11 files changed, 160 insertions, 53 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index ca83b73fba19..0249f4be9b5c 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1710,14 +1710,13 @@ static ssize_t cgroup_write_X64(struct cgroup *cgrp, struct cftype *cft,
                 return -EFAULT;
 
         buffer[nbytes] = 0;     /* nul-terminate */
-        strstrip(buffer);
         if (cft->write_u64) {
-                u64 val = simple_strtoull(buffer, &end, 0);
+                u64 val = simple_strtoull(strstrip(buffer), &end, 0);
                 if (*end)
                         return -EINVAL;
                 retval = cft->write_u64(cgrp, cft, val);
         } else {
-                s64 val = simple_strtoll(buffer, &end, 0);
+                s64 val = simple_strtoll(strstrip(buffer), &end, 0);
                 if (*end)
                         return -EINVAL;
                 retval = cft->write_s64(cgrp, cft, val);
@@ -1753,8 +1752,7 @@ static ssize_t cgroup_write_string(struct cgroup *cgrp, struct cftype *cft,
         }
 
         buffer[nbytes] = 0;     /* nul-terminate */
-        strstrip(buffer);
-        retval = cft->write_string(cgrp, cft, buffer);
+        retval = cft->write_string(cgrp, cft, strstrip(buffer));
         if (!retval)
                 retval = nbytes;
 out:
diff --git a/kernel/exit.c b/kernel/exit.c
index e61891f80123..f7864ac2ecc1 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -359,10 +359,8 @@ void __set_special_pids(struct pid *pid)
 {
         struct task_struct *curr = current->group_leader;
 
-        if (task_session(curr) != pid) {
+        if (task_session(curr) != pid)
                 change_pid(curr, PIDTYPE_SID, pid);
-                proc_sid_connector(curr);
-        }
 
         if (task_pgrp(curr) != pid)
                 change_pid(curr, PIDTYPE_PGID, pid);
diff --git a/kernel/futex.c b/kernel/futex.c
index 4949d336d88d..642f3bbaacc7 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -150,7 +150,8 @@ static struct futex_hash_bucket *hash_futex(union futex_key *key)
  */
 static inline int match_futex(union futex_key *key1, union futex_key *key2)
 {
-        return (key1->both.word == key2->both.word
+        return (key1 && key2
+                && key1->both.word == key2->both.word
                 && key1->both.ptr == key2->both.ptr
                 && key1->both.offset == key2->both.offset);
 }
@@ -1028,7 +1029,6 @@ static inline
 void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
                            struct futex_hash_bucket *hb)
 {
-        drop_futex_key_refs(&q->key);
         get_futex_key_refs(key);
         q->key = *key;
 
@@ -1226,6 +1226,7 @@ retry_private:
                  */
                 if (ret == 1) {
                         WARN_ON(pi_state);
+                        drop_count++;
                         task_count++;
                         ret = get_futex_value_locked(&curval2, uaddr2);
                         if (!ret)
@@ -1304,6 +1305,7 @@ retry_private:
                         if (ret == 1) {
                                 /* We got the lock. */
                                 requeue_pi_wake_futex(this, &key2, hb2);
+                                drop_count++;
                                 continue;
                         } else if (ret) {
                                 /* -EDEADLK */
@@ -1791,6 +1793,7 @@ static int futex_wait(u32 __user *uaddr, int fshared,
                                              current->timer_slack_ns);
         }
 
+retry:
         /* Prepare to wait on uaddr. */
         ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
         if (ret)
@@ -1808,9 +1811,14 @@ static int futex_wait(u32 __user *uaddr, int fshared,
                 goto out_put_key;
 
         /*
-         * We expect signal_pending(current), but another thread may
-         * have handled it for us already.
+         * We expect signal_pending(current), but we might be the
+         * victim of a spurious wakeup as well.
          */
+        if (!signal_pending(current)) {
+                put_futex_key(fshared, &q.key);
+                goto retry;
+        }
+
         ret = -ERESTARTSYS;
         if (!abs_time)
                 goto out_put_key;
@@ -2118,9 +2126,11 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
                  */
                 plist_del(&q->list, &q->list.plist);
 
