12 files changed, 82 insertions, 45 deletions

diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c
index e1191c996c59..5cf6731b98e9 100644
--- a/kernel/locking/mutex-debug.c
+++ b/kernel/locking/mutex-debug.c
@@ -71,18 +71,17 @@ void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
 
 void debug_mutex_unlock(struct mutex *lock)
 {
-        if (unlikely(!debug_locks))
-                return;
+        if (likely(debug_locks)) {
+                DEBUG_LOCKS_WARN_ON(lock->magic != lock);
 
-        DEBUG_LOCKS_WARN_ON(lock->magic != lock);
+                if (!lock->owner)
+                        DEBUG_LOCKS_WARN_ON(!lock->owner);
+                else
+                        DEBUG_LOCKS_WARN_ON(lock->owner != current);
 
-        if (!lock->owner)
-                DEBUG_LOCKS_WARN_ON(!lock->owner);
-        else
-                DEBUG_LOCKS_WARN_ON(lock->owner != current);
-
-        DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
-        mutex_clear_owner(lock);
+                DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
+                mutex_clear_owner(lock);
+        }
 
         /*
          * __mutex_slowpath_needs_to_unlock() is explicitly 0 for debug
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 27ef40925525..b08095786cb8 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1021,8 +1021,17 @@ struct task_struct *pick_next_task_dl(struct rq *rq, struct task_struct *prev)
 
         dl_rq = &rq->dl;
 
-        if (need_pull_dl_task(rq, prev))
+        if (need_pull_dl_task(rq, prev)) {
                 pull_dl_task(rq);
+                /*
+                 * pull_rt_task() can drop (and re-acquire) rq->lock; this
+                 * means a stop task can slip in, in which case we need to
+                 * re-start task selection.
+                 */
+                if (rq->stop && rq->stop->on_rq)
+                        return RETRY_TASK;
+        }
+
         /*
          * When prev is DL, we may throttle it in put_prev_task().
          * So, we update time before we check for dl_nr_running.
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 7e9bd0b1fa9e..7570dd969c28 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1497,7 +1497,7 @@ static void task_numa_placement(struct task_struct *p)
         /* If the task is part of a group prevent parallel updates to group stats */
         if (p->numa_group) {
                 group_lock = &p->numa_group->lock;
-                spin_lock(group_lock);
+                spin_lock_irq(group_lock);
         }
 
         /* Find the node with the highest number of faults */
@@ -1572,7 +1572,7 @@ static void task_numa_placement(struct task_struct *p)
                         }
                 }
 
-                spin_unlock(group_lock);
+                spin_unlock_irq(group_lock);
         }
 
         /* Preferred node as the node with the most faults */
@@ -1677,7 +1677,8 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags,
         if (!join)
                 return;
 
-        double_lock(&my_grp->lock, &grp->lock);
+        BUG_ON(irqs_disabled());
+        double_lock_irq(&my_grp->lock, &grp->lock);
 
         for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++) {
                 my_grp->faults[i] -= p->numa_faults_memory[i];
@@ -1691,7 +1692,7 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags,
         grp->nr_tasks++;
 
         spin_unlock(&my_grp->lock);
-        spin_unlock(&grp->lock);
+        spin_unlock_irq(&grp->lock);
 
         rcu_assign_pointer(p->numa_group, grp);
 
@@ -1710,14 +1711,14 @@ void task_numa_free(struct task_struct *p)
         void *numa_faults = p->numa_faults_memory;
 
         if (grp) {
-                spin_lock(&grp->lock);
+                spin_lock_irq(&grp->lock);
                 for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++)
                         grp->faults[i] -= p->numa_faults_memory[i];
                 grp->total_faults -= p->total_numa_faults;
 
                 list_del(&p->numa_entry);
                 grp->nr_tasks--;
-                spin_unlock(&grp->lock);
+                spin_unlock_irq(&grp->lock);
                 rcu_assign_pointer(p->numa_group, NULL);
                 put_numa_group(grp);
         }
@@ -6727,7 +6728,8 @@ static int idle_balance(struct rq *this_rq)
 out:
         /* Is there a task of a high priority class? */
         if (this_rq->nr_running != this_rq->cfs.h_nr_running &&
-            (this_rq->dl.dl_nr_running ||
+            ((this_rq->stop && this_rq->stop->on_rq) ||
+             this_rq->dl.dl_nr_running ||
              (this_rq->rt.rt_nr_running && !rt_rq_throttled(&this_rq->rt))))
                 pulled_task = -1;
 
