Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Signed-off-by: David S. Miller <davem@davemloft.net>

9 files changed, 122 insertions, 63 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 7868fc3c0bc5..70776aec2562 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1648,10 +1648,13 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                          int flags, const char *unused_dev_name,
                          void *data)
 {
+        struct super_block *pinned_sb = NULL;
+        struct cgroup_subsys *ss;
         struct cgroup_root *root;
         struct cgroup_sb_opts opts;
         struct dentry *dentry;
         int ret;
+        int i;
         bool new_sb;
 
         /*
@@ -1677,6 +1680,27 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                 goto out_unlock;
         }
 
+        /*
+         * Destruction of cgroup root is asynchronous, so subsystems may
+         * still be dying after the previous unmount.  Let's drain the
+         * dying subsystems.  We just need to ensure that the ones
+         * unmounted previously finish dying and don't care about new ones
+         * starting.  Testing ref liveliness is good enough.
+         */
+        for_each_subsys(ss, i) {
+                if (!(opts.subsys_mask & (1 << i)) ||
+                    ss->root == &cgrp_dfl_root)
+                        continue;
+
+                if (!percpu_ref_tryget_live(&ss->root->cgrp.self.refcnt)) {
+                        mutex_unlock(&cgroup_mutex);
+                        msleep(10);
+                        ret = restart_syscall();
+                        goto out_free;
+                }
+                cgroup_put(&ss->root->cgrp);
+        }
+
         for_each_root(root) {
                 bool name_match = false;
 
@@ -1717,15 +1741,23 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
                 }
 
                 /*
-                 * A root's lifetime is governed by its root cgroup.
-                 * tryget_live failure indicate that the root is being
-                 * destroyed.  Wait for destruction to complete so that the
-                 * subsystems are free.  We can use wait_queue for the wait
-                 * but this path is super cold.  Let's just sleep for a bit
-                 * and retry.
+                 * We want to reuse @root whose lifetime is governed by its
+                 * ->cgrp.  Let's check whether @root is alive and keep it
+                 * that way.  As cgroup_kill_sb() can happen anytime, we
+                 * want to block it by pinning the sb so that @root doesn't
+                 * get killed before mount is complete.
+                 *
+                 * With the sb pinned, tryget_live can reliably indicate
+                 * whether @root can be reused.  If it's being killed,
+                 * drain it.  We can use wait_queue for the wait but this
+                 * path is super cold.  Let's just sleep a bit and retry.
                  */
-                if (!percpu_ref_tryget_live(&root->cgrp.self.refcnt)) {
+                pinned_sb = kernfs_pin_sb(root->kf_root, NULL);
+                if (IS_ERR(pinned_sb) ||
+                    !percpu_ref_tryget_live(&root->cgrp.self.refcnt)) {
                         mutex_unlock(&cgroup_mutex);
+                        if (!IS_ERR_OR_NULL(pinned_sb))
+                                deactivate_super(pinned_sb);
                         msleep(10);
                         ret = restart_syscall();
                         goto out_free;
@@ -1770,6 +1802,16 @@ out_free:
                                 CGROUP_SUPER_MAGIC, &new_sb);
         if (IS_ERR(dentry) || !new_sb)
                 cgroup_put(&root->cgrp);
+
+        /*
+         * If @pinned_sb, we're reusing an existing root and holding an
+         * extra ref on its sb.  Mount is complete.  Put the extra ref.
+         */
+        if (pinned_sb) {
+                WARN_ON(new_sb);
+                deactivate_super(pinned_sb);
+        }
+
         return dentry;
 }
 
@@ -3328,7 +3370,7 @@ bool css_has_online_children(struct cgroup_subsys_state *css)
 
         rcu_read_lock();
         css_for_each_child(child, css) {
-                if (css->flags & CSS_ONLINE) {
+                if (child->flags & CSS_ONLINE) {
                         ret = true;
                         break;
                 }
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index f6b33c696224..116a4164720a 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1181,7 +1181,13 @@ done:
 
 int current_cpuset_is_being_rebound(void)
 {
-        return task_cs(current) == cpuset_being_rebound;
+        int ret;
+
+        rcu_read_lock();
+        ret = task_cs(current) == cpuset_being_rebound;
+        rcu_read_unlock();
+
+        return ret;
 }
 
