7 files changed, 36 insertions, 24 deletions

diff --git a/include/linux/irq.h b/include/linux/irq.h
index ca507c9426b0..b7cbeed972e4 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -487,6 +487,16 @@ static inline void init_copy_desc_masks(struct irq_desc *old_desc,
 #endif
 }
 
+static inline void free_desc_masks(struct irq_desc *old_desc,
+                                   struct irq_desc *new_desc)
+{
+        free_cpumask_var(old_desc->affinity);
+
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+        free_cpumask_var(old_desc->pending_mask);
+#endif
+}
+
 #else /* !CONFIG_SMP */
 
 static inline bool init_alloc_desc_masks(struct irq_desc *desc, int cpu,
@@ -500,6 +510,10 @@ static inline void init_copy_desc_masks(struct irq_desc *old_desc,
 {
 }
 
+static inline void free_desc_masks(struct irq_desc *old_desc,
+                                   struct irq_desc *new_desc)
+{
+}
 #endif  /* CONFIG_SMP */
 
 #endif /* _LINUX_IRQ_H */
diff --git a/kernel/fork.c b/kernel/fork.c
index 989c7c202b3d..b9e2edd00726 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -800,6 +800,12 @@ static void posix_cpu_timers_init_group(struct signal_struct *sig)
         sig->cputime_expires.virt_exp = cputime_zero;
         sig->cputime_expires.sched_exp = 0;
 
+        if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
+                sig->cputime_expires.prof_exp =
+                        secs_to_cputime(sig->rlim[RLIMIT_CPU].rlim_cur);
+                sig->cputimer.running = 1;
+        }
+
         /* The timer lists. */
         INIT_LIST_HEAD(&sig->cpu_timers[0]);
         INIT_LIST_HEAD(&sig->cpu_timers[1]);
@@ -815,11 +821,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
                 atomic_inc(&current->signal->live);
                 return 0;
         }
-        sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
-
-        if (sig)
-                posix_cpu_timers_init_group(sig);
 
+        sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
         tsk->signal = sig;
         if (!sig)
                 return -ENOMEM;
@@ -859,6 +862,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim);
         task_unlock(current->group_leader);
 
+        posix_cpu_timers_init_group(sig);
+
         acct_init_pacct(&sig->pacct);
 
         tty_audit_fork(sig);
diff --git a/kernel/futex.c b/kernel/futex.c
index 6b50a024bca2..eef8cd26b5e5 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -883,7 +883,12 @@ retry_private:
 out_unlock:
         double_unlock_hb(hb1, hb2);
 
-        /* drop_futex_key_refs() must be called outside the spinlocks. */
+        /*
+         * drop_futex_key_refs() must be called outside the spinlocks. During
+         * the requeue we moved futex_q's from the hash bucket at key1 to the
+         * one at key2 and updated their key pointer.  We no longer need to
+         * hold the references to key1.
+         */
         while (--drop_count >= 0)
                 drop_futex_key_refs(&key1);
 
diff --git a/kernel/irq/numa_migrate.c b/kernel/irq/numa_migrate.c
index 243d6121e50e..44bbdcbaf8d2 100644
--- a/kernel/irq/numa_migrate.c
+++ b/kernel/irq/numa_migrate.c
@@ -54,6 +54,7 @@ static bool init_copy_one_irq_desc(int irq, struct irq_desc *old_desc,
 static void free_one_irq_desc(struct irq_desc *old_desc, struct irq_desc *desc)
 {
         free_kstat_irqs(old_desc, desc);
+        free_desc_masks(old_desc, desc);
         arch_free_chip_data(old_desc, desc);
 }
 
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 8e5d9a68b022..bb53185d8c78 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -18,7 +18,7 @@ void update_rlimit_cpu(unsigned long rlim_new)
 
         cputime = secs_to_cputime(rlim_new);
         if (cputime_eq(current->signal->it_prof_expires, cputime_zero) ||
-            cputime_lt(current->signal->it_prof_expires, cputime)) {
+            cputime_gt(current->signal->it_prof_expires, cputime)) {
                 spin_lock_irq(&current->sighand->siglock);
                 set_process_cpu_timer(current, CPUCLOCK_PROF, &cputime, NULL);
                 spin_unlock_irq(&current->sighand->siglock);
diff --git a/kernel/timer.c b/kernel/timer.c
index b4555568b4e4..cffffad01c31 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -531,10 +531,13 @@ static void __init_timer(struct timer_list *timer,
 }
 
 /**
- * init_timer - initialize a timer.
+ * init_timer_key - initialize a timer
  * @timer: the timer to be initialized
+ * @name: name of the timer
+ * @key: lockdep class key of the fake lock used for tracking timer
+ *       sync lock dependencies
  *
- * init_timer() must be done to a timer prior calling *any* of the
+ * init_timer_key() must be done to a timer prior calling *any* of the
  * other timer functions.
  */
 void init_timer_key(struct timer_list *timer,
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index be3001f912e4..7536acea135b 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1051,13 +1051,6 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                         if (str < end)
                                 *str = '%';
                         ++str;
-                        if (*fmt) {
-                                if (str < end)
-                                        *str = *fmt;
-                                ++str;
-                        } else {
-                                --fmt;
-                        }
                         break;
 
                 case FORMAT_TYPE_NRCHARS: {
@@ -1339,8 +1332,6 @@ do {									\
                         break;
 
                 case FORMAT_TYPE_INVALID:
-                        if (!*fmt)
-                                --fmt;
                         break;
 
                 case FORMAT_TYPE_NRCHARS: {
@@ -1523,13 +1514,6 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                         if (str < end)
                                 *str = '%';
                         ++str;
-                        if (*fmt) {
-                                if (str < end)
-                                        *str = *fmt;
-                                ++str;
-                        } else {
-                                --fmt;
-                        }
                         break;
 
                 case FORMAT_TYPE_NRCHARS: