16 files changed, 376 insertions, 64 deletions

diff --git a/kernel/acct.c b/kernel/acct.c
index 9f3391090b3e..9a4715a2f6bf 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -491,13 +491,17 @@ static void do_acct_process(struct bsd_acct_struct *acct,
         u64 run_time;
         struct timespec uptime;
         struct tty_struct *tty;
+        const struct cred *orig_cred;
+
+        /* Perform file operations on behalf of whoever enabled accounting */
+        orig_cred = override_creds(file->f_cred);
 
         /*
          * First check to see if there is enough free_space to continue
          * the process accounting system.
          */
         if (!check_free_space(acct, file))
-                return;
+                goto out;
 
         /*
          * Fill the accounting struct with the needed info as recorded
@@ -578,6 +582,8 @@ static void do_acct_process(struct bsd_acct_struct *acct,
                                sizeof(acct_t), &file->f_pos);
         current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
         set_fs(fs);
+out:
+        revert_creds(orig_cred);
 }
 
 /**
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index b6eadfe30e7b..c7ece8f027f2 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -600,6 +600,7 @@ static struct inode_operations cgroup_dir_inode_operations;
 static struct file_operations proc_cgroupstats_operations;
 
 static struct backing_dev_info cgroup_backing_dev_info = {
+        .name           = "cgroup",
         .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK,
 };
 
diff --git a/kernel/cred.c b/kernel/cred.c
index 1bb4d7e5d616..006fcab009d5 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -18,6 +18,18 @@
 #include <linux/cn_proc.h>
 #include "cred-internals.h"
 
+#if 0
+#define kdebug(FMT, ...) \
+        printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__)
+#else
+static inline __attribute__((format(printf, 1, 2)))
+void no_printk(const char *fmt, ...)
+{
+}
+#define kdebug(FMT, ...) \
+        no_printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__)
+#endif
+
 static struct kmem_cache *cred_jar;
 
 /*
@@ -36,6 +48,10 @@ static struct thread_group_cred init_tgcred = {
  */
 struct cred init_cred = {
         .usage                  = ATOMIC_INIT(4),
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        .subscribers            = ATOMIC_INIT(2),
+        .magic                  = CRED_MAGIC,
+#endif
         .securebits             = SECUREBITS_DEFAULT,
         .cap_inheritable        = CAP_INIT_INH_SET,
         .cap_permitted          = CAP_FULL_SET,
@@ -48,6 +64,31 @@ struct cred init_cred = {
 #endif
 };
 
+static inline void set_cred_subscribers(struct cred *cred, int n)
+{
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        atomic_set(&cred->subscribers, n);
+#endif
+}
+
+static inline int read_cred_subscribers(const struct cred *cred)
+{
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        return atomic_read(&cred->subscribers);
+#else
+        return 0;
+#endif
+}
+
+static inline void alter_cred_subscribers(const struct cred *_cred, int n)
+{
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        struct cred *cred = (struct cred *) _cred;
+
+        atomic_add(n, &cred->subscribers);
+#endif
+}
+
 /*
  * Dispose of the shared task group credentials
  */
@@ -85,9 +126,22 @@ static void put_cred_rcu(struct rcu_head *rcu)
 {
         struct cred *cred = container_of(rcu, struct cred, rcu);
 
+        kdebug("put_cred_rcu(%p)", cred);
+
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        if (cred->magic != CRED_MAGIC_DEAD ||
+            atomic_read(&cred->usage) != 0 ||
+            read_cred_subscribers(cred) != 0)
+                panic("CRED: put_cred_rcu() sees %p with"
+                      " mag %x, put %p, usage %d, subscr %d\n",
+                      cred, cred->magic, cred->put_addr,
+                      atomic_read(&cred->usage),
+                      read_cred_subscribers(cred));
+#else
         if (atomic_read(&cred->usage) != 0)
                 panic("CRED: put_cred_rcu() sees %p with usage %d\n",
                       cred, atomic_read(&cred->usage));
+#endif
 
