18 files changed, 196 insertions, 67 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index d9d5648f3cdc..a184470cf9b5 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2098,11 +2098,6 @@ int cgroup_attach_proc(struct cgroup *cgrp, struct task_struct *leader)
                         continue;
                 /* get old css_set pointer */
                 task_lock(tsk);
-                if (tsk->flags & PF_EXITING) {
-                        /* ignore this task if it's going away */
-                        task_unlock(tsk);
-                        continue;
-                }
                 oldcg = tsk->cgroups;
                 get_css_set(oldcg);
                 task_unlock(tsk);
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 9fe58c46a426..0b1712dba587 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -123,6 +123,19 @@ static inline struct cpuset *task_cs(struct task_struct *task)
                             struct cpuset, css);
 }
 
+#ifdef CONFIG_NUMA
+static inline bool task_has_mempolicy(struct task_struct *task)
+{
+        return task->mempolicy;
+}
+#else
+static inline bool task_has_mempolicy(struct task_struct *task)
+{
+        return false;
+}
+#endif
+
+
 /* bits in struct cpuset flags field */
 typedef enum {
         CS_CPU_EXCLUSIVE,
@@ -949,7 +962,7 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
 static void cpuset_change_task_nodemask(struct task_struct *tsk,
                                         nodemask_t *newmems)
 {
-        bool masks_disjoint = !nodes_intersects(*newmems, tsk->mems_allowed);
+        bool need_loop;
 
 repeat:
         /*
@@ -962,6 +975,14 @@ repeat:
                 return;
 
         task_lock(tsk);
+        /*
+         * Determine if a loop is necessary if another thread is doing
+         * get_mems_allowed().  If at least one node remains unchanged and
+         * tsk does not have a mempolicy, then an empty nodemask will not be
+         * possible when mems_allowed is larger than a word.
+         */
+        need_loop = task_has_mempolicy(tsk) ||
+                        !nodes_intersects(*newmems, tsk->mems_allowed);
         nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
         mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
 
@@ -981,11 +1002,9 @@ repeat:
 
         /*
          * Allocation of memory is very fast, we needn't sleep when waiting
-         * for the read-side.  No wait is necessary, however, if at least one
-         * node remains unchanged.
+         * for the read-side.
          */
-        while (masks_disjoint &&
-                        ACCESS_ONCE(tsk->mems_allowed_change_disable)) {
+        while (need_loop && ACCESS_ONCE(tsk->mems_allowed_change_disable)) {
                 task_unlock(tsk);
                 if (!task_curr(tsk))
                         yield();
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 923c6b5667db..fc0e7ff11dda 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3558,9 +3558,13 @@ static void ring_buffer_wakeup(struct perf_event *event)
 
         rcu_read_lock();
         rb = rcu_dereference(event->rb);
-        list_for_each_entry_rcu(event, &rb->event_list, rb_entry) {
+        if (!rb)
+                goto unlock;
+
+        list_for_each_entry_rcu(event, &rb->event_list, rb_entry)
                 wake_up_all(&event->waitq);
-        }
+
+unlock:
         rcu_read_unlock();
 }
 
diff --git a/kernel/exit.c b/kernel/exit.c
index d0b7d988f873..e6e01b959a0e 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1540,8 +1540,15 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
         }
 
         /* dead body doesn't have much to contribute */
-        if (p->exit_state == EXIT_DEAD)
+        if (unlikely(p->exit_state == EXIT_DEAD)) {
+                /*
+                 * But do not ignore this task until the tracer does
+                 * wait_task_zombie()->do_notify_parent().
+                 */
+                if (likely(!ptrace) && unlikely(ptrace_reparented(p)))
+                        wo->notask_error = 0;
                 return 0;
+        }
 
