seccomp: check in_compat_syscall, not is_compat_task, in strict mode

[deliverable/linux.git] / kernel / fork.c

diff --git a/kernel/fork.c b/kernel/fork.c
index 2e391c754ae730bd2d8520c2ab497c403220c6e3..5b8d1e7ceeeab3c396d0c83865e5ce0af72bbbe1 100644 (file)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -164,12 +164,20 @@ static struct thread_info *alloc_thread_info_node(struct task_struct *tsk,
        struct page *page = alloc_kmem_pages_node(node, THREADINFO_GFP,
                                                  THREAD_SIZE_ORDER);
 
+       if (page)
+               memcg_kmem_update_page_stat(page, MEMCG_KERNEL_STACK,
+                                           1 << THREAD_SIZE_ORDER);
+
        return page ? page_address(page) : NULL;
 }
 
 static inline void free_thread_info(struct thread_info *ti)
 {
-       free_kmem_pages((unsigned long)ti, THREAD_SIZE_ORDER);
+       struct page *page = virt_to_page(ti);
+
+       memcg_kmem_update_page_stat(page, MEMCG_KERNEL_STACK,
+                                   -(1 << THREAD_SIZE_ORDER));
+       __free_kmem_pages(page, THREAD_SIZE_ORDER);
 }
 # else
 static struct kmem_cache *thread_info_cache;
@@ -1884,7 +1892,7 @@ static int check_unshare_flags(unsigned long unshare_flags)
        if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
                                CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
                                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET|
-                               CLONE_NEWUSER|CLONE_NEWPID))
+                               CLONE_NEWUSER|CLONE_NEWPID|CLONE_NEWCGROUP))
                return -EINVAL;
        /*
         * Not implemented, but pretend it works if there is nothing