         security_cred_free(cred);
         key_put(cred->thread_keyring);
@@ -106,12 +160,90 @@ static void put_cred_rcu(struct rcu_head *rcu)
  */
 void __put_cred(struct cred *cred)
 {
+        kdebug("__put_cred(%p{%d,%d})", cred,
+               atomic_read(&cred->usage),
+               read_cred_subscribers(cred));
+
         BUG_ON(atomic_read(&cred->usage) != 0);
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        BUG_ON(read_cred_subscribers(cred) != 0);
+        cred->magic = CRED_MAGIC_DEAD;
+        cred->put_addr = __builtin_return_address(0);
+#endif
+        BUG_ON(cred == current->cred);
+        BUG_ON(cred == current->real_cred);
 
         call_rcu(&cred->rcu, put_cred_rcu);
 }
 EXPORT_SYMBOL(__put_cred);
 
+/*
+ * Clean up a task's credentials when it exits
+ */
+void exit_creds(struct task_struct *tsk)
+{
+        struct cred *cred;
+
+        kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
+               atomic_read(&tsk->cred->usage),
+               read_cred_subscribers(tsk->cred));
+
+        cred = (struct cred *) tsk->real_cred;
+        tsk->real_cred = NULL;
+        validate_creds(cred);
+        alter_cred_subscribers(cred, -1);
+        put_cred(cred);
+
+        cred = (struct cred *) tsk->cred;
+        tsk->cred = NULL;
+        validate_creds(cred);
+        alter_cred_subscribers(cred, -1);
+        put_cred(cred);
+
+        cred = (struct cred *) tsk->replacement_session_keyring;
+        if (cred) {
+                tsk->replacement_session_keyring = NULL;
+                validate_creds(cred);
+                put_cred(cred);
+        }
+}
+
+/*
+ * Allocate blank credentials, such that the credentials can be filled in at a
+ * later date without risk of ENOMEM.
+ */
+struct cred *cred_alloc_blank(void)
+{
+        struct cred *new;
+
+        new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
+        if (!new)
+                return NULL;
+
+#ifdef CONFIG_KEYS
+        new->tgcred = kzalloc(sizeof(*new->tgcred), GFP_KERNEL);
+        if (!new->tgcred) {
+                kfree(new);
+                return NULL;
+        }
+        atomic_set(&new->tgcred->usage, 1);
+#endif
+
+        atomic_set(&new->usage, 1);
+
+        if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
+                goto error;
+
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        new->magic = CRED_MAGIC;
+#endif
+        return new;
+
+error:
+        abort_creds(new);
+        return NULL;
+}
+
 /**
  * prepare_creds - Prepare a new set of credentials for modification
  *
@@ -132,16 +264,19 @@ struct cred *prepare_creds(void)
         const struct cred *old;
         struct cred *new;
 
-        BUG_ON(atomic_read(&task->real_cred->usage) < 1);
+        validate_process_creds();
 
         new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
         if (!new)
                 return NULL;
 
+        kdebug("prepare_creds() alloc %p", new);
+
         old = task->cred;
         memcpy(new, old, sizeof(struct cred));
 
         atomic_set(&new->usage, 1);
+        set_cred_subscribers(new, 0);
         get_group_info(new->group_info);
         get_uid(new->user);
 
@@ -157,6 +292,7 @@ struct cred *prepare_creds(void)
 
         if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
                 goto error;
+        validate_creds(new);
         return new;
 
 error:
@@ -229,9 +365,12 @@ struct cred *prepare_usermodehelper_creds(void)
         if (!new)
                 return NULL;
 
+        kdebug("prepare_usermodehelper_creds() alloc %p", new);
+
         memcpy(new, &init_cred, sizeof(struct cred));
 
         atomic_set(&new->usage, 1);
+        set_cred_subscribers(new, 0);
         get_group_info(new->group_info);
         get_uid(new->user);
 
