7 files changed, 79 insertions, 40 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 781845a013ab..e91963302c0d 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4480,6 +4480,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
         struct dentry *d = cgrp->dentry;
         struct cgroup_event *event, *tmp;
         struct cgroup_subsys *ss;
+        struct cgroup *child;
         bool empty;
 
         lockdep_assert_held(&d->d_inode->i_mutex);
@@ -4490,12 +4491,28 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
          * @cgrp from being removed while __put_css_set() is in progress.
          */
         read_lock(&css_set_lock);
-        empty = list_empty(&cgrp->cset_links) && list_empty(&cgrp->children);
+        empty = list_empty(&cgrp->cset_links);
         read_unlock(&css_set_lock);
         if (!empty)
                 return -EBUSY;
 
         /*
+         * Make sure there's no live children.  We can't test ->children
+         * emptiness as dead children linger on it while being destroyed;
+         * otherwise, "rmdir parent/child parent" may fail with -EBUSY.
+         */
+        empty = true;
+        rcu_read_lock();
+        list_for_each_entry_rcu(child, &cgrp->children, sibling) {
+                empty = cgroup_is_dead(child);
+                if (!empty)
+                        break;
+        }
+        rcu_read_unlock();
+        if (!empty)
+                return -EBUSY;
+
+        /*
          * Block new css_tryget() by killing css refcnts.  cgroup core
          * guarantees that, by the time ->css_offline() is invoked, no new
          * css reference will be given out via css_tryget().  We can't
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 010a0083c0ae..ea1966db34f2 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -475,13 +475,17 @@ static int validate_change(const struct cpuset *cur, const struct cpuset *trial)
 
         /*
          * Cpusets with tasks - existing or newly being attached - can't
-         * have empty cpus_allowed or mems_allowed.
+         * be changed to have empty cpus_allowed or mems_allowed.
          */
         ret = -ENOSPC;
-        if ((cgroup_task_count(cur->css.cgroup) || cur->attach_in_progress) &&
-            (cpumask_empty(trial->cpus_allowed) &&
-             nodes_empty(trial->mems_allowed)))
-                goto out;
+        if ((cgroup_task_count(cur->css.cgroup) || cur->attach_in_progress)) {
+                if (!cpumask_empty(cur->cpus_allowed) &&
+                    cpumask_empty(trial->cpus_allowed))
+                        goto out;
+                if (!nodes_empty(cur->mems_allowed) &&
+                    nodes_empty(trial->mems_allowed))
+                        goto out;
+        }
 
         ret = 0;
 out:
diff --git a/kernel/fork.c b/kernel/fork.c
index e23bb19e2a3e..bf46287c91a4 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1177,7 +1177,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
          * don't allow the creation of threads.
          */
         if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&
-            (task_active_pid_ns(current) != current->nsproxy->pid_ns))
+            (task_active_pid_ns(current) !=
+             current->nsproxy->pid_ns_for_children))
                 return ERR_PTR(-EINVAL);
 
         retval = security_task_create(clone_flags);
@@ -1351,7 +1352,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
         if (pid != &init_struct_pid) {
                 retval = -ENOMEM;
-                pid = alloc_pid(p->nsproxy->pid_ns);
+                pid = alloc_pid(p->nsproxy->pid_ns_for_children);
                 if (!pid)
                         goto bad_fork_cleanup_io;
         }
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 364ceab15f0c..997cbb951a3b 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -29,15 +29,15 @@
 static struct kmem_cache *nsproxy_cachep;
 
 struct nsproxy init_nsproxy = {
-        .count  = ATOMIC_INIT(1),
-        .uts_ns = &init_uts_ns,
+        .count                  = ATOMIC_INIT(1),
+        .uts_ns                 = &init_uts_ns,
 #if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC)
-        .ipc_ns = &init_ipc_ns,
+        .ipc_ns                 = &init_ipc_ns,
 #endif
-        .mnt_ns = NULL,
-        .pid_ns = &init_pid_ns,
+        .mnt_ns                 = NULL,
+        .pid_ns_for_children    = &init_pid_ns,
 #ifdef CONFIG_NET
-        .net_ns = &init_net,
+        .net_ns                 = &init_net,
 #endif
 };
 
@@ -85,9 +85,10 @@ static struct nsproxy *create_new_namespaces(unsigned long flags,
                 goto out_ipc;
         }
 
-        new_nsp->pid_ns = copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns);
-        if (IS_ERR(new_nsp->pid_ns)) {
-                err = PTR_ERR(new_nsp->pid_ns);
+        new_nsp->pid_ns_for_children =
+                copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
+        if (IS_ERR(new_nsp->pid_ns_for_children)) {
+                err = PTR_ERR(new_nsp->pid_ns_for_children);
                 goto out_pid;
         }
 
