Merge remote-tracking branch 'ovl/rename2' into for-linus

11 files changed, 60 insertions, 56 deletions

diff --git a/mm/debug.c b/mm/debug.c
index 8865bfb41b0b..74c7cae4f683 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -42,9 +42,11 @@ const struct trace_print_flags vmaflag_names[] = {
 
 void __dump_page(struct page *page, const char *reason)
 {
+        int mapcount = PageSlab(page) ? 0 : page_mapcount(page);
+
         pr_emerg("page:%p count:%d mapcount:%d mapping:%p index:%#lx",
-                  page, page_ref_count(page), page_mapcount(page),
-                  page->mapping, page->index);
+                  page, page_ref_count(page), mapcount,
+                  page->mapping, page_to_pgoff(page));
         if (PageCompound(page))
                 pr_cont(" compound_mapcount: %d", compound_mapcount(page));
         pr_cont("\n");
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index a6abd76baa72..53ae6d00656a 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1138,9 +1138,6 @@ int do_huge_pmd_numa_page(struct fault_env *fe, pmd_t pmd)
         bool was_writable;
         int flags = 0;
 
-        /* A PROT_NONE fault should not end up here */
-        BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
-
         fe->ptl = pmd_lock(vma->vm_mm, fe->pmd);
         if (unlikely(!pmd_same(pmd, *fe->pmd)))
                 goto out_unlock;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 79c52d0061af..728d7790dc2d 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -838,7 +838,8 @@ static bool hugepage_vma_check(struct vm_area_struct *vma)
  * value (scan code).
  */
 
-static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)
+static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address,
+                struct vm_area_struct **vmap)
 {
         struct vm_area_struct *vma;
         unsigned long hstart, hend;
@@ -846,7 +847,7 @@ static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)
         if (unlikely(khugepaged_test_exit(mm)))
                 return SCAN_ANY_PROCESS;
 
-        vma = find_vma(mm, address);
+        *vmap = vma = find_vma(mm, address);
         if (!vma)
                 return SCAN_VMA_NULL;
 
@@ -881,6 +882,11 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
                 .pmd = pmd,
         };
 
+        /* we only decide to swapin, if there is enough young ptes */
+        if (referenced < HPAGE_PMD_NR/2) {
+                trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
+                return false;
+        }
         fe.pte = pte_offset_map(pmd, address);
         for (; fe.address < address + HPAGE_PMD_NR*PAGE_SIZE;
                         fe.pte++, fe.address += PAGE_SIZE) {
@@ -888,17 +894,12 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
                 if (!is_swap_pte(pteval))
                         continue;
                 swapped_in++;
-                /* we only decide to swapin, if there is enough young ptes */
-                if (referenced < HPAGE_PMD_NR/2) {
-                        trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
-                        return false;
-                }
                 ret = do_swap_page(&fe, pteval);
 
                 /* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */
                 if (ret & VM_FAULT_RETRY) {
                         down_read(&mm->mmap_sem);
-                        if (hugepage_vma_revalidate(mm, address)) {
+                        if (hugepage_vma_revalidate(mm, address, &fe.vma)) {
                                 /* vma is no longer available, don't continue to swapin */
                                 trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
                                 return false;
@@ -923,7 +924,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
 static void collapse_huge_page(struct mm_struct *mm,
                                    unsigned long address,
                                    struct page **hpage,
-                                   struct vm_area_struct *vma,
                                    int node, int referenced)
 {
         pmd_t *pmd, _pmd;
@@ -933,6 +933,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         spinlock_t *pmd_ptl, *pte_ptl;
         int isolated = 0, result = 0;
         struct mem_cgroup *memcg;
+        struct vm_area_struct *vma;
         unsigned long mmun_start;       /* For mmu_notifiers */
         unsigned long mmun_end;         /* For mmu_notifiers */
         gfp_t gfp;
@@ -961,7 +962,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         }
 
         down_read(&mm->mmap_sem);
-        result = hugepage_vma_revalidate(mm, address);
+        result = hugepage_vma_revalidate(mm, address, &vma);
         if (result) {
                 mem_cgroup_cancel_charge(new_page, memcg, true);
                 up_read(&mm->mmap_sem);
@@ -994,7 +995,7 @@ static void collapse_huge_page(struct mm_struct *mm,
          * handled by the anon_vma lock + PG_lock.
          */
         down_write(&mm->mmap_sem);
-        result = hugepage_vma_revalidate(mm, address);
+        result = hugepage_vma_revalidate(mm, address, &vma);
         if (result)
                 goto out;
         /* check if the pmd is still valid */
@@ -1202,7 +1203,7 @@ out_unmap:
         if (ret) {
                 node = khugepaged_find_target_node();
                 /* collapse_huge_page will return with the mmap_sem released */
-                collapse_huge_page(mm, address, hpage, vma, node, referenced);
+                collapse_huge_page(mm, address, hpage, node, referenced);
         }
 out:
         trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced,
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9a6a51a7c416..4be518d4e68a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1740,17 +1740,22 @@ static DEFINE_MUTEX(percpu_charge_mutex);
 static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
         struct memcg_stock_pcp *stock;
+        unsigned long flags;
         bool ret = false;
 
         if (nr_pages > CHARGE_BATCH)
                 return ret;
 
-        stock = &get_cpu_var(memcg_stock);
+        local_irq_save(flags);
+
+        stock = this_cpu_ptr(&memcg_stock);
         if (memcg == stock->cached && stock->nr_pages >= nr_pages) {
                 stock->nr_pages -= nr_pages;
                 ret = true;
         }
-        put_cpu_var(memcg_stock);
+
+        local_irq_restore(flags);
+
         return ret;
 }
 
@@ -1771,15 +1776,18 @@ static void drain_stock(struct memcg_stock_pcp *stock)
         stock->cached = NULL;
 }
 
-/*
- * This must be called under preempt disabled or must be called by
- * a thread which is pinned to local cpu.
- */
 static void drain_local_stock(struct work_struct *dummy)
 {
-        struct memcg_stock_pcp *stock = this_cpu_ptr(&memcg_stock);
+        struct memcg_stock_pcp *stock;
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        stock = this_cpu_ptr(&memcg_stock);
         drain_stock(stock);
         clear_bit(FLUSHING_CACHED_CHARGE, &stock->flags);
+
+        local_irq_restore(flags);
 }
 
 /*
@@ -1788,14 +1796,19 @@ static void drain_local_stock(struct work_struct *dummy)
  */
 static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
-        struct memcg_stock_pcp *stock = &get_cpu_var(memcg_stock);
+        struct memcg_stock_pcp *stock;
+        unsigned long flags;
+
+        local_irq_save(flags);
 
+        stock = this_cpu_ptr(&memcg_stock);
         if (stock->cached != memcg) { /* reset if necessary */
                 drain_stock(stock);
                 stock->cached = memcg;
         }
         stock->nr_pages += nr_pages;
-        put_cpu_var(memcg_stock);
+
+        local_irq_restore(flags);
 }
 
 /*
diff --git a/mm/memory.c b/mm/memory.c
index 83be99d9d8a1..793fe0f9841c 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3351,9 +3351,6 @@ static int do_numa_page(struct fault_env *fe, pte_t pte)
         bool was_writable = pte_write(pte);
         int flags = 0;
 
-        /* A PROT_NONE fault should not end up here */
-        BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
-
         /*
         * The "pte" at this point cannot be used safely without
         * validation through pte_unmap_same(). It's of NUMA type but
@@ -3458,6 +3455,11 @@ static int wp_huge_pmd(struct fault_env *fe, pmd_t orig_pmd)
         return VM_FAULT_FALLBACK;
 }
 
+static inline bool vma_is_accessible(struct vm_area_struct *vma)
+{
+        return vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE);
+}
+
 /*
  * These routines also need to handle stuff like marking pages dirty
  * and/or accessed for architectures that don't do it in hardware (most
@@ -3524,7 +3526,7 @@ static int handle_pte_fault(struct fault_env *fe)
         if (!pte_present(entry))
                 return do_swap_page(fe, entry);
 
-        if (pte_protnone(entry))
+        if (pte_protnone(entry) && vma_is_accessible(fe->vma))
                 return do_numa_page(fe, entry);
 
         fe->ptl = pte_lockptr(fe->vma->vm_mm, fe->pmd);
@@ -3590,7 +3592,7 @@ static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
 
                 barrier();
                 if (pmd_trans_huge(orig_pmd) || pmd_devmap(orig_pmd)) {
-                        if (pmd_protnone(orig_pmd))
+                        if (pmd_protnone(orig_pmd) && vma_is_accessible(vma))
                                 return do_huge_pmd_numa_page(&fe, orig_pmd);
 
                         if ((fe.flags & FAULT_FLAG_WRITE) &&
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 41266dc29f33..b58906b6215c 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1567,7 +1567,9 @@ static struct page *new_node_page(struct page *page, unsigned long private,
                 return alloc_huge_page_node(page_hstate(compound_head(page)),
                                         next_node_in(nid, nmask));
 
-        node_clear(nid, nmask);
+        if (nid != next_node_in(nid, nmask))
+                node_clear(nid, nmask);
+
         if (PageHighMem(page)
             || (zone_idx(page_zone(page)) == ZONE_MOVABLE))
                 gfp_mask |= __GFP_HIGHMEM;
diff --git a/mm/page_io.c b/mm/page_io.c
index 16bd82fad38c..eafe5ddc2b54 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -264,6 +264,7 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
         int ret;
         struct swap_info_struct *sis = page_swap_info(page);
 
+        BUG_ON(!PageSwapCache(page));
         if (sis->flags & SWP_FILE) {
                 struct kiocb kiocb;
                 struct file *swap_file = sis->swap_file;
@@ -337,6 +338,7 @@ int swap_readpage(struct page *page)
         int ret = 0;
         struct swap_info_struct *sis = page_swap_info(page);
 
+        BUG_ON(!PageSwapCache(page));
         VM_BUG_ON_PAGE(!PageLocked(page), page);
         VM_BUG_ON_PAGE(PageUptodate(page), page);
         if (frontswap_load(page) == 0) {
@@ -386,6 +388,7 @@ int swap_set_page_dirty(struct page *page)
 
         if (sis->flags & SWP_FILE) {
                 struct address_space *mapping = sis->swap_file->f_mapping;
+                BUG_ON(!PageSwapCache(page));
                 return mapping->a_ops->set_page_dirty(page);
         } else {
                 return __set_page_dirty_no_writeback(page);
diff --git a/mm/shmem.c b/mm/shmem.c
index 28ae88bbeffa..e7e8f8c210c1 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -270,7 +270,7 @@ bool shmem_charge(struct inode *inode, long pages)
                 info->alloced -= pages;
                 shmem_recalc_inode(inode);
                 spin_unlock_irqrestore(&info->lock, flags);
-
+                shmem_unacct_blocks(info->flags, pages);
                 return false;
         }
         percpu_counter_add(&sbinfo->used_blocks, pages);
@@ -291,6 +291,7 @@ void shmem_uncharge(struct inode *inode, long pages)
 
         if (sbinfo->max_blocks)
                 percpu_counter_sub(&sbinfo->used_blocks, pages);
+        shmem_unacct_blocks(info->flags, pages);
 }
 
 /*
@@ -1980,7 +1981,7 @@ unsigned long shmem_get_unmapped_area(struct file *file,
                                 return addr;
                         sb = shm_mnt->mnt_sb;
                 }
-                if (SHMEM_SB(sb)->huge != SHMEM_HUGE_NEVER)
+                if (SHMEM_SB(sb)->huge == SHMEM_HUGE_NEVER)
                         return addr;
         }
 
@@ -3813,7 +3814,7 @@ static const struct inode_operations shmem_dir_inode_operations = {
         .mkdir          = shmem_mkdir,
         .rmdir          = shmem_rmdir,
         .mknod          = shmem_mknod,
-        .rename2        = shmem_rename2,
+        .rename         = shmem_rename2,
         .tmpfile        = shmem_tmpfile,
 #endif
 #ifdef CONFIG_TMPFS_XATTR
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 78cfa292a29a..2657accc6e2b 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2724,7 +2724,6 @@ int swapcache_prepare(swp_entry_t entry)
 struct swap_info_struct *page_swap_info(struct page *page)
 {
         swp_entry_t swap = { .val = page_private(page) };
-        BUG_ON(!PageSwapCache(page));
         return swap_info[swp_type(swap)];
 }
 
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 089328f2b920..3c8da0af9695 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -207,8 +207,11 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n,
          * Some architectures (arm64) return true for virt_addr_valid() on
          * vmalloced addresses. Work around this by checking for vmalloc
          * first.
+         *
+         * We also need to check for module addresses explicitly since we
+         * may copy static data from modules to userspace
          */
-        if (is_vmalloc_addr(ptr))
+        if (is_vmalloc_or_module_addr(ptr))
                 return NULL;
 
         if (!virt_addr_valid(ptr))
diff --git a/mm/vmscan.c b/mm/vmscan.c
index b1e12a1ea9cf..0fe8b7113868 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2303,23 +2303,6 @@ out:
         }
 }
 
-#ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
-static void init_tlb_ubc(void)
-{
-        /*
-         * This deliberately does not clear the cpumask as it's expensive
-         * and unnecessary. If there happens to be data in there then the
-         * first SWAP_CLUSTER_MAX pages will send an unnecessary IPI and
-         * then will be cleared.
-         */
-        current->tlb_ubc.flush_required = false;
-}
-#else
-static inline void init_tlb_ubc(void)
-{
-}
-#endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
-
 /*
  * This is a basic per-node page freer.  Used by both kswapd and direct reclaim.
  */
@@ -2355,8 +2338,6 @@ static void shrink_node_memcg(struct pglist_data *pgdat, struct mem_cgroup *memc
         scan_adjusted = (global_reclaim(sc) && !current_is_kswapd() &&
                          sc->priority == DEF_PRIORITY);
 
-        init_tlb_ubc();
-
         blk_start_plug(&plug);
         while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] ||
                                         nr[LRU_INACTIVE_FILE]) {