@@ -250,6 +389,7 @@ struct cred *prepare_usermodehelper_creds(void)
 #endif
         if (security_prepare_creds(new, &init_cred, GFP_ATOMIC) < 0)
                 goto error;
+        validate_creds(new);
 
         BUG_ON(atomic_read(&new->usage) != 1);
         return new;
@@ -286,6 +426,10 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
             ) {
                 p->real_cred = get_cred(p->cred);
                 get_cred(p->cred);
+                alter_cred_subscribers(p->cred, 2);
+                kdebug("share_creds(%p{%d,%d})",
+                       p->cred, atomic_read(&p->cred->usage),
+                       read_cred_subscribers(p->cred));
                 atomic_inc(&p->cred->user->processes);
                 return 0;
         }
@@ -331,6 +475,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
 
         atomic_inc(&new->user->processes);
         p->cred = p->real_cred = get_cred(new);
+        alter_cred_subscribers(new, 2);
+        validate_creds(new);
         return 0;
 
 error_put:
@@ -355,13 +501,20 @@ error_put:
 int commit_creds(struct cred *new)
 {
         struct task_struct *task = current;
-        const struct cred *old;
+        const struct cred *old = task->real_cred;
 
-        BUG_ON(task->cred != task->real_cred);
-        BUG_ON(atomic_read(&task->real_cred->usage) < 2);
+        kdebug("commit_creds(%p{%d,%d})", new,
+               atomic_read(&new->usage),
+               read_cred_subscribers(new));
+
+        BUG_ON(task->cred != old);
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        BUG_ON(read_cred_subscribers(old) < 2);
+        validate_creds(old);
+        validate_creds(new);
+#endif
         BUG_ON(atomic_read(&new->usage) < 1);
 
-        old = task->real_cred;
         security_commit_creds(new, old);
 
         get_cred(new); /* we will require a ref for the subj creds too */
@@ -390,12 +543,14 @@ int commit_creds(struct cred *new)
          *   cheaply with the new uid cache, so if it matters
          *   we should be checking for it.  -DaveM
          */
+        alter_cred_subscribers(new, 2);
         if (new->user != old->user)
                 atomic_inc(&new->user->processes);
         rcu_assign_pointer(task->real_cred, new);
         rcu_assign_pointer(task->cred, new);
         if (new->user != old->user)
                 atomic_dec(&old->user->processes);
+        alter_cred_subscribers(old, -2);
 
         sched_switch_user(task);
 
@@ -428,6 +583,13 @@ EXPORT_SYMBOL(commit_creds);
  */
 void abort_creds(struct cred *new)
 {
+        kdebug("abort_creds(%p{%d,%d})", new,
+               atomic_read(&new->usage),
+               read_cred_subscribers(new));
+
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        BUG_ON(read_cred_subscribers(new) != 0);
+#endif
         BUG_ON(atomic_read(&new->usage) < 1);
         put_cred(new);
 }
@@ -444,7 +606,20 @@ const struct cred *override_creds(const struct cred *new)
 {
         const struct cred *old = current->cred;
 
-        rcu_assign_pointer(current->cred, get_cred(new));
+        kdebug("override_creds(%p{%d,%d})", new,
+               atomic_read(&new->usage),
+               read_cred_subscribers(new));
+
+        validate_creds(old);
+        validate_creds(new);
+        get_cred(new);
+        alter_cred_subscribers(new, 1);
+        rcu_assign_pointer(current->cred, new);
+        alter_cred_subscribers(old, -1);
+
+        kdebug("override_creds() = %p{%d,%d}", old,
+               atomic_read(&old->usage),
+               read_cred_subscribers(old));
         return old;
 }
 EXPORT_SYMBOL(override_creds);
@@ -460,7 +635,15 @@ void revert_creds(const struct cred *old)
 {
         const struct cred *override = current->cred;
 
