9 files changed, 267 insertions, 122 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d1d3e8f57de9..2e7f7ab739e4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2082,7 +2082,7 @@ static void adjust_branches(struct bpf_prog *prog, int pos, int delta)
                 /* adjust offset of jmps if necessary */
                 if (i < pos && i + insn->off + 1 > pos)
                         insn->off += delta;
-                else if (i > pos && i + insn->off + 1 < pos)
+                else if (i > pos + delta && i + insn->off + 1 <= pos + delta)
                         insn->off -= delta;
         }
 }
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index c03a640ef6da..d27904c193da 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -58,6 +58,7 @@
 #include <linux/kthread.h>
 #include <linux/delay.h>
 #include <linux/atomic.h>
+#include <linux/cpuset.h>
 #include <net/sock.h>
 
 /*
@@ -2739,6 +2740,7 @@ out_unlock_rcu:
 out_unlock_threadgroup:
         percpu_up_write(&cgroup_threadgroup_rwsem);
         cgroup_kn_unlock(of->kn);
+        cpuset_post_attach_flush();
         return ret ?: nbytes;
 }
 
@@ -4655,14 +4657,15 @@ static void css_free_work_fn(struct work_struct *work)
 
         if (ss) {
                 /* css free path */
+                struct cgroup_subsys_state *parent = css->parent;
                 int id = css->id;
 
-                if (css->parent)
-                        css_put(css->parent);
-
                 ss->css_free(css);
                 cgroup_idr_remove(&ss->css_idr, id);
                 cgroup_put(cgrp);
+
+                if (parent)
+                        css_put(parent);
         } else {
                 /* cgroup free path */
                 atomic_dec(&cgrp->root->nr_cgrps);
@@ -4758,6 +4761,7 @@ static void init_and_link_css(struct cgroup_subsys_state *css,
         INIT_LIST_HEAD(&css->sibling);
         INIT_LIST_HEAD(&css->children);
         css->serial_nr = css_serial_nr_next++;
+        atomic_set(&css->online_cnt, 0);
 
         if (cgroup_parent(cgrp)) {
                 css->parent = cgroup_css(cgroup_parent(cgrp), ss);
@@ -4780,6 +4784,10 @@ static int online_css(struct cgroup_subsys_state *css)
         if (!ret) {
                 css->flags |= CSS_ONLINE;
                 rcu_assign_pointer(css->cgroup->subsys[ss->id], css);
+
+                atomic_inc(&css->online_cnt);
+                if (css->parent)
+                        atomic_inc(&css->parent->online_cnt);
         }
         return ret;
 }
@@ -5017,10 +5025,15 @@ static void css_killed_work_fn(struct work_struct *work)
                 container_of(work, struct cgroup_subsys_state, destroy_work);
 
         mutex_lock(&cgroup_mutex);
-        offline_css(css);
-        mutex_unlock(&cgroup_mutex);
 
-        css_put(css);
+        do {
+                offline_css(css);
+                css_put(css);
+                /* @css can't go away while we're holding cgroup_mutex */
+                css = css->parent;
+        } while (css && atomic_dec_and_test(&css->online_cnt));
+
+        mutex_unlock(&cgroup_mutex);
 }
 
 /* css kill confirmation processing requires process context, bounce */
@@ -5029,8 +5042,10 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
         struct cgroup_subsys_state *css =
                 container_of(ref, struct cgroup_subsys_state, refcnt);
 
-        INIT_WORK(&css->destroy_work, css_killed_work_fn);
-        queue_work(cgroup_destroy_wq, &css->destroy_work);
+        if (atomic_dec_and_test(&css->online_cnt)) {
+                INIT_WORK(&css->destroy_work, css_killed_work_fn);
+                queue_work(cgroup_destroy_wq, &css->destroy_work);
+        }
 }
 
 /**
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 3e945fcd8179..41989ab4db57 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -287,6 +287,8 @@ static struct cpuset top_cpuset = {
 static DEFINE_MUTEX(cpuset_mutex);
 static DEFINE_SPINLOCK(callback_lock);
 
+static struct workqueue_struct *cpuset_migrate_mm_wq;
+
 /*
  * CPU / memory hotplug is handled asynchronously.
  */
@@ -972,31 +974,51 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
 }
 
 /*
- * cpuset_migrate_mm
- *
- *    Migrate memory region from one set of nodes to another.
- *
- *    Temporarilly set tasks mems_allowed to target nodes of migration,
- *    so that the migration code can allocate pages on these nodes.
- *
- *    While the mm_struct we are migrating is typically from some
- *    other task, the task_struct mems_allowed that we are hacking
- *    is for our current task, which must allocate new pages for that
- *    migrating memory region.
+ * Migrate memory region from one set of nodes to another.  This is
+ * performed asynchronously as it can be called from process migration path
+ * holding locks involved in process management.  All mm migrations are
+ * performed in the queued order and can be waited for by flushing
+ * cpuset_migrate_mm_wq.
  */
 
