19 files changed, 230 insertions, 143 deletions

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 2207efc941d1..dd236b66ca3a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5039,6 +5039,7 @@ static void perf_event_mmap_output(struct perf_event *event,
                 mmap_event->event_id.header.size += sizeof(mmap_event->maj);
                 mmap_event->event_id.header.size += sizeof(mmap_event->min);
                 mmap_event->event_id.header.size += sizeof(mmap_event->ino);
+                mmap_event->event_id.header.size += sizeof(mmap_event->ino_generation);
         }
 
         perf_event_header__init_id(&mmap_event->event_id.header, &sample, event);
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index f3569747d629..ad8e1bdca70e 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1682,12 +1682,10 @@ static bool handle_trampoline(struct pt_regs *regs)
                 tmp = ri;
                 ri = ri->next;
                 kfree(tmp);
+                utask->depth--;
 
                 if (!chained)
                         break;
-
-                utask->depth--;
-
                 BUG_ON(!ri);
         }
 
diff --git a/kernel/extable.c b/kernel/extable.c
index 67460b93b1a1..832cb28105bb 100644
--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -41,7 +41,7 @@ u32 __initdata main_extable_sort_needed = 1;
 /* Sort the kernel's built-in exception table */
 void __init sort_main_extable(void)
 {
-        if (main_extable_sort_needed) {
+        if (main_extable_sort_needed && __stop___ex_table > __start___ex_table) {
                 pr_notice("Sorting __ex_table...\n");
                 sort_extable(__start___ex_table, __stop___ex_table);
         }
diff --git a/kernel/fork.c b/kernel/fork.c
index c9eaf2013002..81ccb4f010c2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -351,7 +351,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
         struct rb_node **rb_link, *rb_parent;
         int retval;
         unsigned long charge;
-        struct mempolicy *pol;
 
         uprobe_start_dup_mmap();
         down_write(&oldmm->mmap_sem);
@@ -400,11 +399,9 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                         goto fail_nomem;
                 *tmp = *mpnt;
                 INIT_LIST_HEAD(&tmp->anon_vma_chain);
-                pol = mpol_dup(vma_policy(mpnt));
-                retval = PTR_ERR(pol);
-                if (IS_ERR(pol))
+                retval = vma_dup_policy(mpnt, tmp);
+                if (retval)
                         goto fail_nomem_policy;
-                vma_set_policy(tmp, pol);
                 tmp->vm_mm = mm;
                 if (anon_vma_fork(tmp, mpnt))
                         goto fail_nomem_anon_vma_fork;
@@ -472,7 +469,7 @@ out:
         uprobe_end_dup_mmap();
         return retval;
 fail_nomem_anon_vma_fork:
-        mpol_put(pol);
+        mpol_put(vma_policy(tmp));
 fail_nomem_policy:
         kmem_cache_free(vm_area_cachep, tmp);
 fail_nomem:
@@ -1173,13 +1170,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 return ERR_PTR(-EINVAL);
 
         /*
-         * If the new process will be in a different pid namespace
-         * don't allow the creation of threads.
+         * If the new process will be in a different pid or user namespace
+         * do not allow it to share a thread group or signal handlers or
+         * parent with the forking task.
          */
-        if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&
-            (task_active_pid_ns(current) !=
-             current->nsproxy->pid_ns_for_children))
-                return ERR_PTR(-EINVAL);
+        if (clone_flags & (CLONE_SIGHAND | CLONE_PARENT)) {
+                if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
+                    (task_active_pid_ns(current) !=
+                                current->nsproxy->pid_ns_for_children))
+                        return ERR_PTR(-EINVAL);
+        }
 
         retval = security_task_create(clone_flags);
         if (retval)
@@ -1576,15 +1576,6 @@ long do_fork(unsigned long clone_flags,
         long nr;
 
