11 files changed, 101 insertions, 49 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 83096b67510a..aefa73a8a586 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -560,7 +560,7 @@ static void audit_buffer_free(struct audit_buffer *ab)
 }
 
 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
-                                                unsigned int __nocast gfp_mask, int type)
+                                                gfp_t gfp_mask, int type)
 {
         unsigned long flags;
         struct audit_buffer *ab = NULL;
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 79866bc6b3a1..28176d083f7b 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -968,8 +968,6 @@ static ssize_t cpuset_common_file_read(struct file *file, char __user *buf,
         char *page;
         ssize_t retval = 0;
         char *s;
-        char *start;
-        size_t n;
 
         if (!(page = (char *)__get_free_page(GFP_KERNEL)))
                 return -ENOMEM;
@@ -999,14 +997,7 @@ static ssize_t cpuset_common_file_read(struct file *file, char __user *buf,
         *s++ = '\n';
         *s = '\0';
 
-        /* Do nothing if *ppos is at the eof or beyond the eof. */
-        if (s - page <= *ppos)
-                return 0;
-
-        start = page + *ppos;
-        n = s - start;
-        retval = n - copy_to_user(buf, start, min(n, nbytes));
-        *ppos += retval;
+        retval = simple_read_from_buffer(buf, nbytes, ppos, page, s - page);
 out:
         free_page((unsigned long)page);
         return retval;
@@ -1679,7 +1670,7 @@ static const struct cpuset *nearest_exclusive_ancestor(const struct cpuset *cs)
  *      GFP_USER     - only nodes in current tasks mems allowed ok.
  **/
 
-int cpuset_zone_allowed(struct zone *z, unsigned int __nocast gfp_mask)
+int cpuset_zone_allowed(struct zone *z, gfp_t gfp_mask)
 {
         int node;                       /* node that zone z is on */
         const struct cpuset *cs;        /* current cpuset ancestors */
diff --git a/kernel/exit.c b/kernel/exit.c
index ee6d8b8abef5..43077732619b 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1203,7 +1203,7 @@ static int wait_task_stopped(task_t *p, int delayed_group_leader, int noreap,
 
                 exit_code = p->exit_code;
                 if (unlikely(!exit_code) ||
-                    unlikely(p->state > TASK_STOPPED))
+                    unlikely(p->state & TASK_TRACED))
                         goto bail_ref;
                 return wait_noreap_copyout(p, pid, uid,
                                            why, (exit_code << 8) | 0x7f,
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index 179baafcdd96..64ab045c3d9d 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -36,7 +36,7 @@
  * struct kfifo with kfree().
  */
 struct kfifo *kfifo_init(unsigned char *buffer, unsigned int size,
-                         unsigned int __nocast gfp_mask, spinlock_t *lock)
+                         gfp_t gfp_mask, spinlock_t *lock)
 {
         struct kfifo *fifo;
 
@@ -64,7 +64,7 @@ EXPORT_SYMBOL(kfifo_init);
  *
  * The size will be rounded-up to a power of 2.
  */
-struct kfifo *kfifo_alloc(unsigned int size, unsigned int __nocast gfp_mask, spinlock_t *lock)
+struct kfifo *kfifo_alloc(unsigned int size, gfp_t gfp_mask, spinlock_t *lock)
 {
         unsigned char *buffer;
         struct kfifo *ret;
diff --git a/kernel/params.c b/kernel/params.c
index fbf173215fd2..1a8614bac5d5 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -80,8 +80,6 @@ static char *next_arg(char *args, char **param, char **val)
         int in_quote = 0, quoted = 0;
         char *next;
 
-        /* Chew any extra spaces */
-        while (*args == ' ') args++;
         if (*args == '"') {
                 args++;
                 in_quote = 1;
@@ -121,6 +119,10 @@ static char *next_arg(char *args, char **param, char **val)
                 next = args + i + 1;
         } else
                 next = args + i;
+
+        /* Chew up trailing spaces. */
+        while (*next == ' ')
+                next++;
         return next;
 }
 
