4 files changed, 42 insertions, 9 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index cce59cb5ee6a..7f2683a10ac4 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -953,7 +953,8 @@ NORET_TYPE void do_exit(long code)
 
         acct_update_integrals(tsk);
         /* sync mm's RSS info before statistics gathering */
-        sync_mm_rss(tsk, tsk->mm);
+        if (tsk->mm)
+                sync_mm_rss(tsk, tsk->mm);
         group_dead = atomic_dec_and_test(&tsk->signal->live);
         if (group_dead) {
                 hrtimer_cancel(&tsk->signal->real_timer);
diff --git a/kernel/fork.c b/kernel/fork.c
index 4799c5f0e6d0..44b0791b0a2e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1052,6 +1052,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         p->prev_utime = cputime_zero;
         p->prev_stime = cputime_zero;
 #endif
+#if defined(SPLIT_RSS_COUNTING)
+        memset(&p->rss_stat, 0, sizeof(p->rss_stat));
+#endif
 
         p->default_timer_slack_ns = current->timer_slack_ns;
 
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 398fda155f6e..704e488730a5 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -757,6 +757,16 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                 if (new->flags & IRQF_ONESHOT)
                         desc->status |= IRQ_ONESHOT;
 
+                /*
+                 * Force MSI interrupts to run with interrupts
+                 * disabled. The multi vector cards can cause stack
+                 * overflows due to nested interrupts when enough of
+                 * them are directed to a core and fire at the same
+                 * time.
+                 */
+                if (desc->msi_desc)
+                        new->flags |= IRQF_DISABLED;
+
                 if (!(desc->status & IRQ_NOAUTOEN)) {
                         desc->depth = 0;
                         desc->status &= ~IRQ_DISABLED;
diff --git a/kernel/module.c b/kernel/module.c
index 9f8d23d8b3a8..1016b75b026a 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -521,11 +521,13 @@ static void module_unload_init(struct module *mod)
         int cpu;
 
         INIT_LIST_HEAD(&mod->modules_which_use_me);
-        for_each_possible_cpu(cpu)
-                per_cpu_ptr(mod->refptr, cpu)->count = 0;
+        for_each_possible_cpu(cpu) {
+                per_cpu_ptr(mod->refptr, cpu)->incs = 0;
+                per_cpu_ptr(mod->refptr, cpu)->decs = 0;
+        }
 
         /* Hold reference count during initialization. */
-        __this_cpu_write(mod->refptr->count, 1);
+        __this_cpu_write(mod->refptr->incs, 1);
         /* Backwards compatibility macros put refcount during init. */
         mod->waiter = current;
 }
@@ -664,12 +666,28 @@ static int try_stop_module(struct module *mod, int flags, int *forced)
 
 unsigned int module_refcount(struct module *mod)
 {
-        unsigned int total = 0;
+        unsigned int incs = 0, decs = 0;
         int cpu;
 
         for_each_possible_cpu(cpu)
-                total += per_cpu_ptr(mod->refptr, cpu)->count;
-        return total;
+                decs += per_cpu_ptr(mod->refptr, cpu)->decs;
+        /*
+         * ensure the incs are added up after the decs.
+         * module_put ensures incs are visible before decs with smp_wmb.
+         *
+         * This 2-count scheme avoids the situation where the refcount
+         * for CPU0 is read, then CPU0 increments the module refcount,
+         * then CPU1 drops that refcount, then the refcount for CPU1 is
+         * read. We would record a decrement but not its corresponding
+         * increment so we would see a low count (disaster).
+         *
+         * Rare situation? But module_refcount can be preempted, and we
+         * might be tallying up 4096+ CPUs. So it is not impossible.
+         */
+        smp_rmb();
+        for_each_possible_cpu(cpu)
+                incs += per_cpu_ptr(mod->refptr, cpu)->incs;
+        return incs - decs;
 }
 EXPORT_SYMBOL(module_refcount);
 
@@ -846,10 +864,11 @@ void module_put(struct module *module)
 {
         if (module) {
                 preempt_disable();
-                __this_cpu_dec(module->refptr->count);
+                smp_wmb(); /* see comment in module_refcount */
+                __this_cpu_inc(module->refptr->decs);
 
                 trace_module_put(module, _RET_IP_,
-                                 __this_cpu_read(module->refptr->count));
+                                 __this_cpu_read(module->refptr->decs));
                 /* Maybe they're waiting for us to drop reference? */
                 if (unlikely(!module_is_live(module)))
                         wake_up_process(module->waiter);