         /* slay zombie? */
         if (p->exit_state == EXIT_ZOMBIE) {
diff --git a/kernel/futex.c b/kernel/futex.c
index ea87f4d2f455..1614be20173d 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -314,17 +314,29 @@ again:
 #endif
 
         lock_page(page_head);
+
+        /*
+         * If page_head->mapping is NULL, then it cannot be a PageAnon
+         * page; but it might be the ZERO_PAGE or in the gate area or
+         * in a special mapping (all cases which we are happy to fail);
+         * or it may have been a good file page when get_user_pages_fast
+         * found it, but truncated or holepunched or subjected to
+         * invalidate_complete_page2 before we got the page lock (also
+         * cases which we are happy to fail).  And we hold a reference,
+         * so refcount care in invalidate_complete_page's remove_mapping
+         * prevents drop_caches from setting mapping to NULL beneath us.
+         *
+         * The case we do have to guard against is when memory pressure made
+         * shmem_writepage move it from filecache to swapcache beneath us:
+         * an unlikely race, but we do need to retry for page_head->mapping.
+         */
         if (!page_head->mapping) {
+                int shmem_swizzled = PageSwapCache(page_head);
                 unlock_page(page_head);
                 put_page(page_head);
-                /*
-                * ZERO_PAGE pages don't have a mapping. Avoid a busy loop
-                * trying to find one. RW mapping would have COW'd (and thus
-                * have a mapping) so this page is RO and won't ever change.
-                */
-                if ((page_head == ZERO_PAGE(address)))
-                        return -EFAULT;
-                goto again;
+                if (shmem_swizzled)
+                        goto again;
+                return -EFAULT;
         }
 
         /*
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 8b1748d0172c..2e48ec0c2e91 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -74,11 +74,17 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
 
         /*
          * Ensure the task is not frozen.
-         * Also, when a freshly created task is scheduled once, changes
-         * its state to TASK_UNINTERRUPTIBLE without having ever been
-         * switched out once, it musn't be checked.
+         * Also, skip vfork and any other user process that freezer should skip.
          */
-        if (unlikely(t->flags & PF_FROZEN || !switch_count))
+        if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP)))
+            return;
+
+        /*
+         * When a freshly created task is scheduled once, changes its state to
+         * TASK_UNINTERRUPTIBLE without having ever been switched out once, it
+         * musn't be checked.
+         */
+        if (unlikely(!switch_count))
                 return;
 
         if (switch_count != t->last_switch_count) {
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index f45c6817770e..8fb755132322 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -431,6 +431,7 @@ unsigned int max_lockdep_depth;
  * about it later on, in lockdep_info().
  */
 static int lockdep_init_error;
+static const char *lock_init_error;
 static unsigned long lockdep_init_trace_data[20];
 static struct stack_trace lockdep_init_trace = {
         .max_entries = ARRAY_SIZE(lockdep_init_trace_data),
@@ -568,11 +569,12 @@ static void lockdep_print_held_locks(struct task_struct *curr)
         }
 }
 
-static void print_kernel_version(void)
+static void print_kernel_ident(void)
 {
-        printk("%s %.*s\n", init_utsname()->release,
+        printk("%s %.*s %s\n", init_utsname()->release,
                 (int)strcspn(init_utsname()->version, " "),
-                init_utsname()->version);
+                init_utsname()->version,
+                print_tainted());
 }
 
 static int very_verbose(struct lock_class *class)
@@ -656,6 +658,7 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
         if (unlikely(!lockdep_initialized)) {
                 lockdep_init();
                 lockdep_init_error = 1;
+                lock_init_error = lock->name;
                 save_stack_trace(&lockdep_init_trace);
         }
 #endif
@@ -723,7 +726,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
 
         class = look_up_lock_class(lock, subclass);
         if (likely(class))
-                return class;
+                goto out_set_class_cache;
 
         /*
          * Debug-check: all keys must be persistent!
@@ -808,6 +811,7 @@ out_unlock_set:
         graph_unlock();
         raw_local_irq_restore(flags);
 