@@ -135,6 +137,10 @@ int parse_args(const char *name,
 
         DEBUGP("Parsing ARGS: %s\n", args);
 
+        /* Chew leading spaces */
+        while (*args == ' ')
+                args++;
+
         while (*args) {
                 int ret;
 
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index ad85d3f0dcc4..7a51a5597c33 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -424,6 +424,7 @@ static void cleanup_timers(struct list_head *head,
         cputime_t ptime = cputime_add(utime, stime);
 
         list_for_each_entry_safe(timer, next, head, entry) {
+                put_task_struct(timer->task);
                 timer->task = NULL;
                 list_del_init(&timer->entry);
                 if (cputime_lt(timer->expires.cpu, ptime)) {
@@ -436,6 +437,7 @@ static void cleanup_timers(struct list_head *head,
 
         ++head;
         list_for_each_entry_safe(timer, next, head, entry) {
+                put_task_struct(timer->task);
                 timer->task = NULL;
                 list_del_init(&timer->entry);
                 if (cputime_lt(timer->expires.cpu, utime)) {
@@ -448,6 +450,7 @@ static void cleanup_timers(struct list_head *head,
 
         ++head;
         list_for_each_entry_safe(timer, next, head, entry) {
+                put_task_struct(timer->task);
                 timer->task = NULL;
                 list_del_init(&timer->entry);
                 if (timer->expires.sched < sched_time) {
diff --git a/kernel/power/power.h b/kernel/power/power.h
index 9c9167d910dd..6748de23e83c 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -9,6 +9,9 @@
 #define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)
 #endif
 
+#define MAX_PBES        ((PAGE_SIZE - sizeof(struct new_utsname) \
+                        - 4 - 3*sizeof(unsigned long) - sizeof(int) \
+                        - sizeof(void *)) / sizeof(swp_entry_t))
 
 struct swsusp_info {
         struct new_utsname      uts;
@@ -18,7 +21,7 @@ struct swsusp_info {
         unsigned long           image_pages;
         unsigned long           pagedir_pages;
         suspend_pagedir_t       * suspend_pagedir;
-        swp_entry_t             pagedir[768];
+        swp_entry_t             pagedir[MAX_PBES];
 } __attribute__((aligned(PAGE_SIZE)));
 
 
diff --git a/kernel/power/swsusp.c b/kernel/power/swsusp.c
index 1cc9ff25e479..2d5c45676442 100644
--- a/kernel/power/swsusp.c
+++ b/kernel/power/swsusp.c
@@ -402,15 +402,14 @@ static int write_page(unsigned long addr, swp_entry_t * loc)
 static void data_free(void)
 {
         swp_entry_t entry;
-        int i;
+        struct pbe * p;
 
-        for (i = 0; i < nr_copy_pages; i++) {
-                entry = (pagedir_nosave + i)->swap_address;
+        for_each_pbe(p, pagedir_nosave) {
+                entry = p->swap_address;
                 if (entry.val)
                         swap_free(entry);
                 else
                         break;
-                (pagedir_nosave + i)->swap_address = (swp_entry_t){0};
         }
 }
 
@@ -932,6 +931,10 @@ static int swsusp_alloc(void)
         if (!enough_swap())
                 return -ENOSPC;
 
+        if (MAX_PBES < nr_copy_pages / PBES_PER_PAGE +
+            !!(nr_copy_pages % PBES_PER_PAGE))
+                return -ENOSPC;
+
         if (!(pagedir_save = alloc_pagedir(nr_copy_pages))) {
                 printk(KERN_ERR "suspend: Allocating pagedir failed.\n");
                 return -ENOMEM;
@@ -1092,7 +1095,7 @@ static inline void eat_page(void *page)
         *eaten_memory = c;
 }
 
-static unsigned long get_usable_page(unsigned gfp_mask)
+unsigned long get_usable_page(unsigned gfp_mask)
 {
         unsigned long m;
 
@@ -1106,7 +1109,7 @@ static unsigned long get_usable_page(unsigned gfp_mask)
         return m;
 }
 
-static void free_eaten_memory(void)
+void free_eaten_memory(void)
 {
         unsigned long m;
         void **c;
@@ -1438,9 +1441,9 @@ static int read_pagedir(struct pbe *pblist)
         }
 
         if (error)
-                free_page((unsigned long)pblist);
-
-        BUG_ON(i != swsusp_info.pagedir_pages);
+                free_pagedir(pblist);
+        else
+                BUG_ON(i != swsusp_info.pagedir_pages);
 
         return error;
 }
@@ -1478,11 +1481,12 @@ static int read_suspend_image(void)
         /* Allocate memory for the image and read the data from swap */
 
         error = check_pagedir(pagedir_nosave);
-        free_eaten_memory();
+
         if (!error)
                 error = data_read(pagedir_nosave);
 
         if (error) { /* We fail cleanly */
+                free_eaten_memory();
                 for_each_pbe (p, pagedir_nosave)
                         if (p->address) {
                                 free_page(p->address);
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index bef3b6901b76..2559d4b8f23f 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -71,7 +71,7 @@ DEFINE_PER_CPU(struct rcu_data, rcu_bh_data) = { 0L };
 
 /* Fake initialization required by compiler */
 static DEFINE_PER_CPU(struct tasklet_struct, rcu_tasklet) = {NULL};
-static int maxbatch = 10;
+static int maxbatch = 10000;
 
 #ifndef __HAVE_ARCH_CMPXCHG
 /*
@@ -109,6 +109,10 @@ void fastcall call_rcu(struct rcu_head *head,
         rdp = &__get_cpu_var(rcu_data);
         *rdp->nxttail = head;
         rdp->nxttail = &head->next;
+
+        if (unlikely(++rdp->count > 10000))
+                set_need_resched();
+
         local_irq_restore(flags);
 }
 
@@ -140,6 +144,12 @@ void fastcall call_rcu_bh(struct rcu_head *head,
         rdp = &__get_cpu_var(rcu_bh_data);
         *rdp->nxttail = head;
         rdp->nxttail = &head->next;
+        rdp->count++;
+/*
+ *  Should we directly call rcu_do_batch() here ?
+ *  if (unlikely(rdp->count > 10000))
+ *      rcu_do_batch(rdp);
+ */
         local_irq_restore(flags);
 }
 
@@ -157,6 +167,7 @@ static void rcu_do_batch(struct rcu_data *rdp)
                 next = rdp->donelist = list->next;
                 list->func(list);
                 list = next;
+                rdp->count--;
                 if (++count >= maxbatch)
                         break;
         }
diff --git a/kernel/signal.c b/kernel/signal.c
index b92c3c9f8b9a..50c992643771 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -262,7 +262,7 @@ next_signal(struct sigpending *pending, sigset_t *mask)
         return sig;
 }
 
-static struct sigqueue *__sigqueue_alloc(struct task_struct *t, unsigned int __nocast flags,
+static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
                                          int override_rlimit)
 {
         struct sigqueue *q = NULL;
@@ -578,7 +578,8 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
                  * is to alert stop-signal processing code when another
                  * processor has come along and cleared the flag.
                  */
-                tsk->signal->flags |= SIGNAL_STOP_DEQUEUED;
+                if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT))
+                        tsk->signal->flags |= SIGNAL_STOP_DEQUEUED;
         }
         if ( signr &&
              ((info->si_code & __SI_MASK) == __SI_TIMER) &&
@@ -936,34 +937,31 @@ force_sig_specific(int sig, struct task_struct *t)
  * as soon as they're available, so putting the signal on the shared queue
  * will be equivalent to sending it to one such thread.
  */
-#define wants_signal(sig, p, mask)                      \
-        (!sigismember(&(p)->blocked, sig)               \
-         && !((p)->state & mask)                        \
-         && !((p)->flags & PF_EXITING)                  \
-         && (task_curr(p) || !signal_pending(p)))
-
+static inline int wants_signal(int sig, struct task_struct *p)
+{
+        if (sigismember(&p->blocked, sig))
+                return 0;
+        if (p->flags & PF_EXITING)
+                return 0;
+        if (sig == SIGKILL)
+                return 1;
+        if (p->state & (TASK_STOPPED | TASK_TRACED))
+                return 0;
+        return task_curr(p) || !signal_pending(p);
+}
 