         /*
-         * Do some preliminary argument and permissions checking before we
-         * actually start allocating stuff
-         */
-        if (clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) {
-                if (clone_flags & (CLONE_THREAD|CLONE_PARENT))
-                        return -EINVAL;
-        }
-
-        /*
          * Determine whether and which event to report to ptracer.  When
          * called from kernel_thread or CLONE_UNTRACED is explicitly
          * requested, no event is reported; otherwise, report if the event
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 59f7b55ba745..2a74f307c5ec 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1474,11 +1474,8 @@ static int __init __parse_crashkernel(char *cmdline,
         if (first_colon && (!first_space || first_colon < first_space))
                 return parse_crashkernel_mem(ck_cmdline, system_ram,
                                 crash_size, crash_base);
-        else
-                return parse_crashkernel_simple(ck_cmdline, crash_size,
-                                crash_base);
 
-        return 0;
+        return parse_crashkernel_simple(ck_cmdline, crash_size, crash_base);
 }
 
 /*
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 6e33498d665c..a0d367a49122 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -112,6 +112,7 @@ static struct kprobe_blackpoint kprobe_blacklist[] = {
 struct kprobe_insn_page {
         struct list_head list;
         kprobe_opcode_t *insns;         /* Page of instruction slots */
+        struct kprobe_insn_cache *cache;
         int nused;
         int ngarbage;
         char slot_used[];
@@ -121,12 +122,6 @@ struct kprobe_insn_page {
         (offsetof(struct kprobe_insn_page, slot_used) + \
          (sizeof(char) * (slots)))
 
-struct kprobe_insn_cache {
-        struct list_head pages; /* list of kprobe_insn_page */
-        size_t insn_size;       /* size of instruction slot */
-        int nr_garbage;
-};
-
 static int slots_per_page(struct kprobe_insn_cache *c)
 {
         return PAGE_SIZE/(c->insn_size * sizeof(kprobe_opcode_t));
@@ -138,8 +133,20 @@ enum kprobe_slot_state {
         SLOT_USED = 2,
 };
 
-static DEFINE_MUTEX(kprobe_insn_mutex); /* Protects kprobe_insn_slots */
-static struct kprobe_insn_cache kprobe_insn_slots = {
+static void *alloc_insn_page(void)
+{
+        return module_alloc(PAGE_SIZE);
+}
+
+static void free_insn_page(void *page)
+{
+        module_free(NULL, page);
+}
+
+struct kprobe_insn_cache kprobe_insn_slots = {
+        .mutex = __MUTEX_INITIALIZER(kprobe_insn_slots.mutex),
+        .alloc = alloc_insn_page,
+        .free = free_insn_page,
         .pages = LIST_HEAD_INIT(kprobe_insn_slots.pages),
         .insn_size = MAX_INSN_SIZE,
         .nr_garbage = 0,
@@ -150,10 +157,12 @@ static int __kprobes collect_garbage_slots(struct kprobe_insn_cache *c);
  * __get_insn_slot() - Find a slot on an executable page for an instruction.
  * We allocate an executable page if there's no room on existing ones.
  */
-static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
+kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
 {
         struct kprobe_insn_page *kip;
+        kprobe_opcode_t *slot = NULL;
 
+        mutex_lock(&c->mutex);
  retry:
         list_for_each_entry(kip, &c->pages, list) {
                 if (kip->nused < slots_per_page(c)) {
@@ -162,7 +171,8 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
                                 if (kip->slot_used[i] == SLOT_CLEAN) {
                                         kip->slot_used[i] = SLOT_USED;
                                         kip->nused++;
-                                        return kip->insns + (i * c->insn_size);
+                                        slot = kip->insns + (i * c->insn_size);
+                                        goto out;
                                 }
                         }
                         /* kip->nused is broken. Fix it. */
@@ -178,37 +188,29 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
         /* All out of space.  Need to allocate a new page. */
         kip = kmalloc(KPROBE_INSN_PAGE_SIZE(slots_per_page(c)), GFP_KERNEL);
         if (!kip)
-                return NULL;
+                goto out;
 
         /*
          * Use module_alloc so this page is within +/- 2GB of where the
          * kernel image and loaded module images reside. This is required
          * so x86_64 can correctly handle the %rip-relative fixups.
          */
-        kip->insns = module_alloc(PAGE_SIZE);
+        kip->insns = c->alloc();
         if (!kip->insns) {
                 kfree(kip);
-                return NULL;
+                goto out;
         }
         INIT_LIST_HEAD(&kip->list);
         memset(kip->slot_used, SLOT_CLEAN, slots_per_page(c));
         kip->slot_used[0] = SLOT_USED;
         kip->nused = 1;
         kip->ngarbage = 0;
+        kip->cache = c;
         list_add(&kip->list, &c->pages);
-        return kip->insns;
-}
-
-
-kprobe_opcode_t __kprobes *get_insn_slot(void)
-{
-        kprobe_opcode_t *ret = NULL;
-
-        mutex_lock(&kprobe_insn_mutex);
-        ret = __get_insn_slot(&kprobe_insn_slots);
-        mutex_unlock(&kprobe_insn_mutex);
-
-        return ret;
+        slot = kip->insns;
+out:
+        mutex_unlock(&c->mutex);
+        return slot;
 }
 
 /* Return 1 if all garbages are collected, otherwise 0. */
@@ -225,7 +227,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
                  */
                 if (!list_is_singular(&kip->list)) {
                         list_del(&kip->list);
-                        module_free(NULL, kip->insns);
+                        kip->cache->free(kip->insns);
                         kfree(kip);
                 }
                 return 1;
@@ -255,11 +257,12 @@ static int __kprobes collect_garbage_slots(struct kprobe_insn_cache *c)
         return 0;
 }
 
-static void __kprobes __free_insn_slot(struct kprobe_insn_cache *c,
-                                       kprobe_opcode_t *slot, int dirty)
+void __kprobes __free_insn_slot(struct kprobe_insn_cache *c,
+                                kprobe_opcode_t *slot, int dirty)
 {
         struct kprobe_insn_page *kip;
 
+        mutex_lock(&c->mutex);
         list_for_each_entry(kip, &c->pages, list) {
                 long idx = ((long)slot - (long)kip->insns) /
                                 (c->insn_size * sizeof(kprobe_opcode_t));
@@ -272,45 +275,25 @@ static void __kprobes __free_insn_slot(struct kprobe_insn_cache *c,
                                         collect_garbage_slots(c);
                         } else
                                 collect_one_slot(kip, idx);
-                        return;
+                        goto out;
                 }
         }
         /* Could not free this slot. */
         WARN_ON(1);
+out:
+        mutex_unlock(&c->mutex);
 }
 
-void __kprobes free_insn_slot(kprobe_opcode_t * slot, int dirty)
-{
-        mutex_lock(&kprobe_insn_mutex);
-        __free_insn_slot(&kprobe_insn_slots, slot, dirty);
-        mutex_unlock(&kprobe_insn_mutex);
-}
 #ifdef CONFIG_OPTPROBES
 /* For optimized_kprobe buffer */
-static DEFINE_MUTEX(kprobe_optinsn_mutex); /* Protects kprobe_optinsn_slots */
-static struct kprobe_insn_cache kprobe_optinsn_slots = {
+struct kprobe_insn_cache kprobe_optinsn_slots = {
+        .mutex = __MUTEX_INITIALIZER(kprobe_optinsn_slots.mutex),
+        .alloc = alloc_insn_page,
+        .free = free_insn_page,
         .pages = LIST_HEAD_INIT(kprobe_optinsn_slots.pages),
         /* .insn_size is initialized later */
         .nr_garbage = 0,
 };
-/* Get a slot for optimized_kprobe buffer */
-kprobe_opcode_t __kprobes *get_optinsn_slot(void)
-{
-        kprobe_opcode_t *ret = NULL;
-
-        mutex_lock(&kprobe_optinsn_mutex);
-        ret = __get_insn_slot(&kprobe_optinsn_slots);
-        mutex_unlock(&kprobe_optinsn_mutex);
-
-        return ret;
-}
-
-void __kprobes free_optinsn_slot(kprobe_opcode_t * slot, int dirty)
-{
-        mutex_lock(&kprobe_optinsn_mutex);
-        __free_insn_slot(&kprobe_optinsn_slots, slot, dirty);
-        mutex_unlock(&kprobe_optinsn_mutex);
-}
 #endif
 #endif
 
diff --git a/kernel/modsign_pubkey.c b/kernel/modsign_pubkey.c
index 2b6e69909c39..7cbd4507a7e6 100644
--- a/kernel/modsign_pubkey.c
+++ b/kernel/modsign_pubkey.c
@@ -18,14 +18,14 @@
 
 struct key *modsign_keyring;
 
-extern __initdata const u8 modsign_certificate_list[];
-extern __initdata const u8 modsign_certificate_list_end[];
+extern __initconst const u8 modsign_certificate_list[];
+extern __initconst const u8 modsign_certificate_list_end[];
 
 /*
  * We need to make sure ccache doesn't cache the .o file as it doesn't notice
  * if modsign.pub changes.
  */
-static __initdata const char annoy_ccache[] = __TIME__ "foo";
+static __initconst const char annoy_ccache[] = __TIME__ "foo";
 
 /*
  * Load the compiled-in keys
diff --git a/kernel/panic.c b/kernel/panic.c
index 801864600514..b6c482ccc5db 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -123,10 +123,14 @@ void panic(const char *fmt, ...)
          */
         smp_send_stop();
 
-        kmsg_dump(KMSG_DUMP_PANIC);
-
+        /*
+         * Run any panic handlers, including those that might need to
+         * add information to the kmsg dump output.
+         */
         atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
 
+        kmsg_dump(KMSG_DUMP_PANIC);
+
         bust_spinlocks(0);
 
         if (!panic_blink)
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 3085e62a80a5..c9c759d5a15c 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -644,22 +644,23 @@ int hibernate(void)
         if (error)
                 goto Exit;
 
-        /* Allocate memory management structures */
-        error = create_basic_memory_bitmaps();
-        if (error)
-                goto Exit;
-
         printk(KERN_INFO "PM: Syncing filesystems ... ");
         sys_sync();
         printk("done.\n");
 
         error = freeze_processes();
         if (error)
-                goto Free_bitmaps;
+                goto Exit;
+
+        lock_device_hotplug();
+        /* Allocate memory management structures */
+        error = create_basic_memory_bitmaps();
+        if (error)
+                goto Thaw;
 
         error = hibernation_snapshot(hibernation_mode == HIBERNATION_PLATFORM);
         if (error || freezer_test_done)
-                goto Thaw;
+                goto Free_bitmaps;
 
         if (in_suspend) {
                 unsigned int flags = 0;
@@ -682,14 +683,14 @@ int hibernate(void)
                 pr_debug("PM: Image restored successfully.\n");
         }
 
+ Free_bitmaps:
+        free_basic_memory_bitmaps();
  Thaw:
+        unlock_device_hotplug();
         thaw_processes();
 
         /* Don't bother checking whether freezer_test_done is true */
         freezer_test_done = false;
-
- Free_bitmaps:
-        free_basic_memory_bitmaps();
  Exit:
         pm_notifier_call_chain(PM_POST_HIBERNATION);
         pm_restore_console();
@@ -806,21 +807,20 @@ static int software_resume(void)
         pm_prepare_console();
         error = pm_notifier_call_chain(PM_RESTORE_PREPARE);
         if (error)
-                goto close_finish;
-
-        error = create_basic_memory_bitmaps();
-        if (error)
-                goto close_finish;
+                goto Close_Finish;
 
         pr_debug("PM: Preparing processes for restore.\n");
         error = freeze_processes();
-        if (error) {
-                swsusp_close(FMODE_READ);
-                goto Done;
-        }
+        if (error)
+                goto Close_Finish;
 
         pr_debug("PM: Loading hibernation image.\n");
 