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index d8cdf1618551..bd2267ad404f 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -1362,10 +1362,11 @@ pick_next_task_rt(struct rq *rq, struct task_struct *prev)
                 pull_rt_task(rq);
                 /*
                  * pull_rt_task() can drop (and re-acquire) rq->lock; this
-                 * means a dl task can slip in, in which case we need to
-                 * re-start task selection.
+                 * means a dl or stop task can slip in, in which case we need
+                 * to re-start task selection.
                  */
-                if (unlikely(rq->dl.dl_nr_running))
+                if (unlikely((rq->stop && rq->stop->on_rq) ||
+                             rq->dl.dl_nr_running))
                         return RETRY_TASK;
         }
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index c9007f28d3a2..456e492a3dca 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1385,6 +1385,15 @@ static inline void double_lock(spinlock_t *l1, spinlock_t *l2)
         spin_lock_nested(l2, SINGLE_DEPTH_NESTING);
 }
 
+static inline void double_lock_irq(spinlock_t *l1, spinlock_t *l2)
+{
+        if (l1 > l2)
+                swap(l1, l2);
+
+        spin_lock_irq(l1);
+        spin_lock_nested(l2, SINGLE_DEPTH_NESTING);
+}
+
 static inline void double_raw_lock(raw_spinlock_t *l1, raw_spinlock_t *l2)
 {
         if (l1 > l2)
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index d8d046c0726a..b35c21503a36 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -69,18 +69,17 @@ static void populate_seccomp_data(struct seccomp_data *sd)
 {
         struct task_struct *task = current;
         struct pt_regs *regs = task_pt_regs(task);
+        unsigned long args[6];
 
         sd->nr = syscall_get_nr(task, regs);
         sd->arch = syscall_get_arch();
-
-        /* Unroll syscall_get_args to help gcc on arm. */
-        syscall_get_arguments(task, regs, 0, 1, (unsigned long *) &sd->args[0]);
-        syscall_get_arguments(task, regs, 1, 1, (unsigned long *) &sd->args[1]);
-        syscall_get_arguments(task, regs, 2, 1, (unsigned long *) &sd->args[2]);
-        syscall_get_arguments(task, regs, 3, 1, (unsigned long *) &sd->args[3]);
-        syscall_get_arguments(task, regs, 4, 1, (unsigned long *) &sd->args[4]);
-        syscall_get_arguments(task, regs, 5, 1, (unsigned long *) &sd->args[5]);
-
+        syscall_get_arguments(task, regs, 0, 6, args);
+        sd->args[0] = args[0];
+        sd->args[1] = args[1];
+        sd->args[2] = args[2];
+        sd->args[3] = args[3];
+        sd->args[4] = args[4];
+        sd->args[5] = args[5];
         sd->instruction_pointer = KSTK_EIP(task);
 }
 
@@ -256,6 +255,7 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
                 goto free_prog;
 
         /* Allocate a new seccomp_filter */
+        ret = -ENOMEM;
         filter = kzalloc(sizeof(struct seccomp_filter) +
                          sizeof(struct sock_filter_int) * new_len,
                          GFP_KERNEL|__GFP_NOWARN);
@@ -265,6 +265,7 @@ static long seccomp_attach_filter(struct sock_fprog *fprog)
         ret = sk_convert_filter(fp, fprog->len, filter->insnsi, &new_len);
         if (ret)
                 goto free_filter;
+        kfree(fp);
 
         atomic_set(&filter->usage, 1);
         filter->len = new_len;
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 015661279b68..0a0608edeb26 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -276,7 +276,7 @@ static bool tick_check_preferred(struct clock_event_device *curdev,
 bool tick_check_replacement(struct clock_event_device *curdev,
                             struct clock_event_device *newdev)
 {
-        if (tick_check_percpu(curdev, newdev, smp_processor_id()))
+        if (!tick_check_percpu(curdev, newdev, smp_processor_id()))
                 return false;
 
         return tick_check_preferred(curdev, newdev);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 9f8af69c67ec..6558b7ac112d 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -84,6 +84,9 @@ static void tick_do_update_jiffies64(ktime_t now)
 
