mm: fix prctl_set_vma_anon_name

prctl_set_vma_anon_name could attempt to set the name across
two vmas at the same time due to a typo, which might corrupt
the vma list.  Fix it to use tmp instead of end to limit
the name setting to a single vma at a time.

Change-Id: Ie32d8ddb0fd547efbeedd6528acdab5ca5b308b4
Reported-by: Jed Davis <jld@mozilla.com>
Signed-off-by: Colin Cross <ccross@android.com>

SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
 void __user *, arg)
{
 char buffer[256];
 int ret = 0;

 /* We only trust the superuser with rebooting the system. */
 if (!capable(CAP_SYS_BOOT))
 return -EPERM;

 /* For safety, we require "magic" arguments. */
 if (magic1 != LINUX_REBOOT_MAGIC1 ||
 (magic2 != LINUX_REBOOT_MAGIC2 &&
	                magic2 != LINUX_REBOOT_MAGIC2A &&
			magic2 != LINUX_REBOOT_MAGIC2B &&
	                magic2 != LINUX_REBOOT_MAGIC2C))
 return -EINVAL;

 /*
	 * If pid namespaces are enabled and the current task is in a child
	 * pid_namespace, the command is handled by reboot_pid_ns() which will
	 * call do_exit().
	 */
	ret = reboot_pid_ns(task_active_pid_ns(current), cmd);
 if (ret)
 return ret;

 /* Instead of trying to make the power_off code look like
	 * halt when pm_power_off is not set do it the easy way.
	 */
 if ((cmd == LINUX_REBOOT_CMD_POWER_OFF) && !pm_power_off)
		cmd = LINUX_REBOOT_CMD_HALT;

	mutex_lock(&reboot_mutex);
 switch (cmd) {
 case LINUX_REBOOT_CMD_RESTART:
		kernel_restart(NULL);
 break;

 case LINUX_REBOOT_CMD_CAD_ON:
		C_A_D = 1;
 break;

 case LINUX_REBOOT_CMD_CAD_OFF:
		C_A_D = 0;
 break;

 case LINUX_REBOOT_CMD_HALT:
		kernel_halt();
		do_exit(0);
		panic("cannot halt");

 case LINUX_REBOOT_CMD_POWER_OFF:
		kernel_power_off();
		do_exit(0);
 break;

 case LINUX_REBOOT_CMD_RESTART2:
 if (strncpy_from_user(&buffer[0], arg, sizeof(buffer) - 1) < 0) {
			ret = -EFAULT;
 break;
 }
		buffer[sizeof(buffer) - 1] = '\0';

		kernel_restart(buffer);
 break;

#ifdef CONFIG_KEXEC
 case LINUX_REBOOT_CMD_KEXEC:
		ret = kernel_kexec();
 break;
#endif

#ifdef CONFIG_HIBERNATION
 case LINUX_REBOOT_CMD_SW_SUSPEND:
		ret = hibernate();
 break;
#endif

 default:
		ret = -EINVAL;
 break;
 }
	mutex_unlock(&reboot_mutex);
 return ret;
}

SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
 void __user *, arg)
{
 char buffer[256];
 int ret = 0;

 /* We only trust the superuser with rebooting the system. */
 if (!capable(CAP_SYS_BOOT))
 return -EPERM;

 /* For safety, we require "magic" arguments. */
 if (magic1 != LINUX_REBOOT_MAGIC1 ||
 (magic2 != LINUX_REBOOT_MAGIC2 &&
	                magic2 != LINUX_REBOOT_MAGIC2A &&
			magic2 != LINUX_REBOOT_MAGIC2B &&
	                magic2 != LINUX_REBOOT_MAGIC2C))
 return -EINVAL;

 /*
	 * If pid namespaces are enabled and the current task is in a child
	 * pid_namespace, the command is handled by reboot_pid_ns() which will
	 * call do_exit().
	 */
	ret = reboot_pid_ns(task_active_pid_ns(current), cmd);
 if (ret)
 return ret;

 /* Instead of trying to make the power_off code look like
	 * halt when pm_power_off is not set do it the easy way.
	 */
 if ((cmd == LINUX_REBOOT_CMD_POWER_OFF) && !pm_power_off)
		cmd = LINUX_REBOOT_CMD_HALT;

	mutex_lock(&reboot_mutex);
 switch (cmd) {
 case LINUX_REBOOT_CMD_RESTART:
		kernel_restart(NULL);
 break;

 case LINUX_REBOOT_CMD_CAD_ON:
		C_A_D = 1;
 break;

 case LINUX_REBOOT_CMD_CAD_OFF:
		C_A_D = 0;
 break;

 case LINUX_REBOOT_CMD_HALT:
		kernel_halt();
		do_exit(0);
		panic("cannot halt");

 case LINUX_REBOOT_CMD_POWER_OFF:
		kernel_power_off();
		do_exit(0);
 break;

 case LINUX_REBOOT_CMD_RESTART2:
 if (strncpy_from_user(&buffer[0], arg, sizeof(buffer) - 1) < 0) {
			ret = -EFAULT;
 break;
 }
		buffer[sizeof(buffer) - 1] = '\0';

		kernel_restart(buffer);
 break;

#ifdef CONFIG_KEXEC
 case LINUX_REBOOT_CMD_KEXEC:
		ret = kernel_kexec();
 break;
#endif

#ifdef CONFIG_HIBERNATION
 case LINUX_REBOOT_CMD_SW_SUSPEND:
		ret = hibernate();
 break;
#endif

 default:
		ret = -EINVAL;
 break;
 }
	mutex_unlock(&reboot_mutex);
 return ret;
}
