1 files changed, 32 insertions, 28 deletions

diff --git a/kernel/fork.c b/kernel/fork.c
index 166b8c49257c..b0ec34abc0bb 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -64,6 +64,7 @@
 #include <linux/magic.h>
 #include <linux/perf_event.h>
 #include <linux/posix-timers.h>
+#include <linux/user-return-notifier.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -85,6 +86,7 @@ int max_threads;		/* tunable limit on nr_threads */
 DEFINE_PER_CPU(unsigned long, process_counts) = 0;
 
 __cacheline_aligned DEFINE_RWLOCK(tasklist_lock);  /* outer */
+EXPORT_SYMBOL_GPL(tasklist_lock);
 
 int nr_processes(void)
 {
@@ -249,6 +251,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
                 goto out;
 
         setup_thread_stack(tsk, orig);
+        clear_user_return_notifier(tsk);
         stackend = end_of_stack(tsk);
         *stackend = STACK_END_MAGIC;    /* for overflow detection */
 
@@ -326,15 +329,17 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                 if (!tmp)
                         goto fail_nomem;
                 *tmp = *mpnt;
+                INIT_LIST_HEAD(&tmp->anon_vma_chain);
                 pol = mpol_dup(vma_policy(mpnt));
                 retval = PTR_ERR(pol);
                 if (IS_ERR(pol))
                         goto fail_nomem_policy;
                 vma_set_policy(tmp, pol);
+                if (anon_vma_fork(tmp, mpnt))
+                        goto fail_nomem_anon_vma_fork;
                 tmp->vm_flags &= ~VM_LOCKED;
                 tmp->vm_mm = mm;
                 tmp->vm_next = NULL;
-                anon_vma_link(tmp);
                 file = tmp->vm_file;
                 if (file) {
                         struct inode *inode = file->f_path.dentry->d_inode;
@@ -389,6 +394,8 @@ out:
         flush_tlb_mm(oldmm);
         up_write(&oldmm->mmap_sem);
         return retval;
+fail_nomem_anon_vma_fork:
+        mpol_put(pol);
 fail_nomem_policy:
         kmem_cache_free(vm_area_cachep, tmp);
 fail_nomem:
@@ -452,8 +459,7 @@ static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
                 (current->mm->flags & MMF_INIT_MASK) : default_dump_filter;
         mm->core_state = NULL;
         mm->nr_ptes = 0;
-        set_mm_counter(mm, file_rss, 0);
-        set_mm_counter(mm, anon_rss, 0);
+        memset(&mm->rss_stat, 0, sizeof(mm->rss_stat));
         spin_lock_init(&mm->page_table_lock);
         mm->free_area_cache = TASK_UNMAPPED_BASE;
         mm->cached_hole_size = ~0UL;
@@ -822,6 +828,8 @@ void __cleanup_sighand(struct sighand_struct *sighand)
  */
 static void posix_cpu_timers_init_group(struct signal_struct *sig)
 {
+        unsigned long cpu_limit;
+
         /* Thread group counters. */
         thread_group_cputime_init(sig);
 
@@ -836,9 +844,9 @@ static void posix_cpu_timers_init_group(struct signal_struct *sig)
         sig->cputime_expires.virt_exp = cputime_zero;
         sig->cputime_expires.sched_exp = 0;
 
-        if (sig->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
-                sig->cputime_expires.prof_exp =
-                        secs_to_cputime(sig->rlim[RLIMIT_CPU].rlim_cur);
+        cpu_limit = ACCESS_ONCE(sig->rlim[RLIMIT_CPU].rlim_cur);
+        if (cpu_limit != RLIM_INFINITY) {
+                sig->cputime_expires.prof_exp = secs_to_cputime(cpu_limit);
                 sig->cputimer.running = 1;
         }
 
