lael-labs/linux

kernel/async.c+0−3

@@ -205,9 +205,6 @@ async_cookie_t async_schedule_node_domain(async_func_t func, void *data, · 204 unmodified lines
205	atomic_inc(&entry_count);	205	atomic_inc(&entry_count);
206	spin_unlock_irqrestore(&async_lock, flags);	206	spin_unlock_irqrestore(&async_lock, flags);
207		207
208	/* mark that this task has queued an async job, used by module init */
209	current->flags \|= PF_USED_ASYNC;
210
211	/* schedule for execution */	208	/* schedule for execution */
212	queue_work_node(node, system_unbound_wq, &entry->work);	209	queue_work_node(node, system_unbound_wq, &entry->work);
213		210

kernel/audit.c+43−19

@@ -541,20 +541,22 @@ static void kauditd_printk_skb(struct sk_buff *skb) · 540 unmodified lines
541	/**	541	/**
542	* kauditd_rehold_skb - Handle a audit record send failure in the hold queue	542	* kauditd_rehold_skb - Handle a audit record send failure in the hold queue
543	* @skb: audit record	543	* @skb: audit record
		544	* @error: error code (unused)
544	*	545	*
545	* Description:	546	* Description:
546	* This should only be used by the kauditd_thread when it fails to flush the	547	* This should only be used by the kauditd_thread when it fails to flush the
547	* hold queue.	548	* hold queue.
548	*/	549	*/
549	static void kauditd_rehold_skb(struct sk_buff *skb)	550	static void kauditd_rehold_skb(struct sk_buff *skb, __always_unused int error)
550	{	551	{
551	/* put the record back in the queue at the same place */	552	/* put the record back in the queue */
552	skb_queue_head(&audit_hold_queue, skb);	553	skb_queue_tail(&audit_hold_queue, skb);
553	}	554	}
554		555
555	/**	556	/**
556	* kauditd_hold_skb - Queue an audit record, waiting for auditd	557	* kauditd_hold_skb - Queue an audit record, waiting for auditd
557	* @skb: audit record	558	* @skb: audit record
		559	* @error: error code
558	*	560	*
559	* Description:	561	* Description:
560	* Queue the audit record, waiting for an instance of auditd. When this	562	* Queue the audit record, waiting for an instance of auditd. When this
@@ -564,19 +566,31 @@ static void kauditd_rehold_skb(struct sk_buff *skb) · 3 unmodified lines
564	* and queue it, if we have room. If we want to hold on to the record, but we	566	* and queue it, if we have room. If we want to hold on to the record, but we
565	* don't have room, record a record lost message.	567	* don't have room, record a record lost message.
566	*/	568	*/
567	static void kauditd_hold_skb(struct sk_buff *skb)	569	static void kauditd_hold_skb(struct sk_buff *skb, int error)
568	{	570	{
569	/* at this point it is uncertain if we will ever send this to auditd so	571	/* at this point it is uncertain if we will ever send this to auditd so
570	* try to send the message via printk before we go any further */	572	* try to send the message via printk before we go any further */
571	kauditd_printk_skb(skb);	573	kauditd_printk_skb(skb);
572		574
573	/* can we just silently drop the message? */	575	/* can we just silently drop the message? */
574	if (!audit_default) {	576	if (!audit_default)
575	kfree_skb(skb);	577	goto drop;
576	return;	578
		579	/* the hold queue is only for when the daemon goes away completely,
		580	* not -EAGAIN failures; if we are in a -EAGAIN state requeue the
		581	* record on the retry queue unless it's full, in which case drop it
		582	*/
		583	if (error == -EAGAIN) {
		584	if (!audit_backlog_limit \|\|
		585	skb_queue_len(&audit_retry_queue) < audit_backlog_limit) {
		586	skb_queue_tail(&audit_retry_queue, skb);
		587	return;
		588	}
		589	audit_log_lost("kauditd retry queue overflow");
		590	goto drop;
577	}	591	}
578		592
579	/* if we have room, queue the message */	593	/* if we have room in the hold queue, queue the message */
580	if (!audit_backlog_limit \|\|	594	if (!audit_backlog_limit \|\|
581	skb_queue_len(&audit_hold_queue) < audit_backlog_limit) {	595	skb_queue_len(&audit_hold_queue) < audit_backlog_limit) {
582	skb_queue_tail(&audit_hold_queue, skb);	596	skb_queue_tail(&audit_hold_queue, skb);
@@ -585,24 +599,32 @@ static void kauditd_hold_skb(struct sk_buff *skb) · 2 unmodified lines
585		599
586	/* we have no other options - drop the message */	600	/* we have no other options - drop the message */
587	audit_log_lost("kauditd hold queue overflow");	601	audit_log_lost("kauditd hold queue overflow");
		602	drop:
588	kfree_skb(skb);	603	kfree_skb(skb);
589	}	604	}
590		605
591	/**	606	/**
592	* kauditd_retry_skb - Queue an audit record, attempt to send again to auditd	607	* kauditd_retry_skb - Queue an audit record, attempt to send again to auditd
593	* @skb: audit record	608	* @skb: audit record
		609	* @error: error code (unused)
594	*	610	*
595	* Description:	611	* Description:
596	* Not as serious as kauditd_hold_skb() as we still have a connected auditd,	612	* Not as serious as kauditd_hold_skb() as we still have a connected auditd,
597	* but for some reason we are having problems sending it audit records so	613	* but for some reason we are having problems sending it audit records so
598	* queue the given record and attempt to resend.	614	* queue the given record and attempt to resend.
599	*/	615	*/
600	static void kauditd_retry_skb(struct sk_buff *skb)	616	static void kauditd_retry_skb(struct sk_buff *skb, __always_unused int error)
601	{	617	{
602	/* NOTE: because records should only live in the retry queue for a	618	if (!audit_backlog_limit \|\|
603	* short period of time, before either being sent or moved to the hold	619	skb_queue_len(&audit_retry_queue) < audit_backlog_limit) {
604	* queue, we don't currently enforce a limit on this queue */	620	skb_queue_tail(&audit_retry_queue, skb);
605	skb_queue_tail(&audit_retry_queue, skb);	621	return;
		622	}
		623
		624	/* we have to drop the record, send it via printk as a last effort */
		625	kauditd_printk_skb(skb);
		626	audit_log_lost("kauditd retry queue overflow");
		627	kfree_skb(skb);
606	}	628	}
607		629
608	/**	630	/**
@@ -640,7 +662,7 @@ static void auditd_reset(const struct auditd_connection *ac) · 31 unmodified lines
640	/* flush the retry queue to the hold queue, but don't touch the main	662	/* flush the retry queue to the hold queue, but don't touch the main
641	* queue since we need to process that normally for multicast */	663	* queue since we need to process that normally for multicast */
642	while ((skb = skb_dequeue(&audit_retry_queue)))	664	while ((skb = skb_dequeue(&audit_retry_queue)))
643	kauditd_hold_skb(skb);	665	kauditd_hold_skb(skb, -ECONNREFUSED);
644	}	666	}
645		667
646	/**	668	/**
@@ -714,16 +736,18 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, · 67 unmodified lines
714	struct sk_buff_head *queue,	736	struct sk_buff_head *queue,
715	unsigned int retry_limit,	737	unsigned int retry_limit,
716	void (skb_hook)(struct sk_buff skb),	738	void (skb_hook)(struct sk_buff skb),
717	void (err_hook)(struct sk_buff skb))	739	void (err_hook)(struct sk_buff skb, int error))
718	{	740	{
719	int rc = 0;	741	int rc = 0;
720	struct sk_buff *skb;	742	struct sk_buff *skb = NULL;
		743	struct sk_buff *skb_tail;
721	unsigned int failed = 0;	744	unsigned int failed = 0;
722		745
723	/* NOTE: kauditd_thread takes care of all our locking, we just use	746	/* NOTE: kauditd_thread takes care of all our locking, we just use
724	* the netlink info passed to us (e.g. sk and portid) */	747	* the netlink info passed to us (e.g. sk and portid) */
725		748
726	while ((skb = skb_dequeue(queue))) {	749	skb_tail = skb_peek_tail(queue);
		750	while ((skb != skb_tail) && (skb = skb_dequeue(queue))) {
727	/* call the skb_hook for each skb we touch */	751	/* call the skb_hook for each skb we touch */
728	if (skb_hook)	752	if (skb_hook)
729	(*skb_hook)(skb);	753	(*skb_hook)(skb);
@@ -731,7 +755,7 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, · 1 unmodified line
731	/* can we send to anyone via unicast? */	755	/* can we send to anyone via unicast? */
732	if (!sk) {	756	if (!sk) {
733	if (err_hook)	757	if (err_hook)
734	(*err_hook)(skb);	758	(*err_hook)(skb, -ECONNREFUSED);
735	continue;	759	continue;
736	}	760	}
737		761
@@ -745,7 +769,7 @@ retry: · 7 unmodified lines
745	rc == -ECONNREFUSED \|\| rc == -EPERM) {	769	rc == -ECONNREFUSED \|\| rc == -EPERM) {
746	sk = NULL;	770	sk = NULL;
747	if (err_hook)	771	if (err_hook)
748	(*err_hook)(skb);	772	(*err_hook)(skb, rc);
749	if (rc == -EAGAIN)	773	if (rc == -EAGAIN)
750	rc = 0;	774	rc = 0;
751	/* continue to drain the queue */	775	/* continue to drain the queue */

kernel/bpf/bpf_lsm.c+1−1

@@ -207,7 +207,7 @@ BTF_ID(func, bpf_lsm_socket_socketpair) · 206 unmodified lines
207		207
208	BTF_ID(func, bpf_lsm_syslog)	208	BTF_ID(func, bpf_lsm_syslog)
209	BTF_ID(func, bpf_lsm_task_alloc)	209	BTF_ID(func, bpf_lsm_task_alloc)
210	BTF_ID(func, bpf_lsm_task_getsecid_subj)	210	BTF_ID(func, bpf_lsm_current_getsecid_subj)
211	BTF_ID(func, bpf_lsm_task_getsecid_obj)	211	BTF_ID(func, bpf_lsm_task_getsecid_obj)
212	BTF_ID(func, bpf_lsm_task_prctl)	212	BTF_ID(func, bpf_lsm_task_prctl)
213	BTF_ID(func, bpf_lsm_task_setscheduler)	213	BTF_ID(func, bpf_lsm_task_setscheduler)

kernel/bpf/ringbuf.c+1−1

@@ -104,7 +104,7 @@ static struct bpf_ringbuf *bpf_ringbuf_area_alloc(size_t data_sz, int numa_node) · 103 unmodified lines
104	}	104	}
105		105
106	rb = vmap(pages, nr_meta_pages + 2 * nr_data_pages,	106	rb = vmap(pages, nr_meta_pages + 2 * nr_data_pages,
107	VM_ALLOC \| VM_USERMAP, PAGE_KERNEL);	107	VM_MAP \| VM_USERMAP, PAGE_KERNEL);
108	if (rb) {	108	if (rb) {
109	kmemleak_not_leak(pages);	109	kmemleak_not_leak(pages);
110	rb->pages = pages;	110	rb->pages = pages;

kernel/bpf/trampoline.c+3−2

 static void notrace inc_misses_counter(struct bpf_prog *prog)
 {
 	struct bpf_prog_stats *stats;
+	unsigned int flags;
 	stats = this_cpu_ptr(prog->stats);
-	u64_stats_update_begin(&stats->syncp);
+	flags = u64_stats_update_begin_irqsave(&stats->syncp);
 	u64_stats_inc(&stats->misses);
-	u64_stats_update_end(&stats->syncp);
+	u64_stats_update_end_irqrestore(&stats->syncp, flags);
 }
 /* The logic is similar to bpf_prog_run(), but with an explicit

