9 files changed, 135 insertions, 29 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 0c56320d38dc..32fa03ad1984 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -291,8 +291,10 @@ int kauditd_thread(void *dummy)
                         set_current_state(TASK_INTERRUPTIBLE);
                         add_wait_queue(&kauditd_wait, &wait);
 
-                        if (!skb_queue_len(&audit_skb_queue))
+                        if (!skb_queue_len(&audit_skb_queue)) {
+                                try_to_freeze();
                                 schedule();
+                        }
 
                         __set_current_state(TASK_RUNNING);
                         remove_wait_queue(&kauditd_wait, &wait);
diff --git a/kernel/futex.c b/kernel/futex.c
index 5872e3507f35..5e71a6bf6f6b 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -270,7 +270,13 @@ static void wake_futex(struct futex_q *q)
         /*
          * The waiting task can free the futex_q as soon as this is written,
          * without taking any locks.  This must come last.
+         *
+         * A memory barrier is required here to prevent the following store
+         * to lock_ptr from getting ahead of the wakeup. Clearing the lock
+         * at the end of wake_up_all() does not prevent this store from
+         * moving.
          */
+        wmb();
         q->lock_ptr = NULL;
 }
 
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 5beda378cc75..3bb71e63a37e 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -246,6 +246,19 @@ static int __kprobes aggr_break_handler(struct kprobe *p, struct pt_regs *regs)
         return ret;
 }
 
+/* Walks the list and increments nmissed count for multiprobe case */
+void __kprobes kprobes_inc_nmissed_count(struct kprobe *p)
+{
+        struct kprobe *kp;
+        if (p->pre_handler != aggr_pre_handler) {
+                p->nmissed++;
+        } else {
+                list_for_each_entry_rcu(kp, &p->list, list)
+                        kp->nmissed++;
+        }
+        return;
+}
+
 /* Called with kretprobe_lock held */
 struct kretprobe_instance __kprobes *get_free_rp_inst(struct kretprobe *rp)
 {
@@ -399,10 +412,7 @@ static inline void add_aggr_kprobe(struct kprobe *ap, struct kprobe *p)
         INIT_LIST_HEAD(&ap->list);
         list_add_rcu(&p->list, &ap->list);
 
-        INIT_HLIST_NODE(&ap->hlist);
-        hlist_del_rcu(&p->hlist);
-        hlist_add_head_rcu(&ap->hlist,
-                &kprobe_table[hash_ptr(ap->addr, KPROBE_HASH_BITS)]);
+        hlist_replace_rcu(&p->hlist, &ap->hlist);
 }
 
 /*
@@ -462,9 +472,16 @@ int __kprobes register_kprobe(struct kprobe *p)
         int ret = 0;
         unsigned long flags = 0;
         struct kprobe *old_p;
+        struct module *mod;
+
+        if ((!kernel_text_address((unsigned long) p->addr)) ||
+                in_kprobes_functions((unsigned long) p->addr))
+                return -EINVAL;
+
+        if ((mod = module_text_address((unsigned long) p->addr)) &&
+                        (unlikely(!try_module_get(mod))))
+                return -EINVAL;
 
-        if ((ret = in_kprobes_functions((unsigned long) p->addr)) != 0)
-                return ret;
         if ((ret = arch_prepare_kprobe(p)) != 0)
                 goto rm_kprobe;
 
@@ -488,6 +505,8 @@ out:
 rm_kprobe:
         if (ret == -EEXIST)
                 arch_remove_kprobe(p);
+        if (ret && mod)
+                module_put(mod);
         return ret;
 }
 
@@ -495,6 +514,7 @@ void __kprobes unregister_kprobe(struct kprobe *p)
 {
         unsigned long flags;
         struct kprobe *old_p;
+        struct module *mod;
 
         spin_lock_irqsave(&kprobe_lock, flags);
         old_p = get_kprobe(p->addr);
@@ -506,6 +526,10 @@ void __kprobes unregister_kprobe(struct kprobe *p)
                         cleanup_kprobe(p, flags);
 
                 synchronize_sched();
+
+                if ((mod = module_text_address((unsigned long)p->addr)))
+                        module_put(mod);
+
                 if (old_p->pre_handler == aggr_pre_handler &&
                                 list_empty(&old_p->list))
                         kfree(old_p);
diff --git a/kernel/params.c b/kernel/params.c
index 47ba69547945..c76ad25e6a21 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -619,7 +619,7 @@ static void __init param_sysfs_builtin(void)
 
