lael-labs/linux

kernel/async.c+0−3

@@ -205,9 +205,6 @@ async_cookie_t async_schedule_node_domain(async_func_t func, void *data, · 204 unmodified lines
205	atomic_inc(&entry_count);	205	atomic_inc(&entry_count);
206	spin_unlock_irqrestore(&async_lock, flags);	206	spin_unlock_irqrestore(&async_lock, flags);
207		207
208	/* mark that this task has queued an async job, used by module init */
209	current->flags \|= PF_USED_ASYNC;
210
211	/* schedule for execution */	208	/* schedule for execution */
212	queue_work_node(node, system_unbound_wq, &entry->work);	209	queue_work_node(node, system_unbound_wq, &entry->work);
213		210

kernel/audit.c+43−19

@@ -541,20 +541,22 @@ static void kauditd_printk_skb(struct sk_buff *skb) · 540 unmodified lines
541	/**	541	/**
542	* kauditd_rehold_skb - Handle a audit record send failure in the hold queue	542	* kauditd_rehold_skb - Handle a audit record send failure in the hold queue
543	* @skb: audit record	543	* @skb: audit record
		544	* @error: error code (unused)
544	*	545	*
545	* Description:	546	* Description:
546	* This should only be used by the kauditd_thread when it fails to flush the	547	* This should only be used by the kauditd_thread when it fails to flush the
547	* hold queue.	548	* hold queue.
548	*/	549	*/
549	static void kauditd_rehold_skb(struct sk_buff *skb)	550	static void kauditd_rehold_skb(struct sk_buff *skb, __always_unused int error)
550	{	551	{
551	/* put the record back in the queue at the same place */	552	/* put the record back in the queue */
552	skb_queue_head(&audit_hold_queue, skb);	553	skb_queue_tail(&audit_hold_queue, skb);
553	}	554	}
554		555
555	/**	556	/**
556	* kauditd_hold_skb - Queue an audit record, waiting for auditd	557	* kauditd_hold_skb - Queue an audit record, waiting for auditd
557	* @skb: audit record	558	* @skb: audit record
		559	* @error: error code
558	*	560	*
559	* Description:	561	* Description:
560	* Queue the audit record, waiting for an instance of auditd. When this	562	* Queue the audit record, waiting for an instance of auditd. When this
@@ -564,19 +566,31 @@ static void kauditd_rehold_skb(struct sk_buff *skb) · 3 unmodified lines
564	* and queue it, if we have room. If we want to hold on to the record, but we	566	* and queue it, if we have room. If we want to hold on to the record, but we
565	* don't have room, record a record lost message.	567	* don't have room, record a record lost message.
566	*/	568	*/
567	static void kauditd_hold_skb(struct sk_buff *skb)	569	static void kauditd_hold_skb(struct sk_buff *skb, int error)
568	{	570	{
569	/* at this point it is uncertain if we will ever send this to auditd so	571	/* at this point it is uncertain if we will ever send this to auditd so
570	* try to send the message via printk before we go any further */	572	* try to send the message via printk before we go any further */
571	kauditd_printk_skb(skb);	573	kauditd_printk_skb(skb);
572		574
573	/* can we just silently drop the message? */	575	/* can we just silently drop the message? */
574	if (!audit_default) {	576	if (!audit_default)
575	kfree_skb(skb);	577	goto drop;
576	return;	578
		579	/* the hold queue is only for when the daemon goes away completely,
		580	* not -EAGAIN failures; if we are in a -EAGAIN state requeue the
		581	* record on the retry queue unless it's full, in which case drop it
		582	*/
		583	if (error == -EAGAIN) {
		584	if (!audit_backlog_limit \|\|
		585	skb_queue_len(&audit_retry_queue) < audit_backlog_limit) {
		586	skb_queue_tail(&audit_retry_queue, skb);
		587	return;
		588	}
		589	audit_log_lost("kauditd retry queue overflow");
		590	goto drop;
577	}	591	}
578		592
579	/* if we have room, queue the message */	593	/* if we have room in the hold queue, queue the message */
580	if (!audit_backlog_limit \|\|	594	if (!audit_backlog_limit \|\|
581	skb_queue_len(&audit_hold_queue) < audit_backlog_limit) {	595	skb_queue_len(&audit_hold_queue) < audit_backlog_limit) {
582	skb_queue_tail(&audit_hold_queue, skb);	596	skb_queue_tail(&audit_hold_queue, skb);
@@ -585,24 +599,32 @@ static void kauditd_hold_skb(struct sk_buff *skb) · 2 unmodified lines
585		599
586	/* we have no other options - drop the message */	600	/* we have no other options - drop the message */
587	audit_log_lost("kauditd hold queue overflow");	601	audit_log_lost("kauditd hold queue overflow");
		602	drop:
588	kfree_skb(skb);	603	kfree_skb(skb);
589	}	604	}
590		605
591	/**	606	/**
592	* kauditd_retry_skb - Queue an audit record, attempt to send again to auditd	607	* kauditd_retry_skb - Queue an audit record, attempt to send again to auditd
593	* @skb: audit record	608	* @skb: audit record
		609	* @error: error code (unused)
594	*	610	*
595	* Description:	611	* Description:
596	* Not as serious as kauditd_hold_skb() as we still have a connected auditd,	612	* Not as serious as kauditd_hold_skb() as we still have a connected auditd,
597	* but for some reason we are having problems sending it audit records so	613	* but for some reason we are having problems sending it audit records so
598	* queue the given record and attempt to resend.	614	* queue the given record and attempt to resend.
599	*/	615	*/
600	static void kauditd_retry_skb(struct sk_buff *skb)	616	static void kauditd_retry_skb(struct sk_buff *skb, __always_unused int error)
601	{	617	{
602	/* NOTE: because records should only live in the retry queue for a	618	if (!audit_backlog_limit \|\|
603	* short period of time, before either being sent or moved to the hold	619	skb_queue_len(&audit_retry_queue) < audit_backlog_limit) {
604	* queue, we don't currently enforce a limit on this queue */	620	skb_queue_tail(&audit_retry_queue, skb);
605	skb_queue_tail(&audit_retry_queue, skb);	621	return;
		622	}
		623
		624	/* we have to drop the record, send it via printk as a last effort */
		625	kauditd_printk_skb(skb);
		626	audit_log_lost("kauditd retry queue overflow");
		627	kfree_skb(skb);
606	}	628	}
607		629
608	/**	630	/**
@@ -640,7 +662,7 @@ static void auditd_reset(const struct auditd_connection *ac) · 31 unmodified lines
640	/* flush the retry queue to the hold queue, but don't touch the main	662	/* flush the retry queue to the hold queue, but don't touch the main
641	* queue since we need to process that normally for multicast */	663	* queue since we need to process that normally for multicast */
642	while ((skb = skb_dequeue(&audit_retry_queue)))	664	while ((skb = skb_dequeue(&audit_retry_queue)))
643	kauditd_hold_skb(skb);	665	kauditd_hold_skb(skb, -ECONNREFUSED);
644	}	666	}
645		667
646	/**	668	/**
@@ -714,16 +736,18 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, · 67 unmodified lines
714	struct sk_buff_head *queue,	736	struct sk_buff_head *queue,
715	unsigned int retry_limit,	737	unsigned int retry_limit,
716	void (skb_hook)(struct sk_buff skb),	738	void (skb_hook)(struct sk_buff skb),
717	void (err_hook)(struct sk_buff skb))	739	void (err_hook)(struct sk_buff skb, int error))
718	{	740	{
719	int rc = 0;	741	int rc = 0;
720	struct sk_buff *skb;	742	struct sk_buff *skb = NULL;
		743	struct sk_buff *skb_tail;
721	unsigned int failed = 0;	744	unsigned int failed = 0;
722		745
723	/* NOTE: kauditd_thread takes care of all our locking, we just use	746	/* NOTE: kauditd_thread takes care of all our locking, we just use
724	* the netlink info passed to us (e.g. sk and portid) */	747	* the netlink info passed to us (e.g. sk and portid) */
725		748
726	while ((skb = skb_dequeue(queue))) {	749	skb_tail = skb_peek_tail(queue);
		750	while ((skb != skb_tail) && (skb = skb_dequeue(queue))) {
727	/* call the skb_hook for each skb we touch */	751	/* call the skb_hook for each skb we touch */
728	if (skb_hook)	752	if (skb_hook)
729	(*skb_hook)(skb);	753	(*skb_hook)(skb);
@@ -731,7 +755,7 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, · 1 unmodified line
731	/* can we send to anyone via unicast? */	755	/* can we send to anyone via unicast? */
732	if (!sk) {	756	if (!sk) {
733	if (err_hook)	757	if (err_hook)
734	(*err_hook)(skb);	758	(*err_hook)(skb, -ECONNREFUSED);
735	continue;	759	continue;
736	}	760	}
737		761
@@ -745,7 +769,7 @@ retry: · 7 unmodified lines
745	rc == -ECONNREFUSED \|\| rc == -EPERM) {	769	rc == -ECONNREFUSED \|\| rc == -EPERM) {
746	sk = NULL;	770	sk = NULL;
747	if (err_hook)	771	if (err_hook)
748	(*err_hook)(skb);	772	(*err_hook)(skb, rc);
749	if (rc == -EAGAIN)	773	if (rc == -EAGAIN)
750	rc = 0;	774	rc = 0;
751	/* continue to drain the queue */	775	/* continue to drain the queue */

kernel/auditsc.c+1−1

@@ -185,7 +185,7 @@ static int audit_match_perm(struct audit_context *ctx, int mask) · 184 unmodified lines
185	case AUDITSC_EXECVE:	185	case AUDITSC_EXECVE:
186	return mask & AUDIT_PERM_EXEC;	186	return mask & AUDIT_PERM_EXEC;
187	case AUDITSC_OPENAT2:	187	case AUDITSC_OPENAT2:
188	return mask & ACC_MODE((u32)((struct open_how *)ctx->argv[2])->flags);	188	return mask & ACC_MODE((u32)ctx->openat2.flags);
189	default:	189	default:
190	return 0;	190	return 0;
191	}	191	}

kernel/bpf/bpf_lsm.c+1−1

@@ -207,7 +207,7 @@ BTF_ID(func, bpf_lsm_socket_socketpair) · 206 unmodified lines
207		207
208	BTF_ID(func, bpf_lsm_syslog)	208	BTF_ID(func, bpf_lsm_syslog)
209	BTF_ID(func, bpf_lsm_task_alloc)	209	BTF_ID(func, bpf_lsm_task_alloc)
210	BTF_ID(func, bpf_lsm_task_getsecid_subj)	210	BTF_ID(func, bpf_lsm_current_getsecid_subj)
211	BTF_ID(func, bpf_lsm_task_getsecid_obj)	211	BTF_ID(func, bpf_lsm_task_getsecid_obj)
212	BTF_ID(func, bpf_lsm_task_prctl)	212	BTF_ID(func, bpf_lsm_task_prctl)
213	BTF_ID(func, bpf_lsm_task_setscheduler)	213	BTF_ID(func, bpf_lsm_task_setscheduler)

kernel/bpf/ringbuf.c+1−1

@@ -104,7 +104,7 @@ static struct bpf_ringbuf *bpf_ringbuf_area_alloc(size_t data_sz, int numa_node) · 103 unmodified lines
104	}	104	}
105		105
106	rb = vmap(pages, nr_meta_pages + 2 * nr_data_pages,	106	rb = vmap(pages, nr_meta_pages + 2 * nr_data_pages,
107	VM_ALLOC \| VM_USERMAP, PAGE_KERNEL);	107	VM_MAP \| VM_USERMAP, PAGE_KERNEL);
108	if (rb) {	108	if (rb) {
109	kmemleak_not_leak(pages);	109	kmemleak_not_leak(pages);
110	rb->pages = pages;	110	rb->pages = pages;

kernel/bpf/stackmap.c+3−2

 	   u32, size, u64, flags)
 {
 	struct pt_regs *regs;
-	long res;
+	long res = -EINVAL;
 	if (!try_get_task_stack(task))
 		return -EFAULT;
 	regs = task_pt_regs(task);
-	res = __bpf_get_stack(regs, task, NULL, buf, size, flags);
+	if (regs)
+		res = __bpf_get_stack(regs, task, NULL, buf, size, flags);
 	put_task_stack(task);
 	return res;

kernel/bpf/trampoline.c+3−2

 static void notrace inc_misses_counter(struct bpf_prog *prog)
 {
 	struct bpf_prog_stats *stats;
+	unsigned int flags;
 	stats = this_cpu_ptr(prog->stats);
-	u64_stats_update_begin(&stats->syncp);
+	flags = u64_stats_update_begin_irqsave(&stats->syncp);
 	u64_stats_inc(&stats->misses);
-	u64_stats_update_end(&stats->syncp);
+	u64_stats_update_end_irqrestore(&stats->syncp, flags);
 }
 /* The logic is similar to bpf_prog_run(), but with an explicit

kernel/cgroup/cgroup-v1.c+14−0

@@ -549,6 +549,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, · 548 unmodified lines
549		549
550	BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);	550	BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
551		551
		552	/*
		553	* Release agent gets called with all capabilities,
		554	* require capabilities to set release agent.
		555	*/
		556	if ((of->file->f_cred->user_ns != &init_user_ns) \|\|
		557	!capable(CAP_SYS_ADMIN))
		558	return -EPERM;
		559
552	cgrp = cgroup_kn_lock_live(of->kn, false);	560	cgrp = cgroup_kn_lock_live(of->kn, false);
553	if (!cgrp)	561	if (!cgrp)
554	return -ENODEV;	562	return -ENODEV;
@@ -954,6 +962,12 @@ int cgroup1_parse_param(struct fs_context fc, struct fs_parameter param) · 399 unmodified lines
954	/* Specifying two release agents is forbidden */	962	/* Specifying two release agents is forbidden */
955	if (ctx->release_agent)	963	if (ctx->release_agent)
956	return invalfc(fc, "release_agent respecified");	964	return invalfc(fc, "release_agent respecified");
		965	/*
		966	* Release agent gets called with all capabilities,
		967	* require capabilities to set release agent.
		968	*/
		969	if ((fc->user_ns != &init_user_ns) \|\| !capable(CAP_SYS_ADMIN))
		970	return invalfc(fc, "Setting release_agent not allowed");
957	ctx->release_agent = param->string;	971	ctx->release_agent = param->string;
958	param->string = NULL;	972	param->string = NULL;
959	break;	973	break;

kernel/cgroup/cgroup.c+8−3

 	cgroup_get(cgrp);
 	cgroup_kn_unlock(of->kn);
+	/* Allow only one trigger per file descriptor */
+	if (ctx->psi.trigger) {
+		cgroup_put(cgrp);
+		return -EBUSY;
+	}
 	psi = cgroup_ino(cgrp) == 1 ? &psi_system : &cgrp->psi;
 	new = psi_trigger_create(psi, buf, nbytes, res);
 	if (IS_ERR(new)) {
 		return PTR_ERR(new);
 	}
-	psi_trigger_replace(&ctx->psi.trigger, new);
+	smp_store_release(&ctx->psi.trigger, new);
 	cgroup_put(cgrp);
 	return nbytes;
 {
 	struct cgroup_file_ctx *ctx = of->priv;
-	psi_trigger_replace(&ctx->psi.trigger, NULL);
+	psi_trigger_destroy(ctx->psi.trigger);
 }
 bool cgroup_psi_enabled(void)

kernel/cgroup/cpuset.c+51−14

 	kfree(cs);
 }
+/*
+ * validate_change_legacy() - Validate conditions specific to legacy (v1)
+ *                            behavior.
+ */
+static int validate_change_legacy(struct cpuset *cur, struct cpuset *trial)
+{
+	struct cgroup_subsys_state *css;
+	struct cpuset *c, *par;
+	int ret;
+	WARN_ON_ONCE(!rcu_read_lock_held());
+	/* Each of our child cpusets must be a subset of us */
+	ret = -EBUSY;
+	cpuset_for_each_child(c, css, cur)
+		if (!is_cpuset_subset(c, trial))
+			goto out;
+	/* On legacy hierarchy, we must be a subset of our parent cpuset. */
+	ret = -EACCES;
+	par = parent_cs(cur);
+	if (par && !is_cpuset_subset(trial, par))
+		goto out;
+	ret = 0;
+out:
+	return ret;
+}
 /*
  * validate_change() - Used to validate that any proposed cpuset change
  *		       follows the structural rules for cpusets.
 {
 	struct cgroup_subsys_state *css;
 	struct cpuset *c, *par;
-	int ret;
+	int ret = 0;
-	/* The checks don't apply to root cpuset */
-	if (cur == &top_cpuset)
-		return 0;
 	rcu_read_lock();
-	par = parent_cs(cur);
-	/* On legacy hierarchy, we must be a subset of our parent cpuset. */
+	if (!is_in_v2_mode())
-	ret = -EACCES;
+		ret = validate_change_legacy(cur, trial);
-	if (!is_in_v2_mode() && !is_cpuset_subset(trial, par))
+	if (ret)
+		goto out;
+	/* Remaining checks don't apply to root cpuset */
+	if (cur == &top_cpuset)
 		goto out;
+	par = parent_cs(cur);
 	/*
 	 * If either I or some sibling (!= me) is exclusive, we can't
 	 * overlap
  *
  * Because of the implicit cpu exclusive nature of a partition root,
  * cpumask changes that violates the cpu exclusivity rule will not be
- * permitted when checked by validate_change(). The validate_change()
+ * permitted when checked by validate_change().
- * function will also prevent any changes to the cpu list if it is not
- * a superset of children's cpu lists.
  */
 static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 					  struct cpumask *newmask,
 	struct cpuset *sibling;
 	struct cgroup_subsys_state *pos_css;
+	percpu_rwsem_assert_held(&cpuset_rwsem);
 	/*
 	 * Check all its siblings and call update_cpumasks_hier()
 	 * if their use_parent_ecpus flag is set in order for them
 	 * to use the right effective_cpus value.
+	 *
+	 * The update_cpumasks_hier() function may sleep. So we have to
+	 * release the RCU read lock before calling it.
 	 */
 	rcu_read_lock();
 	cpuset_for_each_child(sibling, pos_css, parent) {
 			continue;
 		if (!sibling->use_parent_ecpus)
 			continue;
+		if (!css_tryget_online(&sibling->css))
+			continue;
+		rcu_read_unlock();
 		update_cpumasks_hier(sibling, tmp);
+		rcu_read_lock();
+		css_put(&sibling->css);
 	}
 	rcu_read_unlock();
 }
 	 * Make sure that subparts_cpus is a subset of cpus_allowed.
 	 */
 	if (cs->nr_subparts_cpus) {
-		cpumask_andnot(cs->subparts_cpus, cs->subparts_cpus,
+		cpumask_and(cs->subparts_cpus, cs->subparts_cpus, cs->cpus_allowed);
-			       cs->cpus_allowed);
 		cs->nr_subparts_cpus = cpumask_weight(cs->subparts_cpus);
 	}
 	spin_unlock_irq(&callback_lock);

kernel/cred.c+2−7

 int set_cred_ucounts(struct cred *new)
 {
-	struct task_struct *task = current;
-	const struct cred *old = task->real_cred;
 	struct ucounts *new_ucounts, *old_ucounts = new->ucounts;
-	if (new->user == old->user && new->user_ns == old->user_ns)
-		return 0;
 	/*
 	 * This optimization is needed because alloc_ucounts() uses locks
 	 * for table lookups.
 	 */
-	if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->euid))
+	if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->uid))
 		return 0;
-	if (!(new_ucounts = alloc_ucounts(new->user_ns, new->euid)))
+	if (!(new_ucounts = alloc_ucounts(new->user_ns, new->uid)))
 		return -EAGAIN;
 	new->ucounts = new_ucounts;

kernel/events/core.c+183−106

 	WRITE_ONCE(event->state, state);
 }
+/*
+ * UP store-release, load-acquire
+ */
+#define __store_release(ptr, val)					\
+do {									\
+	barrier();							\
+	WRITE_ONCE(*(ptr), (val));					\
+} while (0)
+#define __load_acquire(ptr)						\
+({									\
+	__unqual_scalar_typeof(*(ptr)) ___p = READ_ONCE(*(ptr));	\
+	barrier();							\
+	___p;								\
+})
 #ifdef CONFIG_CGROUP_PERF
 static inline bool
 	return t->time;
 }
-static inline void __update_cgrp_time(struct perf_cgroup *cgrp)
+static inline u64 perf_cgroup_event_time_now(struct perf_event *event, u64 now)
 {
-	struct perf_cgroup_info *info;
+	struct perf_cgroup_info *t;
-	u64 now;
-	now = perf_clock();
-	info = this_cpu_ptr(cgrp->info);
+	t = per_cpu_ptr(event->cgrp->info, event->cpu);
+	if (!__load_acquire(&t->active))
+		return t->time;
+	now += READ_ONCE(t->timeoffset);
+	return now;
+}
-	info->time += now - info->timestamp;
+static inline void __update_cgrp_time(struct perf_cgroup_info *info, u64 now, bool adv)
+{
+	if (adv)
+		info->time += now - info->timestamp;
 	info->timestamp = now;
+	/*
+	 * see update_context_time()
+	 */
+	WRITE_ONCE(info->timeoffset, info->time - info->timestamp);
 }
-static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
+static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx, bool final)
 {
 	struct perf_cgroup *cgrp = cpuctx->cgrp;
 	struct cgroup_subsys_state *css;
+	struct perf_cgroup_info *info;
 	if (cgrp) {
+		u64 now = perf_clock();
 		for (css = &cgrp->css; css; css = css->parent) {
 			cgrp = container_of(css, struct perf_cgroup, css);
-			__update_cgrp_time(cgrp);
+			info = this_cpu_ptr(cgrp->info);
+			__update_cgrp_time(info, now, true);
+			if (final)
+				__store_release(&info->active, 0);
 		}
 	}
 }
 static inline void update_cgrp_time_from_event(struct perf_event *event)
 {
+	struct perf_cgroup_info *info;
 	struct perf_cgroup *cgrp;
 	/*
 	/*
 	 * Do not update time when cgroup is not active
 	 */
-	if (cgroup_is_descendant(cgrp->css.cgroup, event->cgrp->css.cgroup))
+	if (cgroup_is_descendant(cgrp->css.cgroup, event->cgrp->css.cgroup)) {
-		__update_cgrp_time(event->cgrp);
+		info = this_cpu_ptr(event->cgrp->info);
+		__update_cgrp_time(info, perf_clock(), true);
+	}
 }
 static inline void
 	for (css = &cgrp->css; css; css = css->parent) {
 		cgrp = container_of(css, struct perf_cgroup, css);
 		info = this_cpu_ptr(cgrp->info);
-		info->timestamp = ctx->timestamp;
+		__update_cgrp_time(info, ctx->timestamp, false);
+		__store_release(&info->active, 1);
 	}
 }
  */
 static void perf_cgroup_switch(struct task_struct *task, int mode)
 {
-	struct perf_cpu_context *cpuctx;
+	struct perf_cpu_context *cpuctx, *tmp;
 	struct list_head *list;
 	unsigned long flags;
 	local_irq_save(flags);
 	list = this_cpu_ptr(&cgrp_cpuctx_list);
-	list_for_each_entry(cpuctx, list, cgrp_cpuctx_entry) {
+	list_for_each_entry_safe(cpuctx, tmp, list, cgrp_cpuctx_entry) {
 		WARN_ON_ONCE(cpuctx->ctx.nr_cgroups == 0);
 		perf_ctx_lock(cpuctx, cpuctx->task_ctx);
 	return ret;
 }
-static inline void
-perf_cgroup_set_shadow_time(struct perf_event *event, u64 now)
-{
-	struct perf_cgroup_info *t;
-	t = per_cpu_ptr(event->cgrp->info, event->cpu);
-	event->shadow_ctx_time = now - t->timestamp;
-}
 static inline void
 perf_cgroup_event_enable(struct perf_event *event, struct perf_event_context *ctx)
 {
 {
 }
-static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
+static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx,
+						bool final)
 {
 }
 {
 }
-static inline void
+static inline u64 perf_cgroup_event_time(struct perf_event *event)
-perf_cgroup_set_shadow_time(struct perf_event *event, u64 now)
 {
+	return 0;
 }
-static inline u64 perf_cgroup_event_time(struct perf_event *event)
+static inline u64 perf_cgroup_event_time_now(struct perf_event *event, u64 now)
 {
 	return 0;
 }
 /*
  * Update the record of the current time in a context.
  */
-static void update_context_time(struct perf_event_context *ctx)
+static void __update_context_time(struct perf_event_context *ctx, bool adv)
 {
 	u64 now = perf_clock();
-	ctx->time += now - ctx->timestamp;
+	if (adv)
+		ctx->time += now - ctx->timestamp;
 	ctx->timestamp = now;
+	/*
+	 * The above: time' = time + (now - timestamp), can be re-arranged
+	 * into: time` = now + (time - timestamp), which gives a single value
+	 * offset to compute future time without locks on.
+	 *
+	 * See perf_event_time_now(), which can be used from NMI context where
+	 * it's (obviously) not possible to acquire ctx->lock in order to read
+	 * both the above values in a consistent manner.
+	 */
+	WRITE_ONCE(ctx->timeoffset, ctx->time - ctx->timestamp);
+}
+static void update_context_time(struct perf_event_context *ctx)
+{
+	__update_context_time(ctx, true);
 }
 static u64 perf_event_time(struct perf_event *event)
 {
 	struct perf_event_context *ctx = event->ctx;
+	if (unlikely(!ctx))
+		return 0;
 	if (is_cgroup_event(event))
 		return perf_cgroup_event_time(event);
-	return ctx ? ctx->time : 0;
+	return ctx->time;
+}
+static u64 perf_event_time_now(struct perf_event *event, u64 now)
+{
+	struct perf_event_context *ctx = event->ctx;
+	if (unlikely(!ctx))
+		return 0;
+	if (is_cgroup_event(event))
+		return perf_cgroup_event_time_now(event, now);
+	if (!(__load_acquire(&ctx->is_active) & EVENT_TIME))
+		return ctx->time;
+	now += READ_ONCE(ctx->timeoffset);
+	return now;
 }
 static enum event_type_t get_event_type(struct perf_event *event)
 	if (ctx->is_active & EVENT_TIME) {
 		update_context_time(ctx);
-		update_cgrp_time_from_cpuctx(cpuctx);
+		update_cgrp_time_from_cpuctx(cpuctx, false);
 	}
 	event_sched_out(event, cpuctx, ctx);
 	list_del_event(event, ctx);
 	if (!ctx->nr_events && ctx->is_active) {
+		if (ctx == &cpuctx->ctx)
+			update_cgrp_time_from_cpuctx(cpuctx, true);
 		ctx->is_active = 0;
 		ctx->rotate_necessary = 0;
 		if (ctx->task) {
 	 * event_function_call() user.
 	 */
 	raw_spin_lock_irq(&ctx->lock);
-	if (!ctx->is_active) {
+	/*
+	 * Cgroup events are per-cpu events, and must IPI because of
+	 * cgrp_cpuctx_list.
+	 */
+	if (!ctx->is_active && !is_cgroup_event(event)) {
 		__perf_remove_from_context(event, __get_cpu_context(ctx),
 					   ctx, (void *)flags);
 		raw_spin_unlock_irq(&ctx->lock);
 	irq_work_queue(&event->pending);
 }
-static void perf_set_shadow_time(struct perf_event *event,
-				 struct perf_event_context *ctx)
-{
-	/*
-	 * use the correct time source for the time snapshot
-	 *
-	 * We could get by without this by leveraging the
-	 * fact that to get to this function, the caller
-	 * has most likely already called update_context_time()
-	 * and update_cgrp_time_xx() and thus both timestamp
-	 * are identical (or very close). Given that tstamp is,
-	 * already adjusted for cgroup, we could say that:
-	 *    tstamp - ctx->timestamp
-	 * is equivalent to
-	 *    tstamp - cgrp->timestamp.
-	 *
-	 * Then, in perf_output_read(), the calculation would
-	 * work with no changes because:
-	 * - event is guaranteed scheduled in
-	 * - no scheduled out in between
-	 * - thus the timestamp would be the same
-	 *
-	 * But this is a bit hairy.
-	 *
-	 * So instead, we have an explicit cgroup call to remain
-	 * within the time source all along. We believe it
-	 * is cleaner and simpler to understand.
-	 */
-	if (is_cgroup_event(event))
-		perf_cgroup_set_shadow_time(event, event->tstamp);
-	else
-		event->shadow_ctx_time = event->tstamp - ctx->timestamp;
-}
 #define MAX_INTERRUPTS (~0ULL)
 static void perf_log_throttle(struct perf_event *event, int enable);
 	perf_pmu_disable(event->pmu);
-	perf_set_shadow_time(event, ctx);
 	perf_log_itrace_start(event);
 	if (event->pmu->add(event, PERF_EF_START)) {
 	 * perf_event_attr::disabled events will not run and can be initialized
 	 * without IPI. Except when this is the first event for the context, in
 	 * that case we need the magic of the IPI to set ctx->is_active.
+	 * Similarly, cgroup events for the context also needs the IPI to
+	 * manipulate the cgrp_cpuctx_list.
 	 *
 	 * The IOC_ENABLE that is sure to follow the creation of a disabled
 	 * event will issue the IPI and reprogram the hardware.
 	 */
-	if (__perf_effective_state(event) == PERF_EVENT_STATE_OFF && ctx->nr_events) {
+	if (__perf_effective_state(event) == PERF_EVENT_STATE_OFF &&
+	    ctx->nr_events && !is_cgroup_event(event)) {
 		raw_spin_lock_irq(&ctx->lock);
 		if (ctx->task == TASK_TOMBSTONE) {
 			raw_spin_unlock_irq(&ctx->lock);
 	return err;
 }
+/*
+ * Copy event-type-independent attributes that may be modified.
+ */
+static void perf_event_modify_copy_attr(struct perf_event_attr *to,
+					const struct perf_event_attr *from)
+{
+	to->sig_data = from->sig_data;
+}
 static int perf_event_modify_attr(struct perf_event *event,
 				  struct perf_event_attr *attr)
 {
 	WARN_ON_ONCE(event->ctx->parent_ctx);
 	mutex_lock(&event->child_mutex);
+	/*
+	 * Event-type-independent attributes must be copied before event-type
+	 * modification, which will validate that final attributes match the
+	 * source attributes after all relevant attributes have been copied.
+	 */
+	perf_event_modify_copy_attr(&event->attr, attr);
 	err = func(event, attr);
 	if (err)
 		goto out;
 	list_for_each_entry(child, &event->child_list, child_list) {
+		perf_event_modify_copy_attr(&child->attr, attr);
 		err = func(child, attr);
 		if (err)
 			goto out;
 		return;
 	}
-	ctx->is_active &= ~event_type;
-	if (!(ctx->is_active & EVENT_ALL))
-		ctx->is_active = 0;
-	if (ctx->task) {
-		WARN_ON_ONCE(cpuctx->task_ctx != ctx);
-		if (!ctx->is_active)
-			cpuctx->task_ctx = NULL;
-	}
 	/*
 	 * Always update time if it was set; not only when it changes.
 	 * Otherwise we can 'forget' to update time for any but the last
 	if (is_active & EVENT_TIME) {
 		/* update (and stop) ctx time */
 		update_context_time(ctx);
-		update_cgrp_time_from_cpuctx(cpuctx);
+		update_cgrp_time_from_cpuctx(cpuctx, ctx == &cpuctx->ctx);
+		/*
+		 * CPU-release for the below ->is_active store,
+		 * see __load_acquire() in perf_event_time_now()
+		 */
+		barrier();
+	}
+	ctx->is_active &= ~event_type;
+	if (!(ctx->is_active & EVENT_ALL))
+		ctx->is_active = 0;
+	if (ctx->task) {
+		WARN_ON_ONCE(cpuctx->task_ctx != ctx);
+		if (!ctx->is_active)
+			cpuctx->task_ctx = NULL;
 	}
 	is_active ^= ctx->is_active; /* changed bits */
 	return 0;
 }
+/*
+ * Because the userpage is strictly per-event (there is no concept of context,
+ * so there cannot be a context indirection), every userpage must be updated
+ * when context time starts :-(
+ *
+ * IOW, we must not miss EVENT_TIME edges.
+ */
 static inline bool event_update_userpage(struct perf_event *event)
 {
 	if (likely(!atomic_read(&event->mmap_count)))
 		return false;
 	perf_event_update_time(event);
-	perf_set_shadow_time(event, event->ctx);
 	perf_event_update_userpage(event);
 	return true;
 	     struct task_struct *task)
 {
 	int is_active = ctx->is_active;
-	u64 now;
 	lockdep_assert_held(&ctx->lock);
 	if (likely(!ctx->nr_events))
 		return;
+	if (is_active ^ EVENT_TIME) {
+		/* start ctx time */
+		__update_context_time(ctx, false);
+		perf_cgroup_set_timestamp(task, ctx);
+		/*
+		 * CPU-release for the below ->is_active store,
+		 * see __load_acquire() in perf_event_time_now()
+		 */
+		barrier();
+	}
 	ctx->is_active |= (event_type | EVENT_TIME);
 	if (ctx->task) {
 		if (!is_active)
 	is_active ^= ctx->is_active; /* changed bits */
-	if (is_active & EVENT_TIME) {
-		/* start ctx time */
-		now = perf_clock();
-		ctx->timestamp = now;
-		perf_cgroup_set_timestamp(task, ctx);
-	}
 	/*
 	 * First go through the list and put on any pinned groups
 	 * in order to give them the best chance of going on.
 	return local64_read(&event->count) + atomic64_read(&event->child_count);
 }
+static void calc_timer_values(struct perf_event *event,
+				u64 *now,
+				u64 *enabled,
+				u64 *running)
+{
+	u64 ctx_time;
+	*now = perf_clock();
+	ctx_time = perf_event_time_now(event, *now);
+	__perf_update_times(event, ctx_time, enabled, running);
+}
 /*
  * NMI-safe method to read a local event, that is an event that
  * is:
 	*value = local64_read(&event->count);
 	if (enabled || running) {
-		u64 now = event->shadow_ctx_time + perf_clock();
+		u64 __enabled, __running, __now;;
-		u64 __enabled, __running;
-		__perf_update_times(event, now, &__enabled, &__running);
+		calc_timer_values(event, &__now, &__enabled, &__running);
 		if (enabled)
 			*enabled = __enabled;
 		if (running)
 	return event->pmu->event_idx(event);
 }
-static void calc_timer_values(struct perf_event *event,
-				u64 *now,
-				u64 *enabled,
-				u64 *running)
-{
-	u64 ctx_time;
-	*now = perf_clock();
-	ctx_time = event->shadow_ctx_time + *now;
-	__perf_update_times(event, ctx_time, enabled, running);
-}
 static void perf_event_init_userpage(struct perf_event *event)
 {
 	struct perf_event_mmap_page *userpg;
 	struct perf_buffer *old_rb = NULL;
 	unsigned long flags;
+	WARN_ON_ONCE(event->parent);
 	if (event->rb) {
 		/*
 		 * Should be impossible, we set this when removing
 {
 	struct perf_buffer *rb;
+	if (event->parent)
+		event = event->parent;
 	rcu_read_lock();
 	rb = rcu_dereference(event->rb);
 	if (rb) {
 {
 	struct perf_buffer *rb;
+	if (event->parent)
+		event = event->parent;
 	rcu_read_lock();
 	rb = rcu_dereference(event->rb);
 	if (rb) {
 		ring_buffer_attach(event, rb);
 		perf_event_update_time(event);
-		perf_set_shadow_time(event, event->ctx);
 		perf_event_init_userpage(event);
 		perf_event_update_userpage(event);
 	} else {
 	if (WARN_ON_ONCE(READ_ONCE(sampler->oncpu) != smp_processor_id()))
 		goto out;
-	rb = ring_buffer_get(sampler->parent ? sampler->parent : sampler);
+	rb = ring_buffer_get(sampler);
 	if (!rb)
 		goto out;
 	if (WARN_ON_ONCE(!sampler || !data->aux_size))
 		return;
-	rb = ring_buffer_get(sampler->parent ? sampler->parent : sampler);
+	rb = ring_buffer_get(sampler);
 	if (!rb)
 		return;

kernel/fork.c+20−10

 #ifdef CONFIG_PROVE_LOCKING
 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
 #endif
+	retval = copy_creds(p, clone_flags);
+	if (retval < 0)
+		goto bad_fork_free;
 	retval = -EAGAIN;
 	if (is_ucounts_overlimit(task_ucounts(p), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
 		if (p->real_cred->user != INIT_USER &&
 		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
-			goto bad_fork_free;
+			goto bad_fork_cleanup_count;
 	}
 	current->flags &= ~PF_NPROC_EXCEEDED;
-	retval = copy_creds(p, clone_flags);
-	if (retval < 0)
-		goto bad_fork_free;
 	/*
 	 * If multiple threads are within copy_process(), then this check
 	 * triggers too late. This doesn't hurt, the check is only there
 	if (retval)
 		goto bad_fork_put_pidfd;
+	/*
+	 * Now that the cgroups are pinned, re-clone the parent cgroup and put
+	 * the new task on the correct runqueue. All this *before* the task
+	 * becomes visible.
+	 *
+	 * This isn't part of ->can_fork() because while the re-cloning is
+	 * cgroup specific, it unconditionally needs to place the task on a
+	 * runqueue.
+	 */
+	sched_cgroup_fork(p, args);
 	/*
 	 * From this point on we must avoid any synchronous user-space
 	 * communication until we take the tasklist-lock. In particular, we do
 		goto bad_fork_cancel_cgroup;
 	}
-	/* past the last point of failure */
-	if (pidfile)
-		fd_install(pidfd, pidfile);
 	init_task_pid_links(p);
 	if (likely(p->pid)) {
 		ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
 	syscall_tracepoint_update(p);
 	write_unlock_irq(&tasklist_lock);
+	if (pidfile)
+		fd_install(pidfd, pidfile);
 	proc_fork_connector(p);
-	sched_post_fork(p, args);
+	sched_post_fork(p);
 	cgroup_post_fork(p, args);
 	perf_event_fork(p);

kernel/locking/lockdep.c+2−2

@@ -3462,7 +3462,7 @@ struct lock_class lock_chain_get_class(struct lock_chain chain, int i) · 3461 unmodified lines
3462	u16 chain_hlock = chain_hlocks[chain->base + i];	3462	u16 chain_hlock = chain_hlocks[chain->base + i];
3463	unsigned int class_idx = chain_hlock_class_idx(chain_hlock);	3463	unsigned int class_idx = chain_hlock_class_idx(chain_hlock);
3464		3464
3465	return lock_classes + class_idx - 1;	3465	return lock_classes + class_idx;
3466	}	3466	}
3467		3467
3468	/*	3468	/*
@@ -3530,7 +3530,7 @@ static void print_chain_keys_chain(struct lock_chain *chain) · 61 unmodified lines
3530	hlock_id = chain_hlocks[chain->base + i];	3530	hlock_id = chain_hlocks[chain->base + i];
3531	chain_key = print_chain_key_iteration(hlock_id, chain_key);	3531	chain_key = print_chain_key_iteration(hlock_id, chain_key);
3532		3532
3533	print_lock_name(lock_classes + chain_hlock_class_idx(hlock_id) - 1);	3533	print_lock_name(lock_classes + chain_hlock_class_idx(hlock_id));
3534	printk("\n");	3534	printk("\n");
3535	}	3535	}
3536	}	3536	}

kernel/module.c+5−20

 	}
 	freeinit->module_init = mod->init_layout.base;
-	/*
-	 * We want to find out whether @mod uses async during init.  Clear
-	 * PF_USED_ASYNC.  async_schedule*() will set it.
-	 */
-	current->flags &= ~PF_USED_ASYNC;
 	do_mod_ctors(mod);
 	/* Start the module */
 	if (mod->init != NULL)
 	/*
 	 * We need to finish all async code before the module init sequence
-	 * is done.  This has potential to deadlock.  For example, a newly
+	 * is done. This has potential to deadlock if synchronous module
-	 * detected block device can trigger request_module() of the
+	 * loading is requested from async (which is not allowed!).
-	 * default iosched from async probing task.  Once userland helper
-	 * reaches here, async_synchronize_full() will wait on the async
-	 * task waiting on request_module() and deadlock.
-	 *
-	 * This deadlock is avoided by perfomring async_synchronize_full()
-	 * iff module init queued any async jobs.  This isn't a full
-	 * solution as it will deadlock the same if module loading from
-	 * async jobs nests more than once; however, due to the various
-	 * constraints, this hack seems to be the best option for now.
-	 * Please refer to the following thread for details.
 	 *
-	 * http://thread.gmane.org/gmane.linux.kernel/1420814
+	 * See commit 0fdff3ec6d87 ("async, kmod: warn on synchronous
+	 * request_module() from async workers") for more details.
 	 */
-	if (!mod->async_probe_requested && (current->flags & PF_USED_ASYNC))
+	if (!mod->async_probe_requested)
 		async_synchronize_full();
 	ftrace_free_mem(mod, mod->init_layout.base, mod->init_layout.base +

kernel/module_decompress.c+2−0

 	info->max_pages = info->used_pages = 0;
 }
+#ifdef CONFIG_SYSFS
 static ssize_t compression_show(struct kobject *kobj,
 				struct kobj_attribute *attr, char *buf)
 {
 	return 0;
 }
 late_initcall(module_decompress_sysfs_init);
+#endif

kernel/power/main.c+4−1

 					struct kobj_attribute *attr,
 					char *buf)
 {
-	return pm_wakeup_irq ? sprintf(buf, "%u\n", pm_wakeup_irq) : -ENODATA;
+	if (!pm_wakeup_irq())
+		return -ENODATA;
+	return sprintf(buf, "%u\n", pm_wakeup_irq());
 }
 power_attr_ro(pm_wakeup_irq);

kernel/power/process.c+1−1

@@ -134,7 +134,7 @@ int freeze_processes(void) · 133 unmodified lines
134	if (!pm_freezing)	134	if (!pm_freezing)
135	atomic_inc(&system_freezing_cnt);	135	atomic_inc(&system_freezing_cnt);
136		136
137	pm_wakeup_clear(true);	137	pm_wakeup_clear(0);
138	pr_info("Freezing user space processes ... ");	138	pr_info("Freezing user space processes ... ");
139	pm_freezing = true;	139	pm_freezing = true;
140	error = try_to_freeze_tasks(true);	140	error = try_to_freeze_tasks(true);

kernel/power/snapshot.c+7−14

  * Register a range of page frames the contents of which should not be saved
  * during hibernation (to be used in the early initialization code).
  */
-void __init __register_nosave_region(unsigned long start_pfn,
+void __init register_nosave_region(unsigned long start_pfn, unsigned long end_pfn)
-				     unsigned long end_pfn, int use_kmalloc)
 {
 	struct nosave_region *region;
 			goto Report;
 		}
 	}
-	if (use_kmalloc) {
+	/* This allocation cannot fail */
-		/* During init, this shouldn't fail */
+	region = memblock_alloc(sizeof(struct nosave_region),
-		region = kmalloc(sizeof(struct nosave_region), GFP_KERNEL);
+				SMP_CACHE_BYTES);
-		BUG_ON(!region);
+	if (!region)
-	} else {
+		panic("%s: Failed to allocate %zu bytes\n", __func__,
-		/* This allocation cannot fail */
+		      sizeof(struct nosave_region));
-		region = memblock_alloc(sizeof(struct nosave_region),
-					SMP_CACHE_BYTES);
-		if (!region)
-			panic("%s: Failed to allocate %zu bytes\n", __func__,
-			      sizeof(struct nosave_region));
-	}
 	region->start_pfn = start_pfn;
 	region->end_pfn = end_pfn;
 	list_add_tail(&region->list, &nosave_regions);

kernel/power/suspend.c+0−2

@@ -136,8 +136,6 @@ static void s2idle_loop(void) · 135 unmodified lines
136	break;	136	break;
137	}	137	}
138		138
139	pm_wakeup_clear(false);
140
141	s2idle_enter();	139	s2idle_enter();
142	}	140	}
143		141

kernel/power/wakelock.c+4−7

 {
 	struct rb_node *node;
 	struct wakelock *wl;
-	char *str = buf;
+	int len = 0;
-	char *end = buf + PAGE_SIZE;
 	mutex_lock(&wakelocks_lock);
 	for (node = rb_first(&wakelocks_tree); node; node = rb_next(node)) {
 		wl = rb_entry(node, struct wakelock, node);
 		if (wl->ws->active == show_active)
-			str += scnprintf(str, end - str, "%s ", wl->name);
+			len += sysfs_emit_at(buf, len, "%s ", wl->name);
 	}
-	if (str > buf)
-		str--;
-	str += scnprintf(str, end - str, "\n");
+	len += sysfs_emit_at(buf, len, "\n");
 	mutex_unlock(&wakelocks_lock);
-	return (str - buf);
+	return len;
 }
 #if CONFIG_PM_WAKELOCKS_LIMIT > 0

kernel/printk/sysctl.c+1−1

@@ -12,7 +12,7 @@ · 11 unmodified lines
12	static const int ten_thousand = 10000;	12	static const int ten_thousand = 10000;
13		13
14	static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,	14	static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
15	void __user buffer, size_t lenp, loff_t *ppos)	15	void buffer, size_t lenp, loff_t *ppos)
16	{	16	{
17	if (write && !capable(CAP_SYS_ADMIN))	17	if (write && !capable(CAP_SYS_ADMIN))
18	return -EPERM;	18	return -EPERM;

kernel/rcu/tasks.h+8−4

 	.call_func = call,								\
 	.rtpcpu = &rt_name ## __percpu,							\
 	.name = n,									\
-	.percpu_enqueue_shift = ilog2(CONFIG_NR_CPUS),					\
+	.percpu_enqueue_shift = ilog2(CONFIG_NR_CPUS) + 1,				\
 	.percpu_enqueue_lim = 1,							\
 	.percpu_dequeue_lim = 1,							\
 	.barrier_q_mutex = __MUTEX_INITIALIZER(rt_name.barrier_q_mutex),		\
 	int cpu;
 	unsigned long flags;
 	int lim;
+	int shift;
 	raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
 	if (rcu_task_enqueue_lim < 0) {
 	if (lim > nr_cpu_ids)
 		lim = nr_cpu_ids;
-	WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids / lim));
+	shift = ilog2(nr_cpu_ids / lim);
+	if (((nr_cpu_ids - 1) >> shift) >= lim)
+		shift++;
+	WRITE_ONCE(rtp->percpu_enqueue_shift, shift);
 	WRITE_ONCE(rtp->percpu_dequeue_lim, lim);
 	smp_store_release(&rtp->percpu_enqueue_lim, lim);
 	for_each_possible_cpu(cpu) {
 	if (unlikely(needadjust)) {
 		raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
 		if (rtp->percpu_enqueue_lim != nr_cpu_ids) {
-			WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids));
+			WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids) + 1);
 			WRITE_ONCE(rtp->percpu_dequeue_lim, nr_cpu_ids);
 			smp_store_release(&rtp->percpu_enqueue_lim, nr_cpu_ids);
 			pr_info("Switching %s to per-CPU callback queuing.\n", rtp->name);
 	if (rcu_task_cb_adjust && ncbs <= rcu_task_collapse_lim) {
 		raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
 		if (rtp->percpu_enqueue_lim > 1) {
-			WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids));
+			WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids) + 1);
 			smp_store_release(&rtp->percpu_enqueue_lim, 1);
 			rtp->percpu_dequeue_gpseq = get_state_synchronize_rcu();
 			pr_info("Starting switch %s to CPU-0 callback queuing.\n", rtp->name);