+out_set_class_cache:
         if (!subclass || force)
                 lock->class_cache[0] = class;
         else if (subclass < NR_LOCKDEP_CACHING_CLASSES)
@@ -1149,7 +1153,7 @@ print_circular_bug_header(struct lock_list *entry, unsigned int depth,
         printk("\n");
         printk("======================================================\n");
         printk("[ INFO: possible circular locking dependency detected ]\n");
-        print_kernel_version();
+        print_kernel_ident();
         printk("-------------------------------------------------------\n");
         printk("%s/%d is trying to acquire lock:\n",
                 curr->comm, task_pid_nr(curr));
@@ -1488,7 +1492,7 @@ print_bad_irq_dependency(struct task_struct *curr,
         printk("======================================================\n");
         printk("[ INFO: %s-safe -> %s-unsafe lock order detected ]\n",
                 irqclass, irqclass);
-        print_kernel_version();
+        print_kernel_ident();
         printk("------------------------------------------------------\n");
         printk("%s/%d [HC%u[%lu]:SC%u[%lu]:HE%u:SE%u] is trying to acquire:\n",
                 curr->comm, task_pid_nr(curr),
@@ -1717,7 +1721,7 @@ print_deadlock_bug(struct task_struct *curr, struct held_lock *prev,
         printk("\n");
         printk("=============================================\n");
         printk("[ INFO: possible recursive locking detected ]\n");
-        print_kernel_version();
+        print_kernel_ident();
         printk("---------------------------------------------\n");
         printk("%s/%d is trying to acquire lock:\n",
                 curr->comm, task_pid_nr(curr));
@@ -2224,7 +2228,7 @@ print_usage_bug(struct task_struct *curr, struct held_lock *this,
         printk("\n");
         printk("=================================\n");
         printk("[ INFO: inconsistent lock state ]\n");
-        print_kernel_version();
+        print_kernel_ident();
         printk("---------------------------------\n");
 
         printk("inconsistent {%s} -> {%s} usage.\n",
@@ -2289,7 +2293,7 @@ print_irq_inversion_bug(struct task_struct *curr,
         printk("\n");
         printk("=========================================================\n");
         printk("[ INFO: possible irq lock inversion dependency detected ]\n");
-        print_kernel_version();
+        print_kernel_ident();
         printk("---------------------------------------------------------\n");
         printk("%s/%d just changed the state of lock:\n",
                 curr->comm, task_pid_nr(curr));
@@ -3175,6 +3179,7 @@ print_unlock_inbalance_bug(struct task_struct *curr, struct lockdep_map *lock,
         printk("\n");
         printk("=====================================\n");
         printk("[ BUG: bad unlock balance detected! ]\n");
+        print_kernel_ident();
         printk("-------------------------------------\n");
         printk("%s/%d is trying to release lock (",
                 curr->comm, task_pid_nr(curr));
@@ -3619,6 +3624,7 @@ print_lock_contention_bug(struct task_struct *curr, struct lockdep_map *lock,
         printk("\n");
         printk("=================================\n");
         printk("[ BUG: bad contention detected! ]\n");
+        print_kernel_ident();
         printk("---------------------------------\n");
         printk("%s/%d is trying to contend lock (",
                 curr->comm, task_pid_nr(curr));
@@ -3974,7 +3980,8 @@ void __init lockdep_info(void)
 