 
 /* module-related sysfs stuff */
-#ifdef CONFIG_MODULES
+#ifdef CONFIG_SYSFS
 
 #define to_module_attr(n) container_of(n, struct module_attribute, attr);
 #define to_module_kobject(n) container_of(n, struct module_kobject, kobj);
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index c4d159a21e04..48d3bce465b8 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -116,6 +116,10 @@ void fastcall call_rcu(struct rcu_head *head,
         local_irq_restore(flags);
 }
 
+static atomic_t rcu_barrier_cpu_count;
+static struct semaphore rcu_barrier_sema;
+static struct completion rcu_barrier_completion;
+
 /**
  * call_rcu_bh - Queue an RCU for invocation after a quicker grace period.
  * @head: structure to be used for queueing the RCU updates.
@@ -162,6 +166,42 @@ long rcu_batches_completed(void)
         return rcu_ctrlblk.completed;
 }
 
+static void rcu_barrier_callback(struct rcu_head *notused)
+{
+        if (atomic_dec_and_test(&rcu_barrier_cpu_count))
+                complete(&rcu_barrier_completion);
+}
+
+/*
+ * Called with preemption disabled, and from cross-cpu IRQ context.
+ */
+static void rcu_barrier_func(void *notused)
+{
+        int cpu = smp_processor_id();
+        struct rcu_data *rdp = &per_cpu(rcu_data, cpu);
+        struct rcu_head *head;
+
+        head = &rdp->barrier;
+        atomic_inc(&rcu_barrier_cpu_count);
+        call_rcu(head, rcu_barrier_callback);
+}
+
+/**
+ * rcu_barrier - Wait until all the in-flight RCUs are complete.
+ */
+void rcu_barrier(void)
+{
+        BUG_ON(in_interrupt());
+        /* Take cpucontrol semaphore to protect against CPU hotplug */
+        down(&rcu_barrier_sema);
+        init_completion(&rcu_barrier_completion);
+        atomic_set(&rcu_barrier_cpu_count, 0);
+        on_each_cpu(rcu_barrier_func, NULL, 0, 1);
+        wait_for_completion(&rcu_barrier_completion);
+        up(&rcu_barrier_sema);
+}
+EXPORT_SYMBOL_GPL(rcu_barrier);
+
 /*
  * Invoke the completed RCU callbacks. They are expected to be in
  * a per-cpu list.
@@ -217,15 +257,23 @@ static void rcu_start_batch(struct rcu_ctrlblk *rcp, struct rcu_state *rsp,
 
         if (rcp->next_pending &&
                         rcp->completed == rcp->cur) {
-                /* Can't change, since spin lock held. */
-                cpus_andnot(rsp->cpumask, cpu_online_map, nohz_cpu_mask);
-
                 rcp->next_pending = 0;
-                /* next_pending == 0 must be visible in __rcu_process_callbacks()
-                 * before it can see new value of cur.
+                /*
+                 * next_pending == 0 must be visible in
+                 * __rcu_process_callbacks() before it can see new value of cur.
                  */
                 smp_wmb();
                 rcp->cur++;
+
+                /*
+                 * Accessing nohz_cpu_mask before incrementing rcp->cur needs a
+                 * Barrier  Otherwise it can cause tickless idle CPUs to be
+                 * included in rsp->cpumask, which will extend graceperiods
+                 * unnecessarily.
+                 */
+                smp_mb();
+                cpus_andnot(rsp->cpumask, cpu_online_map, nohz_cpu_mask);
+
         }
 }
 
@@ -457,6 +505,7 @@ static struct notifier_block __devinitdata rcu_nb = {
  */
 void __init rcu_init(void)
 {
+        sema_init(&rcu_barrier_sema, 1);
         rcu_cpu_notify(&rcu_nb, CPU_UP_PREPARE,
                         (void *)(long)smp_processor_id());
         /* Register notifier for non-boot CPUs */
diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
index 88c28d476550..49fbbeff201c 100644
--- a/kernel/rcutorture.c
+++ b/kernel/rcutorture.c
@@ -409,9 +409,8 @@ rcu_torture_cleanup(void)
         stats_task = NULL;
 
