lael-labs/linux

kernel/bpf/bpf_inode_storage.c+11−4

 	fd = *(int *)key;
 	f = fget_raw(fd);
-	if (!f || !inode_storage_ptr(f->f_inode))
+	if (!f)
+		return -EBADF;
+	if (!inode_storage_ptr(f->f_inode)) {
+		fput(f);
 		return -EBADF;
+	}
 	sdata = bpf_local_storage_update(f->f_inode,
 					 (struct bpf_local_storage_map *)map,
 	 * bpf_local_storage_update expects the owner to have a
 	 * valid storage pointer.
 	 */
-	if (!inode_storage_ptr(inode))
+	if (!inode || !inode_storage_ptr(inode))
 		return (unsigned long)NULL;
 	sdata = inode_storage_lookup(inode, map, true);
 	if (sdata)
 		return (unsigned long)sdata->data;
-	/* This helper must only called from where the inode is gurranteed
+	/* This helper must only called from where the inode is guaranteed
 	 * to have a refcount and cannot be freed.
 	 */
 	if (flags & BPF_LOCAL_STORAGE_GET_F_CREATE) {
 BPF_CALL_2(bpf_inode_storage_delete,
 	   struct bpf_map *, map, struct inode *, inode)
 {
-	/* This helper must only called from where the inode is gurranteed
+	if (!inode)
+		return -EINVAL;
+	/* This helper must only called from where the inode is guaranteed
 	 * to have a refcount and cannot be freed.
 	 */
 	return inode_storage_delete(inode, map);

kernel/bpf/bpf_lsm.c+12−0

 BTF_ID(func, bpf_lsm_file_lock)
 BTF_ID(func, bpf_lsm_file_open)
 BTF_ID(func, bpf_lsm_file_receive)
+#ifdef CONFIG_SECURITY_NETWORK
 BTF_ID(func, bpf_lsm_inet_conn_established)
+#endif /* CONFIG_SECURITY_NETWORK */
 BTF_ID(func, bpf_lsm_inode_create)
 BTF_ID(func, bpf_lsm_inode_free_security)
 BTF_ID(func, bpf_lsm_inode_getattr)
 BTF_ID(func, bpf_lsm_inode_unlink)
 BTF_ID(func, bpf_lsm_kernel_module_request)
 BTF_ID(func, bpf_lsm_kernfs_init_security)
+#ifdef CONFIG_KEYS
 BTF_ID(func, bpf_lsm_key_free)
+#endif /* CONFIG_KEYS */
 BTF_ID(func, bpf_lsm_mmap_file)
 BTF_ID(func, bpf_lsm_netlink_send)
 BTF_ID(func, bpf_lsm_path_notify)
 BTF_ID(func, bpf_lsm_sb_statfs)
 BTF_ID(func, bpf_lsm_sb_umount)
 BTF_ID(func, bpf_lsm_settime)
+#ifdef CONFIG_SECURITY_NETWORK
 BTF_ID(func, bpf_lsm_socket_accept)
 BTF_ID(func, bpf_lsm_socket_bind)
 BTF_ID(func, bpf_lsm_socket_connect)
 BTF_ID(func, bpf_lsm_socket_sendmsg)
 BTF_ID(func, bpf_lsm_socket_shutdown)
 BTF_ID(func, bpf_lsm_socket_socketpair)
+#endif /* CONFIG_SECURITY_NETWORK */
 BTF_ID(func, bpf_lsm_syslog)
 BTF_ID(func, bpf_lsm_task_alloc)
 BTF_ID(func, bpf_lsm_task_getsecid)

kernel/bpf/bpf_task_storage.c+4−1

 	 * bpf_local_storage_update expects the owner to have a
 	 * valid storage pointer.
 	 */
-	if (!task_storage_ptr(task))
+	if (!task || !task_storage_ptr(task))
 		return (unsigned long)NULL;
 	sdata = task_storage_lookup(task, map, true);
 BPF_CALL_2(bpf_task_storage_delete, struct bpf_map *, map, struct task_struct *,
 	   task)
 {
+	if (!task)
+		return -EINVAL;
 	/* This helper must only be called from places where the lifetime of the task
 	 * is guaranteed. Either by being refcounted or by being protected
 	 * by an RCU read-side critical section.

kernel/bpf/btf.c+1−1

@@ -4172,7 +4172,7 @@ static int btf_parse_hdr(struct btf_verifier_env *env) · 4171 unmodified lines
4172	return -ENOTSUPP;	4172	return -ENOTSUPP;
4173	}	4173	}
4174		4174
4175	if (btf_data_size == hdr->hdr_len) {	4175	if (!btf->base_btf && btf_data_size == hdr->hdr_len) {
4176	btf_verifier_log(env, "No data");	4176	btf_verifier_log(env, "No data");
4177	return -EINVAL;	4177	return -EINVAL;
4178	}	4178	}

kernel/bpf/cgroup.c+9−3

 		if (ctx.optlen != 0) {
 			*optlen = ctx.optlen;
 			*kernel_optval = ctx.optval;
+			/* export and don't free sockopt buf */
+			return 0;
 		}
 	}
 out:
-	if (ret)
+	sockopt_free_buf(&ctx);
-		sockopt_free_buf(&ctx);
 	return ret;
 }
 			goto out;
 		}
+		if (ctx.optlen < 0) {
+			ret = -EFAULT;
+			goto out;
+		}
 		if (copy_from_user(ctx.optval, optval,
 				   min(ctx.optlen, max_optlen)) != 0) {
 			ret = -EFAULT;
 		goto out;
 	}
-	if (ctx.optlen > max_optlen) {
+	if (ctx.optlen > max_optlen || ctx.optlen < 0) {
 		ret = -EFAULT;
 		goto out;
 	}

kernel/bpf/hashtab.c+1−0

@@ -152,6 +152,7 @@ static void htab_init_buckets(struct bpf_htab *htab) · 151 unmodified lines
152	lockdep_set_class(&htab->buckets[i].lock,	152	lockdep_set_class(&htab->buckets[i].lock,
153	&htab->lockdep_key);	153	&htab->lockdep_key);
154	}	154	}
		155	cond_resched();
155	}	156	}
156	}	157	}
157		158

kernel/bpf/helpers.c+1−1

@@ -108,7 +108,7 @@ BPF_CALL_2(bpf_map_peek_elem, struct bpf_map , map, void , value) · 107 unmodified lines
108	}	108	}
109		109
110	const struct bpf_func_proto bpf_map_peek_elem_proto = {	110	const struct bpf_func_proto bpf_map_peek_elem_proto = {
111	.func = bpf_map_pop_elem,	111	.func = bpf_map_peek_elem,
112	.gpl_only = false,	112	.gpl_only = false,
113	.ret_type = RET_INTEGER,	113	.ret_type = RET_INTEGER,
114	.arg1_type = ARG_CONST_MAP_PTR,	114	.arg1_type = ARG_CONST_MAP_PTR,

kernel/bpf/preload/Makefile+4−1

 LIBBPF_A = $(obj)/libbpf.a
 LIBBPF_OUT = $(abspath $(obj))
+# Although not in use by libbpf's Makefile, set $(O) so that the "dummy" test
+# in tools/scripts/Makefile.include always succeeds when building the kernel
+# with $(O) pointing to a relative path, as in "make O=build bindeb-pkg".
 $(LIBBPF_A):
-	$(Q)$(MAKE) -C $(LIBBPF_SRCS) OUTPUT=$(LIBBPF_OUT)/ $(LIBBPF_OUT)/libbpf.a
+	$(Q)$(MAKE) -C $(LIBBPF_SRCS) O=$(LIBBPF_OUT)/ OUTPUT=$(LIBBPF_OUT)/ $(LIBBPF_OUT)/libbpf.a
 userccflags += -I $(srctree)/tools/include/ -I $(srctree)/tools/include/uapi \
 	-I $(srctree)/tools/lib/ -Wno-unused-result

kernel/bpf/stackmap.c+2−0

@@ -115,6 +115,8 @@ static struct bpf_map stack_map_alloc(union bpf_attr attr) · 114 unmodified lines
115		115
116	/* hash table size must be power of 2 */	116	/* hash table size must be power of 2 */
117	n_buckets = roundup_pow_of_two(attr->max_entries);	117	n_buckets = roundup_pow_of_two(attr->max_entries);
		118	if (!n_buckets)
		119	return ERR_PTR(-E2BIG);
118		120
119	cost = n_buckets * sizeof(struct stack_map_bucket ) + sizeof(smap);	121	cost = n_buckets * sizeof(struct stack_map_bucket ) + sizeof(smap);
120	cost += n_buckets * (value_size + sizeof(struct stack_map_bucket));	122	cost += n_buckets * (value_size + sizeof(struct stack_map_bucket));

kernel/bpf/syscall.c+4−3

 #include <linux/fs.h>
 #include <linux/license.h>
 #include <linux/filter.h>
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/idr.h>
 #include <linux/cred.h>
 out_put_prog:
 	if (tgt_prog_fd && tgt_prog)
 		bpf_prog_put(tgt_prog);
-	bpf_prog_put(prog);
 	return err;
 }
 			tp_name = prog->aux->attach_func_name;
 			break;
 		}
-		return bpf_tracing_prog_attach(prog, 0, 0);
+		err = bpf_tracing_prog_attach(prog, 0, 0);
+		if (err >= 0)
+			return err;
+		goto out_put_prog;
 	case BPF_PROG_TYPE_RAW_TRACEPOINT:
 	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
 		if (strncpy_from_user(buf,

kernel/bpf/task_iter.c+9−8

@@ -37,7 +37,7 @@ retry: · 36 unmodified lines
37	if (!task) {	37	if (!task) {
38	++*tid;	38	++*tid;
39	goto retry;	39	goto retry;
40	} else if (skip_if_dup_files && task->tgid != task->pid &&	40	} else if (skip_if_dup_files && !thread_group_leader(task) &&
41	task->files == task->group_leader->files) {	41	task->files == task->group_leader->files) {
42	put_task_struct(task);	42	put_task_struct(task);
43	task = NULL;	43	task = NULL;
@@ -151,13 +151,14 @@ again: · 107 unmodified lines
151	curr_task = info->task;	151	curr_task = info->task;
152	curr_fd = info->fd;	152	curr_fd = info->fd;
153	} else {	153	} else {
154	curr_task = task_seq_get_next(ns, &curr_tid, true);	154	curr_task = task_seq_get_next(ns, &curr_tid, true);
155	if (!curr_task) {	155	if (!curr_task) {
156	info->task = NULL;	156	info->task = NULL;
157	return NULL;	157	info->tid = curr_tid;
158	}	158	return NULL;
159		159	}
160	/* set info->task and info->tid */	160
		161	/* set info->task and info->tid */
161	info->task = curr_task;	162	info->task = curr_task;
162	if (curr_tid == info->tid) {	163	if (curr_tid == info->tid) {
163	curr_fd = info->fd;	164	curr_fd = info->fd;

kernel/bpf/verifier.c+25−21

 	case PTR_TO_RDWR_BUF:
 	case PTR_TO_RDWR_BUF_OR_NULL:
 	case PTR_TO_PERCPU_BTF_ID:
+	case PTR_TO_MEM:
+	case PTR_TO_MEM_OR_NULL:
 		return true;
 	default:
 		return false;
 	return res < a;
 }
-static bool signed_add32_overflows(s64 a, s64 b)
+static bool signed_add32_overflows(s32 a, s32 b)
 {
 	/* Do the add in u32, where overflow is well-defined */
 	s32 res = (s32)((u32)a + (u32)b);
 	return res < a;
 }
-static bool signed_sub_overflows(s32 a, s32 b)
+static bool signed_sub_overflows(s64 a, s64 b)
 {
 	/* Do the sub in u64, where overflow is well-defined */
 	s64 res = (s64)((u64)a - (u64)b);
 static bool signed_sub32_overflows(s32 a, s32 b)
 {
-	/* Do the sub in u64, where overflow is well-defined */
+	/* Do the sub in u32, where overflow is well-defined */
 	s32 res = (s32)((u32)a - (u32)b);
 	if (b < 0)
 	case BPF_JSGT:
 		if (reg->s32_min_value > sval)
 			return 1;
-		else if (reg->s32_max_value < sval)
+		else if (reg->s32_max_value <= sval)
 			return 0;
 		break;
 	case BPF_JLT:
 	case BPF_JSGT:
 		if (reg->smin_value > sval)
 			return 1;
-		else if (reg->smax_value < sval)
+		else if (reg->smax_value <= sval)
 			return 0;
 		break;
 	case BPF_JLT:
 	return old->umin_value <= cur->umin_value &&
 	       old->umax_value >= cur->umax_value &&
 	       old->smin_value <= cur->smin_value &&
-	       old->smax_value >= cur->smax_value;
+	       old->smax_value >= cur->smax_value &&
+	       old->u32_min_value <= cur->u32_min_value &&
+	       old->u32_max_value >= cur->u32_max_value &&
+	       old->s32_min_value <= cur->s32_min_value &&
+	       old->s32_max_value >= cur->s32_max_value;
 }
 /* Maximum number of register states that can exist at once */
 		    insn->code == (BPF_ALU | BPF_MOD | BPF_X) ||
 		    insn->code == (BPF_ALU | BPF_DIV | BPF_X)) {
 			bool is64 = BPF_CLASS(insn->code) == BPF_ALU64;
-			struct bpf_insn mask_and_div[] = {
+			bool isdiv = BPF_OP(insn->code) == BPF_DIV;
-				BPF_MOV32_REG(insn->src_reg, insn->src_reg),
+			struct bpf_insn *patchlet;
+			struct bpf_insn chk_and_div[] = {
 				/* Rx div 0 -> 0 */
-				BPF_JMP_IMM(BPF_JNE, insn->src_reg, 0, 2),
+				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |
+					     BPF_JNE | BPF_K, insn->src_reg,
+					     0, 2, 0),
 				BPF_ALU32_REG(BPF_XOR, insn->dst_reg, insn->dst_reg),
 				BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 				*insn,
 			};
-			struct bpf_insn mask_and_mod[] = {
+			struct bpf_insn chk_and_mod[] = {
-				BPF_MOV32_REG(insn->src_reg, insn->src_reg),
 				/* Rx mod 0 -> Rx */
-				BPF_JMP_IMM(BPF_JEQ, insn->src_reg, 0, 1),
+				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |
+					     BPF_JEQ | BPF_K, insn->src_reg,
+					     0, 1, 0),
 				*insn,
 			};
-			struct bpf_insn *patchlet;
-			if (insn->code == (BPF_ALU64 | BPF_DIV | BPF_X) ||
+			patchlet = isdiv ? chk_and_div : chk_and_mod;
-			    insn->code == (BPF_ALU | BPF_DIV | BPF_X)) {
+			cnt = isdiv ? ARRAY_SIZE(chk_and_div) :
-				patchlet = mask_and_div + (is64 ? 1 : 0);
+				      ARRAY_SIZE(chk_and_mod);
-				cnt = ARRAY_SIZE(mask_and_div) - (is64 ? 1 : 0);
-			} else {
-				patchlet = mask_and_mod + (is64 ? 1 : 0);
-				cnt = ARRAY_SIZE(mask_and_mod) - (is64 ? 1 : 0);
-			}
 			new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt);
 			if (!new_prog)

kernel/cgroup/cgroup-v1.c+3−0

 		for_each_subsys(ss, i) {
 			if (strcmp(param->key, ss->legacy_name))
 				continue;
+			if (!cgroup_ssid_enabled(i) || cgroup1_ssid_disabled(i))
+				return invalfc(fc, "Disabled controller '%s'",
+					       param->key);
 			ctx->subsys_mask |= (1 << i);
 			return 0;
 		}

kernel/cgroup/cgroup.c+3−1

 {
 	struct psi_trigger *new;
 	struct cgroup *cgrp;
+	struct psi_group *psi;
 	cgrp = cgroup_kn_lock_live(of->kn, false);
 	if (!cgrp)
 	cgroup_get(cgrp);
 	cgroup_kn_unlock(of->kn);
-	new = psi_trigger_create(&cgrp->psi, buf, nbytes, res);
+	psi = cgroup_ino(cgrp) == 1 ? &psi_system : &cgrp->psi;
+	new = psi_trigger_create(psi, buf, nbytes, res);
 	if (IS_ERR(new)) {
 		cgroup_put(cgrp);
 		return PTR_ERR(new);

kernel/configs/android-recommended.config+0−1

@@ -81,7 +81,6 @@ CONFIG_INPUT_JOYSTICK=y · 80 unmodified lines
81	CONFIG_INPUT_MISC=y	81	CONFIG_INPUT_MISC=y
82	CONFIG_INPUT_TABLET=y	82	CONFIG_INPUT_TABLET=y
83	CONFIG_INPUT_UINPUT=y	83	CONFIG_INPUT_UINPUT=y
84	CONFIG_ION=y
85	CONFIG_JOYSTICK_XPAD=y	84	CONFIG_JOYSTICK_XPAD=y
86	CONFIG_JOYSTICK_XPAD_FF=y	85	CONFIG_JOYSTICK_XPAD_FF=y
87	CONFIG_JOYSTICK_XPAD_LEDS=y	86	CONFIG_JOYSTICK_XPAD_LEDS=y

kernel/dma/map_benchmark.c+6−2

 	__s32 node; /* which numa node this benchmark will run on */
 	__u32 dma_bits; /* DMA addressing capability */
 	__u32 dma_dir; /* DMA data direction */
-	__u64 expansion[10];	/* For future use */
+	__u8 expansion[84];	/* For future use */
 };
 struct map_benchmark_data {
 	atomic64_set(&map->sum_sq_unmap, 0);
 	atomic64_set(&map->loops, 0);
-	for (i = 0; i < threads; i++)
+	for (i = 0; i < threads; i++) {
+		get_task_struct(tsk[i]);
 		wake_up_process(tsk[i]);
+	}
 	msleep_interruptible(map->bparam.seconds * 1000);
 	}
 out:
+	for (i = 0; i < threads; i++)
+		put_task_struct(tsk[i]);
 	put_device(map->dev);
 	kfree(tsk);
 	return ret;

kernel/entry/common.c+3−11

 	lockdep_sys_exit();
 }
-#ifndef _TIF_SINGLESTEP
-static inline bool report_single_step(unsigned long work)
-{
-	return false;
-}
-#else
 /*
  * If SYSCALL_EMU is set, then the only reason to report is when
- * TIF_SINGLESTEP is set (i.e. PTRACE_SYSEMU_SINGLESTEP).  This syscall
+ * SINGLESTEP is set (i.e. PTRACE_SYSEMU_SINGLESTEP).  This syscall
  * instruction has been already reported in syscall_enter_from_user_mode().
  */
 static inline bool report_single_step(unsigned long work)
 {
-	if (!(work & SYSCALL_WORK_SYSCALL_EMU))
+	if (work & SYSCALL_WORK_SYSCALL_EMU)
 		return false;
-	return !!(current_thread_info()->flags & _TIF_SINGLESTEP);
+	return work & SYSCALL_WORK_SYSCALL_EXIT_TRAP;
 }
-#endif
 static void syscall_exit_work(struct pt_regs *regs, unsigned long work)
 {

kernel/entry/syscall_user_dispatch.c+2−2

@@ -50,10 +50,10 @@ bool syscall_user_dispatch(struct pt_regs *regs) · 49 unmodified lines
50	if (unlikely(__get_user(state, sd->selector)))	50	if (unlikely(__get_user(state, sd->selector)))
51	do_exit(SIGSEGV);	51	do_exit(SIGSEGV);
52		52
53	if (likely(state == PR_SYS_DISPATCH_OFF))	53	if (likely(state == SYSCALL_DISPATCH_FILTER_ALLOW))
54	return false;	54	return false;
55		55
56	if (state != PR_SYS_DISPATCH_ON)	56	if (state != SYSCALL_DISPATCH_FILTER_BLOCK)
57	do_exit(SIGSYS);	57	do_exit(SIGSYS);
58	}	58	}
59		59

kernel/fork.c+2−4

 	init_task.signal->rlim[RLIMIT_SIGPENDING] =
 		init_task.signal->rlim[RLIMIT_NPROC];
-	for (i = 0; i < UCOUNT_COUNTS; i++) {
+	for (i = 0; i < UCOUNT_COUNTS; i++)
 		init_user_ns.ucount_max[i] = max_threads/2;
-	}
 #ifdef CONFIG_VMAP_STACK
 	cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "fork:vm_stack_cache",
 {
 	enum pid_type type;
-	for (type = PIDTYPE_PID; type < PIDTYPE_MAX; ++type) {
+	for (type = PIDTYPE_PID; type < PIDTYPE_MAX; ++type)
 		INIT_HLIST_NODE(&task->pid_links[type]);
-	}
 }
 static inline void

kernel/futex.c+96−123

@@ -763,6 +763,29 @@ static struct futex_pi_state *alloc_pi_state(void) · 762 unmodified lines
763	return pi_state;	763	return pi_state;
764	}	764	}
765		765
		766	static void pi_state_update_owner(struct futex_pi_state *pi_state,
		767	struct task_struct *new_owner)
		768	{
		769	struct task_struct *old_owner = pi_state->owner;
		770
		771	lockdep_assert_held(&pi_state->pi_mutex.wait_lock);
		772
		773	if (old_owner) {
		774	raw_spin_lock(&old_owner->pi_lock);
		775	WARN_ON(list_empty(&pi_state->list));
		776	list_del_init(&pi_state->list);
		777	raw_spin_unlock(&old_owner->pi_lock);
		778	}
		779
		780	if (new_owner) {
		781	raw_spin_lock(&new_owner->pi_lock);
		782	WARN_ON(!list_empty(&pi_state->list));
		783	list_add(&pi_state->list, &new_owner->pi_state_list);
		784	pi_state->owner = new_owner;
		785	raw_spin_unlock(&new_owner->pi_lock);
		786	}
		787	}
		788
766	static void get_pi_state(struct futex_pi_state *pi_state)	789	static void get_pi_state(struct futex_pi_state *pi_state)
767	{	790	{
768	WARN_ON_ONCE(!refcount_inc_not_zero(&pi_state->refcount));	791	WARN_ON_ONCE(!refcount_inc_not_zero(&pi_state->refcount));
@@ -785,17 +808,11 @@ static void put_pi_state(struct futex_pi_state *pi_state) · 16 unmodified lines
785	* and has cleaned up the pi_state already	808	* and has cleaned up the pi_state already
786	*/	809	*/
787	if (pi_state->owner) {	810	if (pi_state->owner) {
788	struct task_struct *owner;
789	unsigned long flags;	811	unsigned long flags;
790		812
791	raw_spin_lock_irqsave(&pi_state->pi_mutex.wait_lock, flags);	813	raw_spin_lock_irqsave(&pi_state->pi_mutex.wait_lock, flags);
792	owner = pi_state->owner;	814	pi_state_update_owner(pi_state, NULL);
793	if (owner) {	815	rt_mutex_proxy_unlock(&pi_state->pi_mutex);
794	raw_spin_lock(&owner->pi_lock);
795	list_del_init(&pi_state->list);
796	raw_spin_unlock(&owner->pi_lock);
797	}
798	rt_mutex_proxy_unlock(&pi_state->pi_mutex, owner);
799	raw_spin_unlock_irqrestore(&pi_state->pi_mutex.wait_lock, flags);	816	raw_spin_unlock_irqrestore(&pi_state->pi_mutex.wait_lock, flags);
800	}	817	}
801		818
@@ -941,7 +958,8 @@ static inline void exit_pi_state_list(struct task_struct *curr) { } · 139 unmodified lines
941	* FUTEX_OWNER_DIED bit. See [4]	958	* FUTEX_OWNER_DIED bit. See [4]
942	*	959	*
943	* [10] There is no transient state which leaves owner and user space	960	* [10] There is no transient state which leaves owner and user space
944	* TID out of sync.	961	* TID out of sync. Except one error case where the kernel is denied
		962	* write access to the user address, see fixup_pi_state_owner().
945	*	963	*
946	*	964	*
947	* Serialization and lifetime rules:	965	* Serialization and lifetime rules:
@@ -1521,26 +1539,15 @@ static int wake_futex_pi(u32 __user uaddr, u32 uval, struct futex_pi_state pi_ · 573 unmodified lines
1521	ret = -EINVAL;	1539	ret = -EINVAL;
1522	}	1540	}
1523		1541
1524	if (ret)	1542	if (!ret) {
1525	goto out_unlock;	1543	/*
1526		1544	* This is a point of no return; once we modified the uval
1527	/*	1545	* there is no going back and subsequent operations must
1528	* This is a point of no return; once we modify the uval there is no	1546	* not fail.
1529	* going back and subsequent operations must not fail.	1547	*/
1530	*/	1548	pi_state_update_owner(pi_state, new_owner);
1531		1549	postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
1532	raw_spin_lock(&pi_state->owner->pi_lock);	1550	}
1533	WARN_ON(list_empty(&pi_state->list));
1534	list_del_init(&pi_state->list);
1535	raw_spin_unlock(&pi_state->owner->pi_lock);
1536
1537	raw_spin_lock(&new_owner->pi_lock);
1538	WARN_ON(!list_empty(&pi_state->list));
1539	list_add(&pi_state->list, &new_owner->pi_state_list);
1540	pi_state->owner = new_owner;
1541	raw_spin_unlock(&new_owner->pi_lock);
1542
1543	postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
1544		1551
1545	out_unlock:	1552	out_unlock:
1546	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);	1553	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
@@ -2323,18 +2330,13 @@ static void unqueue_me_pi(struct futex_q *q) · 776 unmodified lines
2323	spin_unlock(q->lock_ptr);	2330	spin_unlock(q->lock_ptr);
2324	}	2331	}
2325		2332
2326	static int fixup_pi_state_owner(u32 __user uaddr, struct futex_q q,	2333	static int __fixup_pi_state_owner(u32 __user uaddr, struct futex_q q,
2327	struct task_struct *argowner)	2334	struct task_struct *argowner)
2328	{	2335	{
2329	struct futex_pi_state *pi_state = q->pi_state;	2336	struct futex_pi_state *pi_state = q->pi_state;
2330	u32 uval, curval, newval;
2331	struct task_struct oldowner, newowner;	2337	struct task_struct oldowner, newowner;
2332	u32 newtid;	2338	u32 uval, curval, newval, newtid;
2333	int ret, err = 0;	2339	int err = 0;
2334
2335	lockdep_assert_held(q->lock_ptr);
2336
2337	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
2338		2340
2339	oldowner = pi_state->owner;	2341	oldowner = pi_state->owner;
2340		2342
@@ -2368,14 +2370,12 @@ retry: · 27 unmodified lines
2368	* We raced against a concurrent self; things are	2370	* We raced against a concurrent self; things are
2369	* already fixed up. Nothing to do.	2371	* already fixed up. Nothing to do.
2370	*/	2372	*/
2371	ret = 0;	2373	return 0;
2372	goto out_unlock;
2373	}	2374	}
2374		2375
2375	if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {	2376	if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
2376	/* We got the lock after all, nothing to fix. */	2377	/* We got the lock. pi_state is correct. Tell caller. */
2377	ret = 0;	2378	return 1;
2378	goto out_unlock;
2379	}	2379	}
2380		2380
2381	/*	2381	/*
@@ -2402,8 +2402,7 @@ retry: · 20 unmodified lines
2402	* We raced against a concurrent self; things are	2402	* We raced against a concurrent self; things are
2403	* already fixed up. Nothing to do.	2403	* already fixed up. Nothing to do.
2404	*/	2404	*/
2405	ret = 0;	2405	return 1;
2406	goto out_unlock;
2407	}	2406	}
2408	newowner = argowner;	2407	newowner = argowner;
2409	}	2408	}
@@ -2433,22 +2432,9 @@ retry: · 23 unmodified lines
2433	* We fixed up user space. Now we need to fix the pi_state	2432	* We fixed up user space. Now we need to fix the pi_state
2434	* itself.	2433	* itself.
2435	*/	2434	*/
2436	if (pi_state->owner != NULL) {	2435	pi_state_update_owner(pi_state, newowner);
2437	raw_spin_lock(&pi_state->owner->pi_lock);
2438	WARN_ON(list_empty(&pi_state->list));
2439	list_del_init(&pi_state->list);
2440	raw_spin_unlock(&pi_state->owner->pi_lock);
2441	}
2442		2436
2443	pi_state->owner = newowner;	2437	return argowner == current;
2444
2445	raw_spin_lock(&newowner->pi_lock);
2446	WARN_ON(!list_empty(&pi_state->list));
2447	list_add(&pi_state->list, &newowner->pi_state_list);
2448	raw_spin_unlock(&newowner->pi_lock);
2449	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
2450
2451	return 0;
2452		2438
2453	/*	2439	/*
2454	* In order to reschedule or handle a page fault, we need to drop the	2440	* In order to reschedule or handle a page fault, we need to drop the
@@ -2469,17 +2455,16 @@ handle_err: · 14 unmodified lines
2469		2455
2470	switch (err) {	2456	switch (err) {
2471	case -EFAULT:	2457	case -EFAULT:
2472	ret = fault_in_user_writeable(uaddr);	2458	err = fault_in_user_writeable(uaddr);
2473	break;	2459	break;
2474		2460
2475	case -EAGAIN:	2461	case -EAGAIN:
2476	cond_resched();	2462	cond_resched();
2477	ret = 0;	2463	err = 0;
2478	break;	2464	break;
2479		2465
2480	default:	2466	default:
2481	WARN_ON_ONCE(1);	2467	WARN_ON_ONCE(1);
2482	ret = err;
2483	break;	2468	break;
2484	}	2469	}
2485		2470
@@ -2489,17 +2474,44 @@ handle_err: · 3 unmodified lines
2489	/*	2474	/*
2490	* Check if someone else fixed it for us:	2475	* Check if someone else fixed it for us:
2491	*/	2476	*/
2492	if (pi_state->owner != oldowner) {	2477	if (pi_state->owner != oldowner)
2493	ret = 0;	2478	return argowner == current;
2494	goto out_unlock;
2495	}
2496		2479
2497	if (ret)	2480	/* Retry if err was -EAGAIN or the fault in succeeded */
2498	goto out_unlock;	2481	if (!err)
		2482	goto retry;
2499		2483
2500	goto retry;	2484	/*
		2485	* fault_in_user_writeable() failed so user state is immutable. At
		2486	* best we can make the kernel state consistent but user state will
		2487	* be most likely hosed and any subsequent unlock operation will be
		2488	* rejected due to PI futex rule [10].
		2489	*
		2490	* Ensure that the rtmutex owner is also the pi_state owner despite
		2491	* the user space value claiming something different. There is no
		2492	* point in unlocking the rtmutex if current is the owner as it
		2493	* would need to wait until the next waiter has taken the rtmutex
		2494	* to guarantee consistent state. Keep it simple. Userspace asked
		2495	* for this wreckaged state.
		2496	*
		2497	* The rtmutex has an owner - either current or some other
		2498	* task. See the EAGAIN loop above.
		2499	*/
		2500	pi_state_update_owner(pi_state, rt_mutex_owner(&pi_state->pi_mutex));
2501		2501
2502	out_unlock:	2502	return err;
		2503	}
		2504
		2505	static int fixup_pi_state_owner(u32 __user uaddr, struct futex_q q,
		2506	struct task_struct *argowner)
		2507	{
		2508	struct futex_pi_state *pi_state = q->pi_state;
		2509	int ret;
		2510
		2511	lockdep_assert_held(q->lock_ptr);
		2512
		2513	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
		2514	ret = __fixup_pi_state_owner(uaddr, q, argowner);
2503	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);	2515	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
2504	return ret;	2516	return ret;
2505	}	2517	}
@@ -2523,8 +2535,6 @@ static long futex_wait_restart(struct restart_block *restart); · 17 unmodified lines
2523	*/	2535	*/
2524	static int fixup_owner(u32 __user uaddr, struct futex_q q, int locked)	2536	static int fixup_owner(u32 __user uaddr, struct futex_q q, int locked)
2525	{	2537	{
2526	int ret = 0;
2527
2528	if (locked) {	2538	if (locked) {
2529	/*	2539	/*
2530	* Got the lock. We might not be the anticipated owner if we	2540	* Got the lock. We might not be the anticipated owner if we
@@ -2535,8 +2545,8 @@ static int fixup_owner(u32 __user uaddr, struct futex_q q, int locked) · 4 unmodified lines
2535	* stable state, anything else needs more attention.	2545	* stable state, anything else needs more attention.
2536	*/	2546	*/
2537	if (q->pi_state->owner != current)	2547	if (q->pi_state->owner != current)
2538	ret = fixup_pi_state_owner(uaddr, q, current);	2548	return fixup_pi_state_owner(uaddr, q, current);
2539	return ret ? ret : locked;	2549	return 1;
2540	}	2550	}
2541		2551
2542	/*	2552	/*
@@ -2547,23 +2557,17 @@ static int fixup_owner(u32 __user uaddr, struct futex_q q, int locked) · 4 unmodified lines
2547	* Another speculative read; pi_state->owner == current is unstable	2557	* Another speculative read; pi_state->owner == current is unstable
2548	* but needs our attention.	2558	* but needs our attention.
2549	*/	2559	*/
2550	if (q->pi_state->owner == current) {	2560	if (q->pi_state->owner == current)
2551	ret = fixup_pi_state_owner(uaddr, q, NULL);	2561	return fixup_pi_state_owner(uaddr, q, NULL);
2552	return ret;
2553	}
2554		2562
2555	/*	2563	/*
2556	* Paranoia check. If we did not take the lock, then we should not be	2564	* Paranoia check. If we did not take the lock, then we should not be
2557	* the owner of the rt_mutex.	2565	* the owner of the rt_mutex. Warn and establish consistent state.
2558	*/	2566	*/
2559	if (rt_mutex_owner(&q->pi_state->pi_mutex) == current) {	2567	if (WARN_ON_ONCE(rt_mutex_owner(&q->pi_state->pi_mutex) == current))
2560	printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p "	2568	return fixup_pi_state_owner(uaddr, q, current);
2561	"pi-state %p\n", ret,
2562	q->pi_state->pi_mutex.owner,
2563	q->pi_state->owner);
2564	}
2565		2569
2566	return ret;	2570	return 0;
2567	}	2571	}
2568		2572
2569	/**	2573	/**
@@ -2771,7 +2775,6 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, · 201 unmodified lines
2771	ktime_t *time, int trylock)	2775	ktime_t *time, int trylock)
2772	{	2776	{
2773	struct hrtimer_sleeper timeout, *to;	2777	struct hrtimer_sleeper timeout, *to;
2774	struct futex_pi_state *pi_state = NULL;
2775	struct task_struct *exiting = NULL;	2778	struct task_struct *exiting = NULL;
2776	struct rt_mutex_waiter rt_waiter;	2779	struct rt_mutex_waiter rt_waiter;
2777	struct futex_hash_bucket *hb;	2780	struct futex_hash_bucket *hb;
@@ -2907,23 +2910,8 @@ no_block: · 129 unmodified lines
2907	if (res)	2910	if (res)
2908	ret = (res < 0) ? res : 0;	2911	ret = (res < 0) ? res : 0;
2909		2912
2910	/*
2911	* If fixup_owner() faulted and was unable to handle the fault, unlock
2912	* it and return the fault to userspace.
2913	*/
2914	if (ret && (rt_mutex_owner(&q.pi_state->pi_mutex) == current)) {
2915	pi_state = q.pi_state;
2916	get_pi_state(pi_state);
2917	}
2918
2919	/* Unqueue and drop the lock */	2913	/* Unqueue and drop the lock */
2920	unqueue_me_pi(&q);	2914	unqueue_me_pi(&q);
2921
2922	if (pi_state) {
2923	rt_mutex_futex_unlock(&pi_state->pi_mutex);
2924	put_pi_state(pi_state);
2925	}
2926
2927	goto out;	2915	goto out;
2928		2916
2929	out_unlock_put_key:	2917	out_unlock_put_key:
@@ -3183,7 +3171,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, · 253 unmodified lines
3183	u32 __user *uaddr2)	3171	u32 __user *uaddr2)
3184	{	3172	{
3185	struct hrtimer_sleeper timeout, *to;	3173	struct hrtimer_sleeper timeout, *to;
3186	struct futex_pi_state *pi_state = NULL;
3187	struct rt_mutex_waiter rt_waiter;	3174	struct rt_mutex_waiter rt_waiter;
3188	struct futex_hash_bucket *hb;	3175	struct futex_hash_bucket *hb;
3189	union futex_key key2 = FUTEX_KEY_INIT;	3176	union futex_key key2 = FUTEX_KEY_INIT;
@@ -3261,16 +3248,17 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, · 71 unmodified lines
3261	if (q.pi_state && (q.pi_state->owner != current)) {	3248	if (q.pi_state && (q.pi_state->owner != current)) {
3262	spin_lock(q.lock_ptr);	3249	spin_lock(q.lock_ptr);
3263	ret = fixup_pi_state_owner(uaddr2, &q, current);	3250	ret = fixup_pi_state_owner(uaddr2, &q, current);
3264	if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
3265	pi_state = q.pi_state;
3266	get_pi_state(pi_state);
3267	}
3268	/*	3251	/*
3269	* Drop the reference to the pi state which	3252	* Drop the reference to the pi state which
3270	* the requeue_pi() code acquired for us.	3253	* the requeue_pi() code acquired for us.
3271	*/	3254	*/
3272	put_pi_state(q.pi_state);	3255	put_pi_state(q.pi_state);
3273	spin_unlock(q.lock_ptr);	3256	spin_unlock(q.lock_ptr);
		3257	/*
		3258	* Adjust the return value. It's either -EFAULT or
		3259	* success (1) but the caller expects 0 for success.
		3260	*/
		3261	ret = ret < 0 ? ret : 0;
3274	}	3262	}
3275	} else {	3263	} else {
3276	struct rt_mutex *pi_mutex;	3264	struct rt_mutex *pi_mutex;
@@ -3301,25 +3289,10 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, · 24 unmodified lines
3301	if (res)	3289	if (res)
3302	ret = (res < 0) ? res : 0;	3290	ret = (res < 0) ? res : 0;
3303		3291
3304	/*
3305	* If fixup_pi_state_owner() faulted and was unable to handle
3306	* the fault, unlock the rt_mutex and return the fault to
3307	* userspace.
3308	*/
3309	if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
3310	pi_state = q.pi_state;
3311	get_pi_state(pi_state);
3312	}
3313
3314	/* Unqueue and drop the lock. */	3292	/* Unqueue and drop the lock. */
3315	unqueue_me_pi(&q);	3293	unqueue_me_pi(&q);
3316	}	3294	}
3317		3295
3318	if (pi_state) {
3319	rt_mutex_futex_unlock(&pi_state->pi_mutex);
3320	put_pi_state(pi_state);
3321	}
3322
3323	if (ret == -EINTR) {	3296	if (ret == -EINTR) {
3324	/*	3297	/*
3325	* We've already been requeued, but cannot restart by calling	3298	* We've already been requeued, but cannot restart by calling

kernel/gcov/Kconfig+1−1

@@ -4,7 +4,7 @@ menu "GCOV-based kernel profiling" · 3 unmodified lines
4	config GCOV_KERNEL	4	config GCOV_KERNEL
5	bool "Enable gcov-based kernel profiling"	5	bool "Enable gcov-based kernel profiling"
6	depends on DEBUG_FS	6	depends on DEBUG_FS
7	select CONSTRUCTORS if !UML	7	select CONSTRUCTORS
8	default n	8	default n
9	help	9	help
10	This option enables gcov-based code profiling (e.g. for code coverage	10	This option enables gcov-based code profiling (e.g. for code coverage

kernel/irq/manage.c+1−0

@@ -2859,3 +2859,4 @@ bool irq_check_status_bit(unsigned int irq, unsigned int bitmask) · 2858 unmodified lines
2859	rcu_read_unlock();	2859	rcu_read_unlock();
2860	return res;	2860	return res;
2861	}	2861	}
		2862	EXPORT_SYMBOL_GPL(irq_check_status_bit);

kernel/irq/msi.c+21−25

@@ -402,7 +402,7 @@ int __msi_domain_alloc_irqs(struct irq_domain domain, struct device dev, · 401 unmodified lines
402	struct msi_domain_ops *ops = info->ops;	402	struct msi_domain_ops *ops = info->ops;
403	struct irq_data *irq_data;	403	struct irq_data *irq_data;
404	struct msi_desc *desc;	404	struct msi_desc *desc;
405	msi_alloc_info_t arg;	405	msi_alloc_info_t arg = { };
406	int i, ret, virq;	406	int i, ret, virq;
407	bool can_reserve;	407	bool can_reserve;
408		408
@@ -436,22 +436,22 @@ int __msi_domain_alloc_irqs(struct irq_domain domain, struct device dev, · 27 unmodified lines
436		436
437	can_reserve = msi_check_reservation_mode(domain, info, dev);	437	can_reserve = msi_check_reservation_mode(domain, info, dev);
438		438
439	for_each_msi_entry(desc, dev) {	439	/*
440	virq = desc->irq;	440	* This flag is set by the PCI layer as we need to activate
441	if (desc->nvec_used == 1)	441	* the MSI entries before the PCI layer enables MSI in the
442	dev_dbg(dev, "irq %d for MSI\n", virq);	442	* card. Otherwise the card latches a random msi message.
443	else	443	*/
		444	if (!(info->flags & MSI_FLAG_ACTIVATE_EARLY))
		445	goto skip_activate;
		446
		447	for_each_msi_vector(desc, i, dev) {
		448	if (desc->irq == i) {
		449	virq = desc->irq;
444	dev_dbg(dev, "irq [%d-%d] for MSI\n",	450	dev_dbg(dev, "irq [%d-%d] for MSI\n",
445	virq, virq + desc->nvec_used - 1);	451	virq, virq + desc->nvec_used - 1);
446	/*	452	}
447	* This flag is set by the PCI layer as we need to activate
448	* the MSI entries before the PCI layer enables MSI in the
449	* card. Otherwise the card latches a random msi message.
450	*/
451	if (!(info->flags & MSI_FLAG_ACTIVATE_EARLY))
452	continue;
453		453
454	irq_data = irq_domain_get_irq_data(domain, desc->irq);	454	irq_data = irq_domain_get_irq_data(domain, i);
455	if (!can_reserve) {	455	if (!can_reserve) {
456	irqd_clr_can_reserve(irq_data);	456	irqd_clr_can_reserve(irq_data);
457	if (domain->flags & IRQ_DOMAIN_MSI_NOMASK_QUIRK)	457	if (domain->flags & IRQ_DOMAIN_MSI_NOMASK_QUIRK)
@@ -462,28 +462,24 @@ int __msi_domain_alloc_irqs(struct irq_domain domain, struct device dev, · 4 unmodified lines
462	goto cleanup;	462	goto cleanup;
463	}	463	}
464		464
		465	skip_activate:
465	/*	466	/*
466	* If these interrupts use reservation mode, clear the activated bit	467	* If these interrupts use reservation mode, clear the activated bit
467	* so request_irq() will assign the final vector.	468	* so request_irq() will assign the final vector.
468	*/	469	*/
469	if (can_reserve) {	470	if (can_reserve) {
470	for_each_msi_entry(desc, dev) {	471	for_each_msi_vector(desc, i, dev) {
471	irq_data = irq_domain_get_irq_data(domain, desc->irq);	472	irq_data = irq_domain_get_irq_data(domain, i);
472	irqd_clr_activated(irq_data);	473	irqd_clr_activated(irq_data);
473	}	474	}
474	}	475	}
475	return 0;	476	return 0;
476		477
477	cleanup:	478	cleanup:
478	for_each_msi_entry(desc, dev) {	479	for_each_msi_vector(desc, i, dev) {
479	struct irq_data *irqd;	480	irq_data = irq_domain_get_irq_data(domain, i);
480		481	if (irqd_is_activated(irq_data))
481	if (desc->irq == virq)	482	irq_domain_deactivate_irq(irq_data);
482	break;
483
484	irqd = irq_domain_get_irq_data(domain, desc->irq);
485	if (irqd_is_activated(irqd))
486	irq_domain_deactivate_irq(irqd);
487	}	483	}
488	msi_domain_free_irqs(domain, dev);	484	msi_domain_free_irqs(domain, dev);
489	return ret;	485	return ret;

kernel/kexec_core.c+0−2

 #ifdef CONFIG_KEXEC_JUMP
 	if (kexec_image->preserve_context) {
-		lock_system_sleep();
 		pm_prepare_console();
 		error = freeze_processes();
 		if (error) {
 		thaw_processes();
  Restore_console:
 		pm_restore_console();
-		unlock_system_sleep();
 	}
 #endif

kernel/kprobes.c+28−8

 	return !offset;
 }
-bool kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset)
+/**
+ * kprobe_on_func_entry() -- check whether given address is function entry
+ * @addr: Target address
+ * @sym:  Target symbol name
+ * @offset: The offset from the symbol or the address
+ *
+ * This checks whether the given @addr+@offset or @sym+@offset is on the
+ * function entry address or not.
+ * This returns 0 if it is the function entry, or -EINVAL if it is not.
+ * And also it returns -ENOENT if it fails the symbol or address lookup.
+ * Caller must pass @addr or @sym (either one must be NULL), or this
+ * returns -EINVAL.
+ */
+int kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset)
 {
 	kprobe_opcode_t *kp_addr = _kprobe_addr(addr, sym, offset);
 	if (IS_ERR(kp_addr))
-		return false;
+		return PTR_ERR(kp_addr);
-	if (!kallsyms_lookup_size_offset((unsigned long)kp_addr, NULL, &offset) ||
+	if (!kallsyms_lookup_size_offset((unsigned long)kp_addr, NULL, &offset))
-						!arch_kprobe_on_func_entry(offset))
+		return -ENOENT;
-		return false;
-	return true;
+	if (!arch_kprobe_on_func_entry(offset))
+		return -EINVAL;
+	return 0;
 }
 int register_kretprobe(struct kretprobe *rp)
 {
-	int ret = 0;
+	int ret;
 	struct kretprobe_instance *inst;
 	int i;
 	void *addr;
-	if (!kprobe_on_func_entry(rp->kp.addr, rp->kp.symbol_name, rp->kp.offset))
+	ret = kprobe_on_func_entry(rp->kp.addr, rp->kp.symbol_name, rp->kp.offset);
+	if (ret)
+		return ret;
+	/* If only rp->kp.addr is specified, check reregistering kprobes */
+	if (rp->kp.addr && check_kprobe_rereg(&rp->kp))
 		return -EINVAL;
 	if (kretprobe_blacklist_size) {

kernel/kthread.c+27−2

@@ -294,7 +294,7 @@ static int kthread(void *_create) · 293 unmodified lines
294	do_exit(ret);	294	do_exit(ret);
295	}	295	}
296		296
297	/* called from do_fork() to get node information for about to be created task */	297	/* called from kernel_clone() to get node information for about to be created task */
298	int tsk_fork_get_node(struct task_struct *tsk)	298	int tsk_fork_get_node(struct task_struct *tsk)
299	{	299	{
300	#ifdef CONFIG_NUMA	300	#ifdef CONFIG_NUMA
@@ -493,11 +493,36 @@ struct task_struct kthread_create_on_cpu(int (threadfn)(void *data), · 192 unmodified lines
493	return p;	493	return p;
494	kthread_bind(p, cpu);	494	kthread_bind(p, cpu);
495	/* CPU hotplug need to bind once again when unparking the thread. */	495	/* CPU hotplug need to bind once again when unparking the thread. */
496	set_bit(KTHREAD_IS_PER_CPU, &to_kthread(p)->flags);
497	to_kthread(p)->cpu = cpu;	496	to_kthread(p)->cpu = cpu;
498	return p;	497	return p;
499	}	498	}
500		499
		500	void kthread_set_per_cpu(struct task_struct *k, int cpu)
		501	{
		502	struct kthread *kthread = to_kthread(k);
		503	if (!kthread)
		504	return;
		505
		506	WARN_ON_ONCE(!(k->flags & PF_NO_SETAFFINITY));
		507
		508	if (cpu < 0) {
		509	clear_bit(KTHREAD_IS_PER_CPU, &kthread->flags);
		510	return;
		511	}
		512
		513	kthread->cpu = cpu;
		514	set_bit(KTHREAD_IS_PER_CPU, &kthread->flags);
		515	}
		516
		517	bool kthread_is_per_cpu(struct task_struct *k)
		518	{
		519	struct kthread *kthread = to_kthread(k);
		520	if (!kthread)
		521	return false;
		522
		523	return test_bit(KTHREAD_IS_PER_CPU, &kthread->flags);
		524	}
		525
501	/**	526	/**
502	* kthread_unpark - unpark a thread created by kthread_create().	527	* kthread_unpark - unpark a thread created by kthread_create().
503	* @k: thread created by kthread_create().	528	* @k: thread created by kthread_create().

