Merge commit 'v2.6.38-rc2' into core/locking

Reason: Update to mainline before adding the locking cleanup

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

1 files changed, 19 insertions, 6 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 21aa7b3001fb..f9a45ebcc7b1 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -69,7 +69,7 @@ static void __unhash_process(struct task_struct *p, bool group_dead)
 
                 list_del_rcu(&p->tasks);
                 list_del_init(&p->sibling);
-                __get_cpu_var(process_counts)--;
+                __this_cpu_dec(process_counts);
         }
         list_del_rcu(&p->thread_group);
 }
@@ -914,6 +914,15 @@ NORET_TYPE void do_exit(long code)
         if (unlikely(!tsk->pid))
                 panic("Attempted to kill the idle task!");
 
+        /*
+         * If do_exit is called because this processes oopsed, it's possible
+         * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
+         * continuing. Amongst other possible reasons, this is to prevent
+         * mm_release()->clear_child_tid() from writing to a user-controlled
+         * kernel address.
+         */
+        set_fs(USER_DS);
+
         tracehook_report_exit(&code);
 
         validate_creds_for_do_exit(tsk);
@@ -985,6 +994,15 @@ NORET_TYPE void do_exit(long code)
         exit_fs(tsk);
         check_stack_usage();
         exit_thread();
+
+        /*
+         * Flush inherited counters to the parent - before the parent
+         * gets woken up by child-exit notifications.
+         *
+         * because of cgroup mode, must be called before cgroup_exit()
+         */
+        perf_event_exit_task(tsk);
+
         cgroup_exit(tsk, 1);
 
         if (group_dead)
@@ -998,11 +1016,6 @@ NORET_TYPE void do_exit(long code)
          * FIXME: do that only when needed, using sched_exit tracepoint
          */
         flush_ptrace_hw_breakpoint(tsk);
-        /*
-         * Flush inherited counters to the parent - before the parent
-         * gets woken up by child-exit notifications.
-         */
-        perf_event_exit_task(tsk);
 
         exit_notify(tsk, group_dead);
 #ifdef CONFIG_NUMA