+struct cpuset_migrate_mm_work {
+        struct work_struct      work;
+        struct mm_struct        *mm;
+        nodemask_t              from;
+        nodemask_t              to;
+};
+
+static void cpuset_migrate_mm_workfn(struct work_struct *work)
+{
+        struct cpuset_migrate_mm_work *mwork =
+                container_of(work, struct cpuset_migrate_mm_work, work);
+
+        /* on a wq worker, no need to worry about %current's mems_allowed */
+        do_migrate_pages(mwork->mm, &mwork->from, &mwork->to, MPOL_MF_MOVE_ALL);
+        mmput(mwork->mm);
+        kfree(mwork);
+}
+
 static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
                                                         const nodemask_t *to)
 {
-        struct task_struct *tsk = current;
-
-        tsk->mems_allowed = *to;
+        struct cpuset_migrate_mm_work *mwork;
 
-        do_migrate_pages(mm, from, to, MPOL_MF_MOVE_ALL);
+        mwork = kzalloc(sizeof(*mwork), GFP_KERNEL);
+        if (mwork) {
+                mwork->mm = mm;
+                mwork->from = *from;
+                mwork->to = *to;
+                INIT_WORK(&mwork->work, cpuset_migrate_mm_workfn);
+                queue_work(cpuset_migrate_mm_wq, &mwork->work);
+        } else {
+                mmput(mm);
+        }
+}
 
-        rcu_read_lock();
-        guarantee_online_mems(task_cs(tsk), &tsk->mems_allowed);
-        rcu_read_unlock();
+void cpuset_post_attach_flush(void)
+{
+        flush_workqueue(cpuset_migrate_mm_wq);
 }
 
 /*
@@ -1097,7 +1119,8 @@ static void update_tasks_nodemask(struct cpuset *cs)
                 mpol_rebind_mm(mm, &cs->mems_allowed);
                 if (migrate)
                         cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems);
-                mmput(mm);
+                else
+                        mmput(mm);
         }
         css_task_iter_end(&it);
 
@@ -1545,11 +1568,11 @@ static void cpuset_attach(struct cgroup_taskset *tset)
                          * @old_mems_allowed is the right nodesets that we
                          * migrate mm from.
                          */
-                        if (is_memory_migrate(cs)) {
+                        if (is_memory_migrate(cs))
                                 cpuset_migrate_mm(mm, &oldcs->old_mems_allowed,
                                                   &cpuset_attach_nodemask_to);
-                        }
-                        mmput(mm);
+                        else
+                                mmput(mm);
                 }
         }
 
@@ -1714,6 +1737,7 @@ out_unlock:
         mutex_unlock(&cpuset_mutex);
         kernfs_unbreak_active_protection(of->kn);
         css_put(&cs->css);
+        flush_workqueue(cpuset_migrate_mm_wq);
         return retval ?: nbytes;
 }
 
@@ -2359,6 +2383,9 @@ void __init cpuset_init_smp(void)
         top_cpuset.effective_mems = node_states[N_MEMORY];
 
         register_hotmemory_notifier(&cpuset_track_online_nodes_nb);
+
+        cpuset_migrate_mm_wq = alloc_ordered_workqueue("cpuset_migrate_mm", 0);
+        BUG_ON(!cpuset_migrate_mm_wq);
 }
 
 /**
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 60ace56618f6..716547fdb873 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -292,7 +292,7 @@ LIST_HEAD(all_lock_classes);
 #define __classhashfn(key)      hash_long((unsigned long)key, CLASSHASH_BITS)
 #define classhashentry(key)     (classhash_table + __classhashfn((key)))
 
-static struct list_head classhash_table[CLASSHASH_SIZE];
+static struct hlist_head classhash_table[CLASSHASH_SIZE];
 
 /*
  * We put the lock dependency chains into a hash-table as well, to cache
@@ -303,7 +303,7 @@ static struct list_head classhash_table[CLASSHASH_SIZE];
 #define __chainhashfn(chain)    hash_long(chain, CHAINHASH_BITS)
 #define chainhashentry(chain)   (chainhash_table + __chainhashfn((chain)))
 
-static struct list_head chainhash_table[CHAINHASH_SIZE];
+static struct hlist_head chainhash_table[CHAINHASH_SIZE];
 
 /*
  * The hash key of the lock dependency chains is a hash itself too:
@@ -666,7 +666,7 @@ static inline struct lock_class *
 look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
 {
         struct lockdep_subclass_key *key;
-        struct list_head *hash_head;
+        struct hlist_head *hash_head;
         struct lock_class *class;
 
 #ifdef CONFIG_DEBUG_LOCKDEP
@@ -719,7 +719,7 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
         if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
                 return NULL;
 
-        list_for_each_entry_rcu(class, hash_head, hash_entry) {
+        hlist_for_each_entry_rcu(class, hash_head, hash_entry) {
                 if (class->key == key) {
                         /*
                          * Huh! same key, different name? Did someone trample
@@ -742,7 +742,7 @@ static inline struct lock_class *
 register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
 {
         struct lockdep_subclass_key *key;
-        struct list_head *hash_head;
+        struct hlist_head *hash_head;
         struct lock_class *class;
 
         DEBUG_LOCKS_WARN_ON(!irqs_disabled());
@@ -774,7 +774,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
          * We have to do the hash-walk again, to avoid races
          * with another CPU:
          */
-        list_for_each_entry_rcu(class, hash_head, hash_entry) {
+        hlist_for_each_entry_rcu(class, hash_head, hash_entry) {
                 if (class->key == key)
                         goto out_unlock_set;
         }
@@ -805,7 +805,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
          * We use RCU's safe list-add method to make
          * parallel walking of the hash-list safe:
          */
-        list_add_tail_rcu(&class->hash_entry, hash_head);
+        hlist_add_head_rcu(&class->hash_entry, hash_head);
         /*
          * Add it to the global list of classes:
          */
@@ -1822,7 +1822,7 @@ check_deadlock(struct task_struct *curr, struct held_lock *next,
  */
 static int
 check_prev_add(struct task_struct *curr, struct held_lock *prev,
-               struct held_lock *next, int distance, int trylock_loop)
+               struct held_lock *next, int distance, int *stack_saved)
 {
         struct lock_list *entry;
         int ret;
@@ -1883,8 +1883,11 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
                 }
         }
 
-        if (!trylock_loop && !save_trace(&trace))
-                return 0;
+        if (!*stack_saved) {
+                if (!save_trace(&trace))
+                        return 0;
+                *stack_saved = 1;
+        }
 
         /*
          * Ok, all validations passed, add the new lock
@@ -1907,6 +1910,8 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
          * Debugging printouts:
          */
         if (verbose(hlock_class(prev)) || verbose(hlock_class(next))) {
+                /* We drop graph lock, so another thread can overwrite trace. */
+                *stack_saved = 0;
                 graph_unlock();
                 printk("\n new dependency: ");
                 print_lock_name(hlock_class(prev));
@@ -1929,7 +1934,7 @@ static int
 check_prevs_add(struct task_struct *curr, struct held_lock *next)
 {
         int depth = curr->lockdep_depth;
-        int trylock_loop = 0;
+        int stack_saved = 0;
         struct held_lock *hlock;
 
         /*
@@ -1956,7 +1961,7 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
                  */
                 if (hlock->read != 2 && hlock->check) {
                         if (!check_prev_add(curr, hlock, next,
-                                                distance, trylock_loop))
+                                                distance, &stack_saved))
                                 return 0;
                         /*
                          * Stop after the first non-trylock entry,
@@ -1979,7 +1984,6 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
                 if (curr->held_locks[depth].irq_context !=
                                 curr->held_locks[depth-1].irq_context)
                         break;
-                trylock_loop = 1;
         }
         return 1;
 out_bug:
@@ -2017,7 +2021,7 @@ static inline int lookup_chain_cache(struct task_struct *curr,
                                      u64 chain_key)
 {
         struct lock_class *class = hlock_class(hlock);
-        struct list_head *hash_head = chainhashentry(chain_key);
+        struct hlist_head *hash_head = chainhashentry(chain_key);
         struct lock_chain *chain;
         struct held_lock *hlock_curr;
         int i, j;
@@ -2033,7 +2037,7 @@ static inline int lookup_chain_cache(struct task_struct *curr,
          * We can walk it lock-free, because entries only get added
          * to the hash:
          */
-        list_for_each_entry_rcu(chain, hash_head, entry) {
+        hlist_for_each_entry_rcu(chain, hash_head, entry) {
                 if (chain->chain_key == chain_key) {
 cache_hit:
                         debug_atomic_inc(chain_lookup_hits);
@@ -2057,7 +2061,7 @@ cache_hit:
         /*
          * We have to walk the chain again locked - to avoid duplicates:
          */
-        list_for_each_entry(chain, hash_head, entry) {
+        hlist_for_each_entry(chain, hash_head, entry) {
                 if (chain->chain_key == chain_key) {
                         graph_unlock();
                         goto cache_hit;
@@ -2091,7 +2095,7 @@ cache_hit:
                 }
                 chain_hlocks[chain->base + j] = class - lock_classes;
         }
-        list_add_tail_rcu(&chain->entry, hash_head);
+        hlist_add_head_rcu(&chain->entry, hash_head);
         debug_atomic_inc(chain_lookup_misses);
         inc_chains();
 
@@ -3875,7 +3879,7 @@ void lockdep_reset(void)
         nr_process_chains = 0;
         debug_locks = 1;
         for (i = 0; i < CHAINHASH_SIZE; i++)
-                INIT_LIST_HEAD(chainhash_table + i);
+                INIT_HLIST_HEAD(chainhash_table + i);
         raw_local_irq_restore(flags);
 }
 
@@ -3894,7 +3898,7 @@ static void zap_class(struct lock_class *class)
         /*
          * Unhash the class and remove it from the all_lock_classes list:
          */
-        list_del_rcu(&class->hash_entry);
+        hlist_del_rcu(&class->hash_entry);
         list_del_rcu(&class->lock_entry);
 
         RCU_INIT_POINTER(class->key, NULL);
@@ -3917,7 +3921,7 @@ static inline int within(const void *addr, void *start, unsigned long size)
 void lockdep_free_key_range(void *start, unsigned long size)
 {
         struct lock_class *class;
-        struct list_head *head;
+        struct hlist_head *head;
         unsigned long flags;
         int i;
         int locked;
@@ -3930,9 +3934,7 @@ void lockdep_free_key_range(void *start, unsigned long size)
          */
         for (i = 0; i < CLASSHASH_SIZE; i++) {
                 head = classhash_table + i;
-                if (list_empty(head))
-                        continue;
-                list_for_each_entry_rcu(class, head, hash_entry) {
+                hlist_for_each_entry_rcu(class, head, hash_entry) {
                         if (within(class->key, start, size))
                                 zap_class(class);
                         else if (within(class->name, start, size))
@@ -3962,7 +3964,7 @@ void lockdep_free_key_range(void *start, unsigned long size)
 void lockdep_reset_lock(struct lockdep_map *lock)
 {
         struct lock_class *class;
-        struct list_head *head;
+        struct hlist_head *head;
         unsigned long flags;
         int i, j;
         int locked;
@@ -3987,9 +3989,7 @@ void lockdep_reset_lock(struct lockdep_map *lock)
         locked = graph_lock();
         for (i = 0; i < CLASSHASH_SIZE; i++) {
                 head = classhash_table + i;
-                if (list_empty(head))
-                        continue;
-                list_for_each_entry_rcu(class, head, hash_entry) {
+                hlist_for_each_entry_rcu(class, head, hash_entry) {
                         int match = 0;
 
                         for (j = 0; j < NR_LOCKDEP_CACHING_CLASSES; j++)
@@ -4027,10 +4027,10 @@ void lockdep_init(void)
                 return;
 
         for (i = 0; i < CLASSHASH_SIZE; i++)
-                INIT_LIST_HEAD(classhash_table + i);
+                INIT_HLIST_HEAD(classhash_table + i);
 
         for (i = 0; i < CHAINHASH_SIZE; i++)
-                INIT_LIST_HEAD(chainhash_table + i);
+                INIT_HLIST_HEAD(chainhash_table + i);
 
         lockdep_initialized = 1;
 }
diff --git a/kernel/memremap.c b/kernel/memremap.c
index e517a16cb426..2c468dea60bc 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -150,7 +150,7 @@ void devm_memunmap(struct device *dev, void *addr)
 }
 EXPORT_SYMBOL(devm_memunmap);
 
-pfn_t phys_to_pfn_t(dma_addr_t addr, unsigned long flags)
+pfn_t phys_to_pfn_t(phys_addr_t addr, u64 flags)
 {
         return __pfn_to_pfn_t(addr >> PAGE_SHIFT, flags);
 }
@@ -183,7 +183,11 @@ EXPORT_SYMBOL(put_zone_device_page);
 
 static void pgmap_radix_release(struct resource *res)
 {
-        resource_size_t key;
+        resource_size_t key, align_start, align_size, align_end;
+
+        align_start = res->start & ~(SECTION_SIZE - 1);
+        align_size = ALIGN(resource_size(res), SECTION_SIZE);
+        align_end = align_start + align_size - 1;
 
         mutex_lock(&pgmap_lock);
         for (key = res->start; key <= res->end; key += SECTION_SIZE)
@@ -226,12 +230,11 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
                 percpu_ref_put(pgmap->ref);
         }
 
-        pgmap_radix_release(res);
-
         /* pages are dead and unused, undo the arch mapping */
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(resource_size(res), SECTION_SIZE);
         arch_remove_memory(align_start, align_size);
+        pgmap_radix_release(res);
         dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc,
                         "%s: failed to free all reserved pages\n", __func__);
 }
@@ -267,7 +270,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
 {
         int is_ram = region_intersects(res->start, resource_size(res),
                         "System RAM");
-        resource_size_t key, align_start, align_size;
+        resource_size_t key, align_start, align_size, align_end;
         struct dev_pagemap *pgmap;
         struct page_map *page_map;
         unsigned long pfn;
@@ -309,7 +312,10 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
 
         mutex_lock(&pgmap_lock);
         error = 0;
-        for (key = res->start; key <= res->end; key += SECTION_SIZE) {
+        align_start = res->start & ~(SECTION_SIZE - 1);
+        align_size = ALIGN(resource_size(res), SECTION_SIZE);
+        align_end = align_start + align_size - 1;
+        for (key = align_start; key <= align_end; key += SECTION_SIZE) {
                 struct dev_pagemap *dup;
 
                 rcu_read_lock();
@@ -336,8 +342,6 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         if (nid < 0)
                 nid = numa_mem_id();
 
-        align_start = res->start & ~(SECTION_SIZE - 1);
-        align_size = ALIGN(resource_size(res), SECTION_SIZE);
         error = arch_add_memory(nid, align_start, align_size, true);
         if (error)
                 goto err_add_memory;
diff --git a/kernel/module.c b/kernel/module.c
index 8358f4697c0c..9537da37ce87 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -303,6 +303,9 @@ struct load_info {
         struct _ddebug *debug;
         unsigned int num_debug;
         bool sig_ok;
+#ifdef CONFIG_KALLSYMS
+        unsigned long mod_kallsyms_init_off;
+#endif
         struct {
                 unsigned int sym, str, mod, vers, info, pcpu;
         } index;
@@ -2480,10 +2483,21 @@ static void layout_symtab(struct module *mod, struct load_info *info)
         strsect->sh_flags |= SHF_ALLOC;
         strsect->sh_entsize = get_offset(mod, &mod->init_layout.size, strsect,
                                          info->index.str) | INIT_OFFSET_MASK;
-        mod->init_layout.size = debug_align(mod->init_layout.size);
         pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
+
+        /* We'll tack temporary mod_kallsyms on the end. */
+        mod->init_layout.size = ALIGN(mod->init_layout.size,
+                                      __alignof__(struct mod_kallsyms));
+        info->mod_kallsyms_init_off = mod->init_layout.size;
+        mod->init_layout.size += sizeof(struct mod_kallsyms);
+        mod->init_layout.size = debug_align(mod->init_layout.size);
 }
 
+/*
+ * We use the full symtab and strtab which layout_symtab arranged to
+ * be appended to the init section.  Later we switch to the cut-down
+ * core-only ones.
+ */
 static void add_kallsyms(struct module *mod, const struct load_info *info)
 {
         unsigned int i, ndst;
@@ -2492,29 +2506,34 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
         char *s;
         Elf_Shdr *symsec = &info->sechdrs[info->index.sym];
 
-        mod->symtab = (void *)symsec->sh_addr;
-        mod->num_symtab = symsec->sh_size / sizeof(Elf_Sym);
+        /* Set up to point into init section. */
+        mod->kallsyms = mod->init_layout.base + info->mod_kallsyms_init_off;
+
+        mod->kallsyms->symtab = (void *)symsec->sh_addr;
+        mod->kallsyms->num_symtab = symsec->sh_size / sizeof(Elf_Sym);
         /* Make sure we get permanent strtab: don't use info->strtab. */
-        mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
+        mod->kallsyms->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
 