kernel/locking/lockdep.c+7−2

 DEFINE_PER_CPU(unsigned int, lockdep_recursion);
 EXPORT_PER_CPU_SYMBOL_GPL(lockdep_recursion);
-static inline bool lockdep_enabled(void)
+static __always_inline bool lockdep_enabled(void)
 {
 	if (!debug_locks)
 		return false;
 /*
  * Check whether we follow the irq-flags state precisely:
  */
-static void check_flags(unsigned long flags)
+static noinstr void check_flags(unsigned long flags)
 {
 #if defined(CONFIG_PROVE_LOCKING) && defined(CONFIG_DEBUG_LOCKDEP)
 	if (!debug_locks)
 		return;
+	/* Get the warning out..  */
+	instrumentation_begin();
 	if (irqs_disabled_flags(flags)) {
 		if (DEBUG_LOCKS_WARN_ON(lockdep_hardirqs_enabled())) {
 			printk("possible reason: unannotated irqs-off.\n");
 	if (!debug_locks)
 		print_irqtrace_events(current);
+	instrumentation_end();
 #endif
 }

kernel/locking/rtmutex.c+1−2

  * possible because it belongs to the pi_state which is about to be freed
  * and it is not longer visible to other tasks.
  */
-void rt_mutex_proxy_unlock(struct rt_mutex *lock,
+void rt_mutex_proxy_unlock(struct rt_mutex *lock)
-			   struct task_struct *proxy_owner)
 {
 	debug_rt_mutex_proxy_unlock(lock);
 	rt_mutex_set_owner(lock, NULL);

kernel/locking/rtmutex_common.h+1−2

 extern struct task_struct *rt_mutex_next_owner(struct rt_mutex *lock);
 extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
 				       struct task_struct *proxy_owner);
-extern void rt_mutex_proxy_unlock(struct rt_mutex *lock,
+extern void rt_mutex_proxy_unlock(struct rt_mutex *lock);
-				  struct task_struct *proxy_owner);
 extern void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter);
 extern int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 				     struct rt_mutex_waiter *waiter,

kernel/power/swap.c+1−1

 		unsigned int flags, int error)
 {
 	if (!error) {
-		flush_swap_writer(handle);
 		pr_info("S");
 		error = mark_swapfiles(handle, flags);
 		pr_cont("|\n");
+		flush_swap_writer(handle);
 	}
 	if (error)

kernel/printk/printk.c+29−11

  * done:
  *
  *   - Add prefix for each line.
+ *   - Drop truncated lines that no longer fit into the buffer.
  *   - Add the trailing newline that has been removed in vprintk_store().
- *   - Drop truncated lines that do not longer fit into the buffer.
+ *   - Add a string terminator.
+ *
+ * Since the produced string is always terminated, the maximum possible
+ * return value is @r->text_buf_size - 1;
  *
  * Return: The length of the updated/prepared text, including the added
- * prefixes and the newline. The dropped line(s) are not counted.
+ * prefixes and the newline. The terminator is not counted. The dropped
+ * line(s) are not counted.
  */
 static size_t record_print_text(struct printk_record *r, bool syslog,
 				bool time)
 		/*
 		 * Truncate the text if there is not enough space to add the
-		 * prefix and a trailing newline.
+		 * prefix and a trailing newline and a terminator.
 		 */
-		if (len + prefix_len + text_len + 1 > buf_size) {
+		if (len + prefix_len + text_len + 1 + 1 > buf_size) {
 			/* Drop even the current line if no space. */
-			if (len + prefix_len + line_len + 1 > buf_size)
+			if (len + prefix_len + line_len + 1 + 1 > buf_size)
 				break;
-			text_len = buf_size - len - prefix_len - 1;
+			text_len = buf_size - len - prefix_len - 1 - 1;
 			truncated = true;
 		}
 		memmove(text + prefix_len, text, text_len);
 		memcpy(text, prefix, prefix_len);
+		/*
+		 * Increment the prepared length to include the text and
+		 * prefix that were just moved+copied. Also increment for the
+		 * newline at the end of this line. If this is the last line,
+		 * there is no newline, but it will be added immediately below.
+		 */
 		len += prefix_len + line_len + 1;
 		if (text_len == line_len) {
 			/*
-			 * Add the trailing newline removed in
+			 * This is the last line. Add the trailing newline
-			 * vprintk_store().
+			 * removed in vprintk_store().
 			 */
 			text[prefix_len + line_len] = '\n';
 			break;
 		text_len -= line_len + 1;
 	}
+	/*
+	 * If a buffer was provided, it will be terminated. Space for the
+	 * string terminator is guaranteed to be available. The terminator is
+	 * not counted in the return value.
+	 */
+	if (buf_size > 0)
+		r->text_buf[len] = 0;
 	return len;
 }
 	while (prb_read_valid_info(prb, seq, &info, &line_count)) {
 		if (r.info->seq >= dumper->next_seq)
 			break;
-		l += get_record_print_text_size(&info, line_count, true, time);
+		l += get_record_print_text_size(&info, line_count, syslog, time);
 		seq = r.info->seq + 1;
 	}
 						&info, &line_count)) {
 		if (r.info->seq >= dumper->next_seq)
 			break;
-		l -= get_record_print_text_size(&info, line_count, true, time);
+		l -= get_record_print_text_size(&info, line_count, syslog, time);
 		seq = r.info->seq + 1;
 	}

kernel/printk/printk_ringbuffer.c+1−1

@@ -1718,7 +1718,7 @@ static bool copy_data(struct prb_data_ring *data_ring, · 1717 unmodified lines
1718		1718
1719	/* Caller interested in the line count? */	1719	/* Caller interested in the line count? */
1720	if (line_count)	1720	if (line_count)
1721	*line_count = count_lines(data, data_size);	1721	*line_count = count_lines(data, len);
1722		1722
1723	/* Caller interested in the data content? */	1723	/* Caller interested in the data content? */
1724	if (!buf \|\| !buf_size)	1724	if (!buf \|\| !buf_size)

kernel/rcu/tasks.h+21−4

 	}
 }
-/* Spawn RCU-tasks grace-period kthread, e.g., at core_initcall() time. */
+/* Spawn RCU-tasks grace-period kthread. */
 static void __init rcu_spawn_tasks_kthread_generic(struct rcu_tasks *rtp)
 {
 	struct task_struct *t;
 	rcu_spawn_tasks_kthread_generic(&rcu_tasks);
 	return 0;
 }
-core_initcall(rcu_spawn_tasks_kthread);
 #if !defined(CONFIG_TINY_RCU)
 void show_rcu_tasks_classic_gp_kthread(void)
 	rcu_spawn_tasks_kthread_generic(&rcu_tasks_rude);
 	return 0;
 }
-core_initcall(rcu_spawn_tasks_rude_kthread);
 #if !defined(CONFIG_TINY_RCU)
 void show_rcu_tasks_rude_gp_kthread(void)
 static void rcu_tasks_trace_pertask(struct task_struct *t,
 				    struct list_head *hop)
 {
+	// During early boot when there is only the one boot CPU, there
+	// is no idle task for the other CPUs. Just return.
+	if (unlikely(t == NULL))
+		return;
 	WRITE_ONCE(t->trc_reader_special.b.need_qs, false);
 	WRITE_ONCE(t->trc_reader_checked, false);
 	t->trc_ipi_to_cpu = -1;
 	rcu_spawn_tasks_kthread_generic(&rcu_tasks_trace);
 	return 0;
 }
-core_initcall(rcu_spawn_tasks_trace_kthread);
 #if !defined(CONFIG_TINY_RCU)
 void show_rcu_tasks_trace_gp_kthread(void)
 }
 #endif /* #ifndef CONFIG_TINY_RCU */
+void __init rcu_init_tasks_generic(void)
+{
+#ifdef CONFIG_TASKS_RCU
+	rcu_spawn_tasks_kthread();
+#endif
+#ifdef CONFIG_TASKS_RUDE_RCU
+	rcu_spawn_tasks_rude_kthread();
+#endif
+#ifdef CONFIG_TASKS_TRACE_RCU
+	rcu_spawn_tasks_trace_kthread();
+#endif
+}
 #else /* #ifdef CONFIG_TASKS_RCU_GENERIC */
 static inline void rcu_tasks_bootup_oddness(void) {}
 void show_rcu_tasks_gp_kthreads(void) {}

