5 files changed, 31 insertions, 12 deletions

diff --git a/kernel/events/core.c b/kernel/events/core.c
index ba36013cfb21..1b5c081d8b9f 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2303,7 +2303,7 @@ do {					\
 static DEFINE_PER_CPU(int, perf_throttled_count);
 static DEFINE_PER_CPU(u64, perf_throttled_seq);
 
-static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count)
+static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count, bool disable)
 {
         struct hw_perf_event *hwc = &event->hw;
         s64 period, sample_period;
@@ -2322,9 +2322,13 @@ static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count)
         hwc->sample_period = sample_period;
 
         if (local64_read(&hwc->period_left) > 8*sample_period) {
-                event->pmu->stop(event, PERF_EF_UPDATE);
+                if (disable)
+                        event->pmu->stop(event, PERF_EF_UPDATE);
+
                 local64_set(&hwc->period_left, 0);
-                event->pmu->start(event, PERF_EF_RELOAD);
+
+                if (disable)
+                        event->pmu->start(event, PERF_EF_RELOAD);
         }
 }
 
@@ -2350,6 +2354,7 @@ static void perf_adjust_freq_unthr_context(struct perf_event_context *ctx,
                 return;
 
         raw_spin_lock(&ctx->lock);
+        perf_pmu_disable(ctx->pmu);
 
         list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {
                 if (event->state != PERF_EVENT_STATE_ACTIVE)
@@ -2381,13 +2386,17 @@ static void perf_adjust_freq_unthr_context(struct perf_event_context *ctx,
                 /*
                  * restart the event
                  * reload only if value has changed
+                 * we have stopped the event so tell that
+                 * to perf_adjust_period() to avoid stopping it
+                 * twice.
                  */
                 if (delta > 0)
-                        perf_adjust_period(event, period, delta);
+                        perf_adjust_period(event, period, delta, false);
 
                 event->pmu->start(event, delta > 0 ? PERF_EF_RELOAD : 0);
         }
 
+        perf_pmu_enable(ctx->pmu);
         raw_spin_unlock(&ctx->lock);
 }
 
@@ -4562,7 +4571,7 @@ static int __perf_event_overflow(struct perf_event *event,
                 hwc->freq_time_stamp = now;
 
                 if (delta > 0 && delta < 2*TICK_NSEC)
-                        perf_adjust_period(event, delta, hwc->last_period);
+                        perf_adjust_period(event, delta, hwc->last_period, true);
         }
 
         /*
diff --git a/kernel/fork.c b/kernel/fork.c
index 1b2ef3c23ae4..e2cd3e2a5ae8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -66,6 +66,7 @@
 #include <linux/user-return-notifier.h>
 #include <linux/oom.h>
 #include <linux/khugepaged.h>
+#include <linux/signalfd.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -910,7 +911,7 @@ static int copy_io(unsigned long clone_flags, struct task_struct *tsk)
                         return -ENOMEM;
 
                 new_ioc->ioprio = ioc->ioprio;
-                put_io_context(new_ioc, NULL);
+                put_io_context(new_ioc);
         }
 #endif
         return 0;
@@ -935,8 +936,10 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
 
 void __cleanup_sighand(struct sighand_struct *sighand)
 {
-        if (atomic_dec_and_test(&sighand->count))
+        if (atomic_dec_and_test(&sighand->count)) {
+                signalfd_cleanup(sighand);
                 kmem_cache_free(sighand_cachep, sighand);
+        }
 }
 
 
diff --git a/kernel/params.c b/kernel/params.c
index 32ee04308285..4bc965d8a1fe 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -97,7 +97,8 @@ static int parse_one(char *param,
         for (i = 0; i < num_params; i++) {
                 if (parameq(param, params[i].name)) {
                         /* No one handled NULL, so do it here. */
-                        if (!val && params[i].ops->set != param_set_bool)
+                        if (!val && params[i].ops->set != param_set_bool
+                            && params[i].ops->set != param_set_bint)
                                 return -EINVAL;
                         pr_debug("They are equal!  Calling %p\n",
                                params[i].ops->set);
diff --git a/kernel/pid.c b/kernel/pid.c
index ce8e00deaccb..9f08dfabaf13 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -543,12 +543,12 @@ struct pid *find_ge_pid(int nr, struct pid_namespace *ns)
  */
 void __init pidhash_init(void)
 {
-        int i, pidhash_size;
+        unsigned int i, pidhash_size;
 
         pid_hash = alloc_large_system_hash("PID", sizeof(*pid_hash), 0, 18,
                                            HASH_EARLY | HASH_SMALL,
                                            &pidhash_shift, NULL, 4096);
-        pidhash_size = 1 << pidhash_shift;
+        pidhash_size = 1U << pidhash_shift;
 
         for (i = 0; i < pidhash_size; i++)
                 INIT_HLIST_HEAD(&pid_hash[i]);
diff --git a/kernel/relay.c b/kernel/relay.c
index 4335e1d7ee2d..ab56a1764d4d 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -164,10 +164,14 @@ depopulate:
  */
 static struct rchan_buf *relay_create_buf(struct rchan *chan)
 {
-        struct rchan_buf *buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
-        if (!buf)
+        struct rchan_buf *buf;
+
+        if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
                 return NULL;
 
+        buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
+        if (!buf)
+                return NULL;
         buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
         if (!buf->padding)
                 goto free_buf;
@@ -574,6 +578,8 @@ struct rchan *relay_open(const char *base_filename,
 
         if (!(subbuf_size && n_subbufs))
                 return NULL;
+        if (subbuf_size > UINT_MAX / n_subbufs)
+                return NULL;
 
         chan = kzalloc(sizeof(struct rchan), GFP_KERNEL);
         if (!chan)