@@ -100,8 +101,8 @@ static struct nsproxy *create_new_namespaces(unsigned long flags,
         return new_nsp;
 
 out_net:
-        if (new_nsp->pid_ns)
-                put_pid_ns(new_nsp->pid_ns);
+        if (new_nsp->pid_ns_for_children)
+                put_pid_ns(new_nsp->pid_ns_for_children);
 out_pid:
         if (new_nsp->ipc_ns)
                 put_ipc_ns(new_nsp->ipc_ns);
@@ -174,8 +175,8 @@ void free_nsproxy(struct nsproxy *ns)
                 put_uts_ns(ns->uts_ns);
         if (ns->ipc_ns)
                 put_ipc_ns(ns->ipc_ns);
-        if (ns->pid_ns)
-                put_pid_ns(ns->pid_ns);
+        if (ns->pid_ns_for_children)
+                put_pid_ns(ns->pid_ns_for_children);
         put_net(ns->net_ns);
         kmem_cache_free(nsproxy_cachep, ns);
 }
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 6917e8edb48e..601bb361c235 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -349,8 +349,8 @@ static int pidns_install(struct nsproxy *nsproxy, void *ns)
         if (ancestor != active)
                 return -EINVAL;
 
-        put_pid_ns(nsproxy->pid_ns);
-        nsproxy->pid_ns = get_pid_ns(new);
+        put_pid_ns(nsproxy->pid_ns_for_children);
+        nsproxy->pid_ns_for_children = get_pid_ns(new);
         return 0;
 }
 
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index 3bdf28323012..61ed862cdd37 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -265,10 +265,9 @@ static inline void timer_list_header(struct seq_file *m, u64 now)
 static int timer_list_show(struct seq_file *m, void *v)
 {
         struct timer_list_iter *iter = v;
-        u64 now = ktime_to_ns(ktime_get());
 
         if (iter->cpu == -1 && !iter->second_pass)
-                timer_list_header(m, now);
+                timer_list_header(m, iter->now);
         else if (!iter->second_pass)
                 print_cpu(m, iter->cpu, iter->now);
 #ifdef CONFIG_GENERIC_CLOCKEVENTS
@@ -298,33 +297,41 @@ void sysrq_timer_list_show(void)
         return;
 }
 
-static void *timer_list_start(struct seq_file *file, loff_t *offset)
+static void *move_iter(struct timer_list_iter *iter, loff_t offset)
 {
-        struct timer_list_iter *iter = file->private;
-
-        if (!*offset) {
-                iter->cpu = -1;
-                iter->now = ktime_to_ns(ktime_get());
-        } else if (iter->cpu >= nr_cpu_ids) {
+        for (; offset; offset--) {
+                iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
+                if (iter->cpu >= nr_cpu_ids) {
 #ifdef CONFIG_GENERIC_CLOCKEVENTS
-                if (!iter->second_pass) {
-                        iter->cpu = -1;
-                        iter->second_pass = true;
-                } else
-                        return NULL;
+                        if (!iter->second_pass) {
+                                iter->cpu = -1;
+                                iter->second_pass = true;
+                        } else
+                                return NULL;
 #else
-                return NULL;
+                        return NULL;
 #endif
+                }
         }
         return iter;
 }
 
+static void *timer_list_start(struct seq_file *file, loff_t *offset)
+{
+        struct timer_list_iter *iter = file->private;
+
+        if (!*offset)
+                iter->now = ktime_to_ns(ktime_get());
+        iter->cpu = -1;
+        iter->second_pass = false;
+        return move_iter(iter, *offset);
+}
+
 static void *timer_list_next(struct seq_file *file, void *v, loff_t *offset)
 {
         struct timer_list_iter *iter = file->private;
-        iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
         ++*offset;
-        return timer_list_start(file, offset);
+        return move_iter(iter, 1);
 }
 
 static void timer_list_stop(struct seq_file *seq, void *v)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 7f5d4be22034..e93f7b9067d8 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2201,6 +2201,15 @@ __acquires(&pool->lock)
                 dump_stack();
         }
 
+        /*
+         * The following prevents a kworker from hogging CPU on !PREEMPT
+         * kernels, where a requeueing work item waiting for something to
+         * happen could deadlock with stop_machine as such work item could
+         * indefinitely requeue itself while all other CPUs are trapped in
+         * stop_machine.
+         */
+        cond_resched();
+
         spin_lock_irq(&pool->lock);
 
         /* clear cpu intensive status */