kernel/cgroup/cgroup-v1.c+14−0

@@ -549,6 +549,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, · 548 unmodified lines
549		549
550	BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);	550	BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
551		551
		552	/*
		553	* Release agent gets called with all capabilities,
		554	* require capabilities to set release agent.
		555	*/
		556	if ((of->file->f_cred->user_ns != &init_user_ns) \|\|
		557	!capable(CAP_SYS_ADMIN))
		558	return -EPERM;
		559
552	cgrp = cgroup_kn_lock_live(of->kn, false);	560	cgrp = cgroup_kn_lock_live(of->kn, false);
553	if (!cgrp)	561	if (!cgrp)
554	return -ENODEV;	562	return -ENODEV;
@@ -954,6 +962,12 @@ int cgroup1_parse_param(struct fs_context fc, struct fs_parameter param) · 399 unmodified lines
954	/* Specifying two release agents is forbidden */	962	/* Specifying two release agents is forbidden */
955	if (ctx->release_agent)	963	if (ctx->release_agent)
956	return invalfc(fc, "release_agent respecified");	964	return invalfc(fc, "release_agent respecified");
		965	/*
		966	* Release agent gets called with all capabilities,
		967	* require capabilities to set release agent.
		968	*/
		969	if ((fc->user_ns != &init_user_ns) \|\| !capable(CAP_SYS_ADMIN))
		970	return invalfc(fc, "Setting release_agent not allowed");
957	ctx->release_agent = param->string;	971	ctx->release_agent = param->string;
958	param->string = NULL;	972	param->string = NULL;
959	break;	973	break;

kernel/cgroup/cpuset.c+51−14

 	kfree(cs);
 }
+/*
+ * validate_change_legacy() - Validate conditions specific to legacy (v1)
+ *                            behavior.
+ */
+static int validate_change_legacy(struct cpuset *cur, struct cpuset *trial)
+{
+	struct cgroup_subsys_state *css;
+	struct cpuset *c, *par;
+	int ret;
+	WARN_ON_ONCE(!rcu_read_lock_held());
+	/* Each of our child cpusets must be a subset of us */
+	ret = -EBUSY;
+	cpuset_for_each_child(c, css, cur)
+		if (!is_cpuset_subset(c, trial))
+			goto out;
+	/* On legacy hierarchy, we must be a subset of our parent cpuset. */
+	ret = -EACCES;
+	par = parent_cs(cur);
+	if (par && !is_cpuset_subset(trial, par))
+		goto out;
+	ret = 0;
+out:
+	return ret;
+}
 /*
  * validate_change() - Used to validate that any proposed cpuset change
  *		       follows the structural rules for cpusets.
 {
 	struct cgroup_subsys_state *css;
 	struct cpuset *c, *par;
-	int ret;
+	int ret = 0;
-	/* The checks don't apply to root cpuset */
-	if (cur == &top_cpuset)
-		return 0;
 	rcu_read_lock();
-	par = parent_cs(cur);
-	/* On legacy hierarchy, we must be a subset of our parent cpuset. */
+	if (!is_in_v2_mode())
-	ret = -EACCES;
+		ret = validate_change_legacy(cur, trial);
-	if (!is_in_v2_mode() && !is_cpuset_subset(trial, par))
+	if (ret)
+		goto out;
+	/* Remaining checks don't apply to root cpuset */
+	if (cur == &top_cpuset)
 		goto out;
+	par = parent_cs(cur);
 	/*
 	 * If either I or some sibling (!= me) is exclusive, we can't
 	 * overlap
  *
  * Because of the implicit cpu exclusive nature of a partition root,
  * cpumask changes that violates the cpu exclusivity rule will not be
- * permitted when checked by validate_change(). The validate_change()
+ * permitted when checked by validate_change().
- * function will also prevent any changes to the cpu list if it is not
- * a superset of children's cpu lists.
  */
 static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 					  struct cpumask *newmask,
 	struct cpuset *sibling;
 	struct cgroup_subsys_state *pos_css;
+	percpu_rwsem_assert_held(&cpuset_rwsem);
 	/*
 	 * Check all its siblings and call update_cpumasks_hier()
 	 * if their use_parent_ecpus flag is set in order for them
 	 * to use the right effective_cpus value.
+	 *
+	 * The update_cpumasks_hier() function may sleep. So we have to
+	 * release the RCU read lock before calling it.
 	 */
 	rcu_read_lock();
 	cpuset_for_each_child(sibling, pos_css, parent) {
 			continue;
 		if (!sibling->use_parent_ecpus)
 			continue;
+		if (!css_tryget_online(&sibling->css))
+			continue;
+		rcu_read_unlock();
 		update_cpumasks_hier(sibling, tmp);
+		rcu_read_lock();
+		css_put(&sibling->css);
 	}
 	rcu_read_unlock();
 }
 	 * Make sure that subparts_cpus is a subset of cpus_allowed.
 	 */
 	if (cs->nr_subparts_cpus) {
-		cpumask_andnot(cs->subparts_cpus, cs->subparts_cpus,
+		cpumask_and(cs->subparts_cpus, cs->subparts_cpus, cs->cpus_allowed);
-			       cs->cpus_allowed);
 		cs->nr_subparts_cpus = cpumask_weight(cs->subparts_cpus);
 	}
 	spin_unlock_irq(&callback_lock);

kernel/events/core.c+19−4

 	 * event_function_call() user.
 	 */
 	raw_spin_lock_irq(&ctx->lock);
-	if (!ctx->is_active) {
+	/*
+	 * Cgroup events are per-cpu events, and must IPI because of
+	 * cgrp_cpuctx_list.
+	 */
+	if (!ctx->is_active && !is_cgroup_event(event)) {
 		__perf_remove_from_context(event, __get_cpu_context(ctx),
 					   ctx, (void *)flags);
 		raw_spin_unlock_irq(&ctx->lock);
 	 * perf_event_attr::disabled events will not run and can be initialized
 	 * without IPI. Except when this is the first event for the context, in
 	 * that case we need the magic of the IPI to set ctx->is_active.
+	 * Similarly, cgroup events for the context also needs the IPI to
+	 * manipulate the cgrp_cpuctx_list.
 	 *
 	 * The IOC_ENABLE that is sure to follow the creation of a disabled
 	 * event will issue the IPI and reprogram the hardware.
 	 */
-	if (__perf_effective_state(event) == PERF_EVENT_STATE_OFF && ctx->nr_events) {
+	if (__perf_effective_state(event) == PERF_EVENT_STATE_OFF &&
+	    ctx->nr_events && !is_cgroup_event(event)) {
 		raw_spin_lock_irq(&ctx->lock);
 		if (ctx->task == TASK_TOMBSTONE) {
 			raw_spin_unlock_irq(&ctx->lock);
 	struct perf_buffer *old_rb = NULL;
 	unsigned long flags;
+	WARN_ON_ONCE(event->parent);
 	if (event->rb) {
 		/*
 		 * Should be impossible, we set this when removing
 {
 	struct perf_buffer *rb;
+	if (event->parent)
+		event = event->parent;
 	rcu_read_lock();
 	rb = rcu_dereference(event->rb);
 	if (rb) {
 {
 	struct perf_buffer *rb;
+	if (event->parent)
+		event = event->parent;
 	rcu_read_lock();
 	rb = rcu_dereference(event->rb);
 	if (rb) {
 	if (WARN_ON_ONCE(READ_ONCE(sampler->oncpu) != smp_processor_id()))
 		goto out;
-	rb = ring_buffer_get(sampler->parent ? sampler->parent : sampler);
+	rb = ring_buffer_get(sampler);
 	if (!rb)
 		goto out;
 	if (WARN_ON_ONCE(!sampler || !data->aux_size))
 		return;
-	rb = ring_buffer_get(sampler->parent ? sampler->parent : sampler);
+	rb = ring_buffer_get(sampler);
 	if (!rb)
 		return;

kernel/module.c+5−20

 	}
 	freeinit->module_init = mod->init_layout.base;
-	/*
-	 * We want to find out whether @mod uses async during init.  Clear
-	 * PF_USED_ASYNC.  async_schedule*() will set it.
-	 */
-	current->flags &= ~PF_USED_ASYNC;
 	do_mod_ctors(mod);
 	/* Start the module */
 	if (mod->init != NULL)
 	/*
 	 * We need to finish all async code before the module init sequence
-	 * is done.  This has potential to deadlock.  For example, a newly
+	 * is done. This has potential to deadlock if synchronous module
-	 * detected block device can trigger request_module() of the
+	 * loading is requested from async (which is not allowed!).
-	 * default iosched from async probing task.  Once userland helper
-	 * reaches here, async_synchronize_full() will wait on the async
-	 * task waiting on request_module() and deadlock.
-	 *
-	 * This deadlock is avoided by perfomring async_synchronize_full()
-	 * iff module init queued any async jobs.  This isn't a full
-	 * solution as it will deadlock the same if module loading from
-	 * async jobs nests more than once; however, due to the various
-	 * constraints, this hack seems to be the best option for now.
-	 * Please refer to the following thread for details.
 	 *
-	 * http://thread.gmane.org/gmane.linux.kernel/1420814
+	 * See commit 0fdff3ec6d87 ("async, kmod: warn on synchronous
+	 * request_module() from async workers") for more details.
 	 */
-	if (!mod->async_probe_requested && (current->flags & PF_USED_ASYNC))
+	if (!mod->async_probe_requested)
 		async_synchronize_full();
 	ftrace_free_mem(mod, mod->init_layout.base, mod->init_layout.base +

kernel/power/snapshot.c+7−14

  * Register a range of page frames the contents of which should not be saved
  * during hibernation (to be used in the early initialization code).
  */
-void __init __register_nosave_region(unsigned long start_pfn,
+void __init register_nosave_region(unsigned long start_pfn, unsigned long end_pfn)
-				     unsigned long end_pfn, int use_kmalloc)
 {
 	struct nosave_region *region;
 			goto Report;
 		}
 	}
-	if (use_kmalloc) {
+	/* This allocation cannot fail */
-		/* During init, this shouldn't fail */
+	region = memblock_alloc(sizeof(struct nosave_region),
-		region = kmalloc(sizeof(struct nosave_region), GFP_KERNEL);
+				SMP_CACHE_BYTES);
-		BUG_ON(!region);
+	if (!region)
-	} else {
+		panic("%s: Failed to allocate %zu bytes\n", __func__,
-		/* This allocation cannot fail */
+		      sizeof(struct nosave_region));
-		region = memblock_alloc(sizeof(struct nosave_region),
-					SMP_CACHE_BYTES);
-		if (!region)
-			panic("%s: Failed to allocate %zu bytes\n", __func__,
-			      sizeof(struct nosave_region));
-	}
 	region->start_pfn = start_pfn;
 	region->end_pfn = end_pfn;
 	list_add_tail(&region->list, &nosave_regions);

kernel/power/wakelock.c+4−7

 {
 	struct rb_node *node;
 	struct wakelock *wl;
-	char *str = buf;
+	int len = 0;
-	char *end = buf + PAGE_SIZE;
 	mutex_lock(&wakelocks_lock);
 	for (node = rb_first(&wakelocks_tree); node; node = rb_next(node)) {
 		wl = rb_entry(node, struct wakelock, node);
 		if (wl->ws->active == show_active)
-			str += scnprintf(str, end - str, "%s ", wl->name);
+			len += sysfs_emit_at(buf, len, "%s ", wl->name);
 	}
-	if (str > buf)
-		str--;
-	str += scnprintf(str, end - str, "\n");
+	len += sysfs_emit_at(buf, len, "\n");
 	mutex_unlock(&wakelocks_lock);
-	return (str - buf);
+	return len;
 }
 #if CONFIG_PM_WAKELOCKS_LIMIT > 0

kernel/printk/sysctl.c+1−1

@@ -12,7 +12,7 @@ · 11 unmodified lines
12	static const int ten_thousand = 10000;	12	static const int ten_thousand = 10000;
13		13
14	static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,	14	static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
15	void __user buffer, size_t lenp, loff_t *ppos)	15	void buffer, size_t lenp, loff_t *ppos)
16	{	16	{
17	if (write && !capable(CAP_SYS_ADMIN))	17	if (write && !capable(CAP_SYS_ADMIN))
18	return -EPERM;	18	return -EPERM;

kernel/rcu/tasks.h+8−4

 	.call_func = call,								\
 	.rtpcpu = &rt_name ## __percpu,							\
 	.name = n,									\
-	.percpu_enqueue_shift = ilog2(CONFIG_NR_CPUS),					\
+	.percpu_enqueue_shift = ilog2(CONFIG_NR_CPUS) + 1,				\
 	.percpu_enqueue_lim = 1,							\
 	.percpu_dequeue_lim = 1,							\
 	.barrier_q_mutex = __MUTEX_INITIALIZER(rt_name.barrier_q_mutex),		\
 	int cpu;
 	unsigned long flags;
 	int lim;
+	int shift;
 	raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
 	if (rcu_task_enqueue_lim < 0) {
 	if (lim > nr_cpu_ids)
 		lim = nr_cpu_ids;
-	WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids / lim));
+	shift = ilog2(nr_cpu_ids / lim);
+	if (((nr_cpu_ids - 1) >> shift) >= lim)
+		shift++;
+	WRITE_ONCE(rtp->percpu_enqueue_shift, shift);
 	WRITE_ONCE(rtp->percpu_dequeue_lim, lim);
 	smp_store_release(&rtp->percpu_enqueue_lim, lim);
 	for_each_possible_cpu(cpu) {
 	if (unlikely(needadjust)) {
 		raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
 		if (rtp->percpu_enqueue_lim != nr_cpu_ids) {
-			WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids));
+			WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids) + 1);
 			WRITE_ONCE(rtp->percpu_dequeue_lim, nr_cpu_ids);
 			smp_store_release(&rtp->percpu_enqueue_lim, nr_cpu_ids);
 			pr_info("Switching %s to per-CPU callback queuing.\n", rtp->name);
 	if (rcu_task_cb_adjust && ncbs <= rcu_task_collapse_lim) {
 		raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags);
 		if (rtp->percpu_enqueue_lim > 1) {
-			WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids));
+			WRITE_ONCE(rtp->percpu_enqueue_shift, ilog2(nr_cpu_ids) + 1);
 			smp_store_release(&rtp->percpu_enqueue_lim, 1);
 			rtp->percpu_dequeue_gpseq = get_state_synchronize_rcu();
 			pr_info("Starting switch %s to CPU-0 callback queuing.\n", rtp->name);

kernel/sched/membarrier.c+5−4

 #endif
 #ifdef CONFIG_RSEQ
-#define MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK		\
+#define MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK		\
 	(MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ			\
-	| MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ_BITMASK)
+	| MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ)
 #else
-#define MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK	0
+#define MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK	0
 #endif
 #define MEMBARRIER_CMD_BITMASK						\
 	| MEMBARRIER_CMD_REGISTER_GLOBAL_EXPEDITED			\
 	| MEMBARRIER_CMD_PRIVATE_EXPEDITED				\
 	| MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED			\
-	| MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK)
+	| MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK		\
+	| MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK)
 static void ipi_mb(void *info)
 {

kernel/sched/psi.c+41−38

 	return 0;
 }
-static int psi_io_show(struct seq_file *m, void *v)
-{
-	return psi_show(m, &psi_system, PSI_IO);
-}
-static int psi_memory_show(struct seq_file *m, void *v)
-{
-	return psi_show(m, &psi_system, PSI_MEM);
-}
-static int psi_cpu_show(struct seq_file *m, void *v)
-{
-	return psi_show(m, &psi_system, PSI_CPU);
-}
-static int psi_open(struct file *file, int (*psi_show)(struct seq_file *, void *))
-{
-	if (file->f_mode & FMODE_WRITE && !capable(CAP_SYS_RESOURCE))
-		return -EPERM;
-	return single_open(file, psi_show, NULL);
-}
-static int psi_io_open(struct inode *inode, struct file *file)
-{
-	return psi_open(file, psi_io_show);
-}
-static int psi_memory_open(struct inode *inode, struct file *file)
-{
-	return psi_open(file, psi_memory_show);
-}
-static int psi_cpu_open(struct inode *inode, struct file *file)
-{
-	return psi_open(file, psi_cpu_show);
-}
 struct psi_trigger *psi_trigger_create(struct psi_group *group,
 			char *buf, size_t nbytes, enum psi_res res)
 {
 	return ret;
 }
+#ifdef CONFIG_PROC_FS
+static int psi_io_show(struct seq_file *m, void *v)
+{
+	return psi_show(m, &psi_system, PSI_IO);
+}
+static int psi_memory_show(struct seq_file *m, void *v)
+{
+	return psi_show(m, &psi_system, PSI_MEM);
+}
+static int psi_cpu_show(struct seq_file *m, void *v)
+{
+	return psi_show(m, &psi_system, PSI_CPU);
+}
+static int psi_open(struct file *file, int (*psi_show)(struct seq_file *, void *))
+{
+	if (file->f_mode & FMODE_WRITE && !capable(CAP_SYS_RESOURCE))
+		return -EPERM;
+	return single_open(file, psi_show, NULL);
+}
+static int psi_io_open(struct inode *inode, struct file *file)
+{
+	return psi_open(file, psi_io_show);
+}
+static int psi_memory_open(struct inode *inode, struct file *file)
+{
+	return psi_open(file, psi_memory_show);
+}
+static int psi_cpu_open(struct inode *inode, struct file *file)
+{
+	return psi_open(file, psi_cpu_show);
+}
 static ssize_t psi_write(struct file *file, const char __user *user_buf,
 			 size_t nbytes, enum psi_res res)
 {
 	return 0;
 }
 module_init(psi_proc_init);
+#endif /* CONFIG_PROC_FS */

kernel/stackleak.c+2−3

 #define skip_erasing()	false
 #endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */
-asmlinkage void notrace stackleak_erase(void)
+asmlinkage void noinstr stackleak_erase(void)
 {
 	/* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */
 	unsigned long kstack_ptr = current->lowest_stack;
 	/* Reset the 'lowest_stack' value for the next syscall */
 	current->lowest_stack = current_top_of_stack() - THREAD_SIZE/64;
 }
-NOKPROBE_SYMBOL(stackleak_erase);
-void __used __no_caller_saved_registers notrace stackleak_track_stack(void)
+void __used __no_caller_saved_registers noinstr stackleak_track_stack(void)
 {
 	unsigned long sp = current_stack_pointer;

kernel/trace/Kconfig+7−1

 	help
 	  C version of recordmcount available?
+config HAVE_BUILDTIME_MCOUNT_SORT
+       bool
+       help
+         An architecture selects this if it sorts the mcount_loc section
+	 at build time.
 config BUILDTIME_MCOUNT_SORT
        bool
        default y
-       depends on BUILDTIME_TABLE_SORT && !S390
+       depends on HAVE_BUILDTIME_MCOUNT_SORT && DYNAMIC_FTRACE
        help
          Sort the mcount_loc section at build time.

kernel/trace/trace.c+2−1

@@ -7740,7 +7740,8 @@ static struct tracing_log_err get_tracing_log_err(struct trace_array tr) · 7739 unmodified lines
7740	err = kzalloc(sizeof(*err), GFP_KERNEL);	7740	err = kzalloc(sizeof(*err), GFP_KERNEL);
7741	if (!err)	7741	if (!err)
7742	err = ERR_PTR(-ENOMEM);	7742	err = ERR_PTR(-ENOMEM);
7743	tr->n_err_log_entries++;	7743	else
		7744	tr->n_err_log_entries++;
7744		7745
7745	return err;	7746	return err;
7746	}	7747	}

kernel/trace/trace_events_hist.c+8−2

 		(HIST_FIELD_FL_TIMESTAMP | HIST_FIELD_FL_TIMESTAMP_USECS);
 	expr->fn = hist_field_unary_minus;
 	expr->operands[0] = operand1;
+	expr->size = operand1->size;
+	expr->is_signed = operand1->is_signed;
 	expr->operator = FIELD_OP_UNARY_MINUS;
 	expr->name = expr_str(expr, 0);
 	expr->type = kstrdup_const(operand1->type, GFP_KERNEL);
 		/* The operand sizes should be the same, so just pick one */
 		expr->size = operand1->size;
+		expr->is_signed = operand1->is_signed;
 		expr->operator = field_op;
 		expr->type = kstrdup_const(operand1->type, GFP_KERNEL);
 			var_ref_idx = find_var_ref_idx(hist_data, var_ref);
 			if (WARN_ON(var_ref_idx < 0)) {
+				kfree(p);
 				ret = var_ref_idx;
 				goto err;
 			}
 	lockdep_assert_held(&event_mutex);
-	if (glob && strlen(glob)) {
+	WARN_ON(!glob);
+	if (strlen(glob)) {
 		hist_err_clear();
 		last_cmd_set(file, param);
 	}
 			continue;
 		}
 		break;
-	} while (p);
+	} while (1);
 	if (!p)
 		param = NULL;

kernel/ucount.c+2−0

 			kfree(new);
 		} else {
 			hlist_add_head(&new->node, hashent);
+			get_user_ns(new->ns);
 			spin_unlock_irq(&ucounts_lock);
 			return new;
 		}
 	if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
 		hlist_del_init(&ucounts->node);
 		spin_unlock_irqrestore(&ucounts_lock, flags);
+		put_user_ns(ucounts->ns);
 		kfree(ucounts);
 	}
 }