         /* Wait for all RCU callbacks to fire.  */
+        rcu_barrier();
 
-        for (i = 0; i < RCU_TORTURE_PIPE_LEN; i++)
-                synchronize_rcu();
         rcu_torture_stats_print();  /* -After- the stats thread is stopped! */
         printk(KERN_ALERT TORTURE_FLAG
                "--- End of test: %s\n",
diff --git a/kernel/sys.c b/kernel/sys.c
index bce933ebb29f..eecf84526afe 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -32,6 +32,7 @@
 
 #include <linux/compat.h>
 #include <linux/syscalls.h>
+#include <linux/kprobes.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -168,7 +169,7 @@ EXPORT_SYMBOL(notifier_chain_unregister);
  *      of the last notifier function called.
  */
  
-int notifier_call_chain(struct notifier_block **n, unsigned long val, void *v)
+int __kprobes notifier_call_chain(struct notifier_block **n, unsigned long val, void *v)
 {
         int ret=NOTIFY_DONE;
         struct notifier_block *nb = *n;
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 9990e10192e8..b53115b882e1 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2192,29 +2192,32 @@ int sysctl_string(ctl_table *table, int __user *name, int nlen,
                   void __user *oldval, size_t __user *oldlenp,
                   void __user *newval, size_t newlen, void **context)
 {
-        size_t l, len;
-        
         if (!table->data || !table->maxlen) 
                 return -ENOTDIR;
         
         if (oldval && oldlenp) {
-                if (get_user(len, oldlenp))
+                size_t bufsize;
+                if (get_user(bufsize, oldlenp))
                         return -EFAULT;
-                if (len) {
-                        l = strlen(table->data);
-                        if (len > l) len = l;
-                        if (len >= table->maxlen)
+                if (bufsize) {
+                        size_t len = strlen(table->data), copied;
+
+                        /* This shouldn't trigger for a well-formed sysctl */
+                        if (len > table->maxlen)
                                 len = table->maxlen;
-                        if(copy_to_user(oldval, table->data, len))
-                                return -EFAULT;
-                        if(put_user(0, ((char __user *) oldval) + len))
+
+                        /* Copy up to a max of bufsize-1 bytes of the string */
+                        copied = (len >= bufsize) ? bufsize - 1 : len;
+
+                        if (copy_to_user(oldval, table->data, copied) ||
+                            put_user(0, (char __user *)(oldval + copied)))
                                 return -EFAULT;
-                        if(put_user(len, oldlenp))
+                        if (put_user(len, oldlenp))
                                 return -EFAULT;
                 }
         }
         if (newval && newlen) {
-                len = newlen;
+                size_t len = newlen;
                 if (len > table->maxlen)
                         len = table->maxlen;
                 if(copy_from_user(table->data, newval, len))
@@ -2223,7 +2226,7 @@ int sysctl_string(ctl_table *table, int __user *name, int nlen,
                         len--;
                 ((char *) table->data)[len] = 0;
         }
-        return 0;
+        return 1;
 }
 
 /*
diff --git a/kernel/time.c b/kernel/time.c
index 245d595a13cb..b94bfa8c03e0 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -561,6 +561,28 @@ void getnstimeofday(struct timespec *tv)
 EXPORT_SYMBOL_GPL(getnstimeofday);
 #endif
 
+void getnstimestamp(struct timespec *ts)
+{
+        unsigned int seq;
+        struct timespec wall2mono;
+
+        /* synchronize with settimeofday() changes */
+        do {
+                seq = read_seqbegin(&xtime_lock);
+                getnstimeofday(ts);
+                wall2mono = wall_to_monotonic;
+        } while(unlikely(read_seqretry(&xtime_lock, seq)));
+
+        /* adjust to monotonicaly-increasing values */
+        ts->tv_sec += wall2mono.tv_sec;
+        ts->tv_nsec += wall2mono.tv_nsec;
+        while (unlikely(ts->tv_nsec >= NSEC_PER_SEC)) {
+                ts->tv_nsec -= NSEC_PER_SEC;
+                ts->tv_sec++;
+        }
+}
+EXPORT_SYMBOL_GPL(getnstimestamp);
+
 #if (BITS_PER_LONG < 64)
 u64 get_jiffies_64(void)
 {