_files; i++) {
2378                char buf[4 * sizeof(long) + 2]; /* max: %lx-%lx\0 */
2379                unsigned int len;
2380
2381                p = genradix_ptr(&fa, i);
2382                len = snprintf(buf, sizeof(buf), "%lx-%lx", p->start, p->end);
2383                if (!proc_fill_cache(file, ctx,
2384                                      buf, len,
2385                                      proc_map_files_instantiate,
2386                                      task,
2387                                      (void *)(unsigned long)p->mode))
2388                        break;
2389                ctx->pos++;
2390        }
2391
2392out_put_task:
2393        put_task_struct(task);
2394out:
2395        genradix_free(&fa);
2396        return ret;
2397}
2398
2399static const struct file_operations proc_map_files_operations = {
2400        .read           = generic_read_dir,
2401        .iterate_shared = proc_map_files_readdir,
2402        .llseek         = generic_file_llseek,
2403};
2404
2405#if defined(CONFIG_CHECKPOINT_RESTORE) && defined(CONFIG_POSIX_TIMERS)
2406struct timers_private {
2407        struct pid *pid;
2408        struct task_struct *task;
2409        struct sighand_struct *sighand;
2410        struct pid_namespace *ns;
2411        unsigned long flags;
2412};
2413
2414static void *timers_start(struct seq_file *m, loff_t *pos)
2415{
2416        struct timers_private *tp = m->private;
2417
2418        tp->task = get_pid_task(tp->pid, PIDTYPE_PID);
2419        if (!tp->task)
2420                return ERR_PTR(-ESRCH);
2421
2422        tp->sighand = lock_task_sighand(tp->task, &tp->flags);
2423        if (!tp->sighand)
2424                return ERR_PTR(-ESRCH);
2425
2426        return seq_list_start(&tp->task->signal->posix_timers, *pos);
2427}
2428
2429static void *timers_next(struct seq_file *m, void *v, loff_t *pos)
2430{
2431        struct timers_private *tp = m->private;
2432        return seq_list_next(v, &tp->task->signal->posix_timers, pos);
2433}
2434
2435static void timers_stop(struct seq_file *m, void *v)
2436{
2437        struct timers_private *tp = m->private;
2438
2439        if (tp->sighand) {
2440                unlock_task_sighand(tp->task, &tp->flags);
2441                tp->sighand = NULL;
2442        }
2443
2444        if (tp->task) {
2445                put_task_struct(tp->task);
2446                tp->task = NULL;
2447        }
2448}
2449
2450static int show_timer(struct seq_file *m, void *v)
2451{
2452        struct k_itimer *timer;
2453        struct timers_private *tp = m->private;
2454        int notify;
2455        static const char * const nstr[] = {
2456                [SIGEV_SIGNAL] = "signal",
2457                [SIGEV_NONE] = "none",
2458                [SIGEV_THREAD] = "thread",
2459        };
2460
2461        timer = list_entry((struct list_head *)v, struct k_itimer, list);
2462        notify = timer->it_sigev_notify;
2463
2464        seq_printf(m, "ID: %d\n", timer->it_id);
2465        seq_printf(m, "signal: %d/%px\n",
2466                   timer->sigq->info.si_signo,
2467                   timer->sigq->info.si_value.sival_ptr);
2468        seq_printf(m, "notify: %s/%s.%d\n",
2469                   nstr[notify & ~SIGEV_THREAD_ID],
2470                   (notify & SIGEV_THREAD_ID) ? "tid" : "pid",
2471                   pid_nr_ns(timer->it_pid, tp->ns));
2472        seq_printf(m, "ClockID: %d\n", timer->it_clock);
2473
2474        return 0;
2475}
2476
2477static const struct seq_operations proc_timers_seq_ops = {
2478        .start  = timers_start,
2479        .next   = timers_next,
2480        .stop   = timers_stop,
2481        .show   = show_timer,
2482};
2483
2484static int proc_timers_open(struct inode *inode, struct file *file)
2485{
2486        struct timers_private *tp;
2487
2488        tp = __seq_open_private(file, &proc_timers_seq_ops,
2489                        sizeof(struct timers_private));
2490        if (!tp)
2491                return -ENOMEM;
2492
2493        tp->pid = proc_pid(inode);
2494        tp->ns = proc_pid_ns(inode->i_sb);
2495        return 0;
2496}
2497
2498static const struct file_operations proc_timers_operations = {
2499        .open           = proc_timers_open,
2500        .read           = seq_read,
2501        .llseek         = seq_lseek,
2502        .release        = seq_release_private,
2503};
2504#endif
2505
2506static ssize_t timerslack_ns_write(struct file *file, const char __user *buf,
2507                                        size_t count, loff_t *offset)
2508{
2509        struct inode *inode = file_inode(file);
2510        struct task_struct *p;
2511        u64 slack_ns;
2512        int err;
2513
2514        err = kstrtoull_from_user(buf, count, 10, &slack_ns);
2515        if (err < 0)
2516                return err;
2517
2518        p = get_proc_task(inode);
2519        if (!p)
2520                return -ESRCH;
2521
2522        if (p != current) {
2523                rcu_read_lock();
2524                if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
2525                        rcu_read_unlock();
2526                        count = -EPERM;
2527                        goto out;
2528                }
2529                rcu_read_unlock();
2530
2531                err = security_task_setscheduler(p);
2532                if (err) {
2533                        count = err;
2534                        goto out;
2535                }
2536        }
2537
2538        task_lock(p);
2539        if (slack_ns == 0)
2540                p->timer_slack_ns = p->default_timer_slack_ns;
2541        else
2542                p->timer_slack_ns = slack_ns;
2543        task_unlock(p);
2544
2545out:
2546        put_task_struct(p);
2547
2548        return count;
2549}
2550
2551static int timerslack_ns_show(struct seq_file *m, void *v)
2552{
2553        struct inode *inode = m->private;
2554        struct task_struct *p;
2555        int err = 0;
2556
2557        p = get_proc_task(inode);
2558        if (!p)
2559                return -ESRCH;
2560
2561        if (p != current) {
2562                rcu_read_lock();
2563                if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {
2564                        rcu_read_unlock();
2565                        err = -EPERM;
2566                        goto out;
2567                }
2568                rcu_read_unlock();
2569
2570                err = security_task_getscheduler(p);
2571                if (err)
2572                        goto out;
2573        }
2574
2575        task_lock(p);
2576        seq_printf(m, "%llu\n", p->timer_slack_ns);
2577        task_unlock(p);
2578
2579out:
2580        put_task_struct(p);
2581
2582        return err;
2583}
2584
2585static int timerslack_ns_open(struct inode *inode, struct file *filp)
2586{
2587        return single_open(filp, timerslack_ns_show, inode);
2588}
2589
2590static const struct file_operations proc_pid_set_timerslack_ns_operations = {
2591        .open           = timerslack_ns_open,
2592        .read           = seq_read,
2593        .write          = timerslack_ns_write,
2594        .llseek         = seq_lseek,
2595        .release        = single_release,
2596};
2597
2598static struct dentry *proc_pident_instantiate(struct dentry *dentry,
2599        struct task_struct *task, const void *ptr)
2600{
2601        const struct pid_entry *p = ptr;
2602        struct inode *inode;
2603        struct proc_inode *ei;
2604
2605        inode = proc_pid_make_inode(dentry->d_sb, task, p->mode);
2606        if (!inode)
2607                return ERR_PTR(-ENOENT);
2608
2609        ei = PROC_I(inode);
2610        if (S_ISDIR(inode->i_mode))
2611                set_nlink(inode, 2);    /* Use getattr to fix if necessary */
2612        if (p->iop)
2613                inode->i_op = p->iop;
2614        if (p->fop)
2615                inode->i_fop = p->fop;
2616        ei->op = p->op;
2617        pid_update_inode(task, inode);
2618        d_set_d_op(dentry, &pid_dentry_operations);
2619        return d_splice_alias(inode, dentry);
2620}
2621
2622static struct dentry *proc_pident_lookup(struct inode *dir, 
2623                                         struct dentry *dentry,
2624                                         const struct pid_entry *p,
2625                                         const struct pid_entry *end)
2626{
2627        struct task_struct *task = get_proc_task(dir);
2628        struct dentry *res = ERR_PTR(-ENOENT);
2629
2630        if (!task)
2631                goto out_no_task;
2632
2633        /*
2634         * Yes, it does not scale. And it should not. Don't add
2635         * new entries into /proc/<tgid>/ without very good reasons.
2636         */
2637        for (; p < end; p++) {
2638                if (p->len != dentry->d_name.len)
2639                        continue;
2640                if (!memcmp(dentry->d_name.name, p->name, p->len)) {
2641                        res = proc_pident_instantiate(dentry, task, p);
2642                        break;
2643                }
2644        }
2645        put_task_struct(task);
2646out_no_task:
2647        return res;
2648}
2649
2650static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
2651                const struct pid_entry *ents, unsigned int nents)
2652{
2653        struct task_struct *task = get_proc_task(file_inode(file));
2654        const struct pid_entry *p;
2655
2656        if (!task)
2657                return -ENOENT;
2658
2659        if (!dir_emit_dots(file, ctx))
2660                goto out;
2661
2662        if (ctx->pos >= nents + 2)
2663                goto out;
2664
2665        for (p = ents + (ctx->pos - 2); p < ents + nents; p++) {
2666                if (!proc_fill_cache(file, ctx, p->name, p->len,
2667                                proc_pident_instantiate, task, p))
2668                        break;
2669                ctx->pos++;
2670        }
2671out:
2672        put_task_struct(task);
2673        return 0;
2674}
2675
2676#ifdef CONFIG_SECURITY
2677static int proc_pid_attr_open(struct inode *inode, struct file *file)
2678{
2679        file->private_data = NULL;
2680        __mem_open(inode, file, PTRACE_MODE_READ_FSCREDS);
2681        return 0;
2682}
2683
2684static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,
2685                                  size_t count, loff_t *ppos)
2686{
2687        struct inode * inode = file_inode(file);
2688        char *p = NULL;
2689        ssize_t length;
2690        struct task_struct *task = get_proc_task(inode);
2691
2692        if (!task)
2693                return -ESRCH;
2694
2695        length = security_getprocattr(task, PROC_I(inode)->op.lsm,
2696                                      (char*)file->f_path.dentry->d_name.name,
2697                                      &p);
2698        put_task_struct(task);
2699        if (length > 0)
2700                length = simple_read_from_buffer(buf, count, ppos, p, length);
2701        kfree(p);
2702        return length;
2703}
2704
2705static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
2706                                   size_t count, loff_t *ppos)
2707{
2708        struct inode * inode = file_inode(file);
2709        struct task_struct *task;
2710        void *page;
2711        int rv;
2712
2713        /* A task may only write when it was the opener. */
2714        if (file->private_data != current->mm)
2715                return -EPERM;
2716
2717        rcu_read_lock();
2718        task = pid_task(proc_pid(inode), PIDTYPE_PID);
2719        if (!task) {
2720                rcu_read_unlock();
2721                return -ESRCH;
2722        }
2723        /* A task may only write its own attributes. */
2724        if (current != task) {
2725                rcu_read_unlock();
2726                return -EACCES;
2727        }
2728        /* Prevent changes to overridden credentials. */
2729        if (current_cred() != current_real_cred()) {
2730                rcu_read_unlock();
2731                return -EBUSY;
2732        }
2733        rcu_read_unlock();
2734
2735        if (count > PAGE_SIZE)
2736                count = PAGE_SIZE;
2737
2738        /* No partial writes. */
2739        if (*ppos != 0)
2740                return -EINVAL;
2741
2742        page = memdup_user(buf, count);
2743        if (IS_ERR(page)) {
2744                rv = PTR_ERR(page);
2745                goto out;
2746        }
2747
2748        /* Guard against adverse ptrace interaction */
2749        rv = mutex_lock_interruptible(&current->signal->cred_guard_mutex);
2750        if (rv < 0)
2751                goto out_free;
2752
2753        rv = security_setprocattr(PROC_I(inode)->op.lsm,
2754                                  file->f_path.dentry->d_name.name, page,
2755                                  count);
2756        mutex_unlock(&current->signal->cred_guard_mutex);
2757out_free:
2758        kfree(page);
2759out:
2760        return rv;
2761}
2762
2763static const struct file_operations proc_pid_attr_operations = {
2764        .open           = proc_pid_attr_open,
2765        .read           = proc_pid_attr_read,
2766        .write          = proc_pid_attr_write,
2767        .llseek         = generic_file_llseek,
2768        .release        = mem_release,
2769};
2770
2771#define LSM_DIR_OPS(LSM) \
2772static int proc_##LSM##_attr_dir_iterate(struct file *filp, \
2773                             struct dir_context *ctx) \
2774{ \
2775        return proc_pident_readdir(filp, ctx, \
2776                                   LSM##_attr_dir_stuff, \
2777                                   ARRAY_SIZE(LSM##_attr_dir_stuff)); \
2778} \
2779\
2780static const struct file_operations proc_##LSM##_attr_dir_ops = { \
2781        .read           = generic_read_dir, \
2782        .iterate        = proc_##LSM##_attr_dir_iterate, \
2783        .llseek         = default_llseek, \
2784}; \
2785\
2786static struct dentry *proc_##LSM##_attr_dir_lookup(struct inode *dir, \
2787                                struct dentry *dentry, unsigned int flags) \
2788{ \
2789        return proc_pident_lookup(dir, dentry, \
2790                                  LSM##_attr_dir_stuff, \
2791                                  LSM##_attr_dir_stuff + ARRAY_SIZE(LSM##_attr_dir_stuff)); \
2792} \
2793\
2794static const struct inode_operations proc_##LSM##_attr_dir_inode_ops = { \
2795        .lookup         = proc_##LSM##_attr_dir_lookup, \
2796        .getattr        = pid_getattr, \
2797        .setattr        = proc_setattr, \
2798}
2799
2800#ifdef CONFIG_SECURITY_SMACK
2801static const struct pid_entry smack_attr_dir_stuff[] = {
2802        ATTR("smack", "current",        0666),
2803};
2804LSM_DIR_OPS(smack);
2805#endif
2806
2807#ifdef CONFIG_SECURITY_APPARMOR
2808static const struct pid_entry apparmor_attr_dir_stuff[] = {
2809        ATTR("apparmor", "current",     0666),
2810        ATTR("apparmor", "prev",        0444),
2811        ATTR("apparmor", "exec",        0666),
2812};
2813LSM_DIR_OPS(apparmor);
2814#endif
2815
2816static const struct pid_entry attr_dir_stuff[] = {
2817        ATTR(NULL, "current",           0666),
2818        ATTR(NULL, "prev",              0444),
2819        ATTR(NULL, "exec",              0666),
2820        ATTR(NULL, "fscreate",          0666),
2821        ATTR(NULL, "keycreate",         0666),
2822        ATTR(NULL, "sockcreate",        0666),
2823#ifdef CONFIG_SECURITY_SMACK
2824        DIR("smack",                    0555,
2825            proc_smack_attr_dir_inode_ops, proc_smack_attr_dir_ops),
2826#endif
2827#ifdef CONFIG_SECURITY_APPARMOR
2828        DIR("apparmor",                 0555,
2829            proc_apparmor_attr_dir_inode_ops, proc_apparmor_attr_dir_ops),
2830#endif
2831};
2832
2833static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx)
2834{
2835        return proc_pident_readdir(file, ctx, 
2836                                   attr_dir_stuff, ARRAY_SIZE(attr_dir_stuff));
2837}
2838
2839static const struct file_operations proc_attr_dir_operations = {
2840        .read           = generic_read_dir,
2841        .iterate_shared = proc_attr_dir_readdir,
2842        .llseek         = generic_file_llseek,
2843};
2844
2845static struct dentry *proc_attr_dir_lookup(struct inode *dir,
2846                                struct dentry *dentry, unsigned int flags)
2847{
2848        return proc_pident_lookup(dir, dentry,
2849                                  attr_dir_stuff,
2850                                  attr_dir_stuff + ARRAY_SIZE(attr_dir_stuff));
2851}
2852
2853static const struct inode_operations proc_attr_dir_inode_operations = {
2854        .lookup         = proc_attr_dir_lookup,
2855        .getattr        = pid_getattr,
2856        .setattr        = proc_setattr,
2857};
2858
2859#endif
2860
2861#ifdef CONFIG_ELF_CORE
2862static ssize_t proc_coredump_filter_read(struct file *file, char __user *buf,
2863                                         size_t count, loff_t *ppos)
2864{
2865        struct task_struct *task = get_proc_task(file_inode(file));
2866        struct mm_struct *mm;
2867        char buffer[PROC_NUMBUF];
2868        size_t len;
2869        int ret;
2870
2871        if (!task)
2872                return -ESRCH;
2873
2874        ret = 0;
2875        mm = get_task_mm(task);
2876        if (mm) {
2877                len = snprintf(buffer, sizeof(buffer), "%08lx\n",
2878                               ((mm->flags & MMF_DUMP_FILTER_MASK) >>
2879                                MMF_DUMP_FILTER_SHIFT));
2880                mmput(mm);
2881                ret = simple_read_from_buffer(buf, count, ppos, buffer, len);
2882        }
2883
2884        put_task_struct(task);
2885
2886        return ret;
2887}
2888
2889static ssize_t proc_coredump_filter_write(struct file *file,
2890                                          const char __user *buf,
2891                                          size_t count,
2892                                          loff_t *ppos)
2893{
2894        struct task_struct *task;
2895        struct mm_struct *mm;
2896        unsigned int val;
2897        int ret;
2898        int i;
2899        unsigned long mask;
2900
2901        ret = kstrtouint_from_user(buf, count, 0, &val);
2902        if (ret < 0)
2903                return ret;
2904
2905        ret = -ESRCH;
2906        task = get_proc_task(file_inode(file));
2907        if (!task)
2908                goto out_no_task;
2909
2910        mm = get_task_mm(task);
2911        if (!mm)
2912                goto out_no_mm;
2913        ret = 0;
2914
2915        for (i = 0, mask = 1; i < MMF_DUMP_FILTER_BITS; i++, mask <<= 1) {
2916                if (val & mask)
2917                        set_bit(i + MMF_DUMP_FILTER_SHIFT, &mm->flags);
2918                else
2919                        clear_bit(i + MMF_DUMP_FILTER_SHIFT, &mm->flags);
2920        }
2921
2922        mmput(mm);
2923 out_no_mm:
2924        put_task_struct(task);
2925 out_no_task:
2926        if (ret < 0)
2927                return ret;
2928        return count;
2929}
2930
2931static const struct file_operations proc_coredump_filter_operations = {
2932        .read           = proc_coredump_filter_read,
2933        .write          = proc_coredump_filter_write,
2934        .llseek         = generic_file_llseek,
2935};
2936#endif
2937
2938#ifdef CONFIG_TASK_IO_ACCOUNTING
2939static int do_io_accounting(struct task_struct *task, struct seq_file *m, int whole)
2940{
2941        struct task_io_accounting acct = task->ioac;
2942        unsigned long flags;
2943        int result;
2944
2945        result = down_read_killable(&task->signal->exec_update_lock);
2946        if (result)
2947                return result;
2948
2949        if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
2950                result = -EACCES;
2951                goto out_unlock;
2952        }
2953
2954        if (whole && lock_task_sighand(task, &flags)) {
2955                struct task_struct *t = task;
2956
2957                task_io_accounting_add(&acct, &task->signal->ioac);
2958                while_each_thread(task, t)
2959                        task_io_accounting_add(&acct, &t->ioac);
2960
2961                unlock_task_sighand(task, &flags);
2962        }
2963        seq_printf(m,
2964                   "rchar: %llu\n"
2965                   "wchar: %llu\n"
2966                   "syscr: %llu\n"
2967                   "syscw: %llu\n"
2968                   "read_bytes: %llu\n"
2969                   "write_bytes: %llu\n"
2970                   "cancelled_write_bytes: %llu\n",
2971                   (unsigned long long)acct.rchar,
2972                   (unsigned long long)acct.wchar,
2973                   (unsigned long long)acct.syscr,
2974                   (unsigned long long)acct.syscw,
2975                   (unsigned long long)acct.read_bytes,
2976                   (unsigned long long)acct.write_bytes,
2977                   (unsigned long long)acct.cancelled_write_bytes);
2978        result = 0;
2979
2980out_unlock:
2981        up_read(&task->signal->exec_update_lock);
2982        return result;
2983}
2984
2985static int proc_tid_io_accounting(struct seq_file *m, struct pid_namespace *ns,
2986                                  struct pid *pid, struct task_struct *task)
2987{
2988        return do_io_accounting(task, m, 0);
2989}
2990
2991static int proc_tgid_io_accounting(struct seq_file *m, struct pid_namespace *ns,
2992                                   struct pid *pid, struct task_struct *task)
2993{
2994        return do_io_accounting(task, m, 1);
2995}
2996#endif /* CONFIG_TASK_IO_ACCOUNTING */
2997
2998#ifdef CONFIG_USER_NS
2999static int proc_id_map_open(struct inode *inode, struct file *file,
3000        const struct seq_operations *seq_ops)
3001{
3002        struct user_namespace *ns = NULL;
3003        struct task_struct *task;
3004        struct seq_file *seq;
3005        int ret = -EINVAL;
3006
3007        task = get_proc_task(inode);
3008        if (task) {
3009                rcu_read_lock();
3010                ns = get_user_ns(task_cred_xxx(task, user_ns));
3011                rcu_read_unlock();
3012                put_task_struct(task);
3013        }
3014        if (!ns)
3015                goto err;
3016
3017        ret = seq_open(file, seq_ops);
3018        if (ret)
3019                goto err_put_ns;
3020
3021        seq = file->private_data;
3022        seq->private = ns;
3023
3024        return 0;
3025err_put_ns:
3026        put_user_ns(ns);
3027err:
3028        return ret;
3029}
3030
3031static int proc_id_map_release(struct inode *inode, struct file *file)
3032{
3033        struct seq_file *seq = file->private_data;
3034        struct user_namespace *ns = seq->private;
3035        put_user_ns(ns);
3036        return seq_release(inode, file);
3037}
3038
3039static int proc_uid_map_open(struct inode *inode, struct file *file)
3040{
3041        return proc_id_map_open(inode, file, &proc_uid_seq_operations);
3042}
3043
3044static int proc_gid_map_open(struct inode *inode, struct file *file)
3045{
3046        return proc_id_map_open(inode, file, &proc_gid_seq_operations);
3047}
3048
3049static int proc_projid_map_open(struct inode *inode, struct file *file)
3050{
3051        return proc_id_map_open(inode, file, &proc_projid_seq_operations);
3052}
3053
3054static const struct file_operations proc_uid_map_operations = {
3055        .open           = proc_uid_map_open,
3056        .write          = proc_uid_map_write,
3057        .read           = seq_read,
3058        .llseek         = seq_lseek,
3059        .release        = proc_id_map_release,
3060};
3061
3062static const struct file_operations proc_gid_map_operations = {
3063        .open           = proc_gid_map_open,
3064        .write          = proc_gid_map_write,
3065        .read           = seq_read,
3066        .llseek         = seq_lseek,
3067        .release        = proc_id_map_release,
3068};
3069
3070static const struct file_operations proc_projid_map_operations = {
3071        .open           = proc_projid_map_open,
3072        .write          = proc_projid_map_write,
3073        .read           = seq_read,
3074        .llseek         = seq_lseek,
3075        .release        = proc_id_map_release,
3076};
3077
3078static int proc_setgroups_open(struct inode *inode, struct file *file)
3079{
3080        struct user_namespace *ns = NULL;
3081        struct task_struct *task;
3082        int ret;
3083
3084        ret = -ESRCH;
3085        task = get_proc_task(inode);
3086        if (task) {
3087                rcu_read_lock();
3088                ns = get_user_ns(task_cred_xxx(task, user_ns));
3089                rcu_read_unlock();
3090                put_task_struct(task);
3091        }
3092        if (!ns)
3093                goto err;
3094
3095        if (file->f_mode & FMODE_WRITE) {
3096                ret = -EACCES;
3097                if (!ns_capable(ns, CAP_SYS_ADMIN))
3098                        goto err_put_ns;
3099        }
3100
3101        ret = single_open(file, &proc_setgroups_show, ns);
3102        if (ret)
3103                goto err_put_ns;
3104
3105        return 0;
3106err_put_ns:
3107        put_user_ns(ns);
3108err:
3109        return ret;
3110}
3111
3112static int proc_setgroups_release(struct inode *inode, struct file *file)
3113{
3114        struct seq_file *seq = file->private_data;
3115        struct user_namespace *ns = seq->private;
3116        int ret = single_release(inode, file);
3117        put_user_ns(ns);
3118        return ret;
3119}
3120
3121static const struct file_operations proc_setgroups_operations = {
3122        .open           = proc_setgroups_open,
3123        .write          = proc_setgroups_write,
3124        .read           = seq_read,
3125        .llseek         = seq_lseek,
3126        .release        = proc_setgroups_release,
3127};
3128#endif /* CONFIG_USER_NS */
3129
3130static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
3131                                struct pid *pid, struct task_struct *task)
3132{
3133        int err = lock_trace(task);
3134        if (!err) {
3135                seq_printf(m, "%08x\n", task->personality);
3136                unlock_trace(task);
3137        }
3138        return err;
3139}
3140
3141#ifdef CONFIG_LIVEPATCH
3142static int proc_pid_patch_state(struct seq_file *m, struct pid_namespace *ns,
3143                                struct pid *pid, struct task_struct *task)
3144{
3145        seq_printf(m, "%d\n", task->patch_state);
3146        return 0;
3147}
3148#endif /* CONFIG_LIVEPATCH */
3149
3150#ifdef CONFIG_STACKLEAK_METRICS
3151static int proc_stack_depth(struct seq_file *m, struct pid_namespace *ns,
3152                                struct pid *pid, struct task_struct *task)
3153{
3154        unsigned long prev_depth = THREAD_SIZE -
3155                                (task->prev_lowest_stack & (THREAD_SIZE - 1));
3156        unsigned long depth = THREAD_SIZE -
3157                                (task->lowest_stack & (THREAD_SIZE - 1));
3158
3159        seq_printf(m, "previous stack depth: %lu\nstack depth: %lu\n",
3160                                                        prev_depth, depth);
3161        return 0;
3162}
3163#endif /* CONFIG_STACKLEAK_METRICS */
3164
3165/*
3166 * Thread groups
3167 */
3168static const struct file_operations proc_task_operations;
3169static const struct inode_operations proc_task_inode_operations;
3170
3171static const struct pid_entry tgid_base_stuff[] = {
3172        DIR("task",       S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations),
3173        DIR("fd",         S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
3174        DIR("map_files",  S_IRUSR|S_IXUSR, proc_map_files_inode_operations, proc_map_files_operations),
3175        DIR("fdinfo",     S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
3176        DIR("ns",         S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations),
3177#ifdef CONFIG_NET
3178        DIR("net",        S_IRUGO|S_IXUGO, proc_net_inode_operations, proc_net_operations),
3179#endif
3180        REG("environ",    S_IRUSR, proc_environ_operations),
3181        REG("auxv",       S_IRUSR, proc_auxv_operations),
3182        ONE("status",     S_IRUGO, proc_pid_status),
3183        ONE("personality", S_IRUSR, proc_pid_personality),
3184        ONE("limits",     S_IRUGO, proc_pid_limits),
3185#ifdef CONFIG_SCHED_DEBUG
3186        REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
3187#endif
3188#ifdef CONFIG_SCHED_AUTOGROUP
3189        REG("autogroup",  S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
3190#endif
3191#ifdef CONFIG_TIME_NS
3192        REG("timens_offsets",  S_IRUGO|S_IWUSR, proc_timens_offsets_operations),
3193#endif
3194        REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
3195#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
3196        ONE("syscall",    S_IRUSR, proc_pid_syscall),
3197#endif
3198        REG("cmdline",    S_IRUGO, proc_pid_cmdline_ops),
3199        ONE("stat",       S_IRUGO, proc_tgid_stat),
3200        ONE("statm",      S_IRUGO, proc_pid_statm),
3201        REG("maps",       S_IRUGO, proc_pid_maps_operations),
3202#ifdef CONFIG_NUMA
3203        REG("numa_maps",  S_IRUGO, proc_pid_numa_maps_operations),
3204#endif
3205        REG("mem",        S_IRUSR|S_IWUSR, proc_mem_operations),
3206        LNK("cwd",        proc_cwd_link),
3207        LNK("root",       proc_root_link),
3208        LNK("exe",        proc_exe_link),
3209        REG("mounts",     S_IRUGO, proc_mounts_operations),
3210        REG("mountinfo",  S_IRUGO, proc_mountinfo_operations),
3211        REG("mountstats", S_IRUSR, proc_mountstats_operations),
3212#ifdef CONFIG_PROC_PAGE_MONITOR
3213        REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
3214        REG("smaps",      S_IRUGO, proc_pid_smaps_operations),
3215        REG("smaps_rollup", S_IRUGO, proc_pid_smaps_rollup_operations),
3216        REG("pagemap",    S_IRUSR, proc_pagemap_operations),
3217#endif
3218#ifdef CONFIG_SECURITY
3219        DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
3220#endif
3221#ifdef CONFIG_KALLSYMS
3222        ONE("wchan",      S_IRUGO, proc_pid_wchan),
3223#endif
3224#ifdef CONFIG_STACKTRACE
3225        ONE("stack",      S_IRUSR, proc_pid_stack),
3226#endif
3227#ifdef CONFIG_SCHED_INFO
3228        ONE("schedstat",  S_IRUGO, proc_pid_schedstat),
3229#endif
3230#ifdef CONFIG_LATENCYTOP
3231        REG("latency",  S_IRUGO, proc_lstats_operations),
3232#endif
3233#ifdef CONFIG_PROC_PID_CPUSET
3234        ONE("cpuset",     S_IRUGO, proc_cpuset_show),
3235#endif
3236#ifdef CONFIG_CGROUPS
3237        ONE("cgroup",  S_IRUGO, proc_cgroup_show),
3238#endif
3239#ifdef CONFIG_PROC_CPU_RESCTRL
3240        ONE("cpu_resctrl_groups", S_IRUGO, proc_resctrl_show),
3241#endif
3242        ONE("oom_score",  S_IRUGO, proc_oom_score),
3243        REG("oom_adj",    S_IRUGO|S_IWUSR, proc_oom_adj_operations),
3244        REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),
3245#ifdef CONFIG_AUDIT
3246        REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
3247        REG("sessionid",  S_IRUGO, proc_sessionid_operations),
3248#endif
3249#ifdef CONFIG_FAULT_INJECTION
3250        REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
3251        REG("fail-nth", 0644, proc_fail_nth_operations),
3252#endif
3253#ifdef CONFIG_ELF_CORE
3254        REG("coredump_filter", S_IRUGO|S_IWUSR, proc_coredump_filter_operations),
3255#endif
3256#ifdef CONFIG_TASK_IO_ACCOUNTING
3257        ONE("io",       S_IRUSR, proc_tgid_io_accounting),
3258#endif
3259#ifdef CONFIG_USER_NS
3260        REG("uid_map",    S_IRUGO|S_IWUSR, proc_uid_map_operations),
3261        REG("gid_map",    S_IRUGO|S_IWUSR, proc_gid_map_operations),
3262        REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
3263        REG("setgroups",  S_IRUGO|S_IWUSR, proc_setgroups_operations),
3264#endif
3265#if defined(CONFIG_CHECKPOINT_RESTORE) && defined(CONFIG_POSIX_TIMERS)
3266        REG("timers",     S_IRUGO, proc_timers_operations),
3267#endif
3268        REG("timerslack_ns", S_IRUGO|S_IWUGO, proc_pid_set_timerslack_ns_operations),
3269#ifdef CONFIG_LIVEPATCH
3270        ONE("patch_state",  S_IRUSR, proc_pid_patch_state),
3271#endif
3272#ifdef CONFIG_STACKLEAK_METRICS
3273        ONE("stack_depth", S_IRUGO, proc_stack_depth),
3274#endif
3275#ifdef CONFIG_PROC_PID_ARCH_STATUS
3276        ONE("arch_status", S_IRUGO, proc_pid_arch_status),
3277#endif
3278#ifdef CONFIG_SECCOMP_CACHE_DEBUG
3279        ONE("seccomp_cache", S_IRUSR, proc_pid_seccomp_cache),
3280#endif
3281};
3282
3283static int proc_tgid_base_readdir(struct file *file, struct dir_context *ctx)
3284{
3285        return proc_pident_readdir(file, ctx,
3286                                   tgid_base_stuff, ARRAY_SIZE(tgid_base_stuff));
3287}
3288
3289static const struct file_operations proc_tgid_base_operations = {
3290        .read           = generic_read_dir,
3291        .iterate_shared = proc_tgid_base_readdir,
3292        .llseek         = generic_file_llseek,
3293};
3294
3295struct pid *tgid_pidfd_to_pid(const struct file *file)
3296{
3297        if (file->f_op != &proc_tgid_base_operations)
3298                return ERR_PTR(-EBADF);
3299
3300        return proc_pid(file_inode(file));
3301}
3302
3303static struct dentry *proc_tgid_base_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
3304{
3305        return proc_pident_lookup(dir, dentry,
3306                                  tgid_base_stuff,
3307                                  tgid_base_stuff + ARRAY_SIZE(tgid_base_stuff));
3308}
3309
3310static const struct inode_operations proc_tgid_base_inode_operations = {
3311        .lookup         = proc_tgid_base_lookup,
3312        .getattr        = pid_getattr,
3313        .setattr        = proc_setattr,
3314        .permission     = proc_pid_permission,
3315};
3316
3317/**
3318 * proc_flush_pid -  Remove dcache entries for @pid from the /proc dcache.
3319 * @pid: pid that should be flushed.
3320 *
3321 * This function walks a list of inodes (that belong to any proc
3322 * filesystem) that are attached to the pid and flushes them from
3323 * the dentry cache.
3324 *
3325 * It is safe and reasonable to cache /proc entries for a task until
3326 * that task exits.  After that they just clog up the dcache with
3327 * useless entries, possibly causing useful dcache entries to be
3328 * flushed instead.  This routine is provided to flush those useless
3329 * dcache entries when a process is reaped.
3330 *
3331 * NOTE: This routine is just an optimization so it does not guarantee
3332 *       that no dcache entries will exist after a process is reaped
3333 *       it just makes it very unlikely that any will persist.
3334 */
3335
3336void proc_flush_pid(struct pid *pid)
3337{
3338        proc_invalidate_siblings_dcache(&pid->inodes, &pid->lock);
3339}
3340
3341static struct dentry *proc_pid_instantiate(struct dentry * dentry,
3342                                   struct task_struct *task, const void *ptr)
3343{
3344        struct inode *inode;
3345
3346        inode = proc_pid_make_inode(dentry->d_sb, task, S_IFDIR | S_IRUGO | S_IXUGO);
3347        if (!inode)
3348                return ERR_PTR(-ENOENT);
3349
3350        inode->i_op = &proc_tgid_base_inode_operations;
3351        inode->i_fop = &proc_tgid_base_operations;
3352        inode->i_flags|=S_IMMUTABLE;
3353
3354        set_nlink(inode, nlink_tgid);
3355        pid_update_inode(task, inode);
3356
3357        d_set_d_op(dentry, &pid_dentry_operations);
3358        return d_splice_alias(inode, dentry);
3359}
3360
3361struct dentry *proc_pid_lookup(struct dentry *dentry, unsigned int flags)
3362{
3363        struct task_struct *task;
3364        unsigned tgid;
3365        struct proc_fs_info *fs_info;
3366        struct pid_namespace *ns;
3367        struct dentry *result = ERR_PTR(-ENOENT);
3368
3369        tgid = name_to_int(&dentry->d_name);
3370        if (tgid == ~0U)
3371                goto out;
3372
3373        fs_info = proc_sb_info(dentry->d_sb);
3374        ns = fs_info->pid_ns;
3375        rcu_read_lock();
3376        task = find_task_by_pid_ns(tgid, ns);
3377        if (task)
3378                get_task_struct(task);
3379        rcu_read_unlock();
3380        if (!task)
3381                goto out;
3382
3383        /* Limit procfs to only ptraceable tasks */
3384        if (fs_info->hide_pid == HIDEPID_NOT_PTRACEABLE) {
3385                if (!has_pid_permissions(fs_info, task, HIDEPID_NO_ACCESS))
3386                        goto out_put_task;
3387        }
3388
3389        result = proc_pid_instantiate(dentry, task, NULL);
3390out_put_task:
3391        put_task_struct(task);
3392out:
3393        return result;
3394}
3395
3396/*
3397 * Find the first task with tgid >= tgid
3398 *
3399 */
3400struct tgid_iter {
3401        unsigned int tgid;
3402        struct task_struct *task;
3403};
3404static struct tgid_iter next_tgid(struct pid_namespace *ns, struct tgid_iter iter)
3405{
3406        struct pid *pid;
3407
3408        if (iter.task)
3409                put_task_struct(iter.task);
3410        rcu_read_lock();
3411retry:
3412        iter.task = NULL;
3413        pid = find_ge_pid(iter.tgid, ns);
3414        if (pid) {
3415                iter.tgid = pid_nr_ns(pid, ns);
3416                iter.task = pid_task(pid, PIDTYPE_TGID);
3417                if (!iter.task) {
3418                        iter.tgid += 1;
3419                        goto retry;
3420                }
3421                get_task_struct(iter.task);
3422        }
3423        rcu_read_unlock();
3424        return iter;
3425}
3426
3427#define TGID_OFFSET (FIRST_PROCESS_ENTRY + 2)
3428
3429/* for the /proc/ directory itself, after non-process stuff has been done */
3430int proc_pid_readdir(struct file *file, struct dir_context *ctx)
3431{
3432        struct tgid_iter iter;
3433        struct proc_fs_info *fs_info = proc_sb_info(file_inode(file)->i_sb);
3434        struct pid_namespace *ns = proc_pid_ns(file_inode(file)->i_sb);
3435        loff_t pos = ctx->pos;
3436
3437        if (pos >= PID_MAX_LIMIT + TGID_OFFSET)
3438                return 0;
3439
3440        if (pos == TGID_OFFSET - 2) {
3441                struct inode *inode = d_inode(fs_info->proc_self);
3442                if (!dir_emit(ctx, "self", 4, inode->i_ino, DT_LNK))
3443                        return 0;
3444                ctx->pos = pos = pos + 1;
3445        }
3446        if (pos == TGID_OFFSET - 1) {
3447                struct inode *inode = d_inode(fs_info->proc_thread_self);
3448                if (!dir_emit(ctx, "thread-self", 11, inode->i_ino, DT_LNK))
3449                        return 0;
3450                ctx->pos = pos = pos + 1;
3451        }
3452        iter.tgid = pos - TGID_OFFSET;
3453        iter.task = NULL;
3454        for (iter = next_tgid(ns, iter);
3455             iter.task;
3456             iter.tgid += 1, iter = next_tgid(ns, iter)) {
3457                char name[10 + 1];
3458                unsigned int len;
3459
3460                cond_resched();
3461                if (!has_pid_permissions(fs_info, iter.task, HIDEPID_INVISIBLE))
3462                        continue;
3463
3464                len = snprintf(name, sizeof(name), "%u", iter.tgid);
3465                ctx->pos = iter.tgid + TGID_OFFSET;
3466                if (!proc_fill_cache(file, ctx, name, len,
3467                                     proc_pid_instantiate, iter.task, NULL)) {
3468                        put_task_struct(iter.task);
3469                        return 0;
3470                }
3471        }
3472        ctx->pos = PID_MAX_LIMIT + TGID_OFFSET;
3473        return 0;
3474}
3475
3476/*
3477 * proc_tid_comm_permission is a special permission function exclusively
3478 * used for the node /proc/<pid>/task/<tid>/comm.
3479 * It bypasses generic permission checks in the case where a task of the same
3480 * task group attempts to access the node.
3481 * The rationale behind this is that glibc and bionic access this node for
3482 * cross thread naming (pthread_set/getname_np(!self)). However, if
3483 * PR_SET_DUMPABLE gets set to 0 this node among others becomes uid=0 gid=0,
3484 * which locks out the cross thread naming implementation.
3485 * This function makes sure that the node is always accessible for members of
3486 * same thread group.
3487 */
3488static int proc_tid_comm_permission(struct user_namespace *mnt_userns,
3489                                    struct inode *inode, int mask)
3490{
3491        bool is_same_tgroup;
3492        struct task_struct *task;
3493
3494        task = get_proc_task(inode);
3495        if (!task)
3496                return -ESRCH;
3497        is_same_tgroup = same_thread_group(current, task);
3498        put_task_struct(task);
3499
3500        if (likely(is_same_tgroup && !(mask & MAY_EXEC))) {
3501                /* This file (/proc/<pid>/task/<tid>/comm) can always be
3502                 * read or written by the members of the corresponding
3503                 * thread group.
