9 files changed, 166 insertions, 76 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 3737a682cdf5..b6eadfe30e7b 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -47,6 +47,7 @@
 #include <linux/hash.h>
 #include <linux/namei.h>
 #include <linux/smp_lock.h>
+#include <linux/pid_namespace.h>
 
 #include <asm/atomic.h>
 
@@ -734,16 +735,28 @@ static void cgroup_d_remove_dir(struct dentry *dentry)
  * reference to css->refcnt. In general, this refcnt is expected to goes down
  * to zero, soon.
  *
- * CGRP_WAIT_ON_RMDIR flag is modified under cgroup's inode->i_mutex;
+ * CGRP_WAIT_ON_RMDIR flag is set under cgroup's inode->i_mutex;
  */
 DECLARE_WAIT_QUEUE_HEAD(cgroup_rmdir_waitq);
 
-static void cgroup_wakeup_rmdir_waiters(const struct cgroup *cgrp)
+static void cgroup_wakeup_rmdir_waiter(struct cgroup *cgrp)
 {
-        if (unlikely(test_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags)))
+        if (unlikely(test_and_clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags)))
                 wake_up_all(&cgroup_rmdir_waitq);
 }
 
+void cgroup_exclude_rmdir(struct cgroup_subsys_state *css)
+{
+        css_get(css);
+}
+
+void cgroup_release_and_wakeup_rmdir(struct cgroup_subsys_state *css)
+{
+        cgroup_wakeup_rmdir_waiter(css->cgroup);
+        css_put(css);
+}
+
+
 static int rebind_subsystems(struct cgroupfs_root *root,
                               unsigned long final_bits)
 {
@@ -960,6 +973,7 @@ static void init_cgroup_housekeeping(struct cgroup *cgrp)
         INIT_LIST_HEAD(&cgrp->children);
         INIT_LIST_HEAD(&cgrp->css_sets);
         INIT_LIST_HEAD(&cgrp->release_list);
+        INIT_LIST_HEAD(&cgrp->pids_list);
         init_rwsem(&cgrp->pids_mutex);
 }
 static void init_cgroup_root(struct cgroupfs_root *root)
@@ -1357,7 +1371,7 @@ int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk)
          * wake up rmdir() waiter. the rmdir should fail since the cgroup
          * is no longer empty.
          */
-        cgroup_wakeup_rmdir_waiters(cgrp);
+        cgroup_wakeup_rmdir_waiter(cgrp);
         return 0;
 }
 
@@ -2201,12 +2215,30 @@ err:
         return ret;
 }
 
+/*
+ * Cache pids for all threads in the same pid namespace that are
+ * opening the same "tasks" file.
+ */
+struct cgroup_pids {
+        /* The node in cgrp->pids_list */
+        struct list_head list;
+        /* The cgroup those pids belong to */
+        struct cgroup *cgrp;
+        /* The namepsace those pids belong to */
+        struct pid_namespace *ns;
+        /* Array of process ids in the cgroup */
+        pid_t *tasks_pids;
+        /* How many files are using the this tasks_pids array */
+        int use_count;
+        /* Length of the current tasks_pids array */
+        int length;
+};
+
 static int cmppid(const void *a, const void *b)
 {
         return *(pid_t *)a - *(pid_t *)b;
 }
 
-
 /*
  * seq_file methods for the "tasks" file. The seq_file position is the
  * next pid to display; the seq_file iterator is a pointer to the pid
@@ -2221,45 +2253,47 @@ static void *cgroup_tasks_start(struct seq_file *s, loff_t *pos)
          * after a seek to the start). Use a binary-search to find the
          * next pid to display, if any
          */
-        struct cgroup *cgrp = s->private;
+        struct cgroup_pids *cp = s->private;
+        struct cgroup *cgrp = cp->cgrp;
         int index = 0, pid = *pos;
         int *iter;
 
         down_read(&cgrp->pids_mutex);
         if (pid) {
-                int end = cgrp->pids_length;
+                int end = cp->length;
 
                 while (index < end) {
                         int mid = (index + end) / 2;
-                        if (cgrp->tasks_pids[mid] == pid) {
+                        if (cp->tasks_pids[mid] == pid) {
                                 index = mid;
                                 break;
-                        } else if (cgrp->tasks_pids[mid] <= pid)
+                        } else if (cp->tasks_pids[mid] <= pid)
                                 index = mid + 1;
                         else
                                 end = mid;
                 }
         }
         /* If we're off the end of the array, we're done */
-        if (index >= cgrp->pids_length)
+        if (index >= cp->length)
                 return NULL;
         /* Update the abstract position to be the actual pid that we found */
-        iter = cgrp->tasks_pids + index;
+        iter = cp->tasks_pids + index;
         *pos = *iter;
         return iter;
 }
 
 static void cgroup_tasks_stop(struct seq_file *s, void *v)
 {
-        struct cgroup *cgrp = s->private;
+        struct cgroup_pids *cp = s->private;
+        struct cgroup *cgrp = cp->cgrp;
         up_read(&cgrp->pids_mutex);
 }
 
 static void *cgroup_tasks_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct cgroup *cgrp = s->private;
+        struct cgroup_pids *cp = s->private;
         int *p = v;
-        int *end = cgrp->tasks_pids + cgrp->pids_length;
+        int *end = cp->tasks_pids + cp->length;
 
         /*
          * Advance to the next pid in the array. If this goes off the
@@ -2286,26 +2320,33 @@ static struct seq_operations cgroup_tasks_seq_operations = {
         .show = cgroup_tasks_show,
 };
 
-static void release_cgroup_pid_array(struct cgroup *cgrp)
+static void release_cgroup_pid_array(struct cgroup_pids *cp)
 {
+        struct cgroup *cgrp = cp->cgrp;
+
         down_write(&cgrp->pids_mutex);
-        BUG_ON(!cgrp->pids_use_count);
-        if (!--cgrp->pids_use_count) {
-                kfree(cgrp->tasks_pids);
-                cgrp->tasks_pids = NULL;
-                cgrp->pids_length = 0;
+        BUG_ON(!cp->use_count);
+        if (!--cp->use_count) {
+                list_del(&cp->list);
+                put_pid_ns(cp->ns);
+                kfree(cp->tasks_pids);
+                kfree(cp);
         }
         up_write(&cgrp->pids_mutex);
 }
 
 static int cgroup_tasks_release(struct inode *inode, struct file *file)
 {
-        struct cgroup *cgrp = __d_cgrp(file->f_dentry->d_parent);
+        struct seq_file *seq;
+        struct cgroup_pids *cp;
 
         if (!(file->f_mode & FMODE_READ))
                 return 0;
 
-        release_cgroup_pid_array(cgrp);
+        seq = file->private_data;
+        cp = seq->private;
+
+        release_cgroup_pid_array(cp);
         return seq_release(inode, file);
 }
 
@@ -2324,6 +2365,8 @@ static struct file_operations cgroup_tasks_operations = {
 static int cgroup_tasks_open(struct inode *unused, struct file *file)
 {
         struct cgroup *cgrp = __d_cgrp(file->f_dentry->d_parent);
+        struct pid_namespace *ns = current->nsproxy->pid_ns;
+        struct cgroup_pids *cp;
         pid_t *pidarray;
         int npids;
         int retval;
@@ -2350,20 +2393,37 @@ static int cgroup_tasks_open(struct inode *unused, struct file *file)
          * array if necessary
          */
         down_write(&cgrp->pids_mutex);
-        kfree(cgrp->tasks_pids);
-        cgrp->tasks_pids = pidarray;
-        cgrp->pids_length = npids;
-        cgrp->pids_use_count++;
+
+        list_for_each_entry(cp, &cgrp->pids_list, list) {
+                if (ns == cp->ns)
+                        goto found;
+        }
+
+        cp = kzalloc(sizeof(*cp), GFP_KERNEL);
+        if (!cp) {
+                up_write(&cgrp->pids_mutex);
+                kfree(pidarray);
+                return -ENOMEM;
+        }
+        cp->cgrp = cgrp;
+        cp->ns = ns;
+        get_pid_ns(ns);
+        list_add(&cp->list, &cgrp->pids_list);
+found:
+        kfree(cp->tasks_pids);
+        cp->tasks_pids = pidarray;
+        cp->length = npids;
+        cp->use_count++;
         up_write(&cgrp->pids_mutex);
 
         file->f_op = &cgroup_tasks_operations;
 
         retval = seq_open(file, &cgroup_tasks_seq_operations);
         if (retval) {
-                release_cgroup_pid_array(cgrp);
+                release_cgroup_pid_array(cp);
                 return retval;
         }
-        ((struct seq_file *)file->private_data)->private = cgrp;
+        ((struct seq_file *)file->private_data)->private = cp;
         return 0;
 }
 
@@ -2696,33 +2756,42 @@ again:
         mutex_unlock(&cgroup_mutex);
 
         /*
+         * In general, subsystem has no css->refcnt after pre_destroy(). But
+         * in racy cases, subsystem may have to get css->refcnt after
+         * pre_destroy() and it makes rmdir return with -EBUSY. This sometimes
+         * make rmdir return -EBUSY too often. To avoid that, we use waitqueue
+         * for cgroup's rmdir. CGRP_WAIT_ON_RMDIR is for synchronizing rmdir
+         * and subsystem's reference count handling. Please see css_get/put
+         * and css_tryget() and cgroup_wakeup_rmdir_waiter() implementation.
+         */
+        set_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
+
+        /*
          * Call pre_destroy handlers of subsys. Notify subsystems
          * that rmdir() request comes.
          */
         ret = cgroup_call_pre_destroy(cgrp);
-        if (ret)
+        if (ret) {
+                clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
                 return ret;
+        }
 
         mutex_lock(&cgroup_mutex);
         parent = cgrp->parent;
         if (atomic_read(&cgrp->count) || !list_empty(&cgrp->children)) {
+                clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
                 mutex_unlock(&cgroup_mutex);
                 return -EBUSY;
         }
-        /*
-         * css_put/get is provided for subsys to grab refcnt to css. In typical
-         * case, subsystem has no reference after pre_destroy(). But, under
-         * hierarchy management, some *temporal* refcnt can be hold.
-         * To avoid returning -EBUSY to a user, waitqueue is used. If subsys
-         * is really busy, it should return -EBUSY at pre_destroy(). wake_up
-         * is called when css_put() is called and refcnt goes down to 0.
-         */
-        set_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
         prepare_to_wait(&cgroup_rmdir_waitq, &wait, TASK_INTERRUPTIBLE);
-
         if (!cgroup_clear_css_refs(cgrp)) {
                 mutex_unlock(&cgroup_mutex);
-                schedule();
+                /*
+                 * Because someone may call cgroup_wakeup_rmdir_waiter() before
+                 * prepare_to_wait(), we need to check this flag.
+                 */
+                if (test_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags))
+                        schedule();
                 finish_wait(&cgroup_rmdir_waitq, &wait);
                 clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
                 if (signal_pending(current))
@@ -3294,7 +3363,7 @@ void __css_put(struct cgroup_subsys_state *css)
                         set_bit(CGRP_RELEASABLE, &cgrp->flags);
                         check_for_release(cgrp);
                 }
-                cgroup_wakeup_rmdir_waiters(cgrp);
+                cgroup_wakeup_rmdir_waiter(cgrp);
         }
         rcu_read_unlock();
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 9b42695f0d14..29b532e718f7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -426,6 +426,7 @@ static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
         init_rwsem(&mm->mmap_sem);
         INIT_LIST_HEAD(&mm->mmlist);
         mm->flags = (current->mm) ? current->mm->flags : default_dump_filter;
+        mm->oom_adj = (current->mm) ? current->mm->oom_adj : 0;
         mm->core_state = NULL;
         mm->nr_ptes = 0;
         set_mm_counter(mm, file_rss, 0);
diff --git a/kernel/kexec.c b/kernel/kexec.c
index ae1c35201cc8..f336e2107f98 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1228,7 +1228,7 @@ static int __init parse_crashkernel_mem(char 			*cmdline,
         } while (*cur++ == ',');
 
