5 files changed, 74 insertions, 30 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index eb9e9a7870fa..acedbe626d47 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -716,6 +716,19 @@ source "lib/Kconfig.kmemcheck"
 
 source "lib/Kconfig.kasan"
 
+config DEBUG_REFCOUNT
+        bool "Verbose refcount checks"
+        help
+          Say Y here if you want reference counters (refcount_t and kref) to
+          generate WARNs on dubious usage. Without this refcount_t will still
+          be a saturating counter and avoid Use-After-Free by turning it into
+          a resource leak Denial-Of-Service.
+
+          Use of this option will increase kernel text size but will alert the
+          admin of potential abuse.
+
+          If in doubt, say "N".
+
 endmenu # "Memory Debugging"
 
 config ARCH_HAS_KCOV
@@ -980,20 +993,6 @@ config DEBUG_TIMEKEEPING
 
           If unsure, say N.
 
-config TIMER_STATS
-        bool "Collect kernel timers statistics"
-        depends on DEBUG_KERNEL && PROC_FS
-        help
-          If you say Y here, additional code will be inserted into the
-          timer routines to collect statistics about kernel timers being
-          reprogrammed. The statistics can be read from /proc/timer_stats.
-          The statistics collection is started by writing 1 to /proc/timer_stats,
-          writing 0 stops it. This feature is useful to collect information
-          about timer usage patterns in kernel and userspace. This feature
-          is lightweight if enabled in the kernel config but not activated
-          (it defaults to deactivated on bootup and will only be activated
-          if some application like powertop activates it explicitly).
-
 config DEBUG_PREEMPT
         bool "Debug preemptible kernel"
         depends on DEBUG_KERNEL && PREEMPT && TRACE_IRQFLAGS_SUPPORT
@@ -1180,6 +1179,18 @@ config LOCK_TORTURE_TEST
           Say M if you want these torture tests to build as a module.
           Say N if you are unsure.
 
+config WW_MUTEX_SELFTEST
+        tristate "Wait/wound mutex selftests"
+        help
+          This option provides a kernel module that runs tests on the
+          on the struct ww_mutex locking API.
+
+          It is recommended to enable DEBUG_WW_MUTEX_SLOWPATH in conjunction
+          with this test harness.
+
+          Say M if you want these self tests to build as a module.
+          Say N if you are unsure.
+
 endmenu # lock debugging
 
 config TRACE_IRQFLAGS
@@ -1450,6 +1461,7 @@ config RCU_CPU_STALL_TIMEOUT
 config RCU_TRACE
         bool "Enable tracing for RCU"
         depends on DEBUG_KERNEL
+        default y if TREE_RCU
         select TRACE_CLOCK
         help
           This option provides tracing in RCU which presents stats
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 04c1ef717fe0..8c28cbd7e104 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -52,9 +52,18 @@ static int			debug_objects_fixups __read_mostly;
 static int                      debug_objects_warnings __read_mostly;
 static int                      debug_objects_enabled __read_mostly
                                 = CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT;
-
+static int                      debug_objects_pool_size __read_mostly
+                                = ODEBUG_POOL_SIZE;
+static int                      debug_objects_pool_min_level __read_mostly
+                                = ODEBUG_POOL_MIN_LEVEL;
 static struct debug_obj_descr   *descr_test  __read_mostly;
 
+/*
+ * Track numbers of kmem_cache_alloc()/free() calls done.
+ */
+static int                      debug_objects_allocated;
+static int                      debug_objects_freed;
+
 static void free_obj_work(struct work_struct *work);
 static DECLARE_WORK(debug_obj_work, free_obj_work);
 
@@ -88,13 +97,13 @@ static void fill_pool(void)
         struct debug_obj *new;
         unsigned long flags;
 
-        if (likely(obj_pool_free >= ODEBUG_POOL_MIN_LEVEL))
+        if (likely(obj_pool_free >= debug_objects_pool_min_level))
                 return;
 
         if (unlikely(!obj_cache))
                 return;
 
-        while (obj_pool_free < ODEBUG_POOL_MIN_LEVEL) {
+        while (obj_pool_free < debug_objects_pool_min_level) {
 
                 new = kmem_cache_zalloc(obj_cache, gfp);
                 if (!new)
@@ -102,6 +111,7 @@ static void fill_pool(void)
 
                 raw_spin_lock_irqsave(&pool_lock, flags);
                 hlist_add_head(&new->node, &obj_pool);
+                debug_objects_allocated++;
                 obj_pool_free++;
                 raw_spin_unlock_irqrestore(&pool_lock, flags);
         }
@@ -162,24 +172,39 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
 
 /*
  * workqueue function to free objects.
+ *
+ * To reduce contention on the global pool_lock, the actual freeing of
+ * debug objects will be delayed if the pool_lock is busy. We also free
+ * the objects in a batch of 4 for each lock/unlock cycle.
  */
+#define ODEBUG_FREE_BATCH       4
+
 static void free_obj_work(struct work_struct *work)
 {
-        struct debug_obj *obj;
+        struct debug_obj *objs[ODEBUG_FREE_BATCH];
         unsigned long flags;
+        int i;
 
-        raw_spin_lock_irqsave(&pool_lock, flags);
-        while (obj_pool_free > ODEBUG_POOL_SIZE) {
-                obj = hlist_entry(obj_pool.first, typeof(*obj), node);
-                hlist_del(&obj->node);
-                obj_pool_free--;
+        if (!raw_spin_trylock_irqsave(&pool_lock, flags))
+                return;
+        while (obj_pool_free >= debug_objects_pool_size + ODEBUG_FREE_BATCH) {
+                for (i = 0; i < ODEBUG_FREE_BATCH; i++) {
+                        objs[i] = hlist_entry(obj_pool.first,
+                                              typeof(*objs[0]), node);
+                        hlist_del(&objs[i]->node);
+                }
+
+                obj_pool_free -= ODEBUG_FREE_BATCH;
+                debug_objects_freed += ODEBUG_FREE_BATCH;
                 /*
                  * We release pool_lock across kmem_cache_free() to
                  * avoid contention on pool_lock.
                  */
                 raw_spin_unlock_irqrestore(&pool_lock, flags);
-                kmem_cache_free(obj_cache, obj);
-                raw_spin_lock_irqsave(&pool_lock, flags);
+                for (i = 0; i < ODEBUG_FREE_BATCH; i++)
+                        kmem_cache_free(obj_cache, objs[i]);
+                if (!raw_spin_trylock_irqsave(&pool_lock, flags))
+                        return;
         }
         raw_spin_unlock_irqrestore(&pool_lock, flags);
 }
@@ -198,7 +223,7 @@ static void free_object(struct debug_obj *obj)
          * schedule work when the pool is filled and the cache is
          * initialized:
          */
-        if (obj_pool_free > ODEBUG_POOL_SIZE && obj_cache)
+        if (obj_pool_free > debug_objects_pool_size && obj_cache)
                 sched = 1;
         hlist_add_head(&obj->node, &obj_pool);
         obj_pool_free++;
@@ -758,6 +783,8 @@ static int debug_stats_show(struct seq_file *m, void *v)
         seq_printf(m, "pool_min_free :%d\n", obj_pool_min_free);
         seq_printf(m, "pool_used     :%d\n", obj_pool_used);
         seq_printf(m, "pool_max_used :%d\n", obj_pool_max_used);
+        seq_printf(m, "objs_allocated:%d\n", debug_objects_allocated);
+        seq_printf(m, "objs_freed    :%d\n", debug_objects_freed);
         return 0;
 }
 
@@ -1116,4 +1143,11 @@ void __init debug_objects_mem_init(void)
                 pr_warn("out of memory.\n");
         } else
                 debug_objects_selftest();
+
+        /*
+         * Increase the thresholds for allocating and freeing objects
+         * according to the number of possible CPUs available in the system.
+         */
+        debug_objects_pool_size += num_possible_cpus() * 32;
+        debug_objects_pool_min_level += num_possible_cpus() * 4;
 }
diff --git a/lib/ioremap.c b/lib/ioremap.c
index 86c8911b0e3a..a3e14ce92a56 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -144,4 +144,3 @@ int ioremap_page_range(unsigned long addr,
 
         return err;
 }
-EXPORT_SYMBOL_GPL(ioremap_page_range);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 0b92d605fb69..84812a9fb16f 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -769,7 +769,7 @@ static void radix_tree_free_nodes(struct radix_tree_node *node)
                         struct radix_tree_node *old = child;
                         offset = child->offset + 1;
                         child = child->parent;
-                        WARN_ON_ONCE(!list_empty(&node->private_list));
+                        WARN_ON_ONCE(!list_empty(&old->private_list));
                         radix_tree_node_free(old);
                         if (old == entry_to_node(node))
                                 return;
diff --git a/lib/timerqueue.c b/lib/timerqueue.c
index adc6ee0a5126..4a720ed4fdaf 100644
--- a/lib/timerqueue.c
+++ b/lib/timerqueue.c
@@ -80,8 +80,7 @@ bool timerqueue_del(struct timerqueue_head *head, struct timerqueue_node *node)
         if (head->next == node) {
                 struct rb_node *rbn = rb_next(&node->node);
 
-                head->next = rbn ?
-                        rb_entry(rbn, struct timerqueue_node, node) : NULL;
+                head->next = rb_entry_safe(rbn, struct timerqueue_node, node);
         }
         rb_erase(&node->node, &head->head);
         RB_CLEAR_NODE(&node->node);