+                /* Handle spurious wakeups gracefully */
+                ret = -EAGAIN;
                 if (timeout && !timeout->task)
                         ret = -ETIMEDOUT;
-                else
+                else if (signal_pending(current))
                         ret = -ERESTARTNOINTR;
         }
         return ret;
@@ -2198,6 +2208,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
         debug_rt_mutex_init_waiter(&rt_waiter);
         rt_waiter.task = NULL;
 
+retry:
         key2 = FUTEX_KEY_INIT;
         ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
         if (unlikely(ret != 0))
@@ -2292,6 +2303,9 @@ out_put_keys:
 out_key2:
         put_futex_key(fshared, &key2);
 
+        /* Spurious wakeup ? */
+        if (ret == -EAGAIN)
+                goto retry;
 out:
         if (to) {
                 hrtimer_cancel(&to->timer);
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 9d0b5c665883..afb7ef3dbc44 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -1355,7 +1355,7 @@ static void perf_ctx_adjust_freq(struct perf_event_context *ctx)
         u64 interrupts, freq;
 
         spin_lock(&ctx->lock);
-        list_for_each_entry(event, &ctx->group_list, group_entry) {
+        list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {
                 if (event->state != PERF_EVENT_STATE_ACTIVE)
                         continue;
 
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 705f02ac7433..0536125b0497 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -913,7 +913,20 @@ static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
                         spin_unlock(&rnp->lock); /* irqs remain disabled. */
                         break;
                 }
-                rcu_preempt_offline_tasks(rsp, rnp, rdp);
+
+                /*
+                 * If there was a task blocking the current grace period,
+                 * and if all CPUs have checked in, we need to propagate
+                 * the quiescent state up the rcu_node hierarchy.  But that
+                 * is inconvenient at the moment due to deadlock issues if
+                 * this should end the current grace period.  So set the
+                 * offlined CPU's bit in ->qsmask in order to force the
+                 * next force_quiescent_state() invocation to clean up this
+                 * mess in a deadlock-free manner.
+                 */
+                if (rcu_preempt_offline_tasks(rsp, rnp, rdp) && !rnp->qsmask)
+                        rnp->qsmask |= mask;
+
                 mask = rnp->grpmask;
                 spin_unlock(&rnp->lock);        /* irqs remain disabled. */
                 rnp = rnp->parent;
@@ -958,7 +971,7 @@ static void rcu_offline_cpu(int cpu)
  * Invoke any RCU callbacks that have made it to the end of their grace
  * period.  Thottle as specified by rdp->blimit.
  */
-static void rcu_do_batch(struct rcu_data *rdp)
+static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
 {
         unsigned long flags;
         struct rcu_head *next, *list, **tail;
@@ -1011,6 +1024,13 @@ static void rcu_do_batch(struct rcu_data *rdp)
         if (rdp->blimit == LONG_MAX && rdp->qlen <= qlowmark)
                 rdp->blimit = blimit;
 
+        /* Reset ->qlen_last_fqs_check trigger if enough CBs have drained. */
+        if (rdp->qlen == 0 && rdp->qlen_last_fqs_check != 0) {
+                rdp->qlen_last_fqs_check = 0;
+                rdp->n_force_qs_snap = rsp->n_force_qs;
+        } else if (rdp->qlen < rdp->qlen_last_fqs_check - qhimark)
+                rdp->qlen_last_fqs_check = rdp->qlen;
+
         local_irq_restore(flags);
 
         /* Re-raise the RCU softirq if there are callbacks remaining. */
@@ -1224,7 +1244,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
         }
 
         /* If there are callbacks ready, invoke them. */
-        rcu_do_batch(rdp);
+        rcu_do_batch(rsp, rdp);
 }
 
 /*
@@ -1288,10 +1308,20 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
                 rcu_start_gp(rsp, nestflag);  /* releases rnp_root->lock. */
         }
 
-        /* Force the grace period if too many callbacks or too long waiting. */
-        if (unlikely(++rdp->qlen > qhimark)) {
+        /*
+         * Force the grace period if too many callbacks or too long waiting.
+         * Enforce hysteresis, and don't invoke force_quiescent_state()
+         * if some other CPU has recently done so.  Also, don't bother
+         * invoking force_quiescent_state() if the newly enqueued callback
+         * is the only one waiting for a grace period to complete.
+         */
+        if (unlikely(++rdp->qlen > rdp->qlen_last_fqs_check + qhimark)) {
                 rdp->blimit = LONG_MAX;
-                force_quiescent_state(rsp, 0);
+                if (rsp->n_force_qs == rdp->n_force_qs_snap &&
+                    *rdp->nxttail[RCU_DONE_TAIL] != head)
+                        force_quiescent_state(rsp, 0);
+                rdp->n_force_qs_snap = rsp->n_force_qs;
+                rdp->qlen_last_fqs_check = rdp->qlen;
         } else if ((long)(ACCESS_ONCE(rsp->jiffies_force_qs) - jiffies) < 0)
                 force_quiescent_state(rsp, 1);
         local_irq_restore(flags);
@@ -1523,6 +1553,8 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptable)
         rdp->beenonline = 1;     /* We have now been online. */
         rdp->preemptable = preemptable;
         rdp->passed_quiesc_completed = lastcomp - 1;
+        rdp->qlen_last_fqs_check = 0;
+        rdp->n_force_qs_snap = rsp->n_force_qs;
         rdp->blimit = blimit;
         spin_unlock(&rnp->lock);                /* irqs remain disabled. */
 
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index b40ac5706040..1823c6e20609 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -167,6 +167,10 @@ struct rcu_data {
         struct rcu_head *nxtlist;
         struct rcu_head **nxttail[RCU_NEXT_SIZE];
         long            qlen;           /* # of queued callbacks */
+        long            qlen_last_fqs_check;
+                                        /* qlen at last check for QS forcing */
+        unsigned long   n_force_qs_snap;
+                                        /* did other CPU force QS recently? */
         long            blimit;         /* Upper limit on a processed batch */
 
 #ifdef CONFIG_NO_HZ
@@ -302,9 +306,9 @@ static void rcu_print_task_stall(struct rcu_node *rnp);
 #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp);
 #ifdef CONFIG_HOTPLUG_CPU
-static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
-                                      struct rcu_node *rnp,
-                                      struct rcu_data *rdp);
+static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
+                                     struct rcu_node *rnp,
+                                     struct rcu_data *rdp);
 static void rcu_preempt_offline_cpu(int cpu);
 #endif /* #ifdef CONFIG_HOTPLUG_CPU */
 static void rcu_preempt_check_callbacks(int cpu);
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index c0cb783aa16a..ef2a58c2b9d5 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -304,21 +304,25 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
  * parent is to remove the need for rcu_read_unlock_special() to
  * make more than two attempts to acquire the target rcu_node's lock.
  *
+ * Returns 1 if there was previously a task blocking the current grace
+ * period on the specified rcu_node structure.
+ *
  * The caller must hold rnp->lock with irqs disabled.
  */
-static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
-                                      struct rcu_node *rnp,
-                                      struct rcu_data *rdp)
+static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
+                                     struct rcu_node *rnp,
+                                     struct rcu_data *rdp)
 {
         int i;
         struct list_head *lp;
         struct list_head *lp_root;
+        int retval = rcu_preempted_readers(rnp);
         struct rcu_node *rnp_root = rcu_get_root(rsp);
         struct task_struct *tp;
 
         if (rnp == rnp_root) {
                 WARN_ONCE(1, "Last CPU thought to be offlined?");
-                return;  /* Shouldn't happen: at least one CPU online. */
+                return 0;  /* Shouldn't happen: at least one CPU online. */
         }
         WARN_ON_ONCE(rnp != rdp->mynode &&
                      (!list_empty(&rnp->blocked_tasks[0]) ||
@@ -342,6 +346,8 @@ static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
                         spin_unlock(&rnp_root->lock); /* irqs remain disabled */
                 }
         }
+
+        return retval;
 }
 
