mm: fix prctl_set_vma_anon_name

prctl_set_vma_anon_name could attempt to set the name across
two vmas at the same time due to a typo, which might corrupt
the vma list.  Fix it to use tmp instead of end to limit
the name setting to a single vma at a time.

Change-Id: Ie32d8ddb0fd547efbeedd6528acdab5ca5b308b4
Reported-by: Jed Davis <jld@mozilla.com>
Signed-off-by: Colin Cross <ccross@android.com>

SYSCALL_DEFINE0(setsid)
{
 struct task_struct *group_leader = current->group_leader;
 struct pid *sid = task_pid(group_leader);
 pid_t session = pid_vnr(sid);
 int err = -EPERM;

	write_lock_irq(&tasklist_lock);
 /* Fail if I am already a session leader */
 if (group_leader->signal->leader)
 goto out;

 /* Fail if a process group id already exists that equals the
	 * proposed session id.
	 */
 if (pid_task(sid, PIDTYPE_PGID))
 goto out;

	group_leader->signal->leader = 1;
	__set_special_pids(sid);

	proc_clear_tty(group_leader);

	err = session;
out:
	write_unlock_irq(&tasklist_lock);
 if (err > 0) {
		proc_sid_connector(group_leader);
		sched_autogroup_create_attach(group_leader);
 }
 return err;
}

SYSCALL_DEFINE0(setsid)
{
 struct task_struct *group_leader = current->group_leader;
 struct pid *sid = task_pid(group_leader);
 pid_t session = pid_vnr(sid);
 int err = -EPERM;

	write_lock_irq(&tasklist_lock);
 /* Fail if I am already a session leader */
 if (group_leader->signal->leader)
 goto out;

 /* Fail if a process group id already exists that equals the
	 * proposed session id.
	 */
 if (pid_task(sid, PIDTYPE_PGID))
 goto out;

	group_leader->signal->leader = 1;
	__set_special_pids(sid);

	proc_clear_tty(group_leader);

	err = session;
out:
	write_unlock_irq(&tasklist_lock);
 if (err > 0) {
		proc_sid_connector(group_leader);
		sched_autogroup_create_attach(group_leader);
 }
 return err;
}
