11 files changed, 222 insertions, 197 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 9fcdaa705b6c..3f1ca934a237 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -348,7 +348,7 @@ struct cgrp_cset_link {
  * reference-counted, to improve performance when child cgroups
  * haven't been created.
  */
-static struct css_set init_css_set = {
+struct css_set init_css_set = {
         .refcount               = ATOMIC_INIT(1),
         .cgrp_links             = LIST_HEAD_INIT(init_css_set.cgrp_links),
         .tasks                  = LIST_HEAD_INIT(init_css_set.tasks),
@@ -1495,7 +1495,7 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
          */
         if (!use_task_css_set_links)
                 cgroup_enable_task_cg_lists();
-retry:
+
         mutex_lock(&cgroup_tree_mutex);
         mutex_lock(&cgroup_mutex);
 
@@ -1503,7 +1503,7 @@ retry:
         ret = parse_cgroupfs_options(data, &opts);
         if (ret)
                 goto out_unlock;
-
+retry:
         /* look for a matching existing root */
         if (!opts.subsys_mask && !opts.none && !opts.name) {
                 cgrp_dfl_root_visible = true;
@@ -1562,9 +1562,9 @@ retry:
                 if (!atomic_inc_not_zero(&root->cgrp.refcnt)) {
                         mutex_unlock(&cgroup_mutex);
                         mutex_unlock(&cgroup_tree_mutex);
-                        kfree(opts.release_agent);
-                        kfree(opts.name);
                         msleep(10);
+                        mutex_lock(&cgroup_tree_mutex);
+                        mutex_lock(&cgroup_mutex);
                         goto retry;
                 }
 
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index 2bc4a2256444..345628c78b5b 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -21,6 +21,7 @@
 #include <linux/uaccess.h>
 #include <linux/freezer.h>
 #include <linux/seq_file.h>
+#include <linux/mutex.h>
 
 /*
  * A cgroup is freezing if any FREEZING flags are set.  FREEZING_SELF is
@@ -42,9 +43,10 @@ enum freezer_state_flags {
 struct freezer {
         struct cgroup_subsys_state      css;
         unsigned int                    state;
-        spinlock_t                      lock;
 };
 
+static DEFINE_MUTEX(freezer_mutex);
+
 static inline struct freezer *css_freezer(struct cgroup_subsys_state *css)
 {
         return css ? container_of(css, struct freezer, css) : NULL;
@@ -93,7 +95,6 @@ freezer_css_alloc(struct cgroup_subsys_state *parent_css)
         if (!freezer)
                 return ERR_PTR(-ENOMEM);
 
-        spin_lock_init(&freezer->lock);
         return &freezer->css;
 }
 
@@ -110,14 +111,7 @@ static int freezer_css_online(struct cgroup_subsys_state *css)
         struct freezer *freezer = css_freezer(css);
         struct freezer *parent = parent_freezer(freezer);
 
-        /*
-         * The following double locking and freezing state inheritance
-         * guarantee that @cgroup can never escape ancestors' freezing
-         * states.  See css_for_each_descendant_pre() for details.
-         */
-        if (parent)
-                spin_lock_irq(&parent->lock);
-        spin_lock_nested(&freezer->lock, SINGLE_DEPTH_NESTING);
+        mutex_lock(&freezer_mutex);
 
         freezer->state |= CGROUP_FREEZER_ONLINE;
 
@@ -126,10 +120,7 @@ static int freezer_css_online(struct cgroup_subsys_state *css)
                 atomic_inc(&system_freezing_cnt);
         }
 
-        spin_unlock(&freezer->lock);
-        if (parent)
-                spin_unlock_irq(&parent->lock);
-
+        mutex_unlock(&freezer_mutex);
         return 0;
 }
 
@@ -144,14 +135,14 @@ static void freezer_css_offline(struct cgroup_subsys_state *css)
 {
         struct freezer *freezer = css_freezer(css);
 
-        spin_lock_irq(&freezer->lock);
+        mutex_lock(&freezer_mutex);
 
         if (freezer->state & CGROUP_FREEZING)
                 atomic_dec(&system_freezing_cnt);
 
         freezer->state = 0;
 
-        spin_unlock_irq(&freezer->lock);
+        mutex_unlock(&freezer_mutex);
 }
 
 static void freezer_css_free(struct cgroup_subsys_state *css)
@@ -175,7 +166,7 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
         struct task_struct *task;
         bool clear_frozen = false;
 
-        spin_lock_irq(&freezer->lock);
+        mutex_lock(&freezer_mutex);
 
         /*
          * Make the new tasks conform to the current state of @new_css.
@@ -197,21 +188,13 @@ static void freezer_attach(struct cgroup_subsys_state *new_css,
                 }
         }
 