 #ifdef CONFIG_DEBUG_LOCKDEP
         if (lockdep_init_error) {
-                printk("WARNING: lockdep init error! Arch code didn't call lockdep_init() early enough?\n");
+                printk("WARNING: lockdep init error! lock-%s was acquired"
+                        "before lockdep_init\n", lock_init_error);
                 printk("Call stack leading to lockdep invocation was:\n");
                 print_stack_trace(&lockdep_init_trace, 0);
         }
@@ -3993,6 +4000,7 @@ print_freed_lock_bug(struct task_struct *curr, const void *mem_from,
         printk("\n");
         printk("=========================\n");
         printk("[ BUG: held lock freed! ]\n");
+        print_kernel_ident();
         printk("-------------------------\n");
         printk("%s/%d is freeing memory %p-%p, with a lock still held there!\n",
                 curr->comm, task_pid_nr(curr), mem_from, mem_to-1);
@@ -4050,6 +4058,7 @@ static void print_held_locks_bug(struct task_struct *curr)
         printk("\n");
         printk("=====================================\n");
         printk("[ BUG: lock held at task exit time! ]\n");
+        print_kernel_ident();
         printk("-------------------------------------\n");
         printk("%s/%d is exiting with locks still held!\n",
                 curr->comm, task_pid_nr(curr));
@@ -4147,6 +4156,7 @@ void lockdep_sys_exit(void)
                 printk("\n");
                 printk("================================================\n");
                 printk("[ BUG: lock held when returning to user space! ]\n");
+                print_kernel_ident();
                 printk("------------------------------------------------\n");
                 printk("%s/%d is leaving the kernel with locks still held!\n",
                                 curr->comm, curr->pid);
@@ -4166,6 +4176,7 @@ void lockdep_rcu_suspicious(const char *file, const int line, const char *s)
         printk("\n");
         printk("===============================\n");
         printk("[ INFO: suspicious RCU usage. ]\n");
+        print_kernel_ident();
         printk("-------------------------------\n");
         printk("%s:%d %s!\n", file, line, s);
         printk("\nother info that might help us debug this:\n\n");
diff --git a/kernel/panic.c b/kernel/panic.c
index b26593604214..3458469eb7c3 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -237,11 +237,20 @@ void add_taint(unsigned flag)
          * Can't trust the integrity of the kernel anymore.
          * We don't call directly debug_locks_off() because the issue
          * is not necessarily serious enough to set oops_in_progress to 1
-         * Also we want to keep up lockdep for staging development and
-         * post-warning case.
+         * Also we want to keep up lockdep for staging/out-of-tree
+         * development and post-warning case.
          */
-        if (flag != TAINT_CRAP && flag != TAINT_WARN && __debug_locks_off())
-                printk(KERN_WARNING "Disabling lock debugging due to kernel taint\n");
+        switch (flag) {
+        case TAINT_CRAP:
+        case TAINT_OOT_MODULE:
+        case TAINT_WARN:
+        case TAINT_FIRMWARE_WORKAROUND:
+                break;
+
+        default:
+                if (__debug_locks_off())
+                        printk(KERN_WARNING "Disabling lock debugging due to kernel taint\n");
+        }
 
         set_bit(flag, &tainted_mask);
 }
diff --git a/kernel/printk.c b/kernel/printk.c
index 7982a0a841ea..989e4a52da76 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -199,7 +199,7 @@ void __init setup_log_buf(int early)
                 unsigned long mem;
 
                 mem = memblock_alloc(new_log_buf_len, PAGE_SIZE);
-                if (mem == MEMBLOCK_ERROR)
+                if (!mem)
                         return;
                 new_log_buf = __va(mem);
         } else {
@@ -688,6 +688,7 @@ static void zap_locks(void)
 
         oops_timestamp = jiffies;
 
+        debug_locks_off();
         /* If a crash is occurring, make sure we can't deadlock */
         raw_spin_lock_init(&logbuf_lock);
         /* And make sure that we print immediately */
@@ -840,9 +841,8 @@ asmlinkage int vprintk(const char *fmt, va_list args)
         boot_delay_msec();
         printk_delay();
 
-        preempt_disable();
         /* This stops the holder of console_sem just where we want him */
-        raw_local_irq_save(flags);
+        local_irq_save(flags);
         this_cpu = smp_processor_id();
 
