12 files changed, 98 insertions, 39 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index d9d5648f3cdc..a184470cf9b5 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2098,11 +2098,6 @@ int cgroup_attach_proc(struct cgroup *cgrp, struct task_struct *leader)
                         continue;
                 /* get old css_set pointer */
                 task_lock(tsk);
-                if (tsk->flags & PF_EXITING) {
-                        /* ignore this task if it's going away */
-                        task_unlock(tsk);
-                        continue;
-                }
                 oldcg = tsk->cgroups;
                 get_css_set(oldcg);
                 task_unlock(tsk);
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 9fe58c46a426..0b1712dba587 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -123,6 +123,19 @@ static inline struct cpuset *task_cs(struct task_struct *task)
                             struct cpuset, css);
 }
 
+#ifdef CONFIG_NUMA
+static inline bool task_has_mempolicy(struct task_struct *task)
+{
+        return task->mempolicy;
+}
+#else
+static inline bool task_has_mempolicy(struct task_struct *task)
+{
+        return false;
+}
+#endif
+
+
 /* bits in struct cpuset flags field */
 typedef enum {
         CS_CPU_EXCLUSIVE,
@@ -949,7 +962,7 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
 static void cpuset_change_task_nodemask(struct task_struct *tsk,
                                         nodemask_t *newmems)
 {
-        bool masks_disjoint = !nodes_intersects(*newmems, tsk->mems_allowed);
+        bool need_loop;
 
 repeat:
         /*
@@ -962,6 +975,14 @@ repeat:
                 return;
 
         task_lock(tsk);
+        /*
+         * Determine if a loop is necessary if another thread is doing
+         * get_mems_allowed().  If at least one node remains unchanged and
+         * tsk does not have a mempolicy, then an empty nodemask will not be
+         * possible when mems_allowed is larger than a word.
+         */
+        need_loop = task_has_mempolicy(tsk) ||
+                        !nodes_intersects(*newmems, tsk->mems_allowed);
         nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
         mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
 
@@ -981,11 +1002,9 @@ repeat:
 
         /*
          * Allocation of memory is very fast, we needn't sleep when waiting
-         * for the read-side.  No wait is necessary, however, if at least one
-         * node remains unchanged.
+         * for the read-side.
          */
-        while (masks_disjoint &&
-                        ACCESS_ONCE(tsk->mems_allowed_change_disable)) {
+        while (need_loop && ACCESS_ONCE(tsk->mems_allowed_change_disable)) {
                 task_unlock(tsk);
                 if (!task_curr(tsk))
                         yield();
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 2f8f3f103cb4..24e3a4b1c89c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3360,9 +3360,13 @@ static void ring_buffer_wakeup(struct perf_event *event)
 
         rcu_read_lock();
         rb = rcu_dereference(event->rb);
-        list_for_each_entry_rcu(event, &rb->event_list, rb_entry) {
+        if (!rb)
+                goto unlock;
+
+        list_for_each_entry_rcu(event, &rb->event_list, rb_entry)
                 wake_up_all(&event->waitq);
-        }
+
+unlock:
         rcu_read_unlock();
 }
 
diff --git a/kernel/exit.c b/kernel/exit.c
index d0b7d988f873..e6e01b959a0e 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1540,8 +1540,15 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
         }
 
         /* dead body doesn't have much to contribute */
-        if (p->exit_state == EXIT_DEAD)
+        if (unlikely(p->exit_state == EXIT_DEAD)) {
+                /*
+                 * But do not ignore this task until the tracer does
+                 * wait_task_zombie()->do_notify_parent().
+                 */
+                if (likely(!ptrace) && unlikely(ptrace_reparented(p)))
+                        wo->notask_error = 0;
                 return 0;
+        }
 
