11 files changed, 213 insertions, 30 deletions

diff --git a/lib/Kconfig b/lib/Kconfig
index 71d9f81f6eed..65561716c16c 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -48,6 +48,16 @@ config STMP_DEVICE
 config PERCPU_RWSEM
         boolean
 
+config ARCH_USE_CMPXCHG_LOCKREF
+        bool
+
+config CMPXCHG_LOCKREF
+        def_bool y if ARCH_USE_CMPXCHG_LOCKREF
+        depends on SMP
+        depends on !GENERIC_LOCKBREAK
+        depends on !DEBUG_SPINLOCK
+        depends on !DEBUG_LOCK_ALLOC
+
 config CRC_CCITT
         tristate "CRC-CCITT functions"
         help
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 1501aa553221..444e1c12fea9 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -981,6 +981,25 @@ config DEBUG_KOBJECT
           If you say Y here, some extra kobject debugging messages will be sent
           to the syslog. 
 
+config DEBUG_KOBJECT_RELEASE
+        bool "kobject release debugging"
+        depends on DEBUG_KERNEL
+        help
+          kobjects are reference counted objects.  This means that their
+          last reference count put is not predictable, and the kobject can
+          live on past the point at which a driver decides to drop it's
+          initial reference to the kobject gained on allocation.  An
+          example of this would be a struct device which has just been
+          unregistered.
+
+          However, some buggy drivers assume that after such an operation,
+          the memory backing the kobject can be immediately freed.  This
+          goes completely against the principles of a refcounted object.
+
+          If you say Y here, the kernel will delay the release of kobjects
+          on the last reference count to improve the visibility of this
+          kind of kobject release bug.
+
 config HAVE_DEBUG_BUGVERBOSE
         bool
 
diff --git a/lib/Makefile b/lib/Makefile
index 7baccfd8a4e9..f2cb3082697c 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -20,6 +20,7 @@ lib-$(CONFIG_MMU) += ioremap.o
 lib-$(CONFIG_SMP) += cpumask.o
 
 lib-y   += kobject.o klist.o
+obj-y   += lockref.o
 
 obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o hexdump.o kasprintf.o bitmap.o scatterlist.o \
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 37061ede8b81..bf2c8b1043d8 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -381,19 +381,21 @@ void debug_object_init_on_stack(void *addr, struct debug_obj_descr *descr)
  * debug_object_activate - debug checks when an object is activated
  * @addr:       address of the object
  * @descr:      pointer to an object specific debug description structure
+ * Returns 0 for success, -EINVAL for check failed.
  */
-void debug_object_activate(void *addr, struct debug_obj_descr *descr)
+int debug_object_activate(void *addr, struct debug_obj_descr *descr)
 {
         enum debug_obj_state state;
         struct debug_bucket *db;
         struct debug_obj *obj;
         unsigned long flags;
+        int ret;
         struct debug_obj o = { .object = addr,
                                .state = ODEBUG_STATE_NOTAVAILABLE,
                                .descr = descr };
 
         if (!debug_objects_enabled)
-                return;
+                return 0;
 
         db = get_bucket((unsigned long) addr);
 
@@ -405,23 +407,26 @@ void debug_object_activate(void *addr, struct debug_obj_descr *descr)
                 case ODEBUG_STATE_INIT:
                 case ODEBUG_STATE_INACTIVE:
                         obj->state = ODEBUG_STATE_ACTIVE;
+                        ret = 0;
                         break;
 
                 case ODEBUG_STATE_ACTIVE:
                         debug_print_object(obj, "activate");
                         state = obj->state;
                         raw_spin_unlock_irqrestore(&db->lock, flags);
-                        debug_object_fixup(descr->fixup_activate, addr, state);
-                        return;
+                        ret = debug_object_fixup(descr->fixup_activate, addr, state);
+                        return ret ? -EINVAL : 0;
 
                 case ODEBUG_STATE_DESTROYED:
                         debug_print_object(obj, "activate");
+                        ret = -EINVAL;
                         break;
                 default:
+                        ret = 0;
                         break;
                 }
                 raw_spin_unlock_irqrestore(&db->lock, flags);
-                return;
+                return ret;
         }
 
         raw_spin_unlock_irqrestore(&db->lock, flags);
@@ -431,8 +436,11 @@ void debug_object_activate(void *addr, struct debug_obj_descr *descr)
          * true or not.
          */
         if (debug_object_fixup(descr->fixup_activate, addr,
-                           ODEBUG_STATE_NOTAVAILABLE))
+                           ODEBUG_STATE_NOTAVAILABLE)) {
                 debug_print_object(&o, "activate");
+                return -EINVAL;
+        }
+        return 0;
 }
 
 /**
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index 99fec3ae405a..c37aeacd7651 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -309,7 +309,7 @@ static int ddebug_parse_query(char *words[], int nwords,
                         struct ddebug_query *query, const char *modname)
 {
         unsigned int i;
-        int rc;
+        int rc = 0;
 
         /* check we have an even number of words */
         if (nwords % 2 != 0) {
diff --git a/lib/earlycpio.c b/lib/earlycpio.c
index 7aa7ce250c94..3eb3e4722b8e 100644
--- a/lib/earlycpio.c
+++ b/lib/earlycpio.c
@@ -49,22 +49,23 @@ enum cpio_fields {
 
 /**
  * cpio_data find_cpio_data - Search for files in an uncompressed cpio
- * @path:   The directory to search for, including a slash at the end
- * @data:   Pointer to the the cpio archive or a header inside
- * @len:    Remaining length of the cpio based on data pointer
- * @offset: When a matching file is found, this is the offset to the
- *          beginning of the cpio. It can be used to iterate through
- *          the cpio to find all files inside of a directory path
+ * @path:       The directory to search for, including a slash at the end
+ * @data:       Pointer to the the cpio archive or a header inside
+ * @len:        Remaining length of the cpio based on data pointer
+ * @nextoff:    When a matching file is found, this is the offset from the
+ *              beginning of the cpio to the beginning of the next file, not the
+ *              matching file itself. It can be used to iterate through the cpio
+ *              to find all files inside of a directory path.
  *
- * @return: struct cpio_data containing the address, length and
- *          filename (with the directory path cut off) of the found file.
- *          If you search for a filename and not for files in a directory,
- *          pass the absolute path of the filename in the cpio and make sure
- *          the match returned an empty filename string.
+ * @return:     struct cpio_data containing the address, length and
+ *              filename (with the directory path cut off) of the found file.
+ *              If you search for a filename and not for files in a directory,
+ *              pass the absolute path of the filename in the cpio and make sure
+ *              the match returned an empty filename string.
  */
 
 struct cpio_data find_cpio_data(const char *path, void *data,
-                                          size_t len,  long *offset)
+                                size_t len,  long *nextoff)
 {
         const size_t cpio_header_len = 8*C_NFIELDS - 2;
         struct cpio_data cd = { NULL, 0, "" };
@@ -124,7 +125,7 @@ struct cpio_data find_cpio_data(const char *path, void *data,
                 if ((ch[C_MODE] & 0170000) == 0100000 &&
                     ch[C_NAMESIZE] >= mypathsize &&
                     !memcmp(p, path, mypathsize)) {
-                        *offset = (long)nptr - (long)data;
+                        *nextoff = (long)nptr - (long)data;
                         if (ch[C_NAMESIZE] - mypathsize >= MAX_CPIO_FILE_NAME) {
                                 pr_warn(
                                 "File %s exceeding MAX_CPIO_FILE_NAME [%d]\n",
diff --git a/lib/kobject.c b/lib/kobject.c
index 4a1f33d43548..1d46c151a4ae 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -545,8 +545,8 @@ static void kobject_cleanup(struct kobject *kobj)
         struct kobj_type *t = get_ktype(kobj);
         const char *name = kobj->name;
 
-        pr_debug("kobject: '%s' (%p): %s\n",
-                 kobject_name(kobj), kobj, __func__);
+        pr_debug("kobject: '%s' (%p): %s, parent %p\n",
+                 kobject_name(kobj), kobj, __func__, kobj->parent);
 
         if (t && !t->release)
                 pr_debug("kobject: '%s' (%p): does not have a release() "
@@ -580,9 +580,25 @@ static void kobject_cleanup(struct kobject *kobj)
         }
 }
 
+#ifdef CONFIG_DEBUG_KOBJECT_RELEASE
+static void kobject_delayed_cleanup(struct work_struct *work)
+{
+        kobject_cleanup(container_of(to_delayed_work(work),
+                                     struct kobject, release));
+}
+#endif
+
 static void kobject_release(struct kref *kref)
 {
-        kobject_cleanup(container_of(kref, struct kobject, kref));
+        struct kobject *kobj = container_of(kref, struct kobject, kref);
+#ifdef CONFIG_DEBUG_KOBJECT_RELEASE
+        pr_debug("kobject: '%s' (%p): %s, parent %p (delayed)\n",
+                 kobject_name(kobj), kobj, __func__, kobj->parent);
+        INIT_DELAYED_WORK(&kobj->release, kobject_delayed_cleanup);
+        schedule_delayed_work(&kobj->release, HZ);
+#else
+        kobject_cleanup(kobj);
+#endif
 }
 
 /**
diff --git a/lib/lockref.c b/lib/lockref.c
new file mode 100644
index 000000000000..9d76f404ce9a
--- /dev/null
+++ b/lib/lockref.c
@@ -0,0 +1,128 @@
+#include <linux/export.h>
+#include <linux/lockref.h>
+
+#ifdef CONFIG_CMPXCHG_LOCKREF
+
+/*
+ * Note that the "cmpxchg()" reloads the "old" value for the
+ * failure case.
+ */
+#define CMPXCHG_LOOP(CODE, SUCCESS) do {                                        \
+        struct lockref old;                                                     \
+        BUILD_BUG_ON(sizeof(old) != 8);                                         \
+        old.lock_count = ACCESS_ONCE(lockref->lock_count);                      \
+        while (likely(arch_spin_value_unlocked(old.lock.rlock.raw_lock))) {     \
+                struct lockref new = old, prev = old;                           \
+                CODE                                                            \
+                old.lock_count = cmpxchg(&lockref->lock_count,                  \
+                                         old.lock_count, new.lock_count);       \
+                if (likely(old.lock_count == prev.lock_count)) {                \
+                        SUCCESS;                                                \
+                }                                                               \
+                cpu_relax();                                                    \
+        }                                                                       \
+} while (0)
+
+#else
+
+#define CMPXCHG_LOOP(CODE, SUCCESS) do { } while (0)
+
+#endif
+
+/**
+ * lockref_get - Increments reference count unconditionally
+ * @lockcnt: pointer to lockref structure
+ *
+ * This operation is only valid if you already hold a reference
+ * to the object, so you know the count cannot be zero.
+ */
+void lockref_get(struct lockref *lockref)
+{
+        CMPXCHG_LOOP(
+                new.count++;
+        ,
+                return;
+        );
+
+        spin_lock(&lockref->lock);
+        lockref->count++;
+        spin_unlock(&lockref->lock);
+}
+EXPORT_SYMBOL(lockref_get);
+
+/**
+ * lockref_get_not_zero - Increments count unless the count is 0
+ * @lockcnt: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count was zero
+ */
+int lockref_get_not_zero(struct lockref *lockref)
+{
+        int retval;
+
+        CMPXCHG_LOOP(
+                new.count++;
+                if (!old.count)
+                        return 0;
+        ,
+                return 1;
+        );
+
+        spin_lock(&lockref->lock);
+        retval = 0;
+        if (lockref->count) {
+                lockref->count++;
+                retval = 1;
+        }
+        spin_unlock(&lockref->lock);
+        return retval;
+}
+EXPORT_SYMBOL(lockref_get_not_zero);
+
+/**
+ * lockref_get_or_lock - Increments count unless the count is 0
+ * @lockcnt: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count was zero
+ * and we got the lock instead.
+ */
+int lockref_get_or_lock(struct lockref *lockref)
+{
+        CMPXCHG_LOOP(
+                new.count++;
+                if (!old.count)
+                        break;
+        ,
+                return 1;
+        );
+
+        spin_lock(&lockref->lock);
+        if (!lockref->count)
+                return 0;
+        lockref->count++;
+        spin_unlock(&lockref->lock);
+        return 1;
+}
+EXPORT_SYMBOL(lockref_get_or_lock);
+
+/**
+ * lockref_put_or_lock - decrements count unless count <= 1 before decrement
+ * @lockcnt: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count <= 1 and lock taken
+ */
+int lockref_put_or_lock(struct lockref *lockref)
+{
+        CMPXCHG_LOOP(
+                new.count--;
+                if (old.count <= 1)
+                        break;
+        ,
+                return 1;
+        );
+
+        spin_lock(&lockref->lock);
+        if (lockref->count <= 1)
+                return 0;
+        lockref->count--;
+        spin_unlock(&lockref->lock);
+        return 1;
+}
+EXPORT_SYMBOL(lockref_put_or_lock);
diff --git a/lib/lz4/lz4_compress.c b/lib/lz4/lz4_compress.c
index fd94058bd7f9..28321d8f75ef 100644
--- a/lib/lz4/lz4_compress.c
+++ b/lib/lz4/lz4_compress.c
@@ -437,7 +437,7 @@ int lz4_compress(const unsigned char *src, size_t src_len,
 exit:
         return ret;
 }
-EXPORT_SYMBOL_GPL(lz4_compress);
+EXPORT_SYMBOL(lz4_compress);
 
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("Dual BSD/GPL");
 MODULE_DESCRIPTION("LZ4 compressor");
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index d3414eae73a1..411be80ddb46 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -299,7 +299,7 @@ exit_0:
         return ret;
 }
 #ifndef STATIC
-EXPORT_SYMBOL_GPL(lz4_decompress);
+EXPORT_SYMBOL(lz4_decompress);
 #endif
 
 int lz4_decompress_unknownoutputsize(const char *src, size_t src_len,
@@ -319,8 +319,8 @@ exit_0:
         return ret;
 }
 #ifndef STATIC
-EXPORT_SYMBOL_GPL(lz4_decompress_unknownoutputsize);
+EXPORT_SYMBOL(lz4_decompress_unknownoutputsize);
 
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("Dual BSD/GPL");
 MODULE_DESCRIPTION("LZ4 Decompressor");
 #endif
diff --git a/lib/lz4/lz4hc_compress.c b/lib/lz4/lz4hc_compress.c
index eb1a74f5e368..f344f76b6559 100644
--- a/lib/lz4/lz4hc_compress.c
+++ b/lib/lz4/lz4hc_compress.c
@@ -533,7 +533,7 @@ int lz4hc_compress(const unsigned char *src, size_t src_len,
 exit:
         return ret;
 }
-EXPORT_SYMBOL_GPL(lz4hc_compress);
+EXPORT_SYMBOL(lz4hc_compress);
 
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("Dual BSD/GPL");
 MODULE_DESCRIPTION("LZ4HC compressor");