         /*
@@ -856,7 +856,7 @@ asmlinkage int vprintk(const char *fmt, va_list args)
                  * recursion and return - but flag the recursion so that
                  * it can be printed at the next appropriate moment:
                  */
-                if (!oops_in_progress) {
+                if (!oops_in_progress && !lockdep_recursing(current)) {
                         recursion_bug = 1;
                         goto out_restore_irqs;
                 }
@@ -962,9 +962,8 @@ asmlinkage int vprintk(const char *fmt, va_list args)
 
         lockdep_on();
 out_restore_irqs:
-        raw_local_irq_restore(flags);
+        local_irq_restore(flags);
 
-        preempt_enable();
         return printed_len;
 }
 EXPORT_SYMBOL(printk);
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 24d04477b257..78ab24a7b0e4 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -96,9 +96,20 @@ void __ptrace_unlink(struct task_struct *child)
          */
         if (!(child->flags & PF_EXITING) &&
             (child->signal->flags & SIGNAL_STOP_STOPPED ||
-             child->signal->group_stop_count))
+             child->signal->group_stop_count)) {
                 child->jobctl |= JOBCTL_STOP_PENDING;
 
+                /*
+                 * This is only possible if this thread was cloned by the
+                 * traced task running in the stopped group, set the signal
+                 * for the future reports.
+                 * FIXME: we should change ptrace_init_task() to handle this
+                 * case.
+                 */
+                if (!(child->jobctl & JOBCTL_STOP_SIGMASK))
+                        child->jobctl |= SIGSTOP;
+        }
+
         /*
          * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick
          * @child in the butt.  Note that @resume should be used iff @child
diff --git a/kernel/rtmutex-debug.c b/kernel/rtmutex-debug.c
index 8eafd1bd273e..16502d3a71c8 100644
--- a/kernel/rtmutex-debug.c
+++ b/kernel/rtmutex-debug.c
@@ -101,6 +101,7 @@ void debug_rt_mutex_print_deadlock(struct rt_mutex_waiter *waiter)
 
         printk("\n============================================\n");
         printk(  "[ BUG: circular locking deadlock detected! ]\n");
+        printk("%s\n", print_tainted());
         printk(  "--------------------------------------------\n");
         printk("%s/%d is deadlocking current task %s/%d\n\n",
                task->comm, task_pid_nr(task),
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index a78ed2736ba7..8a39fa3e3c6c 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -2352,13 +2352,11 @@ again:
                 if (!smt && (sd->flags & SD_SHARE_CPUPOWER))
                         continue;
 
-                if (!(sd->flags & SD_SHARE_PKG_RESOURCES)) {
-                        if (!smt) {
-                                smt = 1;
-                                goto again;
-                        }
+                if (smt && !(sd->flags & SD_SHARE_CPUPOWER))
+                        break;
+
+                if (!(sd->flags & SD_SHARE_PKG_RESOURCES))
                         break;
-                }
 
                 sg = sd->groups;
                 do {
@@ -2378,6 +2376,10 @@ next:
                         sg = sg->next;
                 } while (sg != sd->groups);
         }
+        if (!smt) {
+                smt = 1;
+                goto again;
+        }
 done:
         rcu_read_unlock();
 
diff --git a/kernel/signal.c b/kernel/signal.c
index b3f78d09a105..206551563cce 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1994,8 +1994,6 @@ static bool do_signal_stop(int signr)
                  */
                 if (!(sig->flags & SIGNAL_STOP_STOPPED))
                         sig->group_exit_code = signr;
-                else
-                        WARN_ON_ONCE(!current->ptrace);
 
                 sig->group_stop_count = 0;
 
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 6318b511afa1..a650694883a1 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1354,7 +1354,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
 
         fput(file);
 out_putname:
-        putname(pathname);
+        __putname(pathname);
 out:
         return result;
 }
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index c4eb71c8b2ea..1ecd6ba36d6c 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -387,7 +387,6 @@ void clockevents_exchange_device(struct clock_event_device *old,
          * released list and do a notify add later.
          */
         if (old) {
-                old->event_handler = clockevents_handle_noop;
                 clockevents_set_mode(old, CLOCK_EVT_MODE_UNUSED);
                 list_del(&old->list);
                 list_add(&old->list, &clockevents_released);
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index da2f760e780c..d3ad022136e5 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -647,7 +647,7 @@ static void clocksource_enqueue(struct clocksource *cs)
 
 /**
  * __clocksource_updatefreq_scale - Used update clocksource with new freq
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
  * @scale:      Scale factor multiplied against freq to get clocksource hz
  * @freq:       clocksource frequency (cycles per second) divided by scale
  *
@@ -699,7 +699,7 @@ EXPORT_SYMBOL_GPL(__clocksource_updatefreq_scale);
 
 /**
  * __clocksource_register_scale - Used to install new clocksources
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
  * @scale:      Scale factor multiplied against freq to get clocksource hz
  * @freq:       clocksource frequency (cycles per second) divided by scale
  *
@@ -727,7 +727,7 @@ EXPORT_SYMBOL_GPL(__clocksource_register_scale);
 
 /**
  * clocksource_register - Used to install new clocksources
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
  *
  * Returns -EBUSY if registration fails, zero otherwise.
  */
@@ -761,6 +761,8 @@ static void __clocksource_change_rating(struct clocksource *cs, int rating)
 
 /**
  * clocksource_change_rating - Change the rating of a registered clocksource
+ * @cs:         clocksource to be changed
+ * @rating:     new rating
  */
 void clocksource_change_rating(struct clocksource *cs, int rating)
 {
@@ -772,6 +774,7 @@ EXPORT_SYMBOL(clocksource_change_rating);
 
 /**
  * clocksource_unregister - remove a registered clocksource
+ * @cs: clocksource to be unregistered
  */
 void clocksource_unregister(struct clocksource *cs)
 {
@@ -787,6 +790,7 @@ EXPORT_SYMBOL(clocksource_unregister);
 /**
  * sysfs_show_current_clocksources - sysfs interface for current clocksource
  * @dev:        unused
+ * @attr:       unused
  * @buf:        char buffer to be filled with clocksource list
  *
  * Provides sysfs interface for listing current clocksource.
@@ -807,6 +811,7 @@ sysfs_show_current_clocksources(struct sys_device *dev,
 /**
  * sysfs_override_clocksource - interface for manually overriding clocksource
  * @dev:        unused
+ * @attr:       unused
  * @buf:        name of override clocksource
  * @count:      length of buffer
  *
@@ -842,6 +847,7 @@ static ssize_t sysfs_override_clocksource(struct sys_device *dev,
 /**
  * sysfs_show_available_clocksources - sysfs interface for listing clocksource
  * @dev:        unused
+ * @attr:       unused
  * @buf:        char buffer to be filled with clocksource list
  *
  * Provides sysfs interface for listing registered clocksources
diff --git a/kernel/timer.c b/kernel/timer.c
index 9c3c62b0c4bc..a297ffcf888e 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -427,6 +427,12 @@ static int timer_fixup_init(void *addr, enum debug_obj_state state)
         }
 }
 
+/* Stub timer callback for improperly used timers. */
+static void stub_timer(unsigned long data)
+{
+        WARN_ON(1);
+}
+
 /*
  * fixup_activate is called when:
  * - an active object is activated
@@ -450,7 +456,8 @@ static int timer_fixup_activate(void *addr, enum debug_obj_state state)
                         debug_object_activate(timer, &timer_debug_descr);
                         return 0;
                 } else {
-                        WARN_ON_ONCE(1);
+                        setup_timer(timer, stub_timer, 0);
+                        return 1;
                 }
                 return 0;
 
@@ -480,12 +487,40 @@ static int timer_fixup_free(void *addr, enum debug_obj_state state)
         }
 }
 