kernel/sched/core.c+20−18

 	init_entity_runnable_average(&p->se);
 #ifdef CONFIG_SCHED_INFO
 	if (likely(sched_info_on()))
 		memset(&p->sched_info, 0, sizeof(p->sched_info));
 	return 0;
 }
-void sched_post_fork(struct task_struct *p, struct kernel_clone_args *kargs)
+void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs)
 {
 	unsigned long flags;
-#ifdef CONFIG_CGROUP_SCHED
-	struct task_group *tg;
-#endif
+	/*
+	 * Because we're not yet on the pid-hash, p->pi_lock isn't strictly
+	 * required yet, but lockdep gets upset if rules are violated.
+	 */
 	raw_spin_lock_irqsave(&p->pi_lock, flags);
 #ifdef CONFIG_CGROUP_SCHED
-	tg = container_of(kargs->cset->subsys[cpu_cgrp_id],
+	if (1) {
-			  struct task_group, css);
+		struct task_group *tg;
-	p->sched_task_group = autogroup_task_group(p, tg);
+		tg = container_of(kargs->cset->subsys[cpu_cgrp_id],
+				  struct task_group, css);
+		tg = autogroup_task_group(p, tg);
+		p->sched_task_group = tg;
+	}
 #endif
 	rseq_migrate(p);
 	/*
 	if (p->sched_class->task_fork)
 		p->sched_class->task_fork(p);
 	raw_spin_unlock_irqrestore(&p->pi_lock, flags);
+}
+void sched_post_fork(struct task_struct *p)
+{
 	uclamp_post_fork(p);
 }
 	}
 	if (schedstat_enabled() && rq->core->core_forceidle_count) {
-		if (cookie)
+		rq->core->core_forceidle_start = rq_clock(rq->core);
-			rq->core->core_forceidle_start = rq_clock(rq->core);
 		rq->core->core_forceidle_occupation = occ;
 	}
 	if (spin_needbreak(lock) || resched) {
 		spin_unlock(lock);
-		if (resched)
+		if (!_cond_resched())
-			preempt_schedule_common();
-		else
 			cpu_relax();
 		ret = 1;
 		spin_lock(lock);
 	if (rwlock_needbreak(lock) || resched) {
 		read_unlock(lock);
-		if (resched)
+		if (!_cond_resched())
-			preempt_schedule_common();
-		else
 			cpu_relax();
 		ret = 1;
 		read_lock(lock);
 	if (rwlock_needbreak(lock) || resched) {
 		write_unlock(lock);
-		if (resched)
+		if (!_cond_resched())
-			preempt_schedule_common();
-		else
 			cpu_relax();
 		ret = 1;
 		write_lock(lock);

kernel/sched/core_sched.c+1−1

@@ -277,7 +277,7 @@ void __sched_core_account_forceidle(struct rq *rq) · 276 unmodified lines
277	rq_i = cpu_rq(i);	277	rq_i = cpu_rq(i);
278	p = rq_i->core_pick ?: rq_i->curr;	278	p = rq_i->core_pick ?: rq_i->curr;
279		279
280	if (!p->core_cookie)	280	if (p == rq_i->idle)
281	continue;	281	continue;
282		282
283	__schedstat_add(p->stats.core_forceidle_sum, delta);	283	__schedstat_add(p->stats.core_forceidle_sum, delta);

kernel/sched/fair.c+77−41

 static inline void
 dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
-	u32 divider = get_pelt_divider(&se->avg);
 	sub_positive(&cfs_rq->avg.load_avg, se->avg.load_avg);
-	cfs_rq->avg.load_sum = cfs_rq->avg.load_avg * divider;
+	sub_positive(&cfs_rq->avg.load_sum, se_weight(se) * se->avg.load_sum);
+	/* See update_cfs_rq_load_avg() */
+	cfs_rq->avg.load_sum = max_t(u32, cfs_rq->avg.load_sum,
+					  cfs_rq->avg.load_avg * PELT_MIN_DIVIDER);
 }
 #else
 static inline void
 	se->avg.last_update_time = n_last_update_time;
 }
 /*
  * When on migration a sched_entity joins/leaves the PELT hierarchy, we need to
  * propagate its contribution. The key to this propagation is the invariant
  * XXX: only do this for the part of runnable > running ?
  *
  */
 static inline void
 update_tg_cfs_util(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq *gcfs_rq)
 {
-	long delta = gcfs_rq->avg.util_avg - se->avg.util_avg;
+	long delta_sum, delta_avg = gcfs_rq->avg.util_avg - se->avg.util_avg;
-	u32 divider;
+	u32 new_sum, divider;
 	/* Nothing to update */
-	if (!delta)
+	if (!delta_avg)
 		return;
 	/*
 	 */
 	divider = get_pelt_divider(&cfs_rq->avg);
 	/* Set new sched_entity's utilization */
 	se->avg.util_avg = gcfs_rq->avg.util_avg;
-	se->avg.util_sum = se->avg.util_avg * divider;
+	new_sum = se->avg.util_avg * divider;
+	delta_sum = (long)new_sum - (long)se->avg.util_sum;
+	se->avg.util_sum = new_sum;
 	/* Update parent cfs_rq utilization */
-	add_positive(&cfs_rq->avg.util_avg, delta);
+	add_positive(&cfs_rq->avg.util_avg, delta_avg);
-	cfs_rq->avg.util_sum = cfs_rq->avg.util_avg * divider;
+	add_positive(&cfs_rq->avg.util_sum, delta_sum);
+	/* See update_cfs_rq_load_avg() */
+	cfs_rq->avg.util_sum = max_t(u32, cfs_rq->avg.util_sum,
+					  cfs_rq->avg.util_avg * PELT_MIN_DIVIDER);
 }
 static inline void
 update_tg_cfs_runnable(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq *gcfs_rq)
 {
-	long delta = gcfs_rq->avg.runnable_avg - se->avg.runnable_avg;
+	long delta_sum, delta_avg = gcfs_rq->avg.runnable_avg - se->avg.runnable_avg;
-	u32 divider;
+	u32 new_sum, divider;
 	/* Nothing to update */
-	if (!delta)
+	if (!delta_avg)
 		return;
 	/*
 	/* Set new sched_entity's runnable */
 	se->avg.runnable_avg = gcfs_rq->avg.runnable_avg;
-	se->avg.runnable_sum = se->avg.runnable_avg * divider;
+	new_sum = se->avg.runnable_avg * divider;
+	delta_sum = (long)new_sum - (long)se->avg.runnable_sum;
+	se->avg.runnable_sum = new_sum;
 	/* Update parent cfs_rq runnable */
-	add_positive(&cfs_rq->avg.runnable_avg, delta);
+	add_positive(&cfs_rq->avg.runnable_avg, delta_avg);
-	cfs_rq->avg.runnable_sum = cfs_rq->avg.runnable_avg * divider;
+	add_positive(&cfs_rq->avg.runnable_sum, delta_sum);
+	/* See update_cfs_rq_load_avg() */
+	cfs_rq->avg.runnable_sum = max_t(u32, cfs_rq->avg.runnable_sum,
+					      cfs_rq->avg.runnable_avg * PELT_MIN_DIVIDER);
 }
 static inline void
 update_tg_cfs_load(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq *gcfs_rq)
 {
-	long delta, running_sum, runnable_sum = gcfs_rq->prop_runnable_sum;
+	long delta_avg, running_sum, runnable_sum = gcfs_rq->prop_runnable_sum;
 	unsigned long load_avg;
 	u64 load_sum = 0;
+	s64 delta_sum;
 	u32 divider;
 	if (!runnable_sum)
 		 * assuming all tasks are equally runnable.
 		 */
 		if (scale_load_down(gcfs_rq->load.weight)) {
-			load_sum = div_s64(gcfs_rq->avg.load_sum,
+			load_sum = div_u64(gcfs_rq->avg.load_sum,
 				scale_load_down(gcfs_rq->load.weight));
 		}
 	running_sum = se->avg.util_sum >> SCHED_CAPACITY_SHIFT;
 	runnable_sum = max(runnable_sum, running_sum);
-	load_sum = (s64)se_weight(se) * runnable_sum;
+	load_sum = se_weight(se) * runnable_sum;
-	load_avg = div_s64(load_sum, divider);
+	load_avg = div_u64(load_sum, divider);
-	se->avg.load_sum = runnable_sum;
-	delta = load_avg - se->avg.load_avg;
+	delta_avg = load_avg - se->avg.load_avg;
-	if (!delta)
+	if (!delta_avg)
 		return;
-	se->avg.load_avg = load_avg;
+	delta_sum = load_sum - (s64)se_weight(se) * se->avg.load_sum;
-	add_positive(&cfs_rq->avg.load_avg, delta);
+	se->avg.load_sum = runnable_sum;
-	cfs_rq->avg.load_sum = cfs_rq->avg.load_avg * divider;
+	se->avg.load_avg = load_avg;
+	add_positive(&cfs_rq->avg.load_avg, delta_avg);
+	add_positive(&cfs_rq->avg.load_sum, delta_sum);
+	/* See update_cfs_rq_load_avg() */
+	cfs_rq->avg.load_sum = max_t(u32, cfs_rq->avg.load_sum,
+					  cfs_rq->avg.load_avg * PELT_MIN_DIVIDER);
 }
 static inline void add_tg_cfs_propagate(struct cfs_rq *cfs_rq, long runnable_sum)
  *
  * cfs_rq->avg is used for task_h_load() and update_cfs_share() for example.
  *
- * Returns true if the load decayed or we removed load.
+ * Return: true if the load decayed or we removed load.
  *
  * Since both these conditions indicate a changed cfs_rq->avg.load we should
  * call update_tg_load_avg() when this function returns true.
 		r = removed_load;
 		sub_positive(&sa->load_avg, r);
-		sa->load_sum = sa->load_avg * divider;
+		sub_positive(&sa->load_sum, r * divider);
+		/* See sa->util_sum below */
+		sa->load_sum = max_t(u32, sa->load_sum, sa->load_avg * PELT_MIN_DIVIDER);
 		r = removed_util;
 		sub_positive(&sa->util_avg, r);
-		sa->util_sum = sa->util_avg * divider;
+		sub_positive(&sa->util_sum, r * divider);
+		/*
+		 * Because of rounding, se->util_sum might ends up being +1 more than
+		 * cfs->util_sum. Although this is not a problem by itself, detaching
+		 * a lot of tasks with the rounding problem between 2 updates of
+		 * util_avg (~1ms) can make cfs->util_sum becoming null whereas
+		 * cfs_util_avg is not.
+		 * Check that util_sum is still above its lower bound for the new
+		 * util_avg. Given that period_contrib might have moved since the last
+		 * sync, we are only sure that util_sum must be above or equal to
+		 *    util_avg * minimum possible divider
+		 */
+		sa->util_sum = max_t(u32, sa->util_sum, sa->util_avg * PELT_MIN_DIVIDER);
 		r = removed_runnable;
 		sub_positive(&sa->runnable_avg, r);
-		sa->runnable_sum = sa->runnable_avg * divider;
+		sub_positive(&sa->runnable_sum, r * divider);
+		/* See sa->util_sum above */
+		sa->runnable_sum = max_t(u32, sa->runnable_sum,
+					      sa->runnable_avg * PELT_MIN_DIVIDER);
 		/*
 		 * removed_runnable is the unweighted version of removed_load so we
  */
 static void detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
-	/*
-	 * cfs_rq->avg.period_contrib can be used for both cfs_rq and se.
-	 * See ___update_load_avg() for details.
-	 */
-	u32 divider = get_pelt_divider(&cfs_rq->avg);
 	dequeue_load_avg(cfs_rq, se);
 	sub_positive(&cfs_rq->avg.util_avg, se->avg.util_avg);
-	cfs_rq->avg.util_sum = cfs_rq->avg.util_avg * divider;
+	sub_positive(&cfs_rq->avg.util_sum, se->avg.util_sum);
+	/* See update_cfs_rq_load_avg() */
+	cfs_rq->avg.util_sum = max_t(u32, cfs_rq->avg.util_sum,
+					  cfs_rq->avg.util_avg * PELT_MIN_DIVIDER);
 	sub_positive(&cfs_rq->avg.runnable_avg, se->avg.runnable_avg);
-	cfs_rq->avg.runnable_sum = cfs_rq->avg.runnable_avg * divider;
+	sub_positive(&cfs_rq->avg.runnable_sum, se->avg.runnable_sum);
+	/* See update_cfs_rq_load_avg() */
+	cfs_rq->avg.runnable_sum = max_t(u32, cfs_rq->avg.runnable_sum,
+					      cfs_rq->avg.runnable_avg * PELT_MIN_DIVIDER);
 	add_tg_cfs_propagate(cfs_rq, -se->avg.load_sum);
  *
  * If @sg does not have SMT siblings, only pull tasks if all of the SMT siblings
  * of @dst_cpu are idle and @sg has lower priority.
+ *
+ * Return: true if @dst_cpu can pull tasks, false otherwise.
  */
 static bool asym_smt_can_pull_tasks(int dst_cpu, struct sd_lb_stats *sds,
 				    struct sg_lb_stats *sgs,
 /**
  * update_sg_lb_stats - Update sched_group's statistics for load balancing.
  * @env: The load balancing environment.
+ * @sds: Load-balancing data with statistics of the local group.
  * @group: sched_group whose statistics are to be updated.
  * @sgs: variable to hold the statistics for this group.
  * @sg_status: Holds flag indicating the status of the sched_group
 /**
  * find_busiest_group - Returns the busiest group within the sched_domain
  * if there is an imbalance.
+ * @env: The load balancing environment.
  *
  * Also calculates the amount of runnable load which should be moved
  * to restore balance.
  *
- * @env: The load balancing environment.
- *
  * Return:	- The busiest group if imbalance exists.
  */
 static struct sched_group *find_busiest_group(struct lb_env *env)

kernel/sched/membarrier.c+5−4

 #endif
 #ifdef CONFIG_RSEQ
-#define MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK		\
+#define MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK		\
 	(MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ			\
-	| MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ_BITMASK)
+	| MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ)
 #else
-#define MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK	0
+#define MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK	0
 #endif
 #define MEMBARRIER_CMD_BITMASK						\
 	| MEMBARRIER_CMD_REGISTER_GLOBAL_EXPEDITED			\
 	| MEMBARRIER_CMD_PRIVATE_EXPEDITED				\
 	| MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED			\
-	| MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK)
+	| MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK		\
+	| MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK)
 static void ipi_mb(void *info)
 {

kernel/sched/pelt.h+3−1

 }
 #endif
+#define PELT_MIN_DIVIDER	(LOAD_AVG_MAX - 1024)
 static inline u32 get_pelt_divider(struct sched_avg *avg)
 {
-	return LOAD_AVG_MAX - 1024 + avg->period_contrib;
+	return PELT_MIN_DIVIDER + avg->period_contrib;
 }
 static inline void cfs_se_util_change(struct sched_avg *avg)

kernel/sched/psi.c+29−37

@@ -1137,7 +1137,6 @@ struct psi_trigger psi_trigger_create(struct psi_group group, · 1136 unmodified lines
1137	t->event = 0;	1137	t->event = 0;
1138	t->last_event_time = 0;	1138	t->last_event_time = 0;
1139	init_waitqueue_head(&t->event_wait);	1139	init_waitqueue_head(&t->event_wait);
1140	kref_init(&t->refcount);
1141	t->pending_event = false;	1140	t->pending_event = false;
1142		1141
1143	mutex_lock(&group->trigger_lock);	1142	mutex_lock(&group->trigger_lock);
@@ -1167,15 +1166,19 @@ struct psi_trigger psi_trigger_create(struct psi_group group, · 23 unmodified lines
1167	return t;	1166	return t;
1168	}	1167	}
1169		1168
1170	static void psi_trigger_destroy(struct kref *ref)	1169	void psi_trigger_destroy(struct psi_trigger *t)
1171	{	1170	{
1172	struct psi_trigger *t = container_of(ref, struct psi_trigger, refcount);	1171	struct psi_group *group;
1173	struct psi_group *group = t->group;
1174	struct task_struct *task_to_destroy = NULL;	1172	struct task_struct *task_to_destroy = NULL;
1175		1173
1176	if (static_branch_likely(&psi_disabled))	1174	/*
		1175	* We do not check psi_disabled since it might have been disabled after
		1176	* the trigger got created.
		1177	*/
		1178	if (!t)
1177	return;	1179	return;
1178		1180
		1181	group = t->group;
1179	/*	1182	/*
1180	* Wakeup waiters to stop polling. Can happen if cgroup is deleted	1183	* Wakeup waiters to stop polling. Can happen if cgroup is deleted
1181	* from under a polling process.	1184	* from under a polling process.
@@ -1211,9 +1214,9 @@ static void psi_trigger_destroy(struct kref *ref) · 29 unmodified lines
1211	mutex_unlock(&group->trigger_lock);	1214	mutex_unlock(&group->trigger_lock);
1212		1215
1213	/*	1216	/*
1214	* Wait for both *trigger_ptr from psi_trigger_replace and	1217	* Wait for psi_schedule_poll_work RCU to complete its read-side
1215	* poll_task RCUs to complete their read-side critical sections	1218	* critical section before destroying the trigger and optionally the
1216	* before destroying the trigger and optionally the poll_task	1219	* poll_task.
1217	*/	1220	*/
1218	synchronize_rcu();	1221	synchronize_rcu();
1219	/*	1222	/*
@@ -1230,18 +1233,6 @@ static void psi_trigger_destroy(struct kref *ref) · 10 unmodified lines
1230	kfree(t);	1233	kfree(t);
1231	}	1234	}
1232		1235
1233	void psi_trigger_replace(void *trigger_ptr, struct psi_trigger new)
1234	{
1235	struct psi_trigger old = trigger_ptr;
1236
1237	if (static_branch_likely(&psi_disabled))
1238	return;
1239
1240	rcu_assign_pointer(*trigger_ptr, new);
1241	if (old)
1242	kref_put(&old->refcount, psi_trigger_destroy);
1243	}
1244
1245	__poll_t psi_trigger_poll(void **trigger_ptr,	1236	__poll_t psi_trigger_poll(void **trigger_ptr,
1246	struct file file, poll_table wait)	1237	struct file file, poll_table wait)
1247	{	1238	{
@@ -1251,24 +1242,15 @@ __poll_t psi_trigger_poll(void **trigger_ptr, · 3 unmodified lines
1251	if (static_branch_likely(&psi_disabled))	1242	if (static_branch_likely(&psi_disabled))
1252	return DEFAULT_POLLMASK \| EPOLLERR \| EPOLLPRI;	1243	return DEFAULT_POLLMASK \| EPOLLERR \| EPOLLPRI;
1253		1244
1254	rcu_read_lock();	1245	t = smp_load_acquire(trigger_ptr);
1255		1246	if (!t)
1256	t = rcu_dereference((void __rcu __force *)trigger_ptr);
1257	if (!t) {
1258	rcu_read_unlock();
1259	return DEFAULT_POLLMASK \| EPOLLERR \| EPOLLPRI;	1247	return DEFAULT_POLLMASK \| EPOLLERR \| EPOLLPRI;
1260	}
1261	kref_get(&t->refcount);
1262
1263	rcu_read_unlock();
1264		1248
1265	poll_wait(file, &t->event_wait, wait);	1249	poll_wait(file, &t->event_wait, wait);
1266		1250
1267	if (cmpxchg(&t->event, 1, 0) == 1)	1251	if (cmpxchg(&t->event, 1, 0) == 1)
1268	ret \|= EPOLLPRI;	1252	ret \|= EPOLLPRI;
1269		1253
1270	kref_put(&t->refcount, psi_trigger_destroy);
1271
1272	return ret;	1254	return ret;
1273	}	1255	}
1274		1256
@@ -1331,14 +1313,24 @@ static ssize_t psi_write(struct file file, const char __user user_buf, · 56 unmodified lines
1331		1313
1332	buf[buf_size - 1] = '\0';	1314	buf[buf_size - 1] = '\0';
1333		1315
1334	new = psi_trigger_create(&psi_system, buf, nbytes, res);
1335	if (IS_ERR(new))
1336	return PTR_ERR(new);
1337
1338	seq = file->private_data;	1316	seq = file->private_data;
		1317
1339	/* Take seq->lock to protect seq->private from concurrent writes */	1318	/* Take seq->lock to protect seq->private from concurrent writes */
1340	mutex_lock(&seq->lock);	1319	mutex_lock(&seq->lock);
1341	psi_trigger_replace(&seq->private, new);	1320
		1321	/* Allow only one trigger per file descriptor */
		1322	if (seq->private) {
		1323	mutex_unlock(&seq->lock);
		1324	return -EBUSY;
		1325	}
		1326
		1327	new = psi_trigger_create(&psi_system, buf, nbytes, res);
		1328	if (IS_ERR(new)) {
		1329	mutex_unlock(&seq->lock);
		1330	return PTR_ERR(new);
		1331	}
		1332
		1333	smp_store_release(&seq->private, new);
1342	mutex_unlock(&seq->lock);	1334	mutex_unlock(&seq->lock);
1343		1335
1344	return nbytes;	1336	return nbytes;
@@ -1373,7 +1365,7 @@ static int psi_fop_release(struct inode inode, struct file file) · 28 unmodified lines
1373	{	1365	{
1374	struct seq_file *seq = file->private_data;	1366	struct seq_file *seq = file->private_data;
1375		1367
1376	psi_trigger_replace(&seq->private, NULL);	1368	psi_trigger_destroy(seq->private);
1377	return single_release(inode, file);	1369	return single_release(inode, file);
1378	}	1370	}
1379		1371