         /* Set types up while we still have access to sections. */
-        for (i = 0; i < mod->num_symtab; i++)
-                mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
-
-        mod->core_symtab = dst = mod->core_layout.base + info->symoffs;
-        mod->core_strtab = s = mod->core_layout.base + info->stroffs;
-        src = mod->symtab;
-        for (ndst = i = 0; i < mod->num_symtab; i++) {
+        for (i = 0; i < mod->kallsyms->num_symtab; i++)
+                mod->kallsyms->symtab[i].st_info
+                        = elf_type(&mod->kallsyms->symtab[i], info);
+
+        /* Now populate the cut down core kallsyms for after init. */
+        mod->core_kallsyms.symtab = dst = mod->core_layout.base + info->symoffs;
+        mod->core_kallsyms.strtab = s = mod->core_layout.base + info->stroffs;
+        src = mod->kallsyms->symtab;
+        for (ndst = i = 0; i < mod->kallsyms->num_symtab; i++) {
                 if (i == 0 ||
                     is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum,
                                    info->index.pcpu)) {
                         dst[ndst] = src[i];
-                        dst[ndst++].st_name = s - mod->core_strtab;
-                        s += strlcpy(s, &mod->strtab[src[i].st_name],
+                        dst[ndst++].st_name = s - mod->core_kallsyms.strtab;
+                        s += strlcpy(s, &mod->kallsyms->strtab[src[i].st_name],
                                      KSYM_NAME_LEN) + 1;
                 }
         }
-        mod->core_num_syms = ndst;
+        mod->core_kallsyms.num_symtab = ndst;
 }
 #else
 static inline void layout_symtab(struct module *mod, struct load_info *info)
@@ -3263,9 +3282,8 @@ static noinline int do_init_module(struct module *mod)
         module_put(mod);
         trim_init_extable(mod);
 #ifdef CONFIG_KALLSYMS
-        mod->num_symtab = mod->core_num_syms;
-        mod->symtab = mod->core_symtab;
-        mod->strtab = mod->core_strtab;
+        /* Switch to core kallsyms now init is done: kallsyms may be walking! */
+        rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);
 #endif
         mod_tree_remove_init(mod);
         disable_ro_nx(&mod->init_layout);
@@ -3496,7 +3514,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
 
         /* Module is ready to execute: parsing args may do that. */
         after_dashes = parse_args(mod->name, mod->args, mod->kp, mod->num_kp,
-                                  -32768, 32767, NULL,
+                                  -32768, 32767, mod,
                                   unknown_module_param_cb);
         if (IS_ERR(after_dashes)) {
                 err = PTR_ERR(after_dashes);
@@ -3627,6 +3645,11 @@ static inline int is_arm_mapping_symbol(const char *str)
                && (str[2] == '\0' || str[2] == '.');
 }
 
+static const char *symname(struct mod_kallsyms *kallsyms, unsigned int symnum)
+{
+        return kallsyms->strtab + kallsyms->symtab[symnum].st_name;
+}
+
 static const char *get_ksymbol(struct module *mod,
                                unsigned long addr,
                                unsigned long *size,
@@ -3634,6 +3657,7 @@ static const char *get_ksymbol(struct module *mod,
 {
         unsigned int i, best = 0;
         unsigned long nextval;
+        struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms);
 
         /* At worse, next value is at end of module */
         if (within_module_init(addr, mod))
@@ -3643,32 +3667,32 @@ static const char *get_ksymbol(struct module *mod,
 
         /* Scan for closest preceding symbol, and next symbol. (ELF
            starts real symbols at 1). */
-        for (i = 1; i < mod->num_symtab; i++) {
-                if (mod->symtab[i].st_shndx == SHN_UNDEF)
+        for (i = 1; i < kallsyms->num_symtab; i++) {
+                if (kallsyms->symtab[i].st_shndx == SHN_UNDEF)
                         continue;
 
                 /* We ignore unnamed symbols: they're uninformative
                  * and inserted at a whim. */
-                if (mod->symtab[i].st_value <= addr
-                    && mod->symtab[i].st_value > mod->symtab[best].st_value
-                    && *(mod->strtab + mod->symtab[i].st_name) != '\0'
-                    && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name))
+                if (*symname(kallsyms, i) == '\0'
+                    || is_arm_mapping_symbol(symname(kallsyms, i)))
+                        continue;
+
+                if (kallsyms->symtab[i].st_value <= addr
+                    && kallsyms->symtab[i].st_value > kallsyms->symtab[best].st_value)
                         best = i;
-                if (mod->symtab[i].st_value > addr
-                    && mod->symtab[i].st_value < nextval
-                    && *(mod->strtab + mod->symtab[i].st_name) != '\0'
-                    && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name))
-                        nextval = mod->symtab[i].st_value;
+                if (kallsyms->symtab[i].st_value > addr
+                    && kallsyms->symtab[i].st_value < nextval)
+                        nextval = kallsyms->symtab[i].st_value;
         }
 
         if (!best)
                 return NULL;
 
         if (size)
-                *size = nextval - mod->symtab[best].st_value;
+                *size = nextval - kallsyms->symtab[best].st_value;
         if (offset)
-                *offset = addr - mod->symtab[best].st_value;
-        return mod->strtab + mod->symtab[best].st_name;
+                *offset = addr - kallsyms->symtab[best].st_value;
+        return symname(kallsyms, best);
 }
 