-        spin_unlock_irq(&freezer->lock);
-
-        /*
-         * Propagate FROZEN clearing upwards.  We may race with
-         * update_if_frozen(), but as long as both work bottom-up, either
-         * update_if_frozen() sees child's FROZEN cleared or we clear the
-         * parent's FROZEN later.  No parent w/ !FROZEN children can be
-         * left FROZEN.
-         */
+        /* propagate FROZEN clearing upwards */
         while (clear_frozen && (freezer = parent_freezer(freezer))) {
-                spin_lock_irq(&freezer->lock);
                 freezer->state &= ~CGROUP_FROZEN;
                 clear_frozen = freezer->state & CGROUP_FREEZING;
-                spin_unlock_irq(&freezer->lock);
         }
+
+        mutex_unlock(&freezer_mutex);
 }
 
 /**
@@ -228,9 +211,6 @@ static void freezer_fork(struct task_struct *task)
 {
         struct freezer *freezer;
 
-        rcu_read_lock();
-        freezer = task_freezer(task);
-
         /*
          * The root cgroup is non-freezable, so we can skip locking the
          * freezer.  This is safe regardless of race with task migration.
@@ -238,24 +218,18 @@ static void freezer_fork(struct task_struct *task)
          * to do.  If we lost and root is the new cgroup, noop is still the
          * right thing to do.
          */
-        if (!parent_freezer(freezer))
-                goto out;
+        if (task_css_is_root(task, freezer_cgrp_id))
+                return;
 
-        /*
-         * Grab @freezer->lock and freeze @task after verifying @task still
-         * belongs to @freezer and it's freezing.  The former is for the
-         * case where we have raced against task migration and lost and
-         * @task is already in a different cgroup which may not be frozen.
-         * This isn't strictly necessary as freeze_task() is allowed to be
-         * called spuriously but let's do it anyway for, if nothing else,
-         * documentation.
-         */
-        spin_lock_irq(&freezer->lock);
-        if (freezer == task_freezer(task) && (freezer->state & CGROUP_FREEZING))
+        mutex_lock(&freezer_mutex);
+        rcu_read_lock();
+
+        freezer = task_freezer(task);
+        if (freezer->state & CGROUP_FREEZING)
                 freeze_task(task);
-        spin_unlock_irq(&freezer->lock);
-out:
+
         rcu_read_unlock();
+        mutex_unlock(&freezer_mutex);
 }
 
 /**
@@ -281,22 +255,24 @@ static void update_if_frozen(struct cgroup_subsys_state *css)
         struct css_task_iter it;
         struct task_struct *task;
 
-        WARN_ON_ONCE(!rcu_read_lock_held());
-
-        spin_lock_irq(&freezer->lock);
+        lockdep_assert_held(&freezer_mutex);
 
         if (!(freezer->state & CGROUP_FREEZING) ||
             (freezer->state & CGROUP_FROZEN))
-                goto out_unlock;
+                return;
 
         /* are all (live) children frozen? */
+        rcu_read_lock();
         css_for_each_child(pos, css) {
                 struct freezer *child = css_freezer(pos);
 
                 if ((child->state & CGROUP_FREEZER_ONLINE) &&
-                    !(child->state & CGROUP_FROZEN))
-                        goto out_unlock;
+                    !(child->state & CGROUP_FROZEN)) {
+                        rcu_read_unlock();
+                        return;
+                }
         }
+        rcu_read_unlock();
 
         /* are all tasks frozen? */
         css_task_iter_start(css, &it);
@@ -317,21 +293,29 @@ static void update_if_frozen(struct cgroup_subsys_state *css)
         freezer->state |= CGROUP_FROZEN;
 out_iter_end:
         css_task_iter_end(&it);
-out_unlock:
-        spin_unlock_irq(&freezer->lock);
 }
 
 static int freezer_read(struct seq_file *m, void *v)
 {
         struct cgroup_subsys_state *css = seq_css(m), *pos;
 
+        mutex_lock(&freezer_mutex);
         rcu_read_lock();
 
         /* update states bottom-up */
-        css_for_each_descendant_post(pos, css)
+        css_for_each_descendant_post(pos, css) {
+                if (!css_tryget(pos))
+                        continue;
+                rcu_read_unlock();
+
                 update_if_frozen(pos);
 
+                rcu_read_lock();
+                css_put(pos);
+        }
+
         rcu_read_unlock();
+        mutex_unlock(&freezer_mutex);
 
         seq_puts(m, freezer_state_strs(css_freezer(css)->state));
         seq_putc(m, '\n');
@@ -373,7 +357,7 @@ static void freezer_apply_state(struct freezer *freezer, bool freeze,
                                 unsigned int state)
 {
         /* also synchronizes against task migration, see freezer_attach() */
-        lockdep_assert_held(&freezer->lock);
+        lockdep_assert_held(&freezer_mutex);
 
         if (!(freezer->state & CGROUP_FREEZER_ONLINE))
                 return;
@@ -414,31 +398,29 @@ static void freezer_change_state(struct freezer *freezer, bool freeze)
          * descendant will try to inherit its parent's FREEZING state as
          * CGROUP_FREEZING_PARENT.
          */
+        mutex_lock(&freezer_mutex);
         rcu_read_lock();
         css_for_each_descendant_pre(pos, &freezer->css) {
                 struct freezer *pos_f = css_freezer(pos);
                 struct freezer *parent = parent_freezer(pos_f);
 