         if (*crash_size > 0) {
-                while (*cur != ' ' && *cur != '@')
+                while (*cur && *cur != ' ' && *cur != '@')
                         cur++;
                 if (*cur == '@') {
                         cur++;
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 16b5739c516a..0540948e29ab 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -694,7 +694,7 @@ int __kprobes register_kprobe(struct kprobe *p)
         p->addr = addr;
 
         preempt_disable();
-        if (!__kernel_text_address((unsigned long) p->addr) ||
+        if (!kernel_text_address((unsigned long) p->addr) ||
             in_kprobes_functions((unsigned long) p->addr)) {
                 preempt_enable();
                 return -EINVAL;
diff --git a/kernel/profile.c b/kernel/profile.c
index 69911b5745eb..419250ebec4d 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -117,11 +117,12 @@ int __ref profile_init(void)
 
         cpumask_copy(prof_cpu_mask, cpu_possible_mask);
 
-        prof_buffer = kzalloc(buffer_bytes, GFP_KERNEL);
+        prof_buffer = kzalloc(buffer_bytes, GFP_KERNEL|__GFP_NOWARN);
         if (prof_buffer)
                 return 0;
 
-        prof_buffer = alloc_pages_exact(buffer_bytes, GFP_KERNEL|__GFP_ZERO);
+        prof_buffer = alloc_pages_exact(buffer_bytes,
+                                        GFP_KERNEL|__GFP_ZERO|__GFP_NOWARN);
         if (prof_buffer)
                 return 0;
 
diff --git a/kernel/signal.c b/kernel/signal.c
index ccf1ceedaebe..64c5deeaca5d 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2454,11 +2454,9 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
         stack_t oss;
         int error;
 
-        if (uoss) {
-                oss.ss_sp = (void __user *) current->sas_ss_sp;
-                oss.ss_size = current->sas_ss_size;
-                oss.ss_flags = sas_ss_flags(sp);
-        }
+        oss.ss_sp = (void __user *) current->sas_ss_sp;
+        oss.ss_size = current->sas_ss_size;
+        oss.ss_flags = sas_ss_flags(sp);
 
         if (uss) {
                 void __user *ss_sp;
@@ -2466,10 +2464,12 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
                 int ss_flags;
 
                 error = -EFAULT;
-                if (!access_ok(VERIFY_READ, uss, sizeof(*uss))
-                    || __get_user(ss_sp, &uss->ss_sp)
-                    || __get_user(ss_flags, &uss->ss_flags)
-                    || __get_user(ss_size, &uss->ss_size))
+                if (!access_ok(VERIFY_READ, uss, sizeof(*uss)))
+                        goto out;
+                error = __get_user(ss_sp, &uss->ss_sp) |
+                        __get_user(ss_flags, &uss->ss_flags) |
+                        __get_user(ss_size, &uss->ss_size);
+                if (error)
                         goto out;
 
                 error = -EPERM;
@@ -2501,13 +2501,16 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
                 current->sas_ss_size = ss_size;
         }
 
+        error = 0;
         if (uoss) {
                 error = -EFAULT;
-                if (copy_to_user(uoss, &oss, sizeof(oss)))
+                if (!access_ok(VERIFY_WRITE, uoss, sizeof(*uoss)))
                         goto out;
+                error = __put_user(oss.ss_sp, &uoss->ss_sp) |
+                        __put_user(oss.ss_size, &uoss->ss_size) |
+                        __put_user(oss.ss_flags, &uoss->ss_flags);
         }
 