+        kdebug("revert_creds(%p{%d,%d})", old,
+               atomic_read(&old->usage),
+               read_cred_subscribers(old));
+
+        validate_creds(old);
+        validate_creds(override);
+        alter_cred_subscribers(old, 1);
         rcu_assign_pointer(current->cred, old);
+        alter_cred_subscribers(override, -1);
         put_cred(override);
 }
 EXPORT_SYMBOL(revert_creds);
@@ -502,11 +685,15 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         if (!new)
                 return NULL;
 
+        kdebug("prepare_kernel_cred() alloc %p", new);
+
         if (daemon)
                 old = get_task_cred(daemon);
         else
                 old = get_cred(&init_cred);
 
+        validate_creds(old);
+
         *new = *old;
         get_uid(new->user);
         get_group_info(new->group_info);
@@ -526,7 +713,9 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
                 goto error;
 
         atomic_set(&new->usage, 1);
+        set_cred_subscribers(new, 0);
         put_cred(old);
+        validate_creds(new);
         return new;
 
 error:
@@ -589,3 +778,95 @@ int set_create_files_as(struct cred *new, struct inode *inode)
         return security_kernel_create_files_as(new, inode);
 }
 EXPORT_SYMBOL(set_create_files_as);
+
+#ifdef CONFIG_DEBUG_CREDENTIALS
+
+/*
+ * dump invalid credentials
+ */
+static void dump_invalid_creds(const struct cred *cred, const char *label,
+                               const struct task_struct *tsk)
+{
+        printk(KERN_ERR "CRED: %s credentials: %p %s%s%s\n",
+               label, cred,
+               cred == &init_cred ? "[init]" : "",
+               cred == tsk->real_cred ? "[real]" : "",
+               cred == tsk->cred ? "[eff]" : "");
+        printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n",
+               cred->magic, cred->put_addr);
+        printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n",
+               atomic_read(&cred->usage),
+               read_cred_subscribers(cred));
+        printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n",
+               cred->uid, cred->euid, cred->suid, cred->fsuid);
+        printk(KERN_ERR "CRED: ->*gid = { %d,%d,%d,%d }\n",
+               cred->gid, cred->egid, cred->sgid, cred->fsgid);
+#ifdef CONFIG_SECURITY
+        printk(KERN_ERR "CRED: ->security is %p\n", cred->security);
+        if ((unsigned long) cred->security >= PAGE_SIZE &&
+            (((unsigned long) cred->security & 0xffffff00) !=
+             (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8)))
+                printk(KERN_ERR "CRED: ->security {%x, %x}\n",
+                       ((u32*)cred->security)[0],
+                       ((u32*)cred->security)[1]);
+#endif
+}
+
+/*
+ * report use of invalid credentials
+ */
+void __invalid_creds(const struct cred *cred, const char *file, unsigned line)
+{
+        printk(KERN_ERR "CRED: Invalid credentials\n");
+        printk(KERN_ERR "CRED: At %s:%u\n", file, line);
+        dump_invalid_creds(cred, "Specified", current);
+        BUG();
+}
+EXPORT_SYMBOL(__invalid_creds);
+
+/*
+ * check the credentials on a process
+ */
+void __validate_process_creds(struct task_struct *tsk,
+                              const char *file, unsigned line)
+{
+        if (tsk->cred == tsk->real_cred) {
+                if (unlikely(read_cred_subscribers(tsk->cred) < 2 ||
+                             creds_are_invalid(tsk->cred)))
+                        goto invalid_creds;
+        } else {
+                if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 ||
+                             read_cred_subscribers(tsk->cred) < 1 ||
+                             creds_are_invalid(tsk->real_cred) ||
+                             creds_are_invalid(tsk->cred)))
+                        goto invalid_creds;
+        }
+        return;
+
+invalid_creds:
+        printk(KERN_ERR "CRED: Invalid process credentials\n");
+        printk(KERN_ERR "CRED: At %s:%u\n", file, line);
+
+        dump_invalid_creds(tsk->real_cred, "Real", tsk);
+        if (tsk->cred != tsk->real_cred)
+                dump_invalid_creds(tsk->cred, "Effective", tsk);
+        else
+                printk(KERN_ERR "CRED: Effective creds == Real creds\n");
+        BUG();
+}
+EXPORT_SYMBOL(__validate_process_creds);
+
+/*
+ * check creds for do_exit()
+ */
+void validate_creds_for_do_exit(struct task_struct *tsk)
+{
+        kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
+               tsk->real_cred, tsk->cred,
+               atomic_read(&tsk->cred->usage),
+               read_cred_subscribers(tsk->cred));
+
+        __validate_process_creds(tsk, __FILE__, __LINE__);
+}
+
+#endif /* CONFIG_DEBUG_CREDENTIALS */
diff --git a/kernel/exit.c b/kernel/exit.c
index 869dc221733e..c98ff7a8025f 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -901,6 +901,8 @@ NORET_TYPE void do_exit(long code)
 
