6 files changed, 41 insertions, 31 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index aefa73a8a586..0c56320d38dc 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -133,7 +133,7 @@ struct audit_buffer {
         struct list_head     list;
         struct sk_buff       *skb;      /* formatted skb ready to send */
         struct audit_context *ctx;      /* NULL or associated context */
-        int                  gfp_mask;
+        gfp_t                gfp_mask;
 };
 
 static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
@@ -647,7 +647,7 @@ static inline void audit_get_stamp(struct audit_context *ctx,
  * will be written at syscall exit.  If there is no associated task, tsk
  * should be NULL. */
 
-struct audit_buffer *audit_log_start(struct audit_context *ctx, int gfp_mask,
+struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
                                      int type)
 {
         struct audit_buffer     *ab     = NULL;
@@ -879,7 +879,7 @@ void audit_log_end(struct audit_buffer *ab)
 /* Log an audit record.  This is a convenience function that calls
  * audit_log_start, audit_log_vformat, and audit_log_end.  It may be
  * called in any context. */
-void audit_log(struct audit_context *ctx, int gfp_mask, int type, 
+void audit_log(struct audit_context *ctx, gfp_t gfp_mask, int type, 
                const char *fmt, ...)
 {
         struct audit_buffer *ab;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 88696f639aab..d8a68509e729 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -803,7 +803,7 @@ static void audit_log_task_info(struct audit_buffer *ab)
         up_read(&mm->mmap_sem);
 }
 
-static void audit_log_exit(struct audit_context *context, unsigned int gfp_mask)
+static void audit_log_exit(struct audit_context *context, gfp_t gfp_mask)
 {
         int i;
         struct audit_buffer *ab;
diff --git a/kernel/exit.c b/kernel/exit.c
index 4897977a1f4b..3b25b182d2be 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -825,6 +825,14 @@ fastcall NORET_TYPE void do_exit(long code)
 
         tsk->flags |= PF_EXITING;
 
+        /*
+         * Make sure we don't try to process any timer firings
+         * while we are already exiting.
+         */
+        tsk->it_virt_expires = cputime_zero;
+        tsk->it_prof_expires = cputime_zero;
+        tsk->it_sched_expires = 0;
+
         if (unlikely(in_atomic()))
                 printk(KERN_INFO "note: %s[%d] exited with preempt_count %d\n",
                                 current->comm, current->pid,
diff --git a/kernel/kexec.c b/kernel/kexec.c
index cdd4dcd8fb63..36c5d9cd4cc1 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -90,7 +90,7 @@ int kexec_should_crash(struct task_struct *p)
 static int kimage_is_destination_range(struct kimage *image,
                                        unsigned long start, unsigned long end);
 static struct page *kimage_alloc_page(struct kimage *image,
-                                       unsigned int gfp_mask,
+                                       gfp_t gfp_mask,
                                        unsigned long dest);
 
 static int do_kimage_alloc(struct kimage **rimage, unsigned long entry,
@@ -326,8 +326,7 @@ static int kimage_is_destination_range(struct kimage *image,
         return 0;
 }
 
-static struct page *kimage_alloc_pages(unsigned int gfp_mask,
-                                        unsigned int order)
+static struct page *kimage_alloc_pages(gfp_t gfp_mask, unsigned int order)
 {
         struct page *pages;
 
@@ -654,7 +653,7 @@ static kimage_entry_t *kimage_dst_used(struct kimage *image,
 }
 
 static struct page *kimage_alloc_page(struct kimage *image,
-                                        unsigned int gfp_mask,
+                                        gfp_t gfp_mask,
                                         unsigned long destination)
 {
         /*
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 383ba22f0b62..bf374fceb39c 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -497,7 +497,7 @@ static void process_timer_rebalance(struct task_struct *p,
                 left = cputime_div(cputime_sub(expires.cpu, val.cpu),
                                    nthreads);
                 do {
-                        if (!unlikely(t->exit_state)) {
+                        if (!unlikely(t->flags & PF_EXITING)) {
                                 ticks = cputime_add(prof_ticks(t), left);
                                 if (cputime_eq(t->it_prof_expires,
                                                cputime_zero) ||
@@ -512,7 +512,7 @@ static void process_timer_rebalance(struct task_struct *p,
                 left = cputime_div(cputime_sub(expires.cpu, val.cpu),
                                    nthreads);
                 do {
-                        if (!unlikely(t->exit_state)) {
+                        if (!unlikely(t->flags & PF_EXITING)) {
                                 ticks = cputime_add(virt_ticks(t), left);
                                 if (cputime_eq(t->it_virt_expires,
                                                cputime_zero) ||
@@ -527,7 +527,7 @@ static void process_timer_rebalance(struct task_struct *p,
                 nsleft = expires.sched - val.sched;
                 do_div(nsleft, nthreads);
                 do {
-                        if (!unlikely(t->exit_state)) {
+                        if (!unlikely(t->flags & PF_EXITING)) {
                                 ns = t->sched_time + nsleft;
                                 if (t->it_sched_expires == 0 ||
                                     t->it_sched_expires > ns) {
@@ -566,6 +566,9 @@ static void arm_timer(struct k_itimer *timer, union cpu_time_count now)
         struct cpu_timer_list *next;
         unsigned long i;
 
+        if (CPUCLOCK_PERTHREAD(timer->it_clock) && (p->flags & PF_EXITING))
+                return;
+
         head = (CPUCLOCK_PERTHREAD(timer->it_clock) ?
                 p->cpu_timers : p->signal->cpu_timers);
         head += CPUCLOCK_WHICH(timer->it_clock);
@@ -1204,7 +1207,7 @@ static void check_process_timers(struct task_struct *tsk,
 
                         do {
                                 t = next_thread(t);
-                        } while (unlikely(t->exit_state));
+                        } while (unlikely(t->flags & PF_EXITING));
                 } while (t != tsk);
         }
 }
@@ -1293,30 +1296,30 @@ void run_posix_cpu_timers(struct task_struct *tsk)
 
 #undef  UNEXPIRED
 
+        BUG_ON(tsk->exit_state);
+
         /*
          * Double-check with locks held.
          */
         read_lock(&tasklist_lock);
-        if (likely(tsk->signal != NULL)) {
-                spin_lock(&tsk->sighand->siglock);
+        spin_lock(&tsk->sighand->siglock);
 
-                /*
-                 * Here we take off tsk->cpu_timers[N] and tsk->signal->cpu_timers[N]
-                 * all the timers that are firing, and put them on the firing list.
-                 */
-                check_thread_timers(tsk, &firing);
-                check_process_timers(tsk, &firing);
+        /*
+         * Here we take off tsk->cpu_timers[N] and tsk->signal->cpu_timers[N]
+         * all the timers that are firing, and put them on the firing list.
+         */
+        check_thread_timers(tsk, &firing);
+        check_process_timers(tsk, &firing);
 
-                /*
-                 * We must release these locks before taking any timer's lock.
-                 * There is a potential race with timer deletion here, as the
-                 * siglock now protects our private firing list.  We have set
-                 * the firing flag in each timer, so that a deletion attempt
-                 * that gets the timer lock before we do will give it up and
-                 * spin until we've taken care of that timer below.
-                 */
-                spin_unlock(&tsk->sighand->siglock);
-        }
+        /*
+         * We must release these locks before taking any timer's lock.
+         * There is a potential race with timer deletion here, as the
+         * siglock now protects our private firing list.  We have set
+         * the firing flag in each timer, so that a deletion attempt
+         * that gets the timer lock before we do will give it up and
+         * spin until we've taken care of that timer below.
+         */
+        spin_unlock(&tsk->sighand->siglock);
         read_unlock(&tasklist_lock);
 
         /*
diff --git a/kernel/power/swsusp.c b/kernel/power/swsusp.c
index 2d5c45676442..10bc5ec496d7 100644
--- a/kernel/power/swsusp.c
+++ b/kernel/power/swsusp.c
@@ -1095,7 +1095,7 @@ static inline void eat_page(void *page)
         *eaten_memory = c;
 }
 
-unsigned long get_usable_page(unsigned gfp_mask)
+unsigned long get_usable_page(gfp_t gfp_mask)
 {
         unsigned long m;