 /*
@@ -393,6 +399,17 @@ void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
 EXPORT_SYMBOL_GPL(call_rcu);
 
 /*
+ * Wait for an rcu-preempt grace period.  We are supposed to expedite the
+ * grace period, but this is the crude slow compatability hack, so just
+ * invoke synchronize_rcu().
+ */
+void synchronize_rcu_expedited(void)
+{
+        synchronize_rcu();
+}
+EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
+
+/*
  * Check to see if there is any immediate preemptable-RCU-related work
  * to be done.
  */
@@ -521,12 +538,15 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
 
 /*
  * Because preemptable RCU does not exist, it never needs to migrate
- * tasks that were blocked within RCU read-side critical sections.
+ * tasks that were blocked within RCU read-side critical sections, and
+ * such non-existent tasks cannot possibly have been blocking the current
+ * grace period.
  */
-static void rcu_preempt_offline_tasks(struct rcu_state *rsp,
-                                      struct rcu_node *rnp,
-                                      struct rcu_data *rdp)
+static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
+                                     struct rcu_node *rnp,
+                                     struct rcu_data *rdp)
 {
+        return 0;
 }
 
 /*
@@ -565,6 +585,16 @@ void call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu))
 EXPORT_SYMBOL_GPL(call_rcu);
 
 /*
+ * Wait for an rcu-preempt grace period, but make it happen quickly.
+ * But because preemptable RCU does not exist, map to rcu-sched.
+ */
+void synchronize_rcu_expedited(void)
+{
+        synchronize_sched_expedited();
+}
+EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
+
+/*
  * Because preemptable RCU does not exist, it never has any work to do.
  */
 static int rcu_preempt_pending(int cpu)
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 4e777b47eeda..c32c3e643daa 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -861,12 +861,21 @@ wakeup_preempt_entity(struct sched_entity *curr, struct sched_entity *se);
 static struct sched_entity *pick_next_entity(struct cfs_rq *cfs_rq)
 {
         struct sched_entity *se = __pick_next_entity(cfs_rq);
+        struct sched_entity *buddy;
 
-        if (cfs_rq->next && wakeup_preempt_entity(cfs_rq->next, se) < 1)
-                return cfs_rq->next;
+        if (cfs_rq->next) {
+                buddy = cfs_rq->next;
+                cfs_rq->next = NULL;
+                if (wakeup_preempt_entity(buddy, se) < 1)
+                        return buddy;
+        }
 
-        if (cfs_rq->last && wakeup_preempt_entity(cfs_rq->last, se) < 1)
-                return cfs_rq->last;
+        if (cfs_rq->last) {
+                buddy = cfs_rq->last;
+                cfs_rq->last = NULL;
+                if (wakeup_preempt_entity(buddy, se) < 1)
+                        return buddy;
+        }
 
         return se;
 }
@@ -1654,16 +1663,6 @@ static struct task_struct *pick_next_task_fair(struct rq *rq)
 
         do {
                 se = pick_next_entity(cfs_rq);
-                /*
-                 * If se was a buddy, clear it so that it will have to earn
-                 * the favour again.
-                 *
-                 * If se was not a buddy, clear the buddies because neither
-                 * was elegible to run, let them earn it again.
-                 *
-                 * IOW. unconditionally clear buddies.
-                 */
-                __clear_buddies(cfs_rq, NULL);
                 set_next_entity(cfs_rq, se);
                 cfs_rq = group_cfs_rq(se);
         } while (cfs_rq);
diff --git a/kernel/sys.c b/kernel/sys.c
index 255475d163e0..ce17760d9c51 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1110,6 +1110,8 @@ SYSCALL_DEFINE0(setsid)
         err = session;
 out:
         write_unlock_irq(&tasklist_lock);
+        if (err > 0)
+                proc_sid_connector(group_leader);
         return err;
 }
 