+/*
+ * fixup_assert_init is called when:
+ * - an untracked/uninit-ed object is found
+ */
+static int timer_fixup_assert_init(void *addr, enum debug_obj_state state)
+{
+        struct timer_list *timer = addr;
+
+        switch (state) {
+        case ODEBUG_STATE_NOTAVAILABLE:
+                if (timer->entry.prev == TIMER_ENTRY_STATIC) {
+                        /*
+                         * This is not really a fixup. The timer was
+                         * statically initialized. We just make sure that it
+                         * is tracked in the object tracker.
+                         */
+                        debug_object_init(timer, &timer_debug_descr);
+                        return 0;
+                } else {
+                        setup_timer(timer, stub_timer, 0);
+                        return 1;
+                }
+        default:
+                return 0;
+        }
+}
+
 static struct debug_obj_descr timer_debug_descr = {
-        .name           = "timer_list",
-        .debug_hint     = timer_debug_hint,
-        .fixup_init     = timer_fixup_init,
-        .fixup_activate = timer_fixup_activate,
-        .fixup_free     = timer_fixup_free,
+        .name                   = "timer_list",
+        .debug_hint             = timer_debug_hint,
+        .fixup_init             = timer_fixup_init,
+        .fixup_activate         = timer_fixup_activate,
+        .fixup_free             = timer_fixup_free,
+        .fixup_assert_init      = timer_fixup_assert_init,
 };
 
 static inline void debug_timer_init(struct timer_list *timer)
@@ -508,6 +543,11 @@ static inline void debug_timer_free(struct timer_list *timer)
         debug_object_free(timer, &timer_debug_descr);
 }
 
+static inline void debug_timer_assert_init(struct timer_list *timer)
+{
+        debug_object_assert_init(timer, &timer_debug_descr);
+}
+
 static void __init_timer(struct timer_list *timer,
                          const char *name,
                          struct lock_class_key *key);
@@ -531,6 +571,7 @@ EXPORT_SYMBOL_GPL(destroy_timer_on_stack);
 static inline void debug_timer_init(struct timer_list *timer) { }
 static inline void debug_timer_activate(struct timer_list *timer) { }
 static inline void debug_timer_deactivate(struct timer_list *timer) { }
+static inline void debug_timer_assert_init(struct timer_list *timer) { }
 #endif
 
 static inline void debug_init(struct timer_list *timer)
@@ -552,6 +593,11 @@ static inline void debug_deactivate(struct timer_list *timer)
         trace_timer_cancel(timer);
 }
 
+static inline void debug_assert_init(struct timer_list *timer)
+{
+        debug_timer_assert_init(timer);
+}
+
 static void __init_timer(struct timer_list *timer,
                          const char *name,
                          struct lock_class_key *key)
@@ -902,6 +948,8 @@ int del_timer(struct timer_list *timer)
         unsigned long flags;
         int ret = 0;
 
+        debug_assert_init(timer);
+
         timer_stats_timer_clear_start_info(timer);
         if (timer_pending(timer)) {
                 base = lock_timer_base(timer, &flags);
@@ -932,6 +980,8 @@ int try_to_del_timer_sync(struct timer_list *timer)
         unsigned long flags;
         int ret = -1;
 
+        debug_assert_init(timer);
+
         base = lock_timer_base(timer, &flags);
 
         if (base->running_timer == timer)
diff --git a/kernel/wait.c b/kernel/wait.c
index 26fa7797f90f..7fdd9eaca2c3 100644
--- a/kernel/wait.c
+++ b/kernel/wait.c
@@ -10,10 +10,10 @@
 #include <linux/wait.h>
 #include <linux/hash.h>
 
-void __init_waitqueue_head(wait_queue_head_t *q, struct lock_class_key *key)
+void __init_waitqueue_head(wait_queue_head_t *q, const char *name, struct lock_class_key *key)
 {
         spin_lock_init(&q->lock);
-        lockdep_set_class(&q->lock, key);
+        lockdep_set_class_and_name(&q->lock, key, name);
         INIT_LIST_HEAD(&q->task_list);
 }