 static int update_relax_domain_level(struct cpuset *cs, s64 val)
@@ -1617,7 +1623,17 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of,
          * resources, wait for the previously scheduled operations before
          * proceeding, so that we don't end up keep removing tasks added
          * after execution capability is restored.
+         *
+         * cpuset_hotplug_work calls back into cgroup core via
+         * cgroup_transfer_tasks() and waiting for it from a cgroupfs
+         * operation like this one can lead to a deadlock through kernfs
+         * active_ref protection.  Let's break the protection.  Losing the
+         * protection is okay as we check whether @cs is online after
+         * grabbing cpuset_mutex anyway.  This only happens on the legacy
+         * hierarchies.
          */
+        css_get(&cs->css);
+        kernfs_break_active_protection(of->kn);
         flush_work(&cpuset_hotplug_work);
 
         mutex_lock(&cpuset_mutex);
@@ -1645,6 +1661,8 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of,
         free_trial_cpuset(trialcs);
 out_unlock:
         mutex_unlock(&cpuset_mutex);
+        kernfs_unbreak_active_protection(of->kn);
+        css_put(&cs->css);
         return retval ?: nbytes;
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index a33d9a2bcbd7..b0c95f0f06fd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2320,7 +2320,7 @@ static void perf_event_context_sched_out(struct task_struct *task, int ctxn,
         next_parent = rcu_dereference(next_ctx->parent_ctx);
 
         /* If neither context have a parent context; they cannot be clones. */
-        if (!parent && !next_parent)
+        if (!parent || !next_parent)
                 goto unlock;
 
         if (next_parent == ctx || next_ctx == parent || next_parent == parent) {
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index c445e392e93f..6f3254e8c137 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -846,7 +846,7 @@ static void __uprobe_unregister(struct uprobe *uprobe, struct uprobe_consumer *u
 {
         int err;
 
-        if (!consumer_del(uprobe, uc))  /* WARN? */
+        if (WARN_ON(!consumer_del(uprobe, uc)))
                 return;
 
         err = register_for_each_vma(uprobe, NULL);
@@ -927,7 +927,7 @@ int uprobe_apply(struct inode *inode, loff_t offset,
         int ret = -ENOENT;
 
         uprobe = find_uprobe(inode, offset);
-        if (!uprobe)
+        if (WARN_ON(!uprobe))
                 return ret;
 
         down_write(&uprobe->register_rwsem);
@@ -952,7 +952,7 @@ void uprobe_unregister(struct inode *inode, loff_t offset, struct uprobe_consume
         struct uprobe *uprobe;
 
         uprobe = find_uprobe(inode, offset);
-        if (!uprobe)
+        if (WARN_ON(!uprobe))
                 return;
 
         down_write(&uprobe->register_rwsem);
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 7339e42a85ab..1487a123db5c 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -455,9 +455,9 @@ EXPORT_SYMBOL_GPL(irq_alloc_hwirqs);
  */
 void irq_free_hwirqs(unsigned int from, int cnt)
 {
-        int i;
+        int i, j;
 
-        for (i = from; cnt > 0; i++, cnt--) {
+        for (i = from, j = cnt; j > 0; i++, j--) {
                 irq_set_status_flags(i, _IRQ_NOREQUEST | _IRQ_NOPROBE);
                 arch_teardown_hwirq(i);
         }
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index ea2d5f6962ed..13e839dbca07 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1416,9 +1416,10 @@ static int have_callable_console(void)
 /*
  * Can we actually use the console at this time on this cpu?
  *
- * Console drivers may assume that per-cpu resources have been allocated. So
- * unless they're explicitly marked as being able to cope (CON_ANYTIME) don't
- * call them until this CPU is officially up.
+ * Console drivers may assume that per-cpu resources have
+ * been allocated. So unless they're explicitly marked as
+ * being able to cope (CON_ANYTIME) don't call them until
+ * this CPU is officially up.
  */
 static inline int can_use_console(unsigned int cpu)
 {
@@ -1431,10 +1432,8 @@ static inline int can_use_console(unsigned int cpu)
  * console_lock held, and 'console_locked' set) if it
  * is successful, false otherwise.
  */
-static int console_trylock_for_printk(void)
+static int console_trylock_for_printk(unsigned int cpu)
 {
-        unsigned int cpu = smp_processor_id();
-
         if (!console_trylock())
                 return 0;
         /*
@@ -1609,8 +1608,7 @@ asmlinkage int vprintk_emit(int facility, int level,
                  */
                 if (!oops_in_progress && !lockdep_recursing(current)) {
                         recursion_bug = 1;
-                        local_irq_restore(flags);
-                        return 0;
+                        goto out_restore_irqs;
                 }
                 zap_locks();
         }
@@ -1718,27 +1716,21 @@ asmlinkage int vprintk_emit(int facility, int level,
 
         logbuf_cpu = UINT_MAX;
         raw_spin_unlock(&logbuf_lock);
-        lockdep_on();
-        local_irq_restore(flags);
 
