Merge branch 'akpm' (patches from Andrew)

Merge misc fixes from Andrew Morton:

 - "fork: unconditionally clear stack on fork" is a non-bugfix which got
   lost during the merge window - performance concerns appear to have
   been adequately addressed.

 - and a bunch of fixes

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
  mm: memcg: add __GFP_NOWARN in __memcg_schedule_kmem_cache_create()
  fs, elf: don't complain MAP_FIXED_NOREPLACE unless -EEXIST error
  kexec_file: do not add extra alignment to efi memmap
  proc: fix /proc/loadavg regression
  proc: revalidate kernel thread inodes to root:root
  autofs: mount point create should honour passed in mode
  MAINTAINERS: add personal addresses for Sascha and Uwe
  kasan: add no_sanitize attribute for clang builds
  rapidio: fix rio_dma_transfer error handling
  mm: enable thp migration for shmem thp
  writeback: safer lock nesting
  mm, pagemap: fix swap offset value for PMD migration entry
  mm: fix do_pages_move status handling
  fork: unconditionally clear stack on fork

21 files changed, 106 insertions, 72 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 5ae51d05c09b..b7ff5654b8b5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1373,7 +1373,8 @@ F:	arch/arm/mach-ebsa110/
 F:      drivers/net/ethernet/amd/am79c961a.*
 
 ARM/ENERGY MICRO (SILICON LABS) EFM32 SUPPORT
-M:      Uwe Kleine-König <kernel@pengutronix.de>
+M:      Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 N:      efm32
@@ -1401,7 +1402,8 @@ F:	arch/arm/mach-footbridge/
 
 ARM/FREESCALE IMX / MXC ARM ARCHITECTURE
 M:      Shawn Guo <shawnguo@kernel.org>
-M:      Sascha Hauer <kernel@pengutronix.de>
+M:      Sascha Hauer <s.hauer@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 R:      Fabio Estevam <fabio.estevam@nxp.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -1416,7 +1418,8 @@ F:	include/soc/imx/
 
 ARM/FREESCALE VYBRID ARM ARCHITECTURE
 M:      Shawn Guo <shawnguo@kernel.org>
-M:      Sascha Hauer <kernel@pengutronix.de>
+M:      Sascha Hauer <s.hauer@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 R:      Stefan Agner <stefan@agner.ch>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -5652,7 +5655,8 @@ F:	drivers/net/ethernet/freescale/fec.h
 F:      Documentation/devicetree/bindings/net/fsl-fec.txt
 
 FREESCALE IMX / MXC FRAMEBUFFER DRIVER
-M:      Sascha Hauer <kernel@pengutronix.de>
+M:      Sascha Hauer <s.hauer@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 L:      linux-fbdev@vger.kernel.org
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -12825,7 +12829,8 @@ F:	include/linux/siphash.h
 
 SIOX
 M:      Gavin Schenk <g.schenk@eckelmann.de>
-M:      Uwe Kleine-König <kernel@pengutronix.de>
+M:      Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 S:      Supported
 F:      drivers/siox/*
 F:      include/trace/events/siox.h
diff --git a/arch/powerpc/platforms/cell/spufs/sched.c b/arch/powerpc/platforms/cell/spufs/sched.c
index 9033c8194eda..ccc421503363 100644
--- a/arch/powerpc/platforms/cell/spufs/sched.c
+++ b/arch/powerpc/platforms/cell/spufs/sched.c
@@ -1093,7 +1093,7 @@ static int show_spu_loadavg(struct seq_file *s, void *private)
                 LOAD_INT(c), LOAD_FRAC(c),
                 count_active_contexts(),
                 atomic_read(&nr_spu_contexts),
-                idr_get_cursor(&task_active_pid_ns(current)->idr));
+                idr_get_cursor(&task_active_pid_ns(current)->idr) - 1);
         return 0;
 }
 
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 3182908b7e6c..7326078eaa7a 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -398,11 +398,10 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
          * little bit simple
          */
         efi_map_sz = efi_get_runtime_map_size();
-        efi_map_sz = ALIGN(efi_map_sz, 16);
         params_cmdline_sz = sizeof(struct boot_params) + cmdline_len +
                                 MAX_ELFCOREHDR_STR_LEN;
         params_cmdline_sz = ALIGN(params_cmdline_sz, 16);
-        kbuf.bufsz = params_cmdline_sz + efi_map_sz +
+        kbuf.bufsz = params_cmdline_sz + ALIGN(efi_map_sz, 16) +
                                 sizeof(struct setup_data) +
                                 sizeof(struct efi_setup_data);
 