@@ -884,6 +892,9 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         sig->utime = sig->stime = sig->cutime = sig->cstime = cputime_zero;
         sig->gtime = cputime_zero;
         sig->cgtime = cputime_zero;
+#ifndef CONFIG_VIRT_CPU_ACCOUNTING
+        sig->prev_utime = sig->prev_stime = cputime_zero;
+#endif
         sig->nvcsw = sig->nivcsw = sig->cnvcsw = sig->cnivcsw = 0;
         sig->min_flt = sig->maj_flt = sig->cmin_flt = sig->cmaj_flt = 0;
         sig->inblock = sig->oublock = sig->cinblock = sig->coublock = 0;
@@ -934,9 +945,9 @@ SYSCALL_DEFINE1(set_tid_address, int __user *, tidptr)
 
 static void rt_mutex_init_task(struct task_struct *p)
 {
-        spin_lock_init(&p->pi_lock);
+        raw_spin_lock_init(&p->pi_lock);
 #ifdef CONFIG_RT_MUTEXES
-        plist_head_init(&p->pi_waiters, &p->pi_lock);
+        plist_head_init_raw(&p->pi_waiters, &p->pi_lock);
         p->pi_blocked_on = NULL;
 #endif
 }
@@ -1028,7 +1039,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #endif
         retval = -EAGAIN;
         if (atomic_read(&p->real_cred->user->processes) >=
-                        p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
+                        task_rlimit(p, RLIMIT_NPROC)) {
                 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
                     p->real_cred->user != INIT_USER)
                         goto bad_fork_free;
@@ -1066,8 +1077,10 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         p->gtime = cputime_zero;
         p->utimescaled = cputime_zero;
         p->stimescaled = cputime_zero;
+#ifndef CONFIG_VIRT_CPU_ACCOUNTING
         p->prev_utime = cputime_zero;
         p->prev_stime = cputime_zero;
+#endif
 
         p->default_timer_slack_ns = current->timer_slack_ns;
 
@@ -1120,6 +1133,10 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #ifdef CONFIG_DEBUG_MUTEXES
         p->blocked_on = NULL; /* not blocked yet */
 #endif
+#ifdef CONFIG_CGROUP_MEM_RES_CTLR
+        p->memcg_batch.do_batch = 0;
+        p->memcg_batch.memcg = NULL;
+#endif
 
         p->bts = NULL;
 
@@ -1199,9 +1216,10 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 p->sas_ss_sp = p->sas_ss_size = 0;
 
         /*
-         * Syscall tracing should be turned off in the child regardless
-         * of CLONE_PTRACE.
+         * Syscall tracing and stepping should be turned off in the
+         * child regardless of CLONE_PTRACE.
          */
+        user_disable_single_step(p);
         clear_tsk_thread_flag(p, TIF_SYSCALL_TRACE);
 #ifdef TIF_SYSCALL_EMU
         clear_tsk_thread_flag(p, TIF_SYSCALL_EMU);
@@ -1229,21 +1247,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         /* Need tasklist lock for parent etc handling! */
         write_lock_irq(&tasklist_lock);
 
-        /*
-         * The task hasn't been attached yet, so its cpus_allowed mask will
-         * not be changed, nor will its assigned CPU.
-         *
-         * The cpus_allowed mask of the parent may have changed after it was
-         * copied first time - so re-copy it here, then check the child's CPU
-         * to ensure it is on a valid CPU (and if not, just force it back to
-         * parent's CPU). This avoids alot of nasty races.
-         */
-        p->cpus_allowed = current->cpus_allowed;
-        p->rt.nr_cpus_allowed = current->rt.nr_cpus_allowed;
-        if (unlikely(!cpu_isset(task_cpu(p), p->cpus_allowed) ||
-                        !cpu_online(task_cpu(p))))
-                set_task_cpu(p, smp_processor_id());
-
         /* CLONE_PARENT re-uses the old parent */
         if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
                 p->real_parent = current->real_parent;
@@ -1279,7 +1282,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         }
 
         if (likely(p->pid)) {
-                list_add_tail(&p->sibling, &p->real_parent->children);
                 tracehook_finish_clone(p, clone_flags, trace);
 
                 if (thread_group_leader(p)) {
@@ -1291,6 +1293,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                         p->signal->tty = tty_kref_get(current->signal->tty);
                         attach_pid(p, PIDTYPE_PGID, task_pgrp(current));
                         attach_pid(p, PIDTYPE_SID, task_session(current));
+                        list_add_tail(&p->sibling, &p->real_parent->children);
                         list_add_tail_rcu(&p->tasks, &init_task.tasks);
                         __get_cpu_var(process_counts)++;
                 }
@@ -1310,7 +1313,8 @@ bad_fork_free_pid:
         if (pid != &init_struct_pid)
                 free_pid(pid);
 bad_fork_cleanup_io:
-        put_io_context(p->io_context);
+        if (p->io_context)
+                exit_io_context(p);
 bad_fork_cleanup_namespaces:
         exit_task_namespaces(p);
 bad_fork_cleanup_mm: