8 files changed, 54 insertions, 32 deletions

diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index 9a7b487c6fe2..fe8a916507ed 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -111,14 +111,16 @@ static unsigned int max_task_bp_pinned(int cpu, enum bp_type_idx type)
  * Count the number of breakpoints of the same type and same task.
  * The given event must be not on the list.
  */
-static int task_bp_pinned(struct perf_event *bp, enum bp_type_idx type)
+static int task_bp_pinned(int cpu, struct perf_event *bp, enum bp_type_idx type)
 {
         struct task_struct *tsk = bp->hw.bp_target;
         struct perf_event *iter;
         int count = 0;
 
         list_for_each_entry(iter, &bp_task_head, hw.bp_list) {
-                if (iter->hw.bp_target == tsk && find_slot_idx(iter) == type)
+                if (iter->hw.bp_target == tsk &&
+                    find_slot_idx(iter) == type &&
+                    cpu == iter->cpu)
                         count += hw_breakpoint_weight(iter);
         }
 
@@ -141,7 +143,7 @@ fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp,
                 if (!tsk)
                         slots->pinned += max_task_bp_pinned(cpu, type);
                 else
-                        slots->pinned += task_bp_pinned(bp, type);
+                        slots->pinned += task_bp_pinned(cpu, bp, type);
                 slots->flexible = per_cpu(nr_bp_flexible[type], cpu);
 
                 return;
@@ -154,7 +156,7 @@ fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp,
                 if (!tsk)
                         nr += max_task_bp_pinned(cpu, type);
                 else
-                        nr += task_bp_pinned(bp, type);
+                        nr += task_bp_pinned(cpu, bp, type);
 
                 if (nr > slots->pinned)
                         slots->pinned = nr;
@@ -188,7 +190,7 @@ static void toggle_bp_task_slot(struct perf_event *bp, int cpu, bool enable,
         int old_idx = 0;
         int idx = 0;
 
-        old_count = task_bp_pinned(bp, type);
+        old_count = task_bp_pinned(cpu, bp, type);
         old_idx = old_count - 1;
         idx = old_idx + weight;
 
diff --git a/kernel/futex.c b/kernel/futex.c
index 20ef219bbe9b..19eb089ca003 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -843,6 +843,9 @@ static void wake_futex(struct futex_q *q)
 {
         struct task_struct *p = q->task;
 
+        if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
+                return;
+
         /*
          * We set q->lock_ptr = NULL _before_ we wake up the task. If
          * a non-futex wake up happens on another CPU then the task
@@ -1078,6 +1081,10 @@ retry_private:
 
         plist_for_each_entry_safe(this, next, head, list) {
                 if (match_futex (&this->key, &key1)) {
+                        if (this->pi_state || this->rt_waiter) {
+                                ret = -EINVAL;
+                                goto out_unlock;
+                        }
                         wake_futex(this);
                         if (++ret >= nr_wake)
                                 break;
@@ -1090,6 +1097,10 @@ retry_private:
                 op_ret = 0;
                 plist_for_each_entry_safe(this, next, head, list) {
                         if (match_futex (&this->key, &key2)) {
+                                if (this->pi_state || this->rt_waiter) {
+                                        ret = -EINVAL;
+                                        goto out_unlock;
+                                }
                                 wake_futex(this);
                                 if (++op_ret >= nr_wake2)
                                         break;
@@ -1098,6 +1109,7 @@ retry_private:
                 ret += op_ret;
         }
 
+out_unlock:
         double_unlock_hb(hb1, hb2);
 out_put_keys:
         put_futex_key(&key2);
@@ -1387,9 +1399,13 @@ retry_private:
                 /*
                  * FUTEX_WAIT_REQEUE_PI and FUTEX_CMP_REQUEUE_PI should always
                  * be paired with each other and no other futex ops.
+                 *
+                 * We should never be requeueing a futex_q with a pi_state,
+                 * which is awaiting a futex_unlock_pi().
                  */
                 if ((requeue_pi && !this->rt_waiter) ||
-                    (!requeue_pi && this->rt_waiter)) {
+                    (!requeue_pi && this->rt_waiter) ||
+                    this->pi_state) {
                         ret = -EINVAL;
                         break;
                 }
diff --git a/kernel/modsign_pubkey.c b/kernel/modsign_pubkey.c
index 4646eb2c3820..767e559dfb10 100644
--- a/kernel/modsign_pubkey.c
+++ b/kernel/modsign_pubkey.c
@@ -21,10 +21,10 @@ struct key *modsign_keyring;
 extern __initdata const u8 modsign_certificate_list[];
 extern __initdata const u8 modsign_certificate_list_end[];
 asm(".section .init.data,\"aw\"\n"
-    "modsign_certificate_list:\n"
+    SYMBOL_PREFIX "modsign_certificate_list:\n"
     ".incbin \"signing_key.x509\"\n"
     ".incbin \"extra_certificates\"\n"
-    "modsign_certificate_list_end:"
+    SYMBOL_PREFIX "modsign_certificate_list_end:"
     );
 
 /*
diff --git a/kernel/module_signing.c b/kernel/module_signing.c
index ea1b1df5dbb0..f2970bddc5ea 100644
--- a/kernel/module_signing.c
+++ b/kernel/module_signing.c
@@ -27,13 +27,13 @@
  *      - Information block
  */
 struct module_signature {
-        enum pkey_algo          algo : 8;       /* Public-key crypto algorithm */
-        enum pkey_hash_algo     hash : 8;       /* Digest algorithm */
-        enum pkey_id_type       id_type : 8;    /* Key identifier type */
-        u8                      signer_len;     /* Length of signer's name */
-        u8                      key_id_len;     /* Length of key identifier */
-        u8                      __pad[3];
-        __be32                  sig_len;        /* Length of signature data */
+        u8      algo;           /* Public-key crypto algorithm [enum pkey_algo] */
+        u8      hash;           /* Digest algorithm [enum pkey_hash_algo] */
+        u8      id_type;        /* Key identifier type [enum pkey_id_type] */
+        u8      signer_len;     /* Length of signer's name */
+        u8      key_id_len;     /* Length of key identifier */
+        u8      __pad[3];
+        __be32  sig_len;        /* Length of signature data */
 };
 
 /*
diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
index 0984a21076a3..15f60d01198b 100644
--- a/kernel/sched/auto_group.c
+++ b/kernel/sched/auto_group.c
@@ -143,15 +143,11 @@ autogroup_move_group(struct task_struct *p, struct autogroup *ag)
 
         p->signal->autogroup = autogroup_kref_get(ag);
 
-        if (!ACCESS_ONCE(sysctl_sched_autogroup_enabled))
-                goto out;
-
         t = p;
         do {
                 sched_move_task(t);
         } while_each_thread(p, t);
 
-out:
         unlock_task_sighand(p, &flags);
         autogroup_kref_put(prev);
 }
diff --git a/kernel/sched/auto_group.h b/kernel/sched/auto_group.h
index 8bd047142816..443232ebbb53 100644
--- a/kernel/sched/auto_group.h
+++ b/kernel/sched/auto_group.h
@@ -4,11 +4,6 @@
 #include <linux/rwsem.h>
 
 struct autogroup {
-        /*
-         * reference doesn't mean how many thread attach to this
-         * autogroup now. It just stands for the number of task
-         * could use this autogroup.
-         */
         struct kref             kref;
         struct task_group       *tg;
         struct rw_semaphore     lock;
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 9d4c8d5a1f53..c8c21be11ab4 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -116,7 +116,7 @@ static unsigned long get_timestamp(int this_cpu)
         return cpu_clock(this_cpu) >> 30LL;  /* 2^30 ~= 10^9 */
 }
 
-static unsigned long get_sample_period(void)
+static u64 get_sample_period(void)
 {
         /*
          * convert watchdog_thresh from seconds to ns
@@ -125,7 +125,7 @@ static unsigned long get_sample_period(void)
          * and hard thresholds) to increment before the
          * hardlockup detector generates a warning
          */
-        return get_softlockup_thresh() * (NSEC_PER_SEC / 5);
+        return get_softlockup_thresh() * ((u64)NSEC_PER_SEC / 5);
 }
 
 /* Commands for resetting the watchdog */
@@ -368,6 +368,9 @@ static void watchdog_disable(unsigned int cpu)
 {
         struct hrtimer *hrtimer = &__raw_get_cpu_var(watchdog_hrtimer);
 
+        if (!watchdog_enabled)
+                return;
+
         watchdog_set_prio(SCHED_NORMAL, 0);
         hrtimer_cancel(hrtimer);
         /* disable the perf event */
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 042d221d33cc..1dae900df798 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1361,8 +1361,19 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
 
         WARN_ON_ONCE(timer->function != delayed_work_timer_fn ||
                      timer->data != (unsigned long)dwork);
-        BUG_ON(timer_pending(timer));
-        BUG_ON(!list_empty(&work->entry));
+        WARN_ON_ONCE(timer_pending(timer));
+        WARN_ON_ONCE(!list_empty(&work->entry));
+
+        /*
+         * If @delay is 0, queue @dwork->work immediately.  This is for
+         * both optimization and correctness.  The earliest @timer can
+         * expire is on the closest next tick and delayed_work users depend
+         * on that there's no such delay when @delay is 0.
+         */
+        if (!delay) {
+                __queue_work(cpu, wq, &dwork->work);
+                return;
+        }
 
         timer_stats_timer_set_start_info(&dwork->timer);
 
@@ -1417,9 +1428,6 @@ bool queue_delayed_work_on(int cpu, struct workqueue_struct *wq,
         bool ret = false;
         unsigned long flags;
 
-        if (!delay)
-                return queue_work_on(cpu, wq, &dwork->work);
-
         /* read the comment in __queue_work() */
         local_irq_save(flags);
 
@@ -2407,8 +2415,10 @@ static int rescuer_thread(void *__wq)
 repeat:
         set_current_state(TASK_INTERRUPTIBLE);
 
-        if (kthread_should_stop())
+        if (kthread_should_stop()) {
+                __set_current_state(TASK_RUNNING);
                 return 0;
+        }
 
         /*
          * See whether any cpu is asking for help.  Unbounded