+        lock_device_hotplug();
+        error = create_basic_memory_bitmaps();
+        if (error)
+                goto Thaw;
+
         error = swsusp_read(&flags);
         swsusp_close(FMODE_READ);
         if (!error)
@@ -828,9 +828,10 @@ static int software_resume(void)
 
         printk(KERN_ERR "PM: Failed to load hibernation image, recovering.\n");
         swsusp_free();
-        thaw_processes();
- Done:
         free_basic_memory_bitmaps();
+ Thaw:
+        unlock_device_hotplug();
+        thaw_processes();
  Finish:
         pm_notifier_call_chain(PM_POST_RESTORE);
         pm_restore_console();
@@ -840,7 +841,7 @@ static int software_resume(void)
         mutex_unlock(&pm_mutex);
         pr_debug("PM: Hibernation image not present or could not be loaded.\n");
         return error;
-close_finish:
+ Close_Finish:
         swsusp_close(FMODE_READ);
         goto Finish;
 }
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 349587bb03e1..358a146fd4da 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -352,7 +352,7 @@ static int create_mem_extents(struct list_head *list, gfp_t gfp_mask)
                 struct mem_extent *ext, *cur, *aux;
 
                 zone_start = zone->zone_start_pfn;
-                zone_end = zone->zone_start_pfn + zone->spanned_pages;
+                zone_end = zone_end_pfn(zone);
 
                 list_for_each_entry(ext, list, hook)
                         if (zone_start <= ext->end)
@@ -884,7 +884,7 @@ static unsigned int count_highmem_pages(void)
                         continue;
 
                 mark_free_pages(zone);
-                max_zone_pfn = zone->zone_start_pfn + zone->spanned_pages;
+                max_zone_pfn = zone_end_pfn(zone);
                 for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++)
                         if (saveable_highmem_page(zone, pfn))
                                 n++;
@@ -948,7 +948,7 @@ static unsigned int count_data_pages(void)
                         continue;
 
                 mark_free_pages(zone);
-                max_zone_pfn = zone->zone_start_pfn + zone->spanned_pages;
+                max_zone_pfn = zone_end_pfn(zone);
                 for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++)
                         if (saveable_page(zone, pfn))
                                 n++;
@@ -1041,7 +1041,7 @@ copy_data_pages(struct memory_bitmap *copy_bm, struct memory_bitmap *orig_bm)
                 unsigned long max_zone_pfn;
 
                 mark_free_pages(zone);
-                max_zone_pfn = zone->zone_start_pfn + zone->spanned_pages;
+                max_zone_pfn = zone_end_pfn(zone);
                 for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++)
                         if (page_is_saveable(zone, pfn))
                                 memory_bm_set_bit(orig_bm, pfn);
@@ -1093,7 +1093,7 @@ void swsusp_free(void)
         unsigned long pfn, max_zone_pfn;
 
         for_each_populated_zone(zone) {
-                max_zone_pfn = zone->zone_start_pfn + zone->spanned_pages;
+                max_zone_pfn = zone_end_pfn(zone);
                 for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++)
                         if (pfn_valid(pfn)) {
                                 struct page *page = pfn_to_page(pfn);
@@ -1755,7 +1755,7 @@ static int mark_unsafe_pages(struct memory_bitmap *bm)
 