kernel/sched/core.c+88−23

  */
 static inline bool is_cpu_allowed(struct task_struct *p, int cpu)
 {
+	/* When not in the task's cpumask, no point in looking further. */
 	if (!cpumask_test_cpu(cpu, p->cpus_ptr))
 		return false;
-	if (is_per_cpu_kthread(p) || is_migration_disabled(p))
+	/* migrate_disabled() must be allowed to finish. */
+	if (is_migration_disabled(p))
 		return cpu_online(cpu);
-	return cpu_active(cpu);
+	/* Non kernel threads are not allowed during either online or offline. */
+	if (!(p->flags & PF_KTHREAD))
+		return cpu_active(cpu);
+	/* KTHREAD_IS_PER_CPU is always allowed. */
+	if (kthread_is_per_cpu(p))
+		return cpu_online(cpu);
+	/* Regular kernel threads don't get to stay during offline. */
+	if (cpu_rq(cpu)->balance_push)
+		return false;
+	/* But are allowed during online. */
+	return cpu_online(cpu);
 }
 /*
 	if (p->flags & PF_KTHREAD || is_migration_disabled(p)) {
 		/*
-		 * Kernel threads are allowed on online && !active CPUs.
+		 * Kernel threads are allowed on online && !active CPUs,
+		 * however, during cpu-hot-unplug, even these might get pushed
+		 * away if not KTHREAD_IS_PER_CPU.
 		 *
 		 * Specifically, migration_disabled() tasks must not fail the
 		 * cpumask_any_and_distribute() pick below, esp. so on
 	__do_set_cpus_allowed(p, new_mask, flags);
-	if (p->flags & PF_KTHREAD) {
-		/*
-		 * For kernel threads that do indeed end up on online &&
-		 * !active we want to ensure they are strict per-CPU threads.
-		 */
-		WARN_ON(cpumask_intersects(new_mask, cpu_online_mask) &&
-			!cpumask_intersects(new_mask, cpu_active_mask) &&
-			p->nr_cpus_allowed != 1);
-	}
 	return affine_move_task(rq, p, &rf, dest_cpu, flags);
 out:
 static inline bool ttwu_queue_cond(int cpu, int wake_flags)
 {
+	/*
+	 * Do not complicate things with the async wake_list while the CPU is
+	 * in hotplug state.
+	 */
+	if (!cpu_active(cpu))
+		return false;
 	/*
 	 * If the CPU does not share cache, then queue the task on the
 	 * remote rqs wakelist to avoid accessing remote data.
 	/*
 	 * Both the cpu-hotplug and stop task are in this case and are
 	 * required to complete the hotplug process.
+	 *
+	 * XXX: the idle task does not match kthread_is_per_cpu() due to
+	 * histerical raisins.
 	 */
-	if (is_per_cpu_kthread(push_task) || is_migration_disabled(push_task)) {
+	if (rq->idle == push_task ||
+	    ((push_task->flags & PF_KTHREAD) && kthread_is_per_cpu(push_task)) ||
+	    is_migration_disabled(push_task)) {
 		/*
 		 * If this is the idle task on the outgoing CPU try to wake
 		 * up the hotplug control thread which might wait for the
 	/*
 	 * At this point need_resched() is true and we'll take the loop in
 	 * schedule(). The next pick is obviously going to be the stop task
-	 * which is_per_cpu_kthread() and will push this task away.
+	 * which kthread_is_per_cpu() and will push this task away.
 	 */
 	raw_spin_lock(&rq->lock);
 }
 	struct rq_flags rf;
 	rq_lock_irqsave(rq, &rf);
-	if (on)
+	rq->balance_push = on;
+	if (on) {
+		WARN_ON_ONCE(rq->balance_callback);
 		rq->balance_callback = &balance_push_callback;
-	else
+	} else if (rq->balance_callback == &balance_push_callback) {
 		rq->balance_callback = NULL;
+	}
 	rq_unlock_irqrestore(rq, &rf);
 }
 	struct rq *rq = cpu_rq(cpu);
 	struct rq_flags rf;
+	/*
+	 * Make sure that when the hotplug state machine does a roll-back
+	 * we clear balance_push. Ideally that would happen earlier...
+	 */
 	balance_push_set(cpu, false);
 #ifdef CONFIG_SCHED_SMT
 	nohz_balance_exit_idle(rq);
 	set_cpu_active(cpu, false);
+	/*
+	 * From this point forward, this CPU will refuse to run any task that
+	 * is not: migrate_disable() or KTHREAD_IS_PER_CPU, and will actively
+	 * push those tasks away until this gets cleared, see
+	 * sched_cpu_dying().
+	 */
+	balance_push_set(cpu, true);
 	/*
-	 * We've cleared cpu_active_mask, wait for all preempt-disabled and RCU
+	 * We've cleared cpu_active_mask / set balance_push, wait for all
-	 * users of this state to go away such that all new such users will
+	 * preempt-disabled and RCU users of this state to go away such that
-	 * observe it.
+	 * all new such users will observe it.
+	 *
+	 * Specifically, we rely on ttwu to no longer target this CPU, see
+	 * ttwu_queue_cond() and is_cpu_allowed().
 	 *
 	 * Do sync before park smpboot threads to take care the rcu boost case.
 	 */
 	synchronize_rcu();
-	balance_push_set(cpu, true);
 	rq_lock_irqsave(rq, &rf);
 	if (rq->rd) {
 		update_rq_clock(rq);
 		atomic_long_add(delta, &calc_load_tasks);
 }
+static void dump_rq_tasks(struct rq *rq, const char *loglvl)
+{
+	struct task_struct *g, *p;
+	int cpu = cpu_of(rq);
+	lockdep_assert_held(&rq->lock);
+	printk("%sCPU%d enqueued tasks (%u total):\n", loglvl, cpu, rq->nr_running);
+	for_each_process_thread(g, p) {
+		if (task_cpu(p) != cpu)
+			continue;
+		if (!task_on_rq_queued(p))
+			continue;
+		printk("%s\tpid: %d, name: %s\n", loglvl, p->pid, p->comm);
+	}
+}
 int sched_cpu_dying(unsigned int cpu)
 {
 	struct rq *rq = cpu_rq(cpu);
 	sched_tick_stop(cpu);
 	rq_lock_irqsave(rq, &rf);
-	BUG_ON(rq->nr_running != 1 || rq_has_pinned_tasks(rq));
+	if (rq->nr_running != 1 || rq_has_pinned_tasks(rq)) {
+		WARN(true, "Dying CPU not properly vacated!");
+		dump_rq_tasks(rq, KERN_WARNING);
+	}
 	rq_unlock_irqrestore(rq, &rf);
+	/*
+	 * Now that the CPU is offline, make sure we're welcome
+	 * to new tasks once we come back up.
+	 */
+	balance_push_set(cpu, false);
 	calc_load_migrate(rq);
 	update_max_interval();
 	hrtick_clear(rq);

kernel/sched/sched.h+1−0

@@ -975,6 +975,7 @@ struct rq { · 974 unmodified lines
975	unsigned long cpu_capacity_orig;	975	unsigned long cpu_capacity_orig;
976		976
977	struct callback_head *balance_callback;	977	struct callback_head *balance_callback;
		978	unsigned char balance_push;
978		979
979	unsigned char nohz_idle_balance;	980	unsigned char nohz_idle_balance;
980	unsigned char idle_balance;	981	unsigned char idle_balance;

kernel/signal.c+5−1

 	struct signal_struct *signal = current->signal;
 	int signr;
+	if (unlikely(current->task_works))
+		task_work_run();
 	/*
 	 * For non-generic architectures, check for TIF_NOTIFY_SIGNAL so
 	 * that the arch handlers don't all have to do it. If we get here
 	return true;
 }
-static int copy_siginfo_from_user_any(kernel_siginfo_t *kinfo, siginfo_t *info)
+static int copy_siginfo_from_user_any(kernel_siginfo_t *kinfo,
+		siginfo_t __user *info)
 {
 #ifdef CONFIG_COMPAT
 	/*

kernel/smpboot.c+1−0

@@ -188,6 +188,7 @@ __smpboot_create_thread(struct smp_hotplug_thread *ht, unsigned int cpu) · 187 unmodified lines
188	kfree(td);	188	kfree(td);
189	return PTR_ERR(tsk);	189	return PTR_ERR(tsk);
190	}	190	}
		191	kthread_set_per_cpu(tsk, cpu);
191	/*	192	/*
192	* Park the thread so that it could start right on the CPU	193	* Park the thread so that it could start right on the CPU
193	* when it is available.	194	* when it is available.

kernel/time/ntp.c+4−4

@@ -498,11 +498,11 @@ out: · 497 unmodified lines
498	static void sync_hw_clock(struct work_struct *work);	498	static void sync_hw_clock(struct work_struct *work);
499	static DECLARE_WORK(sync_work, sync_hw_clock);	499	static DECLARE_WORK(sync_work, sync_hw_clock);
500	static struct hrtimer sync_hrtimer;	500	static struct hrtimer sync_hrtimer;
501	#define SYNC_PERIOD_NS (11UL * 60 * NSEC_PER_SEC)	501	#define SYNC_PERIOD_NS (11ULL * 60 * NSEC_PER_SEC)
502		502
503	static enum hrtimer_restart sync_timer_callback(struct hrtimer *timer)	503	static enum hrtimer_restart sync_timer_callback(struct hrtimer *timer)
504	{	504	{
505	queue_work(system_power_efficient_wq, &sync_work);	505	queue_work(system_freezable_power_efficient_wq, &sync_work);
506		506
507	return HRTIMER_NORESTART;	507	return HRTIMER_NORESTART;
508	}	508	}
@@ -512,7 +512,7 @@ static void sched_sync_hw_clock(unsigned long offset_nsec, bool retry) · 3 unmodified lines
512	ktime_t exp = ktime_set(ktime_get_real_seconds(), 0);	512	ktime_t exp = ktime_set(ktime_get_real_seconds(), 0);
513		513
514	if (retry)	514	if (retry)
515	exp = ktime_add_ns(exp, 2 * NSEC_PER_SEC - offset_nsec);	515	exp = ktime_add_ns(exp, 2ULL * NSEC_PER_SEC - offset_nsec);
516	else	516	else
517	exp = ktime_add_ns(exp, SYNC_PERIOD_NS - offset_nsec);	517	exp = ktime_add_ns(exp, SYNC_PERIOD_NS - offset_nsec);
518		518
@@ -668,7 +668,7 @@ void ntp_notify_cmos_timer(void) · 149 unmodified lines
668	* just a pointless work scheduled.	668	* just a pointless work scheduled.
669	*/	669	*/
670	if (ntp_synced() && !hrtimer_is_queued(&sync_hrtimer))	670	if (ntp_synced() && !hrtimer_is_queued(&sync_hrtimer))
671	queue_work(system_power_efficient_wq, &sync_work);	671	queue_work(system_freezable_power_efficient_wq, &sync_work);
672	}	672	}
673		673
674	static void __init ntp_init_cmos_sync(void)	674	static void __init ntp_init_cmos_sync(void)