         tracehook_report_exit(&code);
 
+        validate_creds_for_do_exit(tsk);
+
         /*
          * We're taking recursive faults here in do_exit. Safest is to just
          * leave this task alone and wait for reboot.
@@ -1009,6 +1011,8 @@ NORET_TYPE void do_exit(long code)
         if (tsk->splice_pipe)
                 __free_pipe_info(tsk->splice_pipe);
 
+        validate_creds_for_do_exit(tsk);
+
         preempt_disable();
         /* causes final put_task_struct in finish_task_switch(). */
         tsk->state = TASK_DEAD;
diff --git a/kernel/fork.c b/kernel/fork.c
index 021e1138556e..aab8579c6093 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -152,8 +152,7 @@ void __put_task_struct(struct task_struct *tsk)
         WARN_ON(atomic_read(&tsk->usage));
         WARN_ON(tsk == current);
 
-        put_cred(tsk->real_cred);
-        put_cred(tsk->cred);
+        exit_creds(tsk);
         delayacct_tsk_free(tsk);
 
         if (!profile_handoff_task(tsk))
@@ -426,7 +425,6 @@ static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
         init_rwsem(&mm->mmap_sem);
         INIT_LIST_HEAD(&mm->mmlist);
         mm->flags = (current->mm) ? current->mm->flags : default_dump_filter;
-        mm->oom_adj = (current->mm) ? current->mm->oom_adj : 0;
         mm->core_state = NULL;
         mm->nr_ptes = 0;
         set_mm_counter(mm, file_rss, 0);
@@ -816,11 +814,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
 {
         struct signal_struct *sig;
 
-        if (clone_flags & CLONE_THREAD) {
-                atomic_inc(&current->signal->count);
-                atomic_inc(&current->signal->live);
+        if (clone_flags & CLONE_THREAD)
                 return 0;
-        }
 
         sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
         tsk->signal = sig;
@@ -878,16 +873,6 @@ void __cleanup_signal(struct signal_struct *sig)
         kmem_cache_free(signal_cachep, sig);
 }
 
-static void cleanup_signal(struct task_struct *tsk)
-{
-        struct signal_struct *sig = tsk->signal;
-
-        atomic_dec(&sig->live);
-
-        if (atomic_dec_and_test(&sig->count))
-                __cleanup_signal(sig);
-}
-
 static void copy_flags(unsigned long clone_flags, struct task_struct *p)
 {
         unsigned long new_flags = p->flags;
@@ -1240,6 +1225,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         }
 