 /* For kallsyms to ask for address resolution.  NULL means not found.  Careful
@@ -3758,19 +3782,21 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
 
         preempt_disable();
         list_for_each_entry_rcu(mod, &modules, list) {
+                struct mod_kallsyms *kallsyms;
+
                 if (mod->state == MODULE_STATE_UNFORMED)
                         continue;
-                if (symnum < mod->num_symtab) {
-                        *value = mod->symtab[symnum].st_value;
-                        *type = mod->symtab[symnum].st_info;
-                        strlcpy(name, mod->strtab + mod->symtab[symnum].st_name,
-                                KSYM_NAME_LEN);
+                kallsyms = rcu_dereference_sched(mod->kallsyms);
+                if (symnum < kallsyms->num_symtab) {
+                        *value = kallsyms->symtab[symnum].st_value;
+                        *type = kallsyms->symtab[symnum].st_info;
+                        strlcpy(name, symname(kallsyms, symnum), KSYM_NAME_LEN);
                         strlcpy(module_name, mod->name, MODULE_NAME_LEN);
                         *exported = is_exported(name, *value, mod);
                         preempt_enable();
                         return 0;
                 }
-                symnum -= mod->num_symtab;
+                symnum -= kallsyms->num_symtab;
         }
         preempt_enable();
         return -ERANGE;
@@ -3779,11 +3805,12 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
 static unsigned long mod_find_symname(struct module *mod, const char *name)
 {
         unsigned int i;
+        struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms);
 
-        for (i = 0; i < mod->num_symtab; i++)
-                if (strcmp(name, mod->strtab+mod->symtab[i].st_name) == 0 &&
-                    mod->symtab[i].st_info != 'U')
-                        return mod->symtab[i].st_value;
+        for (i = 0; i < kallsyms->num_symtab; i++)
+                if (strcmp(name, symname(kallsyms, i)) == 0 &&
+                    kallsyms->symtab[i].st_info != 'U')
+                        return kallsyms->symtab[i].st_value;
         return 0;
 }
 
@@ -3822,11 +3849,14 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
         module_assert_mutex();
 
         list_for_each_entry(mod, &modules, list) {
+                /* We hold module_mutex: no need for rcu_dereference_sched */
+                struct mod_kallsyms *kallsyms = mod->kallsyms;
+
                 if (mod->state == MODULE_STATE_UNFORMED)
                         continue;
-                for (i = 0; i < mod->num_symtab; i++) {
-                        ret = fn(data, mod->strtab + mod->symtab[i].st_name,
-                                 mod, mod->symtab[i].st_value);
+                for (i = 0; i < kallsyms->num_symtab; i++) {
+                        ret = fn(data, symname(kallsyms, i),
+                                 mod, kallsyms->symtab[i].st_value);
                         if (ret != 0)
                                 return ret;
                 }
diff --git a/kernel/signal.c b/kernel/signal.c
index f3f1f7a972fd..0508544c8ced 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3508,8 +3508,10 @@ static int sigsuspend(sigset_t *set)
         current->saved_sigmask = current->blocked;
         set_current_blocked(set);
 
-        __set_current_state(TASK_INTERRUPTIBLE);
-        schedule();
+        while (!signal_pending(current)) {
+                __set_current_state(TASK_INTERRUPTIBLE);
+                schedule();
+        }
         set_restore_sigmask();
         return -ERESTARTNOHAND;
 }
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index dda9e6742950..202df6cffcca 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -126,6 +126,13 @@ check_stack(unsigned long ip, unsigned long *stack)
         }
 
         /*
+         * Some archs may not have the passed in ip in the dump.
+         * If that happens, we need to show everything.
+         */
+        if (i == stack_trace_max.nr_entries)
+                i = 0;
+
+        /*
          * Now find where in the stack these are.
          */
         x = 0;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 61a0264e28f9..7ff5dc7d2ac5 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -301,7 +301,23 @@ static DEFINE_SPINLOCK(wq_mayday_lock);	/* protects wq->maydays list */
 static LIST_HEAD(workqueues);           /* PR: list of all workqueues */
 static bool workqueue_freezing;         /* PL: have wqs started freezing? */
 
-static cpumask_var_t wq_unbound_cpumask; /* PL: low level cpumask for all unbound wqs */
+/* PL: allowable cpus for unbound wqs and work items */
+static cpumask_var_t wq_unbound_cpumask;
+
+/* CPU where unbound work was last round robin scheduled from this CPU */
+static DEFINE_PER_CPU(int, wq_rr_cpu_last);
+
+/*
+ * Local execution of unbound work items is no longer guaranteed.  The
+ * following always forces round-robin CPU selection on unbound work items
+ * to uncover usages which depend on it.
+ */
+#ifdef CONFIG_DEBUG_WQ_FORCE_RR_CPU
+static bool wq_debug_force_rr_cpu = true;
+#else
+static bool wq_debug_force_rr_cpu = false;
+#endif
+module_param_named(debug_force_rr_cpu, wq_debug_force_rr_cpu, bool, 0644);
 