         /* Clear page flags */
         for_each_populated_zone(zone) {
-                max_zone_pfn = zone->zone_start_pfn + zone->spanned_pages;
+                max_zone_pfn = zone_end_pfn(zone);
                 for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++)
                         if (pfn_valid(pfn))
                                 swsusp_unset_page_free(pfn_to_page(pfn));
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 4ed81e74f86f..72e8f4fd616d 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -60,11 +60,6 @@ static int snapshot_open(struct inode *inode, struct file *filp)
                 error = -ENOSYS;
                 goto Unlock;
         }
-        if(create_basic_memory_bitmaps()) {
-                atomic_inc(&snapshot_device_available);
-                error = -ENOMEM;
-                goto Unlock;
-        }
         nonseekable_open(inode, filp);
         data = &snapshot_state;
         filp->private_data = data;
@@ -90,10 +85,9 @@ static int snapshot_open(struct inode *inode, struct file *filp)
                 if (error)
                         pm_notifier_call_chain(PM_POST_RESTORE);
         }
-        if (error) {
-                free_basic_memory_bitmaps();
+        if (error)
                 atomic_inc(&snapshot_device_available);
-        }
+
         data->frozen = 0;
         data->ready = 0;
         data->platform_support = 0;
@@ -111,11 +105,11 @@ static int snapshot_release(struct inode *inode, struct file *filp)
         lock_system_sleep();
 
         swsusp_free();
-        free_basic_memory_bitmaps();
         data = filp->private_data;
         free_all_swap_pages(data->swap);
         if (data->frozen) {
                 pm_restore_gfp_mask();
+                free_basic_memory_bitmaps();
                 thaw_processes();
         }
         pm_notifier_call_chain(data->mode == O_RDONLY ?
@@ -207,6 +201,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
         if (!mutex_trylock(&pm_mutex))
                 return -EBUSY;
 
+        lock_device_hotplug();
         data = filp->private_data;
 
         switch (cmd) {
@@ -220,14 +215,22 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                 printk("done.\n");
 
                 error = freeze_processes();
-                if (!error)
+                if (error)
+                        break;
+
+                error = create_basic_memory_bitmaps();
+                if (error)
+                        thaw_processes();
+                else
                         data->frozen = 1;
+
                 break;
 
         case SNAPSHOT_UNFREEZE:
                 if (!data->frozen || data->ready)
                         break;
                 pm_restore_gfp_mask();
+                free_basic_memory_bitmaps();
                 thaw_processes();
                 data->frozen = 0;
                 break;
@@ -371,6 +374,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
 
         }
 
+        unlock_device_hotplug();
         mutex_unlock(&pm_mutex);
 
         return error;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index a146ee327f6a..dd562e9aa2c8 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -236,7 +236,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
          */
         int dumpable = 0;
         /* Don't let security modules deny introspection */
-        if (task == current)
+        if (same_thread_group(task, current))
                 return 0;
         rcu_read_lock();
         tcred = __task_cred(task);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 7f0a5e6cdae0..9b3fe1cd8f40 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5151,7 +5151,7 @@ static int should_we_balance(struct lb_env *env)
          * First idle cpu or the first cpu(busiest) in this sched group
          * is eligible for doing load balancing at this and above domains.
          */
-        return balance_cpu != env->dst_cpu;
+        return balance_cpu == env->dst_cpu;
 }
 