-        error = 0;
 out:
         return error;
 }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 4521c77d1a1a..1f3ec2afa511 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2596,6 +2596,14 @@ ftrace_graph_open(struct inode *inode, struct file *file)
 }
 
 static int
+ftrace_graph_release(struct inode *inode, struct file *file)
+{
+        if (file->f_mode & FMODE_READ)
+                seq_release(inode, file);
+        return 0;
+}
+
+static int
 ftrace_set_func(unsigned long *array, int *idx, char *buffer)
 {
         struct dyn_ftrace *rec;
@@ -2724,9 +2732,10 @@ ftrace_graph_write(struct file *file, const char __user *ubuf,
 }
 
 static const struct file_operations ftrace_graph_fops = {
-        .open = ftrace_graph_open,
-        .read = seq_read,
-        .write = ftrace_graph_write,
+        .open           = ftrace_graph_open,
+        .read           = seq_read,
+        .write          = ftrace_graph_write,
+        .release        = ftrace_graph_release,
 };
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index e644af910124..6a2a9d484cd6 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -301,17 +301,14 @@ static const struct seq_operations stack_trace_seq_ops = {
 
 static int stack_trace_open(struct inode *inode, struct file *file)
 {
-        int ret;
-
-        ret = seq_open(file, &stack_trace_seq_ops);
-
-        return ret;
+        return seq_open(file, &stack_trace_seq_ops);
 }
 
 static const struct file_operations stack_trace_fops = {
         .open           = stack_trace_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
+        .release        = seq_release,
 };
 
 int
diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
index e66f5e493342..aea321c82fa0 100644
--- a/kernel/trace/trace_stat.c
+++ b/kernel/trace/trace_stat.c
@@ -73,7 +73,7 @@ static struct rb_node *release_next(struct rb_node *node)
         }
 }
 
-static void reset_stat_session(struct stat_session *session)
+static void __reset_stat_session(struct stat_session *session)
 {
         struct rb_node *node = session->stat_root.rb_node;
 
@@ -83,10 +83,17 @@ static void reset_stat_session(struct stat_session *session)
         session->stat_root = RB_ROOT;
 }
 
+static void reset_stat_session(struct stat_session *session)
+{
+        mutex_lock(&session->stat_mutex);
+        __reset_stat_session(session);
+        mutex_unlock(&session->stat_mutex);
+}
+
 static void destroy_session(struct stat_session *session)
 {
         debugfs_remove(session->file);
-        reset_stat_session(session);
+        __reset_stat_session(session);
         mutex_destroy(&session->stat_mutex);
         kfree(session);
 }
@@ -150,7 +157,7 @@ static int stat_seq_init(struct stat_session *session)
         int i;
 
         mutex_lock(&session->stat_mutex);
-        reset_stat_session(session);
+        __reset_stat_session(session);
 
         if (!ts->stat_cmp)
                 ts->stat_cmp = dummy_cmp;
@@ -183,7 +190,7 @@ exit:
         return ret;
 
 exit_free_rbtree:
-        reset_stat_session(session);
+        __reset_stat_session(session);
         mutex_unlock(&session->stat_mutex);
         return ret;
 }
@@ -250,16 +257,21 @@ static const struct seq_operations trace_stat_seq_ops = {
 static int tracing_stat_open(struct inode *inode, struct file *file)
 {
         int ret;
-
+        struct seq_file *m;
         struct stat_session *session = inode->i_private;
 
+        ret = stat_seq_init(session);
+        if (ret)
+                return ret;
+
         ret = seq_open(file, &trace_stat_seq_ops);
-        if (!ret) {
-                struct seq_file *m = file->private_data;
-                m->private = session;
-                ret = stat_seq_init(session);
+        if (ret) {
+                reset_stat_session(session);
+                return ret;
         }
 
+        m = file->private_data;
+        m->private = session;
         return ret;
 }
 
@@ -270,11 +282,9 @@ static int tracing_stat_release(struct inode *i, struct file *f)
 {
         struct stat_session *session = i->i_private;
 
-        mutex_lock(&session->stat_mutex);
         reset_stat_session(session);
-        mutex_unlock(&session->stat_mutex);
 
-        return 0;
+        return seq_release(i, f);
 }
 
 static const struct file_operations tracing_stat_fops = {