6 files changed, 40 insertions, 13 deletions

diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 961d74044deb..00e8f2575512 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -166,9 +166,8 @@ static struct super_block *cpuset_sb = NULL;
  * The hooks from fork and exit, cpuset_fork() and cpuset_exit(), don't
  * (usually) grab cpuset_sem.  These are the two most performance
  * critical pieces of code here.  The exception occurs on exit(),
- * if the last task using a cpuset exits, and the cpuset was marked
- * notify_on_release.  In that case, the cpuset_sem is taken, the
- * path to the released cpuset calculated, and a usermode call made
+ * when a task in a notify_on_release cpuset exits.  Then cpuset_sem
+ * is taken, and if the cpuset count is zero, a usermode call made
  * to /sbin/cpuset_release_agent with the name of the cpuset (path
  * relative to the root of cpuset file system) as the argument.
  *
@@ -1404,6 +1403,18 @@ void cpuset_fork(struct task_struct *tsk)
  *
  * Description: Detach cpuset from @tsk and release it.
  *
+ * Note that cpusets marked notify_on_release force every task
+ * in them to take the global cpuset_sem semaphore when exiting.
+ * This could impact scaling on very large systems.  Be reluctant
+ * to use notify_on_release cpusets where very high task exit
+ * scaling is required on large systems.
+ *
+ * Don't even think about derefencing 'cs' after the cpuset use
+ * count goes to zero, except inside a critical section guarded
+ * by the cpuset_sem semaphore.  If you don't hold cpuset_sem,
+ * then a zero cpuset use count is a license to any other task to
+ * nuke the cpuset immediately.
+ *
  **/
 
 void cpuset_exit(struct task_struct *tsk)
@@ -1415,10 +1426,13 @@ void cpuset_exit(struct task_struct *tsk)
         tsk->cpuset = NULL;
         task_unlock(tsk);
 
-        if (atomic_dec_and_test(&cs->count)) {
+        if (notify_on_release(cs)) {
                 down(&cpuset_sem);
-                check_for_release(cs);
+                if (atomic_dec_and_test(&cs->count))
+                        check_for_release(cs);
                 up(&cpuset_sem);
+        } else {
+                atomic_dec(&cs->count);
         }
 }
 
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 06b5a6323998..436c7d93c00a 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -119,8 +119,6 @@ fastcall unsigned int __do_IRQ(unsigned int irq, struct pt_regs *regs)
                  */
                 desc->handler->ack(irq);
                 action_ret = handle_IRQ_event(irq, regs, desc->action);
-                if (!noirqdebug)
-                        note_interrupt(irq, desc, action_ret);
                 desc->handler->end(irq);
                 return 1;
         }
diff --git a/kernel/module.c b/kernel/module.c
index 5734ab09d3f9..83b3d376708c 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1758,6 +1758,7 @@ sys_init_module(void __user *umod,
                 const char __user *uargs)
 {
         struct module *mod;
+        mm_segment_t old_fs = get_fs();
         int ret = 0;
 
         /* Must have permission */
@@ -1775,6 +1776,9 @@ sys_init_module(void __user *umod,
                 return PTR_ERR(mod);
         }
 
+        /* flush the icache in correct context */
+        set_fs(KERNEL_DS);
+
         /* Flush the instruction cache, since we've played with text */
         if (mod->module_init)
                 flush_icache_range((unsigned long)mod->module_init,
@@ -1783,6 +1787,8 @@ sys_init_module(void __user *umod,
         flush_icache_range((unsigned long)mod->module_core,
                            (unsigned long)mod->module_core + mod->core_size);
 
+        set_fs(old_fs);
+
         /* Now sew it into the lists.  They won't access us, since
            strong_try_module_get() will fail. */
         stop_machine_run(__link_module, mod, NR_CPUS);
diff --git a/kernel/sched.c b/kernel/sched.c
index 0dc3158667a2..66b2ed784822 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4243,7 +4243,7 @@ static void move_task_off_dead_cpu(int dead_cpu, struct task_struct *tsk)
 
         /* No more Mr. Nice Guy. */
         if (dest_cpu == NR_CPUS) {
-                tsk->cpus_allowed = cpuset_cpus_allowed(tsk);
+                cpus_setall(tsk->cpus_allowed);
                 dest_cpu = any_online_cpu(tsk->cpus_allowed);
 
                 /*
diff --git a/kernel/signal.c b/kernel/signal.c
index 293e189d8bc3..c89821b69ae3 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -523,7 +523,16 @@ static int __dequeue_signal(struct sigpending *pending, sigset_t *mask,
 {
         int sig = 0;
 
-        sig = next_signal(pending, mask);
+        /* SIGKILL must have priority, otherwise it is quite easy
+         * to create an unkillable process, sending sig < SIGKILL
+         * to self */
+        if (unlikely(sigismember(&pending->signal, SIGKILL))) {
+                if (!sigismember(mask, SIGKILL))
+                        sig = SIGKILL;
+        }
+
+        if (likely(!sig))
+                sig = next_signal(pending, mask);
         if (sig) {
                 if (current->notifier) {
                         if (sigismember(current->notifier_mask, sig)) {
diff --git a/kernel/spinlock.c b/kernel/spinlock.c
index e15ed17863f1..0c3f9d8bbe17 100644
--- a/kernel/spinlock.c
+++ b/kernel/spinlock.c
@@ -294,7 +294,7 @@ EXPORT_SYMBOL(_spin_unlock_irq);
 void __lockfunc _spin_unlock_bh(spinlock_t *lock)
 {
         _raw_spin_unlock(lock);
-        preempt_enable();
+        preempt_enable_no_resched();
         local_bh_enable();
 }
 EXPORT_SYMBOL(_spin_unlock_bh);
@@ -318,7 +318,7 @@ EXPORT_SYMBOL(_read_unlock_irq);
 void __lockfunc _read_unlock_bh(rwlock_t *lock)
 {
         _raw_read_unlock(lock);
-        preempt_enable();
+        preempt_enable_no_resched();
         local_bh_enable();
 }
 EXPORT_SYMBOL(_read_unlock_bh);
@@ -342,7 +342,7 @@ EXPORT_SYMBOL(_write_unlock_irq);
 void __lockfunc _write_unlock_bh(rwlock_t *lock)
 {
         _raw_write_unlock(lock);
-        preempt_enable();
+        preempt_enable_no_resched();
         local_bh_enable();
 }
 EXPORT_SYMBOL(_write_unlock_bh);
@@ -354,7 +354,7 @@ int __lockfunc _spin_trylock_bh(spinlock_t *lock)
         if (_raw_spin_trylock(lock))
                 return 1;
 
-        preempt_enable();
+        preempt_enable_no_resched();
         local_bh_enable();
         return 0;
 }