kernel/time/timekeeping.c+1−2

 /**
  * ktime_get_real_seconds - Get the seconds portion of CLOCK_REALTIME
  *
- * Returns the wall clock seconds since 1970. This replaces the
+ * Returns the wall clock seconds since 1970.
- * get_seconds() interface which is not y2038 safe on 32bit systems.
  *
  * For 64bit systems the fast access to tk->xtime_sec is preserved. On
  * 32bit systems the access must be protected with the sequence

kernel/trace/Kconfig+1−1

@@ -538,7 +538,7 @@ config KPROBE_EVENTS · 537 unmodified lines
538	config KPROBE_EVENTS_ON_NOTRACE	538	config KPROBE_EVENTS_ON_NOTRACE
539	bool "Do NOT protect notrace function from kprobe events"	539	bool "Do NOT protect notrace function from kprobe events"
540	depends on KPROBE_EVENTS	540	depends on KPROBE_EVENTS
541	depends on KPROBES_ON_FTRACE	541	depends on DYNAMIC_FTRACE
542	default n	542	default n
543	help	543	help
544	This is only for the developers who want to debug ftrace itself	544	This is only for the developers who want to debug ftrace itself

kernel/trace/bpf_trace.c+0−3

@@ -96,9 +96,6 @@ unsigned int trace_call_bpf(struct trace_event_call call, void ctx) · 95 unmodified lines
96	{	96	{
97	unsigned int ret;	97	unsigned int ret;
98		98
99	if (in_nmi()) /* not supported yet */
100	return 1;
101
102	cant_sleep();	99	cant_sleep();
103		100
104	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {	101	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {

kernel/trace/fgraph.c+0−2

 		}
 		if (t->ret_stack == NULL) {
-			atomic_set(&t->tracing_graph_pause, 0);
 			atomic_set(&t->trace_overrun, 0);
 			t->curr_ret_stack = -1;
 			t->curr_ret_depth = -1;
 static void
 graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
 {
-	atomic_set(&t->tracing_graph_pause, 0);
 	atomic_set(&t->trace_overrun, 0);
 	t->ftrace_timestamp = 0;
 	/* make curr_ret_stack visible before we add the ret_stack */

kernel/trace/trace.c+1−1

@@ -2745,7 +2745,7 @@ trace_event_buffer_lock_reserve(struct trace_buffer **current_rb, · 2744 unmodified lines
2745	(entry = this_cpu_read(trace_buffered_event))) {	2745	(entry = this_cpu_read(trace_buffered_event))) {
2746	/* Try to use the per cpu buffer first */	2746	/* Try to use the per cpu buffer first */
2747	val = this_cpu_inc_return(trace_buffered_event_cnt);	2747	val = this_cpu_inc_return(trace_buffered_event_cnt);
2748	if (val == 1) {	2748	if ((len < (PAGE_SIZE - sizeof(*entry))) && val == 1) {
2749	trace_event_setup(entry, type, flags, pc);	2749	trace_event_setup(entry, type, flags, pc);
2750	entry->array[0] = len;	2750	entry->array[0] = len;
2751	return entry;	2751	return entry;

kernel/trace/trace_events.c+2−1

@@ -1212,7 +1212,8 @@ system_enable_read(struct file filp, char __user ubuf, size_t cnt, · 1211 unmodified lines
1212	mutex_lock(&event_mutex);	1212	mutex_lock(&event_mutex);
1213	list_for_each_entry(file, &tr->events, list) {	1213	list_for_each_entry(file, &tr->events, list) {
1214	call = file->event_call;	1214	call = file->event_call;
1215	if (!trace_event_name(call) \|\| !call->class \|\| !call->class->reg)	1215	if ((call->flags & TRACE_EVENT_FL_IGNORE_ENABLE) \|\|
		1216	!trace_event_name(call) \|\| !call->class \|\| !call->class->reg)
1216	continue;	1217	continue;
1217		1218
1218	if (system && strcmp(call->class->system, system->name) != 0)	1219	if (system && strcmp(call->class->system, system->name) != 0)

kernel/trace/trace_irqsoff.c+4−0

 	/* non overwrite screws up the latency tracers */
 	set_tracer_flag(tr, TRACE_ITER_OVERWRITE, 1);
 	set_tracer_flag(tr, TRACE_ITER_LATENCY_FMT, 1);
+	/* without pause, we will produce garbage if another latency occurs */
+	set_tracer_flag(tr, TRACE_ITER_PAUSE_ON_TRACE, 1);
 	tr->max_latency = 0;
 	irqsoff_trace = tr;
 {
 	int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT;
 	int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE;
+	int pause_flag = save_flags & TRACE_ITER_PAUSE_ON_TRACE;
 	stop_irqsoff_tracer(tr, is_graph(tr));
 	set_tracer_flag(tr, TRACE_ITER_LATENCY_FMT, lat_flag);
 	set_tracer_flag(tr, TRACE_ITER_OVERWRITE, overwrite_flag);
+	set_tracer_flag(tr, TRACE_ITER_PAUSE_ON_TRACE, pause_flag);
 	ftrace_reset_array_ops(tr);
 	irqsoff_busy = false;

kernel/trace/trace_kprobe.c+7−5

 {
 	struct trace_kprobe *tk = trace_kprobe_primary_from_call(call);
-	return tk ? kprobe_on_func_entry(tk->rp.kp.addr,
+	return tk ? (kprobe_on_func_entry(tk->rp.kp.addr,
 			tk->rp.kp.addr ? NULL : tk->rp.kp.symbol_name,
-			tk->rp.kp.addr ? 0 : tk->rp.kp.offset) : false;
+			tk->rp.kp.addr ? 0 : tk->rp.kp.offset) == 0) : false;
 }
 bool trace_kprobe_error_injectable(struct trace_event_call *call)
 	return 0;
 }
-#if defined(CONFIG_KPROBES_ON_FTRACE) && \
+#if defined(CONFIG_DYNAMIC_FTRACE) && \
 	!defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE)
 static bool __within_notrace_func(unsigned long addr)
 {
 		}
 		if (is_return)
 			flags |= TPARG_FL_RETURN;
-		if (kprobe_on_func_entry(NULL, symbol, offset))
+		ret = kprobe_on_func_entry(NULL, symbol, offset);
+		if (ret == 0)
 			flags |= TPARG_FL_FENTRY;
-		if (offset && is_return && !(flags & TPARG_FL_FENTRY)) {
+		/* Defer the ENOENT case until register kprobe */
+		if (ret == -EINVAL && is_return) {
 			trace_probe_log_err(0, BAD_RETPROBE);
 			goto parse_error;
 		}

kernel/workqueue.c+13−9

 {
 	mutex_lock(&wq_pool_attach_mutex);
-	/*
-	 * set_cpus_allowed_ptr() will fail if the cpumask doesn't have any
-	 * online CPUs.  It'll be re-applied when any of the CPUs come up.
-	 */
-	set_cpus_allowed_ptr(worker->task, pool->attrs->cpumask);
 	/*
 	 * The wq_pool_attach_mutex ensures %POOL_DISASSOCIATED remains
 	 * stable across this function.  See the comments above the flag
 	 */
 	if (pool->flags & POOL_DISASSOCIATED)
 		worker->flags |= WORKER_UNBOUND;
+	else
+		kthread_set_per_cpu(worker->task, pool->cpu);
+	if (worker->rescue_wq)
+		set_cpus_allowed_ptr(worker->task, pool->attrs->cpumask);
 	list_add_tail(&worker->node, &pool->workers);
 	worker->pool = pool;
 	mutex_lock(&wq_pool_attach_mutex);
+	kthread_set_per_cpu(worker->task, -1);
 	list_del(&worker->node);
 	worker->pool = NULL;
 		raw_spin_unlock_irq(&pool->lock);
-		for_each_pool_worker(worker, pool)
+		for_each_pool_worker(worker, pool) {
-			WARN_ON_ONCE(set_cpus_allowed_ptr(worker->task, cpu_active_mask) < 0);
+			kthread_set_per_cpu(worker->task, -1);
+			WARN_ON_ONCE(set_cpus_allowed_ptr(worker->task, cpu_possible_mask) < 0);
+		}
 		mutex_unlock(&wq_pool_attach_mutex);
 	 * of all workers first and then clear UNBOUND.  As we're called
 	 * from CPU_ONLINE, the following shouldn't fail.
 	 */
-	for_each_pool_worker(worker, pool)
+	for_each_pool_worker(worker, pool) {
+		kthread_set_per_cpu(worker->task, pool->cpu);
 		WARN_ON_ONCE(set_cpus_allowed_ptr(worker->task,
 						  pool->attrs->cpumask) < 0);
+	}
 	raw_spin_lock_irq(&pool->lock);

Merge tag 'v5.11' into sched/core, to pick up fixes & refresh the branch

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code