@@ -1546,24 +1548,37 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                         if (arg4 | arg5)
                                 return -EINVAL;
                         switch (arg2) {
-                        case 0:
+                        case PR_MCE_KILL_CLEAR:
                                 if (arg3 != 0)
                                         return -EINVAL;
                                 current->flags &= ~PF_MCE_PROCESS;
                                 break;
-                        case 1:
+                        case PR_MCE_KILL_SET:
                                 current->flags |= PF_MCE_PROCESS;
-                                if (arg3 != 0)
+                                if (arg3 == PR_MCE_KILL_EARLY)
                                         current->flags |= PF_MCE_EARLY;
-                                else
+                                else if (arg3 == PR_MCE_KILL_LATE)
                                         current->flags &= ~PF_MCE_EARLY;
+                                else if (arg3 == PR_MCE_KILL_DEFAULT)
+                                        current->flags &=
+                                                ~(PF_MCE_EARLY|PF_MCE_PROCESS);
+                                else
+                                        return -EINVAL;
                                 break;
                         default:
                                 return -EINVAL;
                         }
                         error = 0;
                         break;
-
+                case PR_MCE_KILL_GET:
+                        if (arg2 | arg3 | arg4 | arg5)
+                                return -EINVAL;
+                        if (current->flags & PF_MCE_PROCESS)
+                                error = (current->flags & PF_MCE_EARLY) ?
+                                        PR_MCE_KILL_EARLY : PR_MCE_KILL_LATE;
+                        else
+                                error = PR_MCE_KILL_DEFAULT;
+                        break;
                 default:
                         error = -EINVAL;
                         break;
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
index b38423ca711a..b6e7aaea4604 100644
--- a/kernel/sysctl_check.c
+++ b/kernel/sysctl_check.c
@@ -1521,7 +1521,7 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
                         if (!table->ctl_name && table->strategy)
                                 set_fail(&fail, table, "Strategy without ctl_name");
 #endif
-#ifdef CONFIG_PROC_FS
+#ifdef CONFIG_PROC_SYSCTL
                         if (table->procname && !table->proc_handler)
                                 set_fail(&fail, table, "No proc_handler");
 #endif
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 47cdd7e76f2b..12328147132c 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -685,21 +685,38 @@ EXPORT_SYMBOL(schedule_delayed_work_on);
 int schedule_on_each_cpu(work_func_t func)
 {
         int cpu;
+        int orig = -1;
         struct work_struct *works;
 
         works = alloc_percpu(struct work_struct);
         if (!works)
                 return -ENOMEM;
 
+        /*
+         * when running in keventd don't schedule a work item on itself.
+         * Can just call directly because the work queue is already bound.
+         * This also is faster.
+         * Make this a generic parameter for other workqueues?
+         */
+        if (current_is_keventd()) {
+                orig = raw_smp_processor_id();
+                INIT_WORK(per_cpu_ptr(works, orig), func);
+                func(per_cpu_ptr(works, orig));
+        }
+
         get_online_cpus();
         for_each_online_cpu(cpu) {
                 struct work_struct *work = per_cpu_ptr(works, cpu);
 
+                if (cpu == orig)
+                        continue;
                 INIT_WORK(work, func);
                 schedule_work_on(cpu, work);
         }
-        for_each_online_cpu(cpu)
-                flush_work(per_cpu_ptr(works, cpu));
+        for_each_online_cpu(cpu) {
+                if (cpu != orig)
+                        flush_work(per_cpu_ptr(works, cpu));
+        }
         put_online_cpus();
         free_percpu(works);
         return 0;