-                spin_lock_irq(&pos_f->lock);
+                if (!css_tryget(pos))
+                        continue;
+                rcu_read_unlock();
 
-                if (pos_f == freezer) {
+                if (pos_f == freezer)
                         freezer_apply_state(pos_f, freeze,
                                             CGROUP_FREEZING_SELF);
-                } else {
-                        /*
-                         * Our update to @parent->state is already visible
-                         * which is all we need.  No need to lock @parent.
-                         * For more info on synchronization, see
-                         * freezer_post_create().
-                         */
+                else
                         freezer_apply_state(pos_f,
                                             parent->state & CGROUP_FREEZING,
                                             CGROUP_FREEZING_PARENT);
-                }
 
-                spin_unlock_irq(&pos_f->lock);
+                rcu_read_lock();
+                css_put(pos);
         }
         rcu_read_unlock();
+        mutex_unlock(&freezer_mutex);
 }
 
 static int freezer_write(struct cgroup_subsys_state *css, struct cftype *cft,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index f83a71a3e46d..440eefc67397 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1443,6 +1443,11 @@ group_sched_out(struct perf_event *group_event,
                 cpuctx->exclusive = 0;
 }
 
+struct remove_event {
+        struct perf_event *event;
+        bool detach_group;
+};
+
 /*
  * Cross CPU call to remove a performance event
  *
@@ -1451,12 +1456,15 @@ group_sched_out(struct perf_event *group_event,
  */
 static int __perf_remove_from_context(void *info)
 {
-        struct perf_event *event = info;
+        struct remove_event *re = info;
+        struct perf_event *event = re->event;
         struct perf_event_context *ctx = event->ctx;
         struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
 
         raw_spin_lock(&ctx->lock);
         event_sched_out(event, cpuctx, ctx);
+        if (re->detach_group)
+                perf_group_detach(event);
         list_del_event(event, ctx);
         if (!ctx->nr_events && cpuctx->task_ctx == ctx) {
                 ctx->is_active = 0;
@@ -1481,10 +1489,14 @@ static int __perf_remove_from_context(void *info)
  * When called from perf_event_exit_task, it's OK because the
  * context has been detached from its task.
  */
-static void perf_remove_from_context(struct perf_event *event)
+static void perf_remove_from_context(struct perf_event *event, bool detach_group)
 {
         struct perf_event_context *ctx = event->ctx;
         struct task_struct *task = ctx->task;
+        struct remove_event re = {
+                .event = event,
+                .detach_group = detach_group,
+        };
 
         lockdep_assert_held(&ctx->mutex);
 
@@ -1493,12 +1505,12 @@ static void perf_remove_from_context(struct perf_event *event)
                  * Per cpu events are removed via an smp call and
                  * the removal is always successful.
                  */
-                cpu_function_call(event->cpu, __perf_remove_from_context, event);
+                cpu_function_call(event->cpu, __perf_remove_from_context, &re);
                 return;
         }
 
 retry:
-        if (!task_function_call(task, __perf_remove_from_context, event))
+        if (!task_function_call(task, __perf_remove_from_context, &re))
                 return;
 
         raw_spin_lock_irq(&ctx->lock);
@@ -1515,6 +1527,8 @@ retry:
          * Since the task isn't running, its safe to remove the event, us
          * holding the ctx->lock ensures the task won't get scheduled in.
          */
+        if (detach_group)
+                perf_group_detach(event);
         list_del_event(event, ctx);
         raw_spin_unlock_irq(&ctx->lock);
 }
@@ -3178,7 +3192,8 @@ static void free_event_rcu(struct rcu_head *head)
 }
 
 static void ring_buffer_put(struct ring_buffer *rb);
-static void ring_buffer_detach(struct perf_event *event, struct ring_buffer *rb);
+static void ring_buffer_attach(struct perf_event *event,
+                               struct ring_buffer *rb);
 
 static void unaccount_event_cpu(struct perf_event *event, int cpu)
 {
@@ -3238,8 +3253,6 @@ static void free_event(struct perf_event *event)
         unaccount_event(event);
 
         if (event->rb) {
-                struct ring_buffer *rb;
-
                 /*
                  * Can happen when we close an event with re-directed output.
                  *
@@ -3247,12 +3260,7 @@ static void free_event(struct perf_event *event)
                  * over us; possibly making our ring_buffer_put() the last.
                  */
                 mutex_lock(&event->mmap_mutex);
-                rb = event->rb;
-                if (rb) {
-                        rcu_assign_pointer(event->rb, NULL);
-                        ring_buffer_detach(event, rb);
-                        ring_buffer_put(rb); /* could be last */
-                }
+                ring_buffer_attach(event, NULL);
                 mutex_unlock(&event->mmap_mutex);
         }
 
@@ -3281,10 +3289,7 @@ int perf_event_release_kernel(struct perf_event *event)
          *     to trigger the AB-BA case.
          */
         mutex_lock_nested(&ctx->mutex, SINGLE_DEPTH_NESTING);
-        raw_spin_lock_irq(&ctx->lock);
-        perf_group_detach(event);
-        raw_spin_unlock_irq(&ctx->lock);
-        perf_remove_from_context(event);
+        perf_remove_from_context(event, true);
         mutex_unlock(&ctx->mutex);
 
         free_event(event);
@@ -3839,28 +3844,47 @@ unlock:
 static void ring_buffer_attach(struct perf_event *event,
                                struct ring_buffer *rb)
 {
+        struct ring_buffer *old_rb = NULL;
         unsigned long flags;
 
-        if (!list_empty(&event->rb_entry))
-                return;
+        if (event->rb) {
+                /*
+                 * Should be impossible, we set this when removing
+                 * event->rb_entry and wait/clear when adding event->rb_entry.
+                 */
+                WARN_ON_ONCE(event->rcu_pending);
 
-        spin_lock_irqsave(&rb->event_lock, flags);
-        if (list_empty(&event->rb_entry))
-                list_add(&event->rb_entry, &rb->event_list);
-        spin_unlock_irqrestore(&rb->event_lock, flags);
-}
+                old_rb = event->rb;
+                event->rcu_batches = get_state_synchronize_rcu();
+                event->rcu_pending = 1;
 
-static void ring_buffer_detach(struct perf_event *event, struct ring_buffer *rb)
-{
-        unsigned long flags;
+                spin_lock_irqsave(&old_rb->event_lock, flags);
+                list_del_rcu(&event->rb_entry);
+                spin_unlock_irqrestore(&old_rb->event_lock, flags);
+        }
 
-        if (list_empty(&event->rb_entry))
-                return;
+        if (event->rcu_pending && rb) {
+                cond_synchronize_rcu(event->rcu_batches);
+                event->rcu_pending = 0;
+        }
+
+        if (rb) {
+                spin_lock_irqsave(&rb->event_lock, flags);
+                list_add_rcu(&event->rb_entry, &rb->event_list);
+                spin_unlock_irqrestore(&rb->event_lock, flags);
+        }
+
+        rcu_assign_pointer(event->rb, rb);
 
-        spin_lock_irqsave(&rb->event_lock, flags);
-        list_del_init(&event->rb_entry);
-        wake_up_all(&event->waitq);
-        spin_unlock_irqrestore(&rb->event_lock, flags);
+        if (old_rb) {
+                ring_buffer_put(old_rb);
+                /*
+                 * Since we detached before setting the new rb, so that we
+                 * could attach the new rb, we could have missed a wakeup.
+                 * Provide it now.
+                 */
+                wake_up_all(&event->waitq);
+        }
 }
 
 static void ring_buffer_wakeup(struct perf_event *event)
@@ -3929,7 +3953,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
 {
         struct perf_event *event = vma->vm_file->private_data;
 
-        struct ring_buffer *rb = event->rb;
+        struct ring_buffer *rb = ring_buffer_get(event);
         struct user_struct *mmap_user = rb->mmap_user;
         int mmap_locked = rb->mmap_locked;
         unsigned long size = perf_data_size(rb);
@@ -3937,18 +3961,14 @@ static void perf_mmap_close(struct vm_area_struct *vma)
         atomic_dec(&rb->mmap_count);
 
         if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex))
-                return;
+                goto out_put;
 
-        /* Detach current event from the buffer. */
-        rcu_assign_pointer(event->rb, NULL);
-        ring_buffer_detach(event, rb);
+        ring_buffer_attach(event, NULL);
         mutex_unlock(&event->mmap_mutex);
 
         /* If there's still other mmap()s of this buffer, we're done. */
-        if (atomic_read(&rb->mmap_count)) {
-                ring_buffer_put(rb); /* can't be last */
-                return;
-        }
+        if (atomic_read(&rb->mmap_count))
+                goto out_put;
 
         /*
          * No other mmap()s, detach from all other events that might redirect
@@ -3978,11 +3998,9 @@ again:
                  * still restart the iteration to make sure we're not now
                  * iterating the wrong list.
                  */
-                if (event->rb == rb) {
-                        rcu_assign_pointer(event->rb, NULL);
-                        ring_buffer_detach(event, rb);
-                        ring_buffer_put(rb); /* can't be last, we still have one */
-                }
+                if (event->rb == rb)
+                        ring_buffer_attach(event, NULL);
+
                 mutex_unlock(&event->mmap_mutex);
                 put_event(event);
 
@@ -4007,6 +4025,7 @@ again:
         vma->vm_mm->pinned_vm -= mmap_locked;
         free_uid(mmap_user);
 
+out_put:
         ring_buffer_put(rb); /* could be last */
 }
 
@@ -4124,7 +4143,6 @@ again:
         vma->vm_mm->pinned_vm += extra;
 
         ring_buffer_attach(event, rb);
-        rcu_assign_pointer(event->rb, rb);
 
         perf_event_init_userpage(event);
         perf_event_update_userpage(event);
@@ -5408,6 +5426,9 @@ struct swevent_htable {
 
         /* Recursion avoidance in each contexts */
         int                             recursion[PERF_NR_CONTEXTS];
+
+        /* Keeps track of cpu being initialized/exited */
+        bool                            online;
 };
 
 static DEFINE_PER_CPU(struct swevent_htable, swevent_htable);
@@ -5654,8 +5675,14 @@ static int perf_swevent_add(struct perf_event *event, int flags)
         hwc->state = !(flags & PERF_EF_START);
 
         head = find_swevent_head(swhash, event);
-        if (WARN_ON_ONCE(!head))
+        if (!head) {
+                /*
+                 * We can race with cpu hotplug code. Do not
+                 * WARN if the cpu just got unplugged.
+                 */
+                WARN_ON_ONCE(swhash->online);
                 return -EINVAL;
+        }
 
         hlist_add_head_rcu(&event->hlist_entry, head);
 
@@ -6914,7 +6941,7 @@ err_size:
 static int
 perf_event_set_output(struct perf_event *event, struct perf_event *output_event)
 {
-        struct ring_buffer *rb = NULL, *old_rb = NULL;
+        struct ring_buffer *rb = NULL;
         int ret = -EINVAL;
 
         if (!output_event)
@@ -6942,8 +6969,6 @@ set:
         if (atomic_read(&event->mmap_count))
                 goto unlock;
 
-        old_rb = event->rb;
-
         if (output_event) {
                 /* get the rb we want to redirect to */
                 rb = ring_buffer_get(output_event);
@@ -6951,23 +6976,7 @@ set:
                         goto unlock;
         }
 
-        if (old_rb)
-                ring_buffer_detach(event, old_rb);
-
-        if (rb)
-                ring_buffer_attach(event, rb);
-
-        rcu_assign_pointer(event->rb, rb);
-
-        if (old_rb) {
-                ring_buffer_put(old_rb);
-                /*
-                 * Since we detached before setting the new rb, so that we
-                 * could attach the new rb, we could have missed a wakeup.
-                 * Provide it now.
-                 */
-                wake_up_all(&event->waitq);
-        }
+        ring_buffer_attach(event, rb);
 
         ret = 0;
 unlock:
@@ -7018,6 +7027,9 @@ SYSCALL_DEFINE5(perf_event_open,
         if (attr.freq) {
                 if (attr.sample_freq > sysctl_perf_event_sample_rate)
                         return -EINVAL;
+        } else {
+                if (attr.sample_period & (1ULL << 63))
+                        return -EINVAL;
         }
 
         /*
@@ -7165,7 +7177,7 @@ SYSCALL_DEFINE5(perf_event_open,
                 struct perf_event_context *gctx = group_leader->ctx;
 
                 mutex_lock(&gctx->mutex);
-                perf_remove_from_context(group_leader);
+                perf_remove_from_context(group_leader, false);
 
                 /*
                  * Removing from the context ends up with disabled
@@ -7175,7 +7187,7 @@ SYSCALL_DEFINE5(perf_event_open,
                 perf_event__state_init(group_leader);
                 list_for_each_entry(sibling, &group_leader->sibling_list,
                                     group_entry) {
-                        perf_remove_from_context(sibling);
+                        perf_remove_from_context(sibling, false);
                         perf_event__state_init(sibling);
                         put_ctx(gctx);
                 }
@@ -7305,7 +7317,7 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
         mutex_lock(&src_ctx->mutex);
         list_for_each_entry_safe(event, tmp, &src_ctx->event_list,
                                  event_entry) {
-                perf_remove_from_context(event);
+                perf_remove_from_context(event, false);
                 unaccount_event_cpu(event, src_cpu);
                 put_ctx(src_ctx);
                 list_add(&event->migrate_entry, &events);
@@ -7367,13 +7379,7 @@ __perf_event_exit_task(struct perf_event *child_event,
                          struct perf_event_context *child_ctx,
                          struct task_struct *child)
 {
-        if (child_event->parent) {
-                raw_spin_lock_irq(&child_ctx->lock);
-                perf_group_detach(child_event);
-                raw_spin_unlock_irq(&child_ctx->lock);
-        }
-
-        perf_remove_from_context(child_event);
+        perf_remove_from_context(child_event, !!child_event->parent);
 
         /*
          * It can happen that the parent exits first, and has events
@@ -7724,6 +7730,8 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
          * swapped under us.
          */
         parent_ctx = perf_pin_task_context(parent, ctxn);
+        if (!parent_ctx)
+                return 0;
 
         /*
          * No need to check if parent_ctx != NULL here; since we saw
@@ -7835,6 +7843,7 @@ static void perf_event_init_cpu(int cpu)
         struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
 
         mutex_lock(&swhash->hlist_mutex);
+        swhash->online = true;
         if (swhash->hlist_refcount > 0) {
                 struct swevent_hlist *hlist;
 
@@ -7857,14 +7866,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu)
 
 static void __perf_event_exit_context(void *__info)
 {
+        struct remove_event re = { .detach_group = false };
         struct perf_event_context *ctx = __info;
-        struct perf_event *event;
 
         perf_pmu_rotate_stop(ctx->pmu);
 
         rcu_read_lock();
-        list_for_each_entry_rcu(event, &ctx->event_list, event_entry)
-                __perf_remove_from_context(event);
+        list_for_each_entry_rcu(re.event, &ctx->event_list, event_entry)
+                __perf_remove_from_context(&re);
         rcu_read_unlock();
 }
 
@@ -7892,6 +7901,7 @@ static void perf_event_exit_cpu(int cpu)
         perf_event_exit_cpu_context(cpu);
 
         mutex_lock(&swhash->hlist_mutex);
+        swhash->online = false;
         swevent_hlist_release(swhash);
         mutex_unlock(&swhash->hlist_mutex);
 }
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 6b715c0af1b1..e0501fe7140d 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -990,11 +990,8 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
         /* Remove an active timer from the queue: */
         ret = remove_hrtimer(timer, base);
 
-        /* Switch the timer base, if necessary: */
-        new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
-
         if (mode & HRTIMER_MODE_REL) {
-                tim = ktime_add_safe(tim, new_base->get_time());
+                tim = ktime_add_safe(tim, base->get_time());
                 /*
                  * CONFIG_TIME_LOW_RES is a temporary way for architectures
                  * to signal that they simply return xtime in
@@ -1009,6 +1006,9 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
 
         hrtimer_set_expires_range_ns(timer, tim, delta_ns);
 
+        /* Switch the timer base, if necessary: */
+        new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
+
         timer_stats_hrtimer_set_start_info(timer);
 
         leftmost = enqueue_hrtimer(timer, new_base);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index d9d8ece46a15..204d3d281809 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2592,8 +2592,14 @@ pick_next_task(struct rq *rq, struct task_struct *prev)
         if (likely(prev->sched_class == class &&
                    rq->nr_running == rq->cfs.h_nr_running)) {
                 p = fair_sched_class.pick_next_task(rq, prev);
-                if (likely(p && p != RETRY_TASK))
-                        return p;
+                if (unlikely(p == RETRY_TASK))
+                        goto again;
+
+                /* assumes fair_sched_class->next == idle_sched_class */
+                if (unlikely(!p))
+                        p = idle_sched_class.pick_next_task(rq, prev);
+
+                return p;
         }
 
 again:
@@ -3124,6 +3130,7 @@ __setparam_dl(struct task_struct *p, const struct sched_attr *attr)
         dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
         dl_se->dl_throttled = 0;
         dl_se->dl_new = 1;
+        dl_se->dl_yielded = 0;
 }
 
 static void __setscheduler_params(struct task_struct *p,
@@ -3639,6 +3646,7 @@ SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
  * sys_sched_setattr - same as above, but with extended sched_attr
  * @pid: the pid in question.
  * @uattr: structure containing the extended parameters.
+ * @flags: for future extension.
  */
 SYSCALL_DEFINE3(sched_setattr, pid_t, pid, struct sched_attr __user *, uattr,
                                unsigned int, flags)
@@ -3783,6 +3791,7 @@ err_size:
  * @pid: the pid in question.
  * @uattr: structure containing the extended parameters.
  * @size: sizeof(attr) for fwd/bwd comp.
+ * @flags: for future extension.
  */
 SYSCALL_DEFINE4(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
                 unsigned int, size, unsigned int, flags)
@@ -6017,6 +6026,8 @@ sd_numa_init(struct sched_domain_topology_level *tl, int cpu)
                                         ,
                 .last_balance           = jiffies,
                 .balance_interval       = sd_weight,
+                .max_newidle_lb_cost    = 0,
+                .next_decay_max_lb_cost = jiffies,
         };
         SD_INIT_NAME(sd, NUMA);
         sd->private = &tl->data;
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
index 5b9bb42b2d47..ab001b5d5048 100644
--- a/kernel/sched/cpudeadline.c
+++ b/kernel/sched/cpudeadline.c
@@ -210,7 +210,5 @@ int cpudl_init(struct cpudl *cp)
  */
 void cpudl_cleanup(struct cpudl *cp)
 {
-        /*
-         * nothing to do for the moment
-         */
+        free_cpumask_var(cp->free_cpus);
 }
diff --git a/kernel/sched/cpupri.c b/kernel/sched/cpupri.c
index 8b836b376d91..3031bac8aa3e 100644
--- a/kernel/sched/cpupri.c
+++ b/kernel/sched/cpupri.c
@@ -70,8 +70,7 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p,
         int idx = 0;
         int task_pri = convert_prio(p->prio);
 
-        if (task_pri >= MAX_RT_PRIO)
-                return 0;
+        BUG_ON(task_pri >= CPUPRI_NR_PRIORITIES);
 
         for (idx = 0; idx < task_pri; idx++) {
                 struct cpupri_vec *vec  = &cp->pri_to_cpu[idx];
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index a95097cb4591..72fdf06ef865 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -332,50 +332,50 @@ out:
  * softirq as those do not count in task exec_runtime any more.
  */
 static void irqtime_account_process_tick(struct task_struct *p, int user_tick,
-                                                struct rq *rq)
+                                         struct rq *rq, int ticks)
 {
-        cputime_t one_jiffy_scaled = cputime_to_scaled(cputime_one_jiffy);
+        cputime_t scaled = cputime_to_scaled(cputime_one_jiffy);
+        u64 cputime = (__force u64) cputime_one_jiffy;
         u64 *cpustat = kcpustat_this_cpu->cpustat;
 
         if (steal_account_process_tick())
                 return;
 
+        cputime *= ticks;
+        scaled *= ticks;
+
         if (irqtime_account_hi_update()) {
-                cpustat[CPUTIME_IRQ] += (__force u64) cputime_one_jiffy;
+                cpustat[CPUTIME_IRQ] += cputime;
         } else if (irqtime_account_si_update()) {
-                cpustat[CPUTIME_SOFTIRQ] += (__force u64) cputime_one_jiffy;
+                cpustat[CPUTIME_SOFTIRQ] += cputime;
         } else if (this_cpu_ksoftirqd() == p) {
                 /*
                  * ksoftirqd time do not get accounted in cpu_softirq_time.
                  * So, we have to handle it separately here.
                  * Also, p->stime needs to be updated for ksoftirqd.
                  */
-                __account_system_time(p, cputime_one_jiffy, one_jiffy_scaled,
-                                        CPUTIME_SOFTIRQ);
+                __account_system_time(p, cputime, scaled, CPUTIME_SOFTIRQ);
         } else if (user_tick) {
-                account_user_time(p, cputime_one_jiffy, one_jiffy_scaled);
+                account_user_time(p, cputime, scaled);
         } else if (p == rq->idle) {
-                account_idle_time(cputime_one_jiffy);
+                account_idle_time(cputime);
         } else if (p->flags & PF_VCPU) { /* System time or guest time */
-                account_guest_time(p, cputime_one_jiffy, one_jiffy_scaled);
+                account_guest_time(p, cputime, scaled);
         } else {
-                __account_system_time(p, cputime_one_jiffy, one_jiffy_scaled,
-                                        CPUTIME_SYSTEM);
+                __account_system_time(p, cputime, scaled,       CPUTIME_SYSTEM);
         }
 }
 
 static void irqtime_account_idle_ticks(int ticks)
 {
-        int i;
         struct rq *rq = this_rq();
 
-        for (i = 0; i < ticks; i++)
-                irqtime_account_process_tick(current, 0, rq);
+        irqtime_account_process_tick(current, 0, rq, ticks);
 }
 #else /* CONFIG_IRQ_TIME_ACCOUNTING */
 static inline void irqtime_account_idle_ticks(int ticks) {}
 static inline void irqtime_account_process_tick(struct task_struct *p, int user_tick,
-                                                struct rq *rq) {}
+                                                struct rq *rq, int nr_ticks) {}
 #endif /* CONFIG_IRQ_TIME_ACCOUNTING */
 
 /*
@@ -464,7 +464,7 @@ void account_process_tick(struct task_struct *p, int user_tick)
                 return;
 
         if (sched_clock_irqtime) {
-                irqtime_account_process_tick(p, user_tick, rq);
+                irqtime_account_process_tick(p, user_tick, rq, 1);
                 return;
         }
 
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index b08095786cb8..800e99b99075 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -528,6 +528,7 @@ static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
         sched_clock_tick();
         update_rq_clock(rq);
         dl_se->dl_throttled = 0;
+        dl_se->dl_yielded = 0;
         if (p->on_rq) {
                 enqueue_task_dl(rq, p, ENQUEUE_REPLENISH);
                 if (task_has_dl_policy(rq->curr))
@@ -893,10 +894,10 @@ static void yield_task_dl(struct rq *rq)
          * We make the task go to sleep until its current deadline by
          * forcing its runtime to zero. This way, update_curr_dl() stops
          * it and the bandwidth timer will wake it up and will give it
-         * new scheduling parameters (thanks to dl_new=1).
+         * new scheduling parameters (thanks to dl_yielded=1).
          */
         if (p->dl.runtime > 0) {
-                rq->curr->dl.dl_new = 1;
+                rq->curr->dl.dl_yielded = 1;
                 p->dl.runtime = 0;
         }
         update_curr_dl(rq);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 7570dd969c28..0fdb96de81a5 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -6653,6 +6653,7 @@ static int idle_balance(struct rq *this_rq)
         int this_cpu = this_rq->cpu;
 
         idle_enter_fair(this_rq);
+
         /*
          * We must set idle_stamp _before_ calling idle_balance(), such that we
          * measure the duration of idle_balance() as idle time.
@@ -6705,14 +6706,16 @@ static int idle_balance(struct rq *this_rq)
 
         raw_spin_lock(&this_rq->lock);
 
+        if (curr_cost > this_rq->max_idle_balance_cost)
+                this_rq->max_idle_balance_cost = curr_cost;
+
         /*
-         * While browsing the domains, we released the rq lock.
-         * A task could have be enqueued in the meantime
+         * While browsing the domains, we released the rq lock, a task could
+         * have been enqueued in the meantime. Since we're not going idle,
+         * pretend we pulled a task.
          */
-        if (this_rq->cfs.h_nr_running && !pulled_task) {
+        if (this_rq->cfs.h_nr_running && !pulled_task)
                 pulled_task = 1;
-                goto out;
-        }
 
         if (pulled_task || time_after(jiffies, this_rq->next_balance)) {
                 /*
@@ -6722,9 +6725,6 @@ static int idle_balance(struct rq *this_rq)
                 this_rq->next_balance = next_balance;
         }
 
-        if (curr_cost > this_rq->max_idle_balance_cost)
-                this_rq->max_idle_balance_cost = curr_cost;
-
 out:
         /* Is there a task of a high priority class? */
         if (this_rq->nr_running != this_rq->cfs.h_nr_running &&
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 0ee63af30bd1..8edc87185427 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1916,6 +1916,12 @@ static void send_mayday(struct work_struct *work)
 
         /* mayday mayday mayday */
         if (list_empty(&pwq->mayday_node)) {
+                /*
+                 * If @pwq is for an unbound wq, its base ref may be put at
+                 * any time due to an attribute change.  Pin @pwq until the
+                 * rescuer is done with it.
+                 */
+                get_pwq(pwq);
                 list_add_tail(&pwq->mayday_node, &wq->maydays);
                 wake_up_process(wq->rescuer->task);
         }
@@ -2398,6 +2404,7 @@ static int rescuer_thread(void *__rescuer)
         struct worker *rescuer = __rescuer;
         struct workqueue_struct *wq = rescuer->rescue_wq;
         struct list_head *scheduled = &rescuer->scheduled;
+        bool should_stop;
 
         set_user_nice(current, RESCUER_NICE_LEVEL);
 
@@ -2409,11 +2416,15 @@ static int rescuer_thread(void *__rescuer)
 repeat:
         set_current_state(TASK_INTERRUPTIBLE);
 
-        if (kthread_should_stop()) {
-                __set_current_state(TASK_RUNNING);
-                rescuer->task->flags &= ~PF_WQ_WORKER;
-                return 0;
-        }
+        /*
+         * By the time the rescuer is requested to stop, the workqueue
+         * shouldn't have any work pending, but @wq->maydays may still have
+         * pwq(s) queued.  This can happen by non-rescuer workers consuming
+         * all the work items before the rescuer got to them.  Go through
+         * @wq->maydays processing before acting on should_stop so that the
+         * list is always empty on exit.
+         */
+        should_stop = kthread_should_stop();
 
         /* see whether any pwq is asking for help */
         spin_lock_irq(&wq_mayday_lock);
@@ -2445,6 +2456,12 @@ repeat:
                 process_scheduled_works(rescuer);
 
                 /*
+                 * Put the reference grabbed by send_mayday().  @pool won't
+                 * go away while we're holding its lock.
+                 */
+                put_pwq(pwq);
+
+                /*
                  * Leave this pool.  If keep_working() is %true, notify a
                  * regular worker; otherwise, we end up with 0 concurrency
                  * and stalling the execution.
@@ -2459,6 +2476,12 @@ repeat:
 
         spin_unlock_irq(&wq_mayday_lock);
 
+        if (should_stop) {
+                __set_current_state(TASK_RUNNING);
+                rescuer->task->flags &= ~PF_WQ_WORKER;
+                return 0;
+        }
+
         /* rescuers should never participate in concurrency management */
         WARN_ON_ONCE(!(rescuer->flags & WORKER_NOT_RUNNING));
         schedule();
@@ -4100,7 +4123,8 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
         if (!pwq) {
                 pr_warning("workqueue: allocation failed while updating NUMA affinity of \"%s\"\n",
                            wq->name);
-                goto out_unlock;
+                mutex_lock(&wq->mutex);
+                goto use_dfl_pwq;
         }
 
         /*