         /* slay zombie? */
         if (p->exit_state == EXIT_ZOMBIE) {
diff --git a/kernel/futex.c b/kernel/futex.c
index ea87f4d2f455..1614be20173d 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -314,17 +314,29 @@ again:
 #endif
 
         lock_page(page_head);
+
+        /*
+         * If page_head->mapping is NULL, then it cannot be a PageAnon
+         * page; but it might be the ZERO_PAGE or in the gate area or
+         * in a special mapping (all cases which we are happy to fail);
+         * or it may have been a good file page when get_user_pages_fast
+         * found it, but truncated or holepunched or subjected to
+         * invalidate_complete_page2 before we got the page lock (also
+         * cases which we are happy to fail).  And we hold a reference,
+         * so refcount care in invalidate_complete_page's remove_mapping
+         * prevents drop_caches from setting mapping to NULL beneath us.
+         *
+         * The case we do have to guard against is when memory pressure made
+         * shmem_writepage move it from filecache to swapcache beneath us:
+         * an unlikely race, but we do need to retry for page_head->mapping.
+         */
         if (!page_head->mapping) {
+                int shmem_swizzled = PageSwapCache(page_head);
                 unlock_page(page_head);
                 put_page(page_head);
-                /*
-                * ZERO_PAGE pages don't have a mapping. Avoid a busy loop
-                * trying to find one. RW mapping would have COW'd (and thus
-                * have a mapping) so this page is RO and won't ever change.
-                */
-                if ((page_head == ZERO_PAGE(address)))
-                        return -EFAULT;
-                goto again;
+                if (shmem_swizzled)
+                        goto again;
+                return -EFAULT;
         }
 
         /*
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 8b1748d0172c..2e48ec0c2e91 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -74,11 +74,17 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
 
         /*
          * Ensure the task is not frozen.
-         * Also, when a freshly created task is scheduled once, changes
-         * its state to TASK_UNINTERRUPTIBLE without having ever been
-         * switched out once, it musn't be checked.
+         * Also, skip vfork and any other user process that freezer should skip.
          */
-        if (unlikely(t->flags & PF_FROZEN || !switch_count))
+        if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP)))
+            return;
+
+        /*
+         * When a freshly created task is scheduled once, changes its state to
+         * TASK_UNINTERRUPTIBLE without having ever been switched out once, it
+         * musn't be checked.
+         */
+        if (unlikely(!switch_count))
                 return;
 
         if (switch_count != t->last_switch_count) {
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 24d04477b257..78ab24a7b0e4 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -96,9 +96,20 @@ void __ptrace_unlink(struct task_struct *child)
          */
         if (!(child->flags & PF_EXITING) &&
             (child->signal->flags & SIGNAL_STOP_STOPPED ||
-             child->signal->group_stop_count))
+             child->signal->group_stop_count)) {
                 child->jobctl |= JOBCTL_STOP_PENDING;
 
+                /*
+                 * This is only possible if this thread was cloned by the
+                 * traced task running in the stopped group, set the signal
+                 * for the future reports.
+                 * FIXME: we should change ptrace_init_task() to handle this
+                 * case.
+                 */
+                if (!(child->jobctl & JOBCTL_STOP_SIGMASK))
+                        child->jobctl |= SIGSTOP;
+        }
+
         /*
          * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick
          * @child in the butt.  Note that @resume should be used iff @child
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index a78ed2736ba7..8a39fa3e3c6c 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -2352,13 +2352,11 @@ again:
                 if (!smt && (sd->flags & SD_SHARE_CPUPOWER))
                         continue;
 
-                if (!(sd->flags & SD_SHARE_PKG_RESOURCES)) {
-                        if (!smt) {
-                                smt = 1;
-                                goto again;
-                        }
+                if (smt && !(sd->flags & SD_SHARE_CPUPOWER))
+                        break;
+
+                if (!(sd->flags & SD_SHARE_PKG_RESOURCES))
                         break;
-                }
 
                 sg = sd->groups;
                 do {
@@ -2378,6 +2376,10 @@ next:
                         sg = sg->next;
                 } while (sg != sd->groups);
         }
+        if (!smt) {
+                smt = 1;
+                goto again;
+        }
 done:
         rcu_read_unlock();
 
diff --git a/kernel/signal.c b/kernel/signal.c
index b3f78d09a105..206551563cce 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1994,8 +1994,6 @@ static bool do_signal_stop(int signr)
                  */
                 if (!(sig->flags & SIGNAL_STOP_STOPPED))
                         sig->group_exit_code = signr;
-                else
-                        WARN_ON_ONCE(!current->ptrace);
 
                 sig->group_stop_count = 0;
 
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 6318b511afa1..a650694883a1 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1354,7 +1354,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
 
         fput(file);
 out_putname:
-        putname(pathname);
+        __putname(pathname);
 out:
         return result;
 }
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index c4eb71c8b2ea..1ecd6ba36d6c 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -387,7 +387,6 @@ void clockevents_exchange_device(struct clock_event_device *old,
          * released list and do a notify add later.
          */
         if (old) {
-                old->event_handler = clockevents_handle_noop;
                 clockevents_set_mode(old, CLOCK_EVT_MODE_UNUSED);
                 list_del(&old->list);
                 list_add(&old->list, &clockevents_released);
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index da2f760e780c..d3ad022136e5 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -647,7 +647,7 @@ static void clocksource_enqueue(struct clocksource *cs)
 
 /**
  * __clocksource_updatefreq_scale - Used update clocksource with new freq
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
  * @scale:      Scale factor multiplied against freq to get clocksource hz
  * @freq:       clocksource frequency (cycles per second) divided by scale
  *
@@ -699,7 +699,7 @@ EXPORT_SYMBOL_GPL(__clocksource_updatefreq_scale);
 
 /**
  * __clocksource_register_scale - Used to install new clocksources
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
  * @scale:      Scale factor multiplied against freq to get clocksource hz
  * @freq:       clocksource frequency (cycles per second) divided by scale
  *
@@ -727,7 +727,7 @@ EXPORT_SYMBOL_GPL(__clocksource_register_scale);
 
 /**
  * clocksource_register - Used to install new clocksources
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
  *
  * Returns -EBUSY if registration fails, zero otherwise.
  */
@@ -761,6 +761,8 @@ static void __clocksource_change_rating(struct clocksource *cs, int rating)
 
 /**
  * clocksource_change_rating - Change the rating of a registered clocksource
+ * @cs:         clocksource to be changed
+ * @rating:     new rating
  */
 void clocksource_change_rating(struct clocksource *cs, int rating)
 {
@@ -772,6 +774,7 @@ EXPORT_SYMBOL(clocksource_change_rating);
 
 /**
  * clocksource_unregister - remove a registered clocksource
+ * @cs: clocksource to be unregistered
  */
 void clocksource_unregister(struct clocksource *cs)
 {
@@ -787,6 +790,7 @@ EXPORT_SYMBOL(clocksource_unregister);
 /**
  * sysfs_show_current_clocksources - sysfs interface for current clocksource
  * @dev:        unused
+ * @attr:       unused
  * @buf:        char buffer to be filled with clocksource list
  *
  * Provides sysfs interface for listing current clocksource.
@@ -807,6 +811,7 @@ sysfs_show_current_clocksources(struct sys_device *dev,
 /**
  * sysfs_override_clocksource - interface for manually overriding clocksource
  * @dev:        unused
+ * @attr:       unused
  * @buf:        name of override clocksource
  * @count:      length of buffer
  *
@@ -842,6 +847,7 @@ static ssize_t sysfs_override_clocksource(struct sys_device *dev,
 /**
  * sysfs_show_available_clocksources - sysfs interface for listing clocksource
  * @dev:        unused
+ * @attr:       unused
  * @buf:        char buffer to be filled with clocksource list
  *
  * Provides sysfs interface for listing registered clocksources