kernel/seccomp.c+10−0

 #include <linux/syscalls.h>
 #include <linux/sysctl.h>
+/* Not exposed in headers: strictly internal use only. */
+#define SECCOMP_MODE_DEAD	(SECCOMP_MODE_FILTER + 1)
 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
 #include <asm/syscall.h>
 #endif
 #ifdef SECCOMP_DEBUG
 	dump_stack();
 #endif
+	current->seccomp.mode = SECCOMP_MODE_DEAD;
 	seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
 	do_exit(SIGKILL);
 }
 	case SECCOMP_RET_KILL_THREAD:
 	case SECCOMP_RET_KILL_PROCESS:
 	default:
+		current->seccomp.mode = SECCOMP_MODE_DEAD;
 		seccomp_log(this_syscall, SIGSYS, action, true);
 		/* Dump core only if this is the last remaining thread. */
 		if (action != SECCOMP_RET_KILL_THREAD ||
 		return 0;
 	case SECCOMP_MODE_FILTER:
 		return __seccomp_filter(this_syscall, sd, false);
+	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
+	case SECCOMP_MODE_DEAD:
+		WARN_ON_ONCE(1);
+		do_exit(SIGKILL);
+		return -1;
 	default:
 		BUG();
 	}

kernel/signal.c+3−2

 	}
 	/*
 	 * Don't clear SIGNAL_UNKILLABLE for traced tasks, users won't expect
-	 * debugging to leave init killable.
+	 * debugging to leave init killable. But HANDLER_EXIT is always fatal.
 	 */
-	if (action->sa.sa_handler == SIG_DFL && !t->ptrace)
+	if (action->sa.sa_handler == SIG_DFL &&
+	    (!t->ptrace || (handler == HANDLER_EXIT)))
 		t->signal->flags &= ~SIGNAL_UNKILLABLE;
 	ret = send_signal(sig, info, t, PIDTYPE_PID);
 	spin_unlock_irqrestore(&t->sighand->siglock, flags);

kernel/stackleak.c+2−3

 #define skip_erasing()	false
 #endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */
-asmlinkage void notrace stackleak_erase(void)
+asmlinkage void noinstr stackleak_erase(void)
 {
 	/* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */
 	unsigned long kstack_ptr = current->lowest_stack;
 	/* Reset the 'lowest_stack' value for the next syscall */
 	current->lowest_stack = current_top_of_stack() - THREAD_SIZE/64;
 }
-NOKPROBE_SYMBOL(stackleak_erase);
-void __used __no_caller_saved_registers notrace stackleak_track_stack(void)
+void __used __no_caller_saved_registers noinstr stackleak_track_stack(void)
 {
 	unsigned long sp = current_stack_pointer;

kernel/sys.c+14−6

 	if (!new_user)
 		return -EAGAIN;
+	free_uid(new->user);
+	new->user = new_user;
+	return 0;
+}
+static void flag_nproc_exceeded(struct cred *new)
+{
+	if (new->ucounts == current_ucounts())
+		return;
 	/*
 	 * We don't fail in case of NPROC limit excess here because too many
 	 * poorly written programs don't check set*uid() return code, assuming
 	 * failure to the execve() stage.
 	 */
 	if (is_ucounts_overlimit(new->ucounts, UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC)) &&
-			new_user != INIT_USER &&
+			new->user != INIT_USER)
-			!capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
 		current->flags |= PF_NPROC_EXCEEDED;
 	else
 		current->flags &= ~PF_NPROC_EXCEEDED;
-	free_uid(new->user);
-	new->user = new_user;
-	return 0;
 }
 /*
 	if (retval < 0)
 		goto error;
+	flag_nproc_exceeded(new);
 	return commit_creds(new);
 error:
 	if (retval < 0)
 		goto error;
+	flag_nproc_exceeded(new);
 	return commit_creds(new);
 error:
 	if (retval < 0)
 		goto error;
+	flag_nproc_exceeded(new);
 	return commit_creds(new);
 error:

kernel/trace/Kconfig+7−1

 	help
 	  C version of recordmcount available?
+config HAVE_BUILDTIME_MCOUNT_SORT
+       bool
+       help
+         An architecture selects this if it sorts the mcount_loc section
+	 at build time.
 config BUILDTIME_MCOUNT_SORT
        bool
        default y
-       depends on BUILDTIME_TABLE_SORT && !S390
+       depends on HAVE_BUILDTIME_MCOUNT_SORT && DYNAMIC_FTRACE
        help
          Sort the mcount_loc section at build time.

kernel/trace/trace.c+6−1

 static int __init set_tracepoint_printk(char *str)
 {
+	/* Ignore the "tp_printk_stop_on_boot" param */
+	if (*str == '_')
+		return 0;
 	if ((strcmp(str, "=0") != 0 && strcmp(str, "=off") != 0))
 		tracepoint_printk = 1;
 	return 1;
 		err = kzalloc(sizeof(*err), GFP_KERNEL);
 		if (!err)
 			err = ERR_PTR(-ENOMEM);
-		tr->n_err_log_entries++;
+		else
+			tr->n_err_log_entries++;
 		return err;
 	}

kernel/trace/trace_events_hist.c+8−2

 		(HIST_FIELD_FL_TIMESTAMP | HIST_FIELD_FL_TIMESTAMP_USECS);
 	expr->fn = hist_field_unary_minus;
 	expr->operands[0] = operand1;
+	expr->size = operand1->size;
+	expr->is_signed = operand1->is_signed;
 	expr->operator = FIELD_OP_UNARY_MINUS;
 	expr->name = expr_str(expr, 0);
 	expr->type = kstrdup_const(operand1->type, GFP_KERNEL);
 		/* The operand sizes should be the same, so just pick one */
 		expr->size = operand1->size;
+		expr->is_signed = operand1->is_signed;
 		expr->operator = field_op;
 		expr->type = kstrdup_const(operand1->type, GFP_KERNEL);
 			var_ref_idx = find_var_ref_idx(hist_data, var_ref);
 			if (WARN_ON(var_ref_idx < 0)) {
+				kfree(p);
 				ret = var_ref_idx;
 				goto err;
 			}
 	lockdep_assert_held(&event_mutex);
-	if (glob && strlen(glob)) {
+	WARN_ON(!glob);
+	if (strlen(glob)) {
 		hist_err_clear();
 		last_cmd_set(file, param);
 	}
 			continue;
 		}
 		break;
-	} while (p);
+	} while (1);
 	if (!p)
 		param = NULL;

kernel/ucount.c+4−1

 			kfree(new);
 		} else {
 			hlist_add_head(&new->node, hashent);
+			get_user_ns(new->ns);
 			spin_unlock_irq(&ucounts_lock);
 			return new;
 		}
 	if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
 		hlist_del_init(&ucounts->node);
 		spin_unlock_irqrestore(&ucounts_lock, flags);
+		put_user_ns(ucounts->ns);
 		kfree(ucounts);
 	}
 }
 	if (rlimit > LONG_MAX)
 		max = LONG_MAX;
 	for (iter = ucounts; iter; iter = iter->ns->ucounts) {
-		if (get_ucounts_value(iter, type) > max)
+		long val = get_ucounts_value(iter, type);
+		if (val < 0 || val > max)
 			return true;
 		max = READ_ONCE(iter->ns->ucount_max[type]);
 	}