         if (clone_flags & CLONE_THREAD) {
+                atomic_inc(&current->signal->count);
+                atomic_inc(&current->signal->live);
                 p->group_leader = current->group_leader;
                 list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
         }
@@ -1283,7 +1270,8 @@ bad_fork_cleanup_mm:
         if (p->mm)
                 mmput(p->mm);
 bad_fork_cleanup_signal:
-        cleanup_signal(p);
+        if (!(clone_flags & CLONE_THREAD))
+                __cleanup_signal(p->signal);
 bad_fork_cleanup_sighand:
         __cleanup_sighand(p->sighand);
 bad_fork_cleanup_fs:
@@ -1308,8 +1296,7 @@ bad_fork_cleanup_put_domain:
         module_put(task_thread_info(p)->exec_domain->module);
 bad_fork_cleanup_count:
         atomic_dec(&p->cred->user->processes);
-        put_cred(p->real_cred);
-        put_cred(p->cred);
+        exit_creds(p);
 bad_fork_free:
         free_task(p);
 fork_out:
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index d222515a5a06..0ec9ed831737 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -607,7 +607,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                  */
                 get_task_struct(t);
                 new->thread = t;
-                wake_up_process(t);
         }
 
         /*
@@ -690,6 +689,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                                 (int)(new->flags & IRQF_TRIGGER_MASK));
         }
 
+        new->irq = irq;
         *old_ptr = new;
 
         /* Reset broken irq detection when installing new handler */
@@ -707,7 +707,13 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
         spin_unlock_irqrestore(&desc->lock, flags);
 
-        new->irq = irq;
+        /*
+         * Strictly no need to wake it up, but hung_task complains
+         * when no hard interrupt wakes the thread up.
+         */
+        if (new->thread)
+                wake_up_process(new->thread);
+
         register_irq_proc(irq, desc);
         new->dir = NULL;
         register_handler_proc(irq, new);
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 385c31a1bdbf..4e8cae2e9148 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -78,6 +78,10 @@ int __request_module(bool wait, const char *fmt, ...)
 #define MAX_KMOD_CONCURRENT 50  /* Completely arbitrary value - KAO */
         static int kmod_loop_msg;
 
+        ret = security_kernel_module_request();
+        if (ret)
+                return ret;
+
         va_start(args, fmt);
         ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
         va_end(args);
@@ -462,6 +466,7 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info,
         int retval = 0;
 
         BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
+        validate_creds(sub_info->cred);
 
         helper_lock();
         if (sub_info->path[0] == '\0')
diff --git a/kernel/module.c b/kernel/module.c
index fd1411403558..2d537186191f 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -909,16 +909,18 @@ void __symbol_put(const char *symbol)
 }
 EXPORT_SYMBOL(__symbol_put);
 
+/* Note this assumes addr is a function, which it currently always is. */
 void symbol_put_addr(void *addr)
 {
         struct module *modaddr;
+        unsigned long a = (unsigned long)dereference_function_descriptor(addr);
 
-        if (core_kernel_text((unsigned long)addr))
+        if (core_kernel_text(a))
                 return;
 
         /* module_text_address is safe here: we're supposed to have reference
          * to module from symbol_get, so it can't go away. */
-        modaddr = __module_text_address((unsigned long)addr);
+        modaddr = __module_text_address(a);
         BUG_ON(!modaddr);
         module_put(modaddr);
 }
@@ -1272,6 +1274,10 @@ static void add_notes_attrs(struct module *mod, unsigned int nsect,
         struct module_notes_attrs *notes_attrs;
         struct bin_attribute *nattr;
 
+        /* failed to create section attributes, so can't create notes */
+        if (!mod->sect_attrs)
+                return;
+
         /* Count notes sections and allocate structures.  */
         notes = 0;
         for (i = 0; i < nsect; i++)
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index 534e20d14d63..d7cbc579fc80 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -50,7 +50,7 @@ static atomic_t nr_task_counters __read_mostly;
  *  1 - disallow cpu counters to unpriv
  *  2 - disallow kernel profiling to unpriv
  */
-int sysctl_perf_counter_paranoid __read_mostly;
+int sysctl_perf_counter_paranoid __read_mostly = 1;
 
 static inline bool perf_paranoid_cpu(void)
 {
@@ -1503,10 +1503,21 @@ static void perf_counter_enable_on_exec(struct task_struct *task)
  */
 static void __perf_counter_read(void *info)
 {
+        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
         struct perf_counter *counter = info;
         struct perf_counter_context *ctx = counter->ctx;
         unsigned long flags;
 