 static void
 __group_complete_signal(int sig, struct task_struct *p)
 {
-        unsigned int mask;
         struct task_struct *t;
 
         /*
-         * Don't bother traced and stopped tasks (but
-         * SIGKILL will punch through that).
-         */
-        mask = TASK_STOPPED | TASK_TRACED;
-        if (sig == SIGKILL)
-                mask = 0;
-
-        /*
          * Now find a thread we can wake up to take the signal off the queue.
          *
          * If the main thread wants the signal, it gets first crack.
          * Probably the least surprising to the average bear.
          */
-        if (wants_signal(sig, p, mask))
+        if (wants_signal(sig, p))
                 t = p;
         else if (thread_group_empty(p))
                 /*
@@ -981,7 +979,7 @@ __group_complete_signal(int sig, struct task_struct *p)
                         t = p->signal->curr_target = p;
                 BUG_ON(t->tgid != p->tgid);
 
-                while (!wants_signal(sig, t, mask)) {
+                while (!wants_signal(sig, t)) {
                         t = next_thread(t);
                         if (t == p->signal->curr_target)
                                 /*
@@ -1195,6 +1193,40 @@ kill_proc_info(int sig, struct siginfo *info, pid_t pid)
         return error;
 }
 
+/* like kill_proc_info(), but doesn't use uid/euid of "current" */
+int kill_proc_info_as_uid(int sig, struct siginfo *info, pid_t pid,
+                      uid_t uid, uid_t euid)
+{
+        int ret = -EINVAL;
+        struct task_struct *p;
+
+        if (!valid_signal(sig))
+                return ret;
+
+        read_lock(&tasklist_lock);
+        p = find_task_by_pid(pid);
+        if (!p) {
+                ret = -ESRCH;
+                goto out_unlock;
+        }
+        if ((!info || ((unsigned long)info != 1 &&
+                        (unsigned long)info != 2 && SI_FROMUSER(info)))
+            && (euid != p->suid) && (euid != p->uid)
+            && (uid != p->suid) && (uid != p->uid)) {
+                ret = -EPERM;
+                goto out_unlock;
+        }
+        if (sig && p->sighand) {
+                unsigned long flags;
+                spin_lock_irqsave(&p->sighand->siglock, flags);
+                ret = __group_send_sig_info(sig, info, p);
+                spin_unlock_irqrestore(&p->sighand->siglock, flags);
+        }
+out_unlock:
+        read_unlock(&tasklist_lock);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(kill_proc_info_as_uid);
 
 /*
  * kill_something_info() interprets pid in interesting ways just like kill(2).
@@ -1766,7 +1798,8 @@ do_signal_stop(int signr)
                                  * stop is always done with the siglock held,
                                  * so this check has no races.
                                  */
-                                if (t->state < TASK_STOPPED) {
+                                if (!t->exit_state &&
+                                    !(t->state & (TASK_STOPPED|TASK_TRACED))) {
                                         stop_count++;
                                         signal_wake_up(t, 0);
                                 }
diff --git a/kernel/time.c b/kernel/time.c
index dd5ae1162a8f..40c2410ac99a 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -570,6 +570,7 @@ void getnstimeofday(struct timespec *tv)
         tv->tv_sec = x.tv_sec;
         tv->tv_nsec = x.tv_usec * NSEC_PER_USEC;
 }
+EXPORT_SYMBOL_GPL(getnstimeofday);
 #endif
 
 #if (BITS_PER_LONG < 64)