 /*
diff --git a/kernel/signal.c b/kernel/signal.c
index 50e41075ac77..ded28b91fa53 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3394,7 +3394,7 @@ COMPAT_SYSCALL_DEFINE4(rt_sigaction, int, sig,
                 new_ka.sa.sa_restorer = compat_ptr(restorer);
 #endif
                 ret |= copy_from_user(&mask, &act->sa_mask, sizeof(mask));
-                ret |= __get_user(new_ka.sa.sa_flags, &act->sa_flags);
+                ret |= get_user(new_ka.sa.sa_flags, &act->sa_flags);
                 if (ret)
                         return -EFAULT;
                 sigset_from_compat(&new_ka.sa.sa_mask, &mask);
@@ -3406,7 +3406,7 @@ COMPAT_SYSCALL_DEFINE4(rt_sigaction, int, sig,
                 ret = put_user(ptr_to_compat(old_ka.sa.sa_handler), 
                                &oact->sa_handler);
                 ret |= copy_to_user(&oact->sa_mask, &mask, sizeof(mask));
-                ret |= __put_user(old_ka.sa.sa_flags, &oact->sa_flags);
+                ret |= put_user(old_ka.sa.sa_flags, &oact->sa_flags);
 #ifdef __ARCH_HAS_SA_RESTORER
                 ret |= put_user(ptr_to_compat(old_ka.sa.sa_restorer),
                                 &oact->sa_restorer);
diff --git a/kernel/smp.c b/kernel/smp.c
index 449b707fc20d..0564571dcdf7 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -48,10 +48,13 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
                                 cpu_to_node(cpu)))
                         return notifier_from_errno(-ENOMEM);
                 if (!zalloc_cpumask_var_node(&cfd->cpumask_ipi, GFP_KERNEL,
-                                cpu_to_node(cpu)))
+                                cpu_to_node(cpu))) {
+                        free_cpumask_var(cfd->cpumask);
                         return notifier_from_errno(-ENOMEM);
+                }
                 cfd->csd = alloc_percpu(struct call_single_data);
                 if (!cfd->csd) {
+                        free_cpumask_var(cfd->cpumask_ipi);
                         free_cpumask_var(cfd->cpumask);
                         return notifier_from_errno(-ENOMEM);
                 }
@@ -572,8 +575,10 @@ EXPORT_SYMBOL(on_each_cpu);
  *
  * If @wait is true, then returns once @func has returned.
  *
- * You must not call this function with disabled interrupts or
- * from a hardware interrupt handler or from a bottom half handler.
+ * You must not call this function with disabled interrupts or from a
+ * hardware interrupt handler or from a bottom half handler.  The
+ * exception is that it may be used during early boot while
+ * early_boot_irqs_disabled is set.
  */
 void on_each_cpu_mask(const struct cpumask *mask, smp_call_func_t func,
                         void *info, bool wait)
@@ -582,9 +587,10 @@ void on_each_cpu_mask(const struct cpumask *mask, smp_call_func_t func,
 
         smp_call_function_many(mask, func, info, wait);
         if (cpumask_test_cpu(cpu, mask)) {
-                local_irq_disable();
+                unsigned long flags;
+                local_irq_save(flags);
                 func(info);
-                local_irq_enable();
+                local_irq_restore(flags);
         }
         put_cpu();
 }
diff --git a/kernel/spinlock.c b/kernel/spinlock.c
index 5cdd8065a3ce..4b082b5cac9e 100644
--- a/kernel/spinlock.c
+++ b/kernel/spinlock.c
@@ -34,6 +34,20 @@
 #else
 #define raw_read_can_lock(l)    read_can_lock(l)
 #define raw_write_can_lock(l)   write_can_lock(l)
+
+/*
+ * Some architectures can relax in favour of the CPU owning the lock.
+ */
+#ifndef arch_read_relax
+# define arch_read_relax(l)     cpu_relax()
+#endif
+#ifndef arch_write_relax
+# define arch_write_relax(l)    cpu_relax()
+#endif
+#ifndef arch_spin_relax
+# define arch_spin_relax(l)     cpu_relax()
+#endif
+
 /*
  * We build the __lock_function inlines here. They are too large for
  * inlining all over the place, but here is only one user per function
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 7822cd88a95c..b2f06f3c6a3f 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1225,7 +1225,7 @@ static struct ctl_table vm_table[] = {
                 .data           = &hugepages_treat_as_movable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = hugetlb_treat_movable_handler,
+                .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "nr_overcommit_hugepages",
diff --git a/kernel/task_work.c b/kernel/task_work.c
index 65bd3c92d6f3..8727032e3a6f 100644
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -4,6 +4,23 @@
 
 static struct callback_head work_exited; /* all we need is ->next == NULL */
 
+/**
+ * task_work_add - ask the @task to execute @work->func()
+ * @task: the task which should run the callback
+ * @work: the callback to run
+ * @notify: send the notification if true
+ *
+ * Queue @work for task_work_run() below and notify the @task if @notify.
+ * Fails if the @task is exiting/exited and thus it can't process this @work.
+ * Otherwise @work->func() will be called when the @task returns from kernel
+ * mode or exits.
+ *
+ * This is like the signal handler which runs in kernel mode, but it doesn't
+ * try to wake up the @task.
+ *
+ * RETURNS:
+ * 0 if succeeds or -ESRCH.
+ */
 int
 task_work_add(struct task_struct *task, struct callback_head *work, bool notify)
 {
@@ -21,11 +38,22 @@ task_work_add(struct task_struct *task, struct callback_head *work, bool notify)
         return 0;
 }
 