3504                 */
3505                return 0;
3506        }
3507
3508        return generic_permission(&init_user_ns, inode, mask);
3509}
3510
3511static const struct inode_operations proc_tid_comm_inode_operations = {
3512                .permission = proc_tid_comm_permission,
3513};
3514
3515/*
3516 * Tasks
3517 */
3518static const struct pid_entry tid_base_stuff[] = {
3519        DIR("fd",        S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
3520        DIR("fdinfo",    S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
3521        DIR("ns",        S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations),
3522#ifdef CONFIG_NET
3523        DIR("net",        S_IRUGO|S_IXUGO, proc_net_inode_operations, proc_net_operations),
3524#endif
3525        REG("environ",   S_IRUSR, proc_environ_operations),
3526        REG("auxv",      S_IRUSR, proc_auxv_operations),
3527        ONE("status",    S_IRUGO, proc_pid_status),
3528        ONE("personality", S_IRUSR, proc_pid_personality),
3529        ONE("limits",    S_IRUGO, proc_pid_limits),
3530#ifdef CONFIG_SCHED_DEBUG
3531        REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
3532#endif
3533        NOD("comm",      S_IFREG|S_IRUGO|S_IWUSR,
3534                         &proc_tid_comm_inode_operations,
3535                         &proc_pid_set_comm_operations, {}),
3536#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
3537        ONE("syscall",   S_IRUSR, proc_pid_syscall),
3538#endif
3539        REG("cmdline",   S_IRUGO, proc_pid_cmdline_ops),
3540        ONE("stat",      S_IRUGO, proc_tid_stat),
3541        ONE("statm",     S_IRUGO, proc_pid_statm),
3542        REG("maps",      S_IRUGO, proc_pid_maps_operations),
3543#ifdef CONFIG_PROC_CHILDREN
3544        REG("children",  S_IRUGO, proc_tid_children_operations),
3545#endif
3546#ifdef CONFIG_NUMA
3547        REG("numa_maps", S_IRUGO, proc_pid_numa_maps_operations),
3548#endif
3549        REG("mem",       S_IRUSR|S_IWUSR, proc_mem_operations),
3550        LNK("cwd",       proc_cwd_link),
3551        LNK("root",      proc_root_link),
3552        LNK("exe",       proc_exe_link),
3553        REG("mounts",    S_IRUGO, proc_mounts_operations),
3554        REG("mountinfo",  S_IRUGO, proc_mountinfo_operations),
3555#ifdef CONFIG_PROC_PAGE_MONITOR
3556        REG("clear_refs", S_IWUSR, proc_clear_refs_operations),
3557        REG("smaps",     S_IRUGO, proc_pid_smaps_operations),
3558        REG("smaps_rollup", S_IRUGO, proc_pid_smaps_rollup_operations),
3559        REG("pagemap",    S_IRUSR, proc_pagemap_operations),
3560#endif
3561#ifdef CONFIG_SECURITY
3562        DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
3563#endif
3564#ifdef CONFIG_KALLSYMS
3565        ONE("wchan",     S_IRUGO, proc_pid_wchan),
3566#endif
3567#ifdef CONFIG_STACKTRACE
3568        ONE("stack",      S_IRUSR, proc_pid_stack),
3569#endif
3570#ifdef CONFIG_SCHED_INFO
3571        ONE("schedstat", S_IRUGO, proc_pid_schedstat),
3572#endif
3573#ifdef CONFIG_LATENCYTOP
3574        REG("latency",  S_IRUGO, proc_lstats_operations),
3575#endif
3576#ifdef CONFIG_PROC_PID_CPUSET
3577        ONE("cpuset",    S_IRUGO, proc_cpuset_show),
3578#endif
3579#ifdef CONFIG_CGROUPS
3580        ONE("cgroup",  S_IRUGO, proc_cgroup_show),
3581#endif
3582#ifdef CONFIG_PROC_CPU_RESCTRL
3583        ONE("cpu_resctrl_groups", S_IRUGO, proc_resctrl_show),
3584#endif
3585        ONE("oom_score", S_IRUGO, proc_oom_score),
3586        REG("oom_adj",   S_IRUGO|S_IWUSR, proc_oom_adj_operations),
3587        REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),
3588#ifdef CONFIG_AUDIT
3589        REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
3590        REG("sessionid",  S_IRUGO, proc_sessionid_operations),
3591#endif
3592#ifdef CONFIG_FAULT_INJECTION
3593        REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
3594        REG("fail-nth", 0644, proc_fail_nth_operations),
3595#endif
3596#ifdef CONFIG_TASK_IO_ACCOUNTING
3597        ONE("io",       S_IRUSR, proc_tid_io_accounting),
3598#endif
3599#ifdef CONFIG_USER_NS
3600        REG("uid_map",    S_IRUGO|S_IWUSR, proc_uid_map_operations),
3601        REG("gid_map",    S_IRUGO|S_IWUSR, proc_gid_map_operations),
3602        REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
3603        REG("setgroups",  S_IRUGO|S_IWUSR, proc_setgroups_operations),
3604#endif
3605#ifdef CONFIG_LIVEPATCH
3606        ONE("patch_state",  S_IRUSR, proc_pid_patch_state),
3607#endif
3608#ifdef CONFIG_PROC_PID_ARCH_STATUS
3609        ONE("arch_status", S_IRUGO, proc_pid_arch_status),
3610#endif
3611#ifdef CONFIG_SECCOMP_CACHE_DEBUG
3612        ONE("seccomp_cache", S_IRUSR, proc_pid_seccomp_cache),
3613#endif
3614};
3615
3616static int proc_tid_base_readdir(struct file *file, struct dir_context *ctx)
3617{
3618        return proc_pident_readdir(file, ctx,
3619                                   tid_base_stuff, ARRAY_SIZE(tid_base_stuff));
3620}
3621
3622static struct dentry *proc_tid_base_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
3623{
3624        return proc_pident_lookup(dir, dentry,
3625                                  tid_base_stuff,
3626                                  tid_base_stuff + ARRAY_SIZE(tid_base_stuff));
3627}
3628
3629static const struct file_operations proc_tid_base_operations = {
3630        .read           = generic_read_dir,
3631        .iterate_shared = proc_tid_base_readdir,
3632        .llseek         = generic_file_llseek,
3633};
3634
3635static const struct inode_operations proc_tid_base_inode_operations = {
3636        .lookup         = proc_tid_base_lookup,
3637        .getattr        = pid_getattr,
3638        .setattr        = proc_setattr,
3639};
3640
3641static struct dentry *proc_task_instantiate(struct dentry *dentry,
3642        struct task_struct *task, const void *ptr)
3643{
3644        struct inode *inode;
3645        inode = proc_pid_make_inode(dentry->d_sb, task, S_IFDIR | S_IRUGO | S_IXUGO);
3646        if (!inode)
3647                return ERR_PTR(-ENOENT);
3648
3649        inode->i_op = &proc_tid_base_inode_operations;
3650        inode->i_fop = &proc_tid_base_operations;
3651        inode->i_flags |= S_IMMUTABLE;
3652
3653        set_nlink(inode, nlink_tid);
3654        pid_update_inode(task, inode);
3655
3656        d_set_d_op(dentry, &pid_dentry_operations);
3657        return d_splice_alias(inode, dentry);
3658}
3659
3660static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry, unsigned int flags)
3661{
3662        struct task_struct *task;
3663        struct task_struct *leader = get_proc_task(dir);
3664        unsigned tid;
3665        struct proc_fs_info *fs_info;
3666        struct pid_namespace *ns;
3667        struct dentry *result = ERR_PTR(-ENOENT);
3668
3669        if (!leader)
3670                goto out_no_task;
3671
3672        tid = name_to_int(&dentry->d_name);
3673        if (tid == ~0U)
3674                goto out;
3675
3676        fs_info = proc_sb_info(dentry->d_sb);
3677        ns = fs_info->pid_ns;
3678        rcu_read_lock();
3679        task = find_task_by_pid_ns(tid, ns);
3680        if (task)
3681                get_task_struct(task);
3682        rcu_read_unlock();
3683        if (!task)
3684                goto out;
3685        if (!same_thread_group(leader, task))
3686                goto out_drop_task;
3687
3688        result = proc_task_instantiate(dentry, task, NULL);
3689out_drop_task:
3690        put_task_struct(task);
3691out:
3692        put_task_struct(leader);
3693out_no_task:
3694        return result;
3695}
3696
3697/*
3698 * Find the first tid of a thread group to return to user space.