                 /* Keep the tick_next_period variable up to date */
                 tick_next_period = ktime_add(last_jiffies_update, tick_period);
+        } else {
+                write_sequnlock(&jiffies_lock);
+                return;
         }
         write_sequnlock(&jiffies_lock);
         update_wall_time();
@@ -967,7 +970,7 @@ static void tick_nohz_switch_to_nohz(void)
         struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
         ktime_t next;
 
-        if (!tick_nohz_active)
+        if (!tick_nohz_enabled)
                 return;
 
         local_irq_disable();
diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
index 5b781d2be383..ffd56351b521 100644
--- a/kernel/trace/trace_functions.c
+++ b/kernel/trace/trace_functions.c
@@ -58,12 +58,16 @@ int ftrace_create_function_files(struct trace_array *tr,
 {
         int ret;
 
-        /* The top level array uses the "global_ops". */
-        if (!(tr->flags & TRACE_ARRAY_FL_GLOBAL)) {
-                ret = allocate_ftrace_ops(tr);
-                if (ret)
-                        return ret;
-        }
+        /*
+         * The top level array uses the "global_ops", and the files are
+         * created on boot up.
+         */
+        if (tr->flags & TRACE_ARRAY_FL_GLOBAL)
+                return 0;
+
+        ret = allocate_ftrace_ops(tr);
+        if (ret)
+                return ret;
 
         ftrace_create_filter_files(tr->ops, parent);
 
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 930e51462dc8..c082a7441345 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -732,9 +732,15 @@ static int uprobe_buffer_enable(void)
 
 static void uprobe_buffer_disable(void)
 {
+        int cpu;
+
         BUG_ON(!mutex_is_locked(&event_mutex));
 
         if (--uprobe_buffer_refcnt == 0) {
+                for_each_possible_cpu(cpu)
+                        free_page((unsigned long)per_cpu_ptr(uprobe_cpu_buffer,
+                                                             cpu)->buf);
+
                 free_percpu(uprobe_cpu_buffer);
                 uprobe_cpu_buffer = NULL;
         }
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 0d8f6023fd8d..bf71b4b2d632 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -152,7 +152,7 @@ static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count)
 
         /* Find the matching extent */
         extents = map->nr_extents;
-        smp_read_barrier_depends();
+        smp_rmb();
         for (idx = 0; idx < extents; idx++) {
                 first = map->extent[idx].first;
                 last = first + map->extent[idx].count - 1;
@@ -176,7 +176,7 @@ static u32 map_id_down(struct uid_gid_map *map, u32 id)
 
         /* Find the matching extent */
         extents = map->nr_extents;
-        smp_read_barrier_depends();
+        smp_rmb();
         for (idx = 0; idx < extents; idx++) {
                 first = map->extent[idx].first;
                 last = first + map->extent[idx].count - 1;
@@ -199,7 +199,7 @@ static u32 map_id_up(struct uid_gid_map *map, u32 id)
 
         /* Find the matching extent */
         extents = map->nr_extents;
-        smp_read_barrier_depends();
+        smp_rmb();
         for (idx = 0; idx < extents; idx++) {
                 first = map->extent[idx].lower_first;
                 last = first + map->extent[idx].count - 1;
@@ -615,9 +615,8 @@ static ssize_t map_write(struct file *file, const char __user *buf,
          * were written before the count of the extents.
          *
          * To achieve this smp_wmb() is used on guarantee the write
-         * order and smp_read_barrier_depends() is guaranteed that we
-         * don't have crazy architectures returning stale data.
-         *
+         * order and smp_rmb() is guaranteed that we don't have crazy
+         * architectures returning stale data.
          */
         mutex_lock(&id_map_mutex);
 
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index e90089fd78e0..516203e665fc 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -138,7 +138,11 @@ static void __touch_watchdog(void)
 
 void touch_softlockup_watchdog(void)
 {
-        __this_cpu_write(watchdog_touch_ts, 0);
+        /*
+         * Preemption can be enabled.  It doesn't matter which CPU's timestamp
+         * gets zeroed here, so use the raw_ operation.
+         */
+        raw_cpu_write(watchdog_touch_ts, 0);
 }
 EXPORT_SYMBOL(touch_softlockup_watchdog);