+        /*
+         * If this is a task context, we need to check whether it is
+         * the current task context of this cpu.  If not it has been
+         * scheduled out before the smp call arrived.  In that case
+         * counter->count would have been updated to a recent sample
+         * when the counter was scheduled out.
+         */
+        if (ctx->task && cpuctx->task_ctx != ctx)
+                return;
+
         local_irq_save(flags);
         if (ctx->is_active)
                 update_context_time(ctx);
@@ -1780,7 +1791,7 @@ static int perf_counter_read_group(struct perf_counter *counter,
         size += err;
 
         list_for_each_entry(sub, &leader->sibling_list, list_entry) {
-                err = perf_counter_read_entry(counter, read_format,
+                err = perf_counter_read_entry(sub, read_format,
                                 buf + size);
                 if (err < 0)
                         return err;
@@ -2008,6 +2019,10 @@ int perf_counter_task_disable(void)
         return 0;
 }
 
+#ifndef PERF_COUNTER_INDEX_OFFSET
+# define PERF_COUNTER_INDEX_OFFSET 0
+#endif
+
 static int perf_counter_index(struct perf_counter *counter)
 {
         if (counter->state != PERF_COUNTER_STATE_ACTIVE)
@@ -4051,6 +4066,7 @@ perf_counter_alloc(struct perf_counter_attr *attr,
         hwc->sample_period = attr->sample_period;
         if (attr->freq && attr->sample_freq)
                 hwc->sample_period = 1;
+        hwc->last_period = hwc->sample_period;
 
         atomic64_set(&hwc->period_left, hwc->sample_period);
 
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 082c320e4dbf..307c285af59e 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -152,7 +152,7 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
         if (!dumpable && !capable(CAP_SYS_PTRACE))
                 return -EPERM;
 
-        return security_ptrace_may_access(task, mode);
+        return security_ptrace_access_check(task, mode);
 }
 
 bool ptrace_may_access(struct task_struct *task, unsigned int mode)
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 98e02328c67d..71d8dc7f9920 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1306,10 +1306,10 @@ static struct ctl_table vm_table[] = {
         {
                 .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "mmap_min_addr",
-                .data           = &mmap_min_addr,
-                .maxlen         = sizeof(unsigned long),
+                .data           = &dac_mmap_min_addr,
+                .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = &mmap_min_addr_handler,
         },
 #ifdef CONFIG_NUMA
         {
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index a6dcd67b041d..620b58abdc32 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -137,11 +137,12 @@ int clockevents_program_event(struct clock_event_device *dev, ktime_t expires,
  */
 int clockevents_register_notifier(struct notifier_block *nb)
 {
+        unsigned long flags;
         int ret;
 
-        spin_lock(&clockevents_lock);
+        spin_lock_irqsave(&clockevents_lock, flags);
         ret = raw_notifier_chain_register(&clockevents_chain, nb);
-        spin_unlock(&clockevents_lock);
+        spin_unlock_irqrestore(&clockevents_lock, flags);
 
         return ret;
 }
@@ -178,16 +179,18 @@ static void clockevents_notify_released(void)
  */
 void clockevents_register_device(struct clock_event_device *dev)
 {
+        unsigned long flags;
+
         BUG_ON(dev->mode != CLOCK_EVT_MODE_UNUSED);
         BUG_ON(!dev->cpumask);
 
-        spin_lock(&clockevents_lock);
+        spin_lock_irqsave(&clockevents_lock, flags);
 
         list_add(&dev->list, &clockevent_devices);
         clockevents_do_notify(CLOCK_EVT_NOTIFY_ADD, dev);
         clockevents_notify_released();
 