3699 *
3700 * Usually this is just the thread group leader, but if the users
3701 * buffer was too small or there was a seek into the middle of the
3702 * directory we have more work todo.
3703 *
3704 * In the case of a short read we start with find_task_by_pid.
3705 *
3706 * In the case of a seek we start with the leader and walk nr
3707 * threads past it.
3708 */
3709static struct task_struct *first_tid(struct pid *pid, int tid, loff_t f_pos,
3710                                        struct pid_namespace *ns)
3711{
3712        struct task_struct *pos, *task;
3713        unsigned long nr = f_pos;
3714
3715        if (nr != f_pos)        /* 32bit overflow? */
3716                return NULL;
3717
3718        rcu_read_lock();
3719        task = pid_task(pid, PIDTYPE_PID);
3720        if (!task)
3721                goto fail;
3722
3723        /* Attempt to start with the tid of a thread */
3724        if (tid && nr) {
3725                pos = find_task_by_pid_ns(tid, ns);
3726                if (pos && same_thread_group(pos, task))
3727                        goto found;
3728        }
3729
3730        /* If nr exceeds the number of threads there is nothing todo */
3731        if (nr >= get_nr_threads(task))
3732                goto fail;
3733
3734        /* If we haven't found our starting place yet start
3735         * with the leader and walk nr threads forward.
3736         */
3737        pos = task = task->group_leader;
3738        do {
3739                if (!nr--)
3740                        goto found;
3741        } while_each_thread(task, pos);
3742fail:
3743        pos = NULL;
3744        goto out;
3745found:
3746        get_task_struct(pos);
3747out:
3748        rcu_read_unlock();
3749        return pos;
3750}
3751
3752/*
3753 * Find the next thread in the thread list.
3754 * Return NULL if there is an error or no next thread.
3755 *
3756 * The reference to the input task_struct is released.
3757 */
3758static struct task_struct *next_tid(struct task_struct *start)
3759{
3760        struct task_struct *pos = NULL;
3761        rcu_read_lock();
3762        if (pid_alive(start)) {
3763                pos = next_thread(start);
3764                if (thread_group_leader(pos))
3765                        pos = NULL;
3766                else
3767                        get_task_struct(pos);
3768        }
3769        rcu_read_unlock();
3770        put_task_struct(start);
3771        return pos;
3772}
3773
3774/* for the /proc/TGID/task/ directories */
3775static int proc_task_readdir(struct file *file, struct dir_context *ctx)
3776{
3777        struct inode *inode = file_inode(file);
3778        struct task_struct *task;
3779        struct pid_namespace *ns;
3780        int tid;
3781
3782        if (proc_inode_is_dead(inode))
3783                return -ENOENT;
3784
3785        if (!dir_emit_dots(file, ctx))
3786                return 0;
3787
3788        /* f_version caches the tgid value that the last readdir call couldn't
3789         * return. lseek aka telldir automagically resets f_version to 0.
3790         */
3791        ns = proc_pid_ns(inode->i_sb);
3792        tid = (int)file->f_version;
3793        file->f_version = 0;
3794        for (task = first_tid(proc_pid(inode), tid, ctx->pos - 2, ns);
3795             task;
3796             task = next_tid(task), ctx->pos++) {
3797                char name[10 + 1];
3798                unsigned int len;
3799                tid = task_pid_nr_ns(task, ns);
3800                len = snprintf(name, sizeof(name), "%u", tid);
3801                if (!proc_fill_cache(file, ctx, name, len,
3802                                proc_task_instantiate, task, NULL)) {
3803                        /* returning this tgid failed, save it as the first
3804                         * pid for the next readir call */
3805                        file->f_version = (u64)tid;
3806                        put_task_struct(task);
3807                        break;
3808                }
3809        }
3810
3811        return 0;
3812}
3813
3814static int proc_task_getattr(struct user_namespace *mnt_userns,
3815                             const struct path *path, struct kstat *stat,
3816                             u32 request_mask, unsigned int query_flags)
3817{
3818        struct inode *inode = d_inode(path->dentry);
3819        struct task_struct *p = get_proc_task(inode);
3820        generic_fillattr(&init_user_ns, inode, stat);
3821
3822        if (p) {
3823                stat->nlink += get_nr_threads(p);
3824                put_task_struct(p);
3825        }
3826
3827        return 0;
3828}
3829
3830static const struct inode_operations proc_task_inode_operations = {
3831        .lookup         = proc_task_lookup,
3832        .getattr        = proc_task_getattr,
3833        .setattr        = proc_setattr,
3834        .permission     = proc_pid_permission,
3835};
3836
3837static const struct file_operations proc_task_operations = {
3838        .read           = generic_read_dir,
3839        .iterate_shared = proc_task_readdir,
3840        .llseek         = generic_file_llseek,
3841};
3842
3843void __init set_proc_pid_nlink(void)
3844{
3845        nlink_tid = pid_entry_nlink(tid_base_stuff, ARRAY_SIZE(tid_base_stuff));
3846        nlink_tgid = pid_entry_nlink(tgid_base_stuff, ARRAY_SIZE(tgid_base_stuff));
3847}
3848