13 files changed, 82 insertions, 69 deletions

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 3aeb4ea2a93a..dd172ee16716 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1849,7 +1849,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz
         union bpf_attr attr = {};
         int err;
 
-        if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
+        if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
         err = check_uarg_tail_zero(uattr, sizeof(attr), size);
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 8cda3bc3ae22..4bfb2908ec15 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -3183,6 +3183,16 @@ static int cgroup_enable_threaded(struct cgroup *cgrp)
         if (cgroup_is_threaded(cgrp))
                 return 0;
 
+        /*
+         * If @cgroup is populated or has domain controllers enabled, it
+         * can't be switched.  While the below cgroup_can_be_thread_root()
+         * test can catch the same conditions, that's only when @parent is
+         * not mixable, so let's check it explicitly.
+         */
+        if (cgroup_is_populated(cgrp) ||
+            cgrp->subtree_control & ~cgrp_dfl_threaded_ss_mask)
+                return -EOPNOTSUPP;
+
         /* we're joining the parent's domain, ensure its validity */
         if (!cgroup_is_valid_domain(dom_cgrp) ||
             !cgroup_can_be_thread_root(dom_cgrp))
diff --git a/kernel/compat.c b/kernel/compat.c
index 3247fe761f60..3f5fa8902e7d 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -488,25 +488,6 @@ get_compat_sigset(sigset_t *set, const compat_sigset_t __user *compat)
 }
 EXPORT_SYMBOL_GPL(get_compat_sigset);
 
-int
-put_compat_sigset(compat_sigset_t __user *compat, const sigset_t *set,
-                  unsigned int size)
-{
-        /* size <= sizeof(compat_sigset_t) <= sizeof(sigset_t) */
-#ifdef __BIG_ENDIAN
-        compat_sigset_t v;
-        switch (_NSIG_WORDS) {
-        case 4: v.sig[7] = (set->sig[3] >> 32); v.sig[6] = set->sig[3];
-        case 3: v.sig[5] = (set->sig[2] >> 32); v.sig[4] = set->sig[2];
-        case 2: v.sig[3] = (set->sig[1] >> 32); v.sig[2] = set->sig[1];
-        case 1: v.sig[1] = (set->sig[0] >> 32); v.sig[0] = set->sig[0];
-        }
-        return copy_to_user(compat, &v, size) ? -EFAULT : 0;
-#else
-        return copy_to_user(compat, set, size) ? -EFAULT : 0;
-#endif
-}
-
 #ifdef CONFIG_NUMA
 COMPAT_SYSCALL_DEFINE6(move_pages, pid_t, pid, compat_ulong_t, nr_pages,
                        compat_uptr_t __user *, pages32,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 96db9ae5d5af..4b838470fac4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2246,7 +2246,7 @@ static void ctx_resched(struct perf_cpu_context *cpuctx,
                         struct perf_event_context *task_ctx,
                         enum event_type_t event_type)
 {
-        enum event_type_t ctx_event_type = event_type & EVENT_ALL;
+        enum event_type_t ctx_event_type;
         bool cpu_event = !!(event_type & EVENT_CPU);
 
         /*
@@ -2256,6 +2256,8 @@ static void ctx_resched(struct perf_cpu_context *cpuctx,
         if (event_type & EVENT_PINNED)
                 event_type |= EVENT_FLEXIBLE;
 
+        ctx_event_type = event_type & EVENT_ALL;
+
         perf_pmu_disable(cpuctx->ctx.pmu);
         if (task_ctx)
                 task_ctx_sched_out(cpuctx, task_ctx, event_type);
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 21b0122cb39c..1d5632d8bbcc 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -14,6 +14,15 @@
 
 static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs);
 
+static void fei_post_handler(struct kprobe *kp, struct pt_regs *regs,
+                             unsigned long flags)
+{
+        /*
+         * A dummy post handler is required to prohibit optimizing, because
+         * jump optimization does not support execution path overriding.
+         */
+}
+
 struct fei_attr {
         struct list_head list;
         struct kprobe kp;
@@ -56,6 +65,7 @@ static struct fei_attr *fei_attr_new(const char *sym, unsigned long addr)
                         return NULL;
                 }
                 attr->kp.pre_handler = fei_kprobe_handler;
+                attr->kp.post_handler = fei_post_handler;
                 attr->retval = adjust_error_retval(addr, 0);
                 INIT_LIST_HEAD(&attr->list);
         }
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index 52a0a7af8640..e7214093dcd1 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -373,7 +373,8 @@ static void __jump_label_update(struct static_key *key,
                         if (kernel_text_address(entry->code))
                                 arch_jump_label_transform(entry, jump_label_type(entry));
                         else
-                                WARN_ONCE(1, "can't patch jump_label at %pS", (void *)entry->code);
+                                WARN_ONCE(1, "can't patch jump_label at %pS",
+                                          (void *)(unsigned long)entry->code);
                 }
         }
 }
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 65cc0cb984e6..940633c63254 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1616,11 +1616,12 @@ bool __sched __rt_mutex_futex_unlock(struct rt_mutex *lock,
 void __sched rt_mutex_futex_unlock(struct rt_mutex *lock)
 {
         DEFINE_WAKE_Q(wake_q);
+        unsigned long flags;
         bool postunlock;
 
-        raw_spin_lock_irq(&lock->wait_lock);
+        raw_spin_lock_irqsave(&lock->wait_lock, flags);
         postunlock = __rt_mutex_futex_unlock(lock, &wake_q);
-        raw_spin_unlock_irq(&lock->wait_lock);
+        raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 
         if (postunlock)
                 rt_mutex_postunlock(&wake_q);
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 4dd4274cabe2..895e6b76b25e 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -427,7 +427,6 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
  err_pfn_remap:
  err_radix:
         pgmap_radix_release(res, pgoff);
-        devres_free(pgmap);
         return ERR_PTR(error);
 }
 EXPORT_SYMBOL(devm_memremap_pages);
diff --git a/kernel/module.c b/kernel/module.c
index ad2d420024f6..e42764acedb4 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -4228,7 +4228,7 @@ static int modules_open(struct inode *inode, struct file *file)
                 m->private = kallsyms_show_value() ? NULL : (void *)8ul;
         }
 
-        return 0;
+        return err;
 }
 
 static const struct file_operations proc_modules_operations = {
diff --git a/kernel/panic.c b/kernel/panic.c
index 2cfef408fec9..4b794f1d8561 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -640,7 +640,7 @@ device_initcall(register_warn_debugfs);
  */
 __visible void __stack_chk_fail(void)
 {
-        panic("stack-protector: Kernel stack is corrupted in: %p\n",
+        panic("stack-protector: Kernel stack is corrupted in: %pB\n",
                 __builtin_return_address(0));
 }
 EXPORT_SYMBOL(__stack_chk_fail);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index e7c535eee0a6..c94895bc5a2c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6683,13 +6683,18 @@ static int tg_cfs_schedulable_down(struct task_group *tg, void *data)
                 parent_quota = parent_b->hierarchical_quota;
 
                 /*
-                 * Ensure max(child_quota) <= parent_quota, inherit when no
+                 * Ensure max(child_quota) <= parent_quota.  On cgroup2,
+                 * always take the min.  On cgroup1, only inherit when no
                  * limit is set:
                  */
-                if (quota == RUNTIME_INF)
-                        quota = parent_quota;
-                else if (parent_quota != RUNTIME_INF && quota > parent_quota)
-                        return -EINVAL;
+                if (cgroup_subsys_on_dfl(cpu_cgrp_subsys)) {
+                        quota = min(quota, parent_quota);
+                } else {
+                        if (quota == RUNTIME_INF)
+                                quota = parent_quota;
+                        else if (parent_quota != RUNTIME_INF && quota > parent_quota)
+                                return -EINVAL;
+                }
         }
         cfs_b->hierarchical_quota = quota;
 
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index c634e093951f..7f9691c86b6e 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -661,7 +661,41 @@ static const struct bpf_func_proto bpf_get_stackid_proto_tp = {
         .arg3_type      = ARG_ANYTHING,
 };
 
-BPF_CALL_3(bpf_perf_prog_read_value_tp, struct bpf_perf_event_data_kern *, ctx,
+static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
+{
+        switch (func_id) {
+        case BPF_FUNC_perf_event_output:
+                return &bpf_perf_event_output_proto_tp;
+        case BPF_FUNC_get_stackid:
+                return &bpf_get_stackid_proto_tp;
+        default:
+                return tracing_func_proto(func_id);
+        }
+}
+
+static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    struct bpf_insn_access_aux *info)
+{
+        if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
+                return false;
+        if (type != BPF_READ)
+                return false;
+        if (off % size != 0)
+                return false;
+
+        BUILD_BUG_ON(PERF_MAX_TRACE_SIZE % sizeof(__u64));
+        return true;
+}
+
+const struct bpf_verifier_ops tracepoint_verifier_ops = {
+        .get_func_proto  = tp_prog_func_proto,
+        .is_valid_access = tp_prog_is_valid_access,
+};
+
+const struct bpf_prog_ops tracepoint_prog_ops = {
+};
+
+BPF_CALL_3(bpf_perf_prog_read_value, struct bpf_perf_event_data_kern *, ctx,
            struct bpf_perf_event_value *, buf, u32, size)
 {
         int err = -EINVAL;
@@ -678,8 +712,8 @@ clear:
         return err;
 }
 
-static const struct bpf_func_proto bpf_perf_prog_read_value_proto_tp = {
-         .func           = bpf_perf_prog_read_value_tp,
+static const struct bpf_func_proto bpf_perf_prog_read_value_proto = {
+         .func           = bpf_perf_prog_read_value,
          .gpl_only       = true,
          .ret_type       = RET_INTEGER,
          .arg1_type      = ARG_PTR_TO_CTX,
@@ -687,7 +721,7 @@ static const struct bpf_func_proto bpf_perf_prog_read_value_proto_tp = {
          .arg3_type      = ARG_CONST_SIZE,
 };
 
-static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *pe_prog_func_proto(enum bpf_func_id func_id)
 {
         switch (func_id) {
         case BPF_FUNC_perf_event_output:
@@ -695,34 +729,12 @@ static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_get_stackid:
                 return &bpf_get_stackid_proto_tp;
         case BPF_FUNC_perf_prog_read_value:
-                return &bpf_perf_prog_read_value_proto_tp;
+                return &bpf_perf_prog_read_value_proto;
         default:
                 return tracing_func_proto(func_id);
         }
 }
 
-static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
-                                    struct bpf_insn_access_aux *info)
-{
-        if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
-                return false;
-        if (type != BPF_READ)
-                return false;
-        if (off % size != 0)
-                return false;
-
-        BUILD_BUG_ON(PERF_MAX_TRACE_SIZE % sizeof(__u64));
-        return true;
-}
-
-const struct bpf_verifier_ops tracepoint_verifier_ops = {
-        .get_func_proto  = tp_prog_func_proto,
-        .is_valid_access = tp_prog_is_valid_access,
-};
-
-const struct bpf_prog_ops tracepoint_prog_ops = {
-};
-
 static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
                                     struct bpf_insn_access_aux *info)
 {
@@ -791,7 +803,7 @@ static u32 pe_prog_convert_ctx_access(enum bpf_access_type type,
 }
 
 const struct bpf_verifier_ops perf_event_verifier_ops = {
-        .get_func_proto         = tp_prog_func_proto,
+        .get_func_proto         = pe_prog_func_proto,
         .is_valid_access        = pe_prog_is_valid_access,
         .convert_ctx_access     = pe_prog_convert_ctx_access,
 };
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index bb9a519cbf50..6ec6ba65127b 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3018,14 +3018,6 @@ static bool __cancel_work(struct work_struct *work, bool is_dwork)
         return ret;
 }
 
-/*
- * See cancel_delayed_work()
- */
-bool cancel_work(struct work_struct *work)
-{
-        return __cancel_work(work, false);
-}
-
 /**
  * cancel_delayed_work - cancel a delayed work
  * @dwork: delayed_work to cancel
@@ -5337,7 +5329,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
 
         ret = device_register(&wq_dev->dev);
         if (ret) {
-                kfree(wq_dev);
+                put_device(&wq_dev->dev);
                 wq->wq_dev = NULL;
                 return ret;
         }