         /* If called from the scheduler, we can not call up(). */
-        if (in_sched)
-                return printed_len;
-
-        /*
-         * Disable preemption to avoid being preempted while holding
-         * console_sem which would prevent anyone from printing to console
-         */
-        preempt_disable();
-        /*
-         * Try to acquire and then immediately release the console semaphore.
-         * The release will print out buffers and wake up /dev/kmsg and syslog()
-         * users.
-         */
-        if (console_trylock_for_printk())
-                console_unlock();
-        preempt_enable();
+        if (!in_sched) {
+                /*
+                 * Try to acquire and then immediately release the console
+                 * semaphore.  The release will print out buffers and wake up
+                 * /dev/kmsg and syslog() users.
+                 */
+                if (console_trylock_for_printk(this_cpu))
+                        console_unlock();
+        }
 
+        lockdep_on();
+out_restore_irqs:
+        local_irq_restore(flags);
         return printed_len;
 }
 EXPORT_SYMBOL(vprintk_emit);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 384ede311717..f243444a3772 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1396,7 +1396,6 @@ void tracing_start(void)
 
         arch_spin_unlock(&global_trace.max_lock);
 
-        ftrace_start();
  out:
         raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
 }
@@ -1443,7 +1442,6 @@ void tracing_stop(void)
         struct ring_buffer *buffer;
         unsigned long flags;
 
-        ftrace_stop();
         raw_spin_lock_irqsave(&global_trace.start_lock, flags);
         if (global_trace.stop_count++)
                 goto out;
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 04fdb5de823c..3c9b97e6b1f4 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -893,6 +893,9 @@ probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
         int ret;
 
         if (file) {
+                if (tu->tp.flags & TP_FLAG_PROFILE)
+                        return -EINTR;
+
                 link = kmalloc(sizeof(*link), GFP_KERNEL);
                 if (!link)
                         return -ENOMEM;
@@ -901,29 +904,40 @@ probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
                 list_add_tail_rcu(&link->list, &tu->tp.files);
 
                 tu->tp.flags |= TP_FLAG_TRACE;
-        } else
-                tu->tp.flags |= TP_FLAG_PROFILE;
+        } else {
+                if (tu->tp.flags & TP_FLAG_TRACE)
+                        return -EINTR;
 
-        ret = uprobe_buffer_enable();
-        if (ret < 0)
-                return ret;
+                tu->tp.flags |= TP_FLAG_PROFILE;
+        }
 
         WARN_ON(!uprobe_filter_is_empty(&tu->filter));
 
         if (enabled)
                 return 0;
 
+        ret = uprobe_buffer_enable();
+        if (ret)
+                goto err_flags;
+
         tu->consumer.filter = filter;
         ret = uprobe_register(tu->inode, tu->offset, &tu->consumer);
-        if (ret) {
-                if (file) {
-                        list_del(&link->list);
-                        kfree(link);
-                        tu->tp.flags &= ~TP_FLAG_TRACE;
-                } else
-                        tu->tp.flags &= ~TP_FLAG_PROFILE;
-        }
+        if (ret)
+                goto err_buffer;
 
+        return 0;
+
+ err_buffer:
+        uprobe_buffer_disable();
+
+ err_flags:
+        if (file) {
+                list_del(&link->list);
+                kfree(link);
+                tu->tp.flags &= ~TP_FLAG_TRACE;
+        } else {
+                tu->tp.flags &= ~TP_FLAG_PROFILE;
+        }
         return ret;
 }
 
@@ -1201,12 +1215,6 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs)
 
         current->utask->vaddr = (unsigned long) &udd;
 
-#ifdef CONFIG_PERF_EVENTS
-        if ((tu->tp.flags & TP_FLAG_TRACE) == 0 &&
-            !uprobe_perf_filter(&tu->consumer, 0, current->mm))
-                return UPROBE_HANDLER_REMOVE;
-#endif
-
         if (WARN_ON_ONCE(!uprobe_cpu_buffer))
                 return 0;
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 6203d2900877..35974ac69600 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3284,6 +3284,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
                 }
         }
 
+        dev_set_uevent_suppress(&wq_dev->dev, false);
         kobject_uevent(&wq_dev->dev.kobj, KOBJ_ADD);
         return 0;
 }
@@ -4879,7 +4880,7 @@ static void __init wq_numa_init(void)
         BUG_ON(!tbl);
 
         for_each_node(node)
-                BUG_ON(!alloc_cpumask_var_node(&tbl[node], GFP_KERNEL,
+                BUG_ON(!zalloc_cpumask_var_node(&tbl[node], GFP_KERNEL,
                                 node_online(node) ? node : NUMA_NO_NODE));
 
         for_each_possible_cpu(cpu) {