+/**
+ * task_work_cancel - cancel a pending work added by task_work_add()
+ * @task: the task which should execute the work
+ * @func: identifies the work to remove
+ *
+ * Find the last queued pending work with ->func == @func and remove
+ * it from queue.
+ *
+ * RETURNS:
+ * The found work or NULL if not found.
+ */
 struct callback_head *
 task_work_cancel(struct task_struct *task, task_work_func_t func)
 {
         struct callback_head **pprev = &task->task_works;
-        struct callback_head *work = NULL;
+        struct callback_head *work;
         unsigned long flags;
         /*
          * If cmpxchg() fails we continue without updating pprev.
@@ -35,7 +63,7 @@ task_work_cancel(struct task_struct *task, task_work_func_t func)
          */
         raw_spin_lock_irqsave(&task->pi_lock, flags);
         while ((work = ACCESS_ONCE(*pprev))) {
-                read_barrier_depends();
+                smp_read_barrier_depends();
                 if (work->func != func)
                         pprev = &work->next;
                 else if (cmpxchg(pprev, work, work->next) == work)
@@ -46,6 +74,14 @@ task_work_cancel(struct task_struct *task, task_work_func_t func)
         return work;
 }
 
+/**
+ * task_work_run - execute the works added by task_work_add()
+ *
+ * Flush the pending works. Should be used by the core kernel code.
+ * Called before the task returns to the user-mode or stops, or when
+ * it exits. In the latter case task_work_add() can no longer add the
+ * new work after task_work_run() returns.
+ */
 void task_work_run(void)
 {
         struct task_struct *task = current;
diff --git a/kernel/up.c b/kernel/up.c
index c54c75e9faf7..630d72bf7e41 100644
--- a/kernel/up.c
+++ b/kernel/up.c
@@ -10,12 +10,64 @@
 int smp_call_function_single(int cpu, void (*func) (void *info), void *info,
                                 int wait)
 {
+        unsigned long flags;
+
         WARN_ON(cpu != 0);
 
-        local_irq_disable();
-        (func)(info);
-        local_irq_enable();
+        local_irq_save(flags);
+        func(info);
+        local_irq_restore(flags);
 
         return 0;
 }
 EXPORT_SYMBOL(smp_call_function_single);
+
+int on_each_cpu(smp_call_func_t func, void *info, int wait)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        func(info);
+        local_irq_restore(flags);
+        return 0;
+}
+EXPORT_SYMBOL(on_each_cpu);
+
+/*
+ * Note we still need to test the mask even for UP
+ * because we actually can get an empty mask from
+ * code that on SMP might call us without the local
+ * CPU in the mask.
+ */
+void on_each_cpu_mask(const struct cpumask *mask,
+                      smp_call_func_t func, void *info, bool wait)
+{
+        unsigned long flags;
+
+        if (cpumask_test_cpu(0, mask)) {
+                local_irq_save(flags);
+                func(info);
+                local_irq_restore(flags);
+        }
+}
+EXPORT_SYMBOL(on_each_cpu_mask);
+
+/*
+ * Preemption is disabled here to make sure the cond_func is called under the
+ * same condtions in UP and SMP.
+ */
+void on_each_cpu_cond(bool (*cond_func)(int cpu, void *info),
+                      smp_call_func_t func, void *info, bool wait,
+                      gfp_t gfp_flags)
+{
+        unsigned long flags;
+
+        preempt_disable();
+        if (cond_func(0, info)) {
+                local_irq_save(flags);
+                func(info);
+                local_irq_restore(flags);
+        }
+        preempt_enable();
+}
+EXPORT_SYMBOL(on_each_cpu_cond);