-        spin_unlock(&clockevents_lock);
+        spin_unlock_irqrestore(&clockevents_lock, flags);
 }
 EXPORT_SYMBOL_GPL(clockevents_register_device);
 
@@ -235,8 +238,9 @@ void clockevents_exchange_device(struct clock_event_device *old,
 void clockevents_notify(unsigned long reason, void *arg)
 {
         struct list_head *node, *tmp;
+        unsigned long flags;
 
-        spin_lock(&clockevents_lock);
+        spin_lock_irqsave(&clockevents_lock, flags);
         clockevents_do_notify(reason, arg);
 
         switch (reason) {
@@ -251,7 +255,7 @@ void clockevents_notify(unsigned long reason, void *arg)
         default:
                 break;
         }
-        spin_unlock(&clockevents_lock);
+        spin_unlock_irqrestore(&clockevents_lock, flags);
 }
 EXPORT_SYMBOL_GPL(clockevents_notify);
 #endif
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 877dbedc3118..c2ec25087a35 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -205,11 +205,11 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
  * Powerstate information: The system enters/leaves a state, where
  * affected devices might stop
  */
-static void tick_do_broadcast_on_off(void *why)
+static void tick_do_broadcast_on_off(unsigned long *reason)
 {
         struct clock_event_device *bc, *dev;
         struct tick_device *td;
-        unsigned long flags, *reason = why;
+        unsigned long flags;
         int cpu, bc_stopped;
 
         spin_lock_irqsave(&tick_broadcast_lock, flags);
@@ -276,8 +276,7 @@ void tick_broadcast_on_off(unsigned long reason, int *oncpu)
                 printk(KERN_ERR "tick-broadcast: ignoring broadcast for "
                        "offline CPU #%d\n", *oncpu);
         else
-                smp_call_function_single(*oncpu, tick_do_broadcast_on_off,
-                                         &reason, 1);
+                tick_do_broadcast_on_off(&reason);
 }
 
 /*
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index a999b92a1277..fddd69d16e03 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -286,7 +286,7 @@ static int __init init_timer_list_procfs(void)
 {
         struct proc_dir_entry *pe;
 
-        pe = proc_create("timer_list", 0644, NULL, &timer_list_fops);
+        pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
         if (!pe)
                 return -ENOMEM;
         return 0;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 1e1d23c26308..25edd5cc5935 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2278,7 +2278,11 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
         read++;
         cnt--;
 
-        if (!(iter->flags & ~FTRACE_ITER_CONT)) {
+        /*
+         * If the parser haven't finished with the last write,
+         * continue reading the user input without skipping spaces.
+         */
+        if (!(iter->flags & FTRACE_ITER_CONT)) {
                 /* skip white space */
                 while (cnt && isspace(ch)) {
                         ret = get_user(ch, ubuf++);
@@ -2288,8 +2292,9 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
                         cnt--;
                 }
 
+                /* only spaces were written */
                 if (isspace(ch)) {
-                        file->f_pos += read;
+                        *ppos += read;
                         ret = read;
                         goto out;
                 }
@@ -2319,12 +2324,12 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
                 if (ret)
                         goto out;
                 iter->buffer_idx = 0;
-        } else
+        } else {
                 iter->flags |= FTRACE_ITER_CONT;
+                iter->buffer[iter->buffer_idx++] = ch;
+        }
 
-
-        file->f_pos += read;
-
+        *ppos += read;
         ret = read;
  out:
         mutex_unlock(&ftrace_regex_lock);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c22b40f8f576..8c358395d338 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3896,17 +3896,9 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,
         if (ret < 0)
                 return ret;
 
-        switch (val) {
-        case 0:
-                trace_flags &= ~(1 << index);
-                break;
-        case 1:
-                trace_flags |= 1 << index;
-                break;
-
-        default:
+        if (val != 0 && val != 1)
                 return -EINVAL;
-        }
+        set_tracer_flags(1 << index, val);
 
         *ppos += cnt;