 /* the per-cpu worker pools */
 static DEFINE_PER_CPU_SHARED_ALIGNED(struct worker_pool [NR_STD_WORKER_POOLS],
@@ -570,6 +586,16 @@ static struct pool_workqueue *unbound_pwq_by_node(struct workqueue_struct *wq,
                                                   int node)
 {
         assert_rcu_or_wq_mutex_or_pool_mutex(wq);
+
+        /*
+         * XXX: @node can be NUMA_NO_NODE if CPU goes offline while a
+         * delayed item is pending.  The plan is to keep CPU -> NODE
+         * mapping valid and stable across CPU on/offlines.  Once that
+         * happens, this workaround can be removed.
+         */
+        if (unlikely(node == NUMA_NO_NODE))
+                return wq->dfl_pwq;
+
         return rcu_dereference_raw(wq->numa_pwq_tbl[node]);
 }
 
@@ -1298,6 +1324,39 @@ static bool is_chained_work(struct workqueue_struct *wq)
         return worker && worker->current_pwq->wq == wq;
 }
 
+/*
+ * When queueing an unbound work item to a wq, prefer local CPU if allowed
+ * by wq_unbound_cpumask.  Otherwise, round robin among the allowed ones to
+ * avoid perturbing sensitive tasks.
+ */
+static int wq_select_unbound_cpu(int cpu)
+{
+        static bool printed_dbg_warning;
+        int new_cpu;
+
+        if (likely(!wq_debug_force_rr_cpu)) {
+                if (cpumask_test_cpu(cpu, wq_unbound_cpumask))
+                        return cpu;
+        } else if (!printed_dbg_warning) {
+                pr_warn("workqueue: round-robin CPU selection forced, expect performance impact\n");
+                printed_dbg_warning = true;
+        }
+
+        if (cpumask_empty(wq_unbound_cpumask))
+                return cpu;
+
+        new_cpu = __this_cpu_read(wq_rr_cpu_last);
+        new_cpu = cpumask_next_and(new_cpu, wq_unbound_cpumask, cpu_online_mask);
+        if (unlikely(new_cpu >= nr_cpu_ids)) {
+                new_cpu = cpumask_first_and(wq_unbound_cpumask, cpu_online_mask);
+                if (unlikely(new_cpu >= nr_cpu_ids))
+                        return cpu;
+        }
+        __this_cpu_write(wq_rr_cpu_last, new_cpu);
+
+        return new_cpu;
+}
+
 static void __queue_work(int cpu, struct workqueue_struct *wq,
                          struct work_struct *work)
 {
@@ -1323,7 +1382,7 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
                 return;
 retry:
         if (req_cpu == WORK_CPU_UNBOUND)
-                cpu = raw_smp_processor_id();
+                cpu = wq_select_unbound_cpu(raw_smp_processor_id());
 
         /* pwq which will be used unless @work is executing elsewhere */
         if (!(wq->flags & WQ_UNBOUND))
@@ -1464,13 +1523,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
         timer_stats_timer_set_start_info(&dwork->timer);
 
         dwork->wq = wq;
-        /* timer isn't guaranteed to run in this cpu, record earlier */
-        if (cpu == WORK_CPU_UNBOUND)
-                cpu = raw_smp_processor_id();
         dwork->cpu = cpu;
         timer->expires = jiffies + delay;
 
-        add_timer_on(timer, cpu);
+        if (unlikely(cpu != WORK_CPU_UNBOUND))
+                add_timer_on(timer, cpu);
+        else
+                add_timer(timer);
 }
 
 /**
@@ -2355,7 +2414,8 @@ static void check_flush_dependency(struct workqueue_struct *target_wq,
         WARN_ONCE(current->flags & PF_MEMALLOC,
                   "workqueue: PF_MEMALLOC task %d(%s) is flushing !WQ_MEM_RECLAIM %s:%pf",
                   current->pid, current->comm, target_wq->name, target_func);
-        WARN_ONCE(worker && (worker->current_pwq->wq->flags & WQ_MEM_RECLAIM),
+        WARN_ONCE(worker && ((worker->current_pwq->wq->flags &
+                              (WQ_MEM_RECLAIM | __WQ_LEGACY)) == WQ_MEM_RECLAIM),
                   "workqueue: WQ_MEM_RECLAIM %s:%pf is flushing !WQ_MEM_RECLAIM %s:%pf",
                   worker->current_pwq->wq->name, worker->current_func,
                   target_wq->name, target_func);