@@ -410,7 +409,7 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
         if (!params)
                 return ERR_PTR(-ENOMEM);
         efi_map_offset = params_cmdline_sz;
-        efi_setup_data_offset = efi_map_offset + efi_map_sz;
+        efi_setup_data_offset = efi_map_offset + ALIGN(efi_map_sz, 16);
 
         /* Copy setup header onto bootparams. Documentation/x86/boot.txt */
         setup_header_size = 0x0202 + kernel[0x0201] - setup_hdr_offset;
diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 9d27016c899e..0434ab7b6497 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -740,10 +740,7 @@ static int do_dma_request(struct mport_dma_req *req,
         tx->callback = dma_xfer_callback;
         tx->callback_param = req;
 
-        req->dmach = chan;
-        req->sync = sync;
         req->status = DMA_IN_PROGRESS;
-        init_completion(&req->req_comp);
         kref_get(&req->refcount);
 
         cookie = dmaengine_submit(tx);
@@ -831,13 +828,20 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
         if (!req)
                 return -ENOMEM;
 
-        kref_init(&req->refcount);
-
         ret = get_dma_channel(priv);
         if (ret) {
                 kfree(req);
                 return ret;
         }
+        chan = priv->dmach;
+
+        kref_init(&req->refcount);
+        init_completion(&req->req_comp);
+        req->dir = dir;
+        req->filp = filp;
+        req->priv = priv;
+        req->dmach = chan;
+        req->sync = sync;
 
         /*
          * If parameter loc_addr != NULL, we are transferring data from/to
@@ -925,11 +929,6 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
                                 xfer->offset, xfer->length);
         }
 
-        req->dir = dir;
-        req->filp = filp;
-        req->priv = priv;
-        chan = priv->dmach;
-
         nents = dma_map_sg(chan->device->dev,
                            req->sgt.sgl, req->sgt.nents, dir);
         if (nents == 0) {
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 82e8f6edfb48..b12e37f27530 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -749,7 +749,7 @@ static int autofs4_dir_mkdir(struct inode *dir,
 
         autofs4_del_active(dentry);
 
-        inode = autofs4_get_inode(dir->i_sb, S_IFDIR | 0555);
+        inode = autofs4_get_inode(dir->i_sb, S_IFDIR | mode);
         if (!inode)
                 return -ENOMEM;
         d_add(dentry, inode);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 41e04183e4ce..4ad6f669fe34 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -377,10 +377,10 @@ static unsigned long elf_map(struct file *filep, unsigned long addr,
         } else
                 map_addr = vm_mmap(filep, addr, size, prot, type, off);
 
-        if ((type & MAP_FIXED_NOREPLACE) && BAD_ADDR(map_addr))
-                pr_info("%d (%s): Uhuuh, elf segment at %p requested but the memory is mapped already\n",
-                                task_pid_nr(current), current->comm,
-                                (void *)addr);
+        if ((type & MAP_FIXED_NOREPLACE) &&
+            PTR_ERR((void *)map_addr) == -EEXIST)
+                pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n",
+                        task_pid_nr(current), current->comm, (void *)addr);
 
         return(map_addr);
 }
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 4b12ba70a895..47d7c151fcba 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -745,11 +745,12 @@ int inode_congested(struct inode *inode, int cong_bits)
          */
         if (inode && inode_to_wb_is_valid(inode)) {
                 struct bdi_writeback *wb;
-                bool locked, congested;
+                struct wb_lock_cookie lock_cookie = {};
+                bool congested;
 
-                wb = unlocked_inode_to_wb_begin(inode, &locked);
+                wb = unlocked_inode_to_wb_begin(inode, &lock_cookie);
                 congested = wb_congested(wb, cong_bits);
-                unlocked_inode_to_wb_end(inode, locked);
+                unlocked_inode_to_wb_end(inode, &lock_cookie);
                 return congested;
         }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index eafa39a3a88c..1b2ede6abcdf 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_struct *task, umode_t mode,
         kuid_t uid;
         kgid_t gid;
 
+        if (unlikely(task->flags & PF_KTHREAD)) {
+                *ruid = GLOBAL_ROOT_UID;
+                *rgid = GLOBAL_ROOT_GID;
+                return;
+        }
+
         /* Default to the tasks effective ownership */
         rcu_read_lock();
         cred = __task_cred(task);
diff --git a/fs/proc/loadavg.c b/fs/proc/loadavg.c
index a000d7547479..b572cc865b92 100644
--- a/fs/proc/loadavg.c
+++ b/fs/proc/loadavg.c
@@ -24,7 +24,7 @@ static int loadavg_proc_show(struct seq_file *m, void *v)
                 LOAD_INT(avnrun[1]), LOAD_FRAC(avnrun[1]),
                 LOAD_INT(avnrun[2]), LOAD_FRAC(avnrun[2]),
                 nr_running(), nr_threads,
-                idr_get_cursor(&task_active_pid_ns(current)->idr));
+                idr_get_cursor(&task_active_pid_ns(current)->idr) - 1);
         return 0;
 }
 
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 65ae54659833..c486ad4b43f0 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1310,9 +1310,11 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
                 else if (is_swap_pmd(pmd)) {
                         swp_entry_t entry = pmd_to_swp_entry(pmd);
+                        unsigned long offset = swp_offset(entry);
 
+                        offset += (addr & ~PMD_MASK) >> PAGE_SHIFT;
                         frame = swp_type(entry) |
-                                (swp_offset(entry) << MAX_SWAPFILES_SHIFT);
+                                (offset << MAX_SWAPFILES_SHIFT);
                         flags |= PM_SWAP;
                         if (pmd_swp_soft_dirty(pmd))
                                 flags |= PM_SOFT_DIRTY;
@@ -1332,6 +1334,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
                                 break;
                         if (pm->show_pfn && (flags & PM_PRESENT))
                                 frame++;
+                        else if (flags & PM_SWAP)
+                                frame += (1 << MAX_SWAPFILES_SHIFT);
                 }
                 spin_unlock(ptl);
                 return err;
diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
index bfe86b54f6c1..0bd432a4d7bd 100644
--- a/include/linux/backing-dev-defs.h
+++ b/include/linux/backing-dev-defs.h
@@ -223,6 +223,11 @@ static inline void set_bdi_congested(struct backing_dev_info *bdi, int sync)
         set_wb_congested(bdi->wb.congested, sync);
 }
 
+struct wb_lock_cookie {
+        bool locked;
+        unsigned long flags;
+};
+
 #ifdef CONFIG_CGROUP_WRITEBACK
 
 /**
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index f6be4b0b6c18..72ca0f3d39f3 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -347,7 +347,7 @@ static inline struct bdi_writeback *inode_to_wb(const struct inode *inode)
 /**
  * unlocked_inode_to_wb_begin - begin unlocked inode wb access transaction
  * @inode: target inode
- * @lockedp: temp bool output param, to be passed to the end function
+ * @cookie: output param, to be passed to the end function
  *
  * The caller wants to access the wb associated with @inode but isn't
  * holding inode->i_lock, the i_pages lock or wb->list_lock.  This
@@ -355,12 +355,12 @@ static inline struct bdi_writeback *inode_to_wb(const struct inode *inode)
  * association doesn't change until the transaction is finished with
  * unlocked_inode_to_wb_end().
  *
- * The caller must call unlocked_inode_to_wb_end() with *@lockdep
- * afterwards and can't sleep during transaction.  IRQ may or may not be
- * disabled on return.
+ * The caller must call unlocked_inode_to_wb_end() with *@cookie afterwards and
+ * can't sleep during the transaction.  IRQs may or may not be disabled on
+ * return.
  */
 static inline struct bdi_writeback *
-unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp)
+unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie)
 {
         rcu_read_lock();
 
@@ -368,10 +368,10 @@ unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp)
          * Paired with store_release in inode_switch_wb_work_fn() and
          * ensures that we see the new wb if we see cleared I_WB_SWITCH.
          */
-        *lockedp = smp_load_acquire(&inode->i_state) & I_WB_SWITCH;
+        cookie->locked = smp_load_acquire(&inode->i_state) & I_WB_SWITCH;
 
-        if (unlikely(*lockedp))
-                xa_lock_irq(&inode->i_mapping->i_pages);
+        if (unlikely(cookie->locked))
+                xa_lock_irqsave(&inode->i_mapping->i_pages, cookie->flags);
 
         /*
          * Protected by either !I_WB_SWITCH + rcu_read_lock() or the i_pages
@@ -383,12 +383,13 @@ unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp)
 /**
  * unlocked_inode_to_wb_end - end inode wb access transaction
  * @inode: target inode
- * @locked: *@lockedp from unlocked_inode_to_wb_begin()
+ * @cookie: @cookie from unlocked_inode_to_wb_begin()
  */
-static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked)
+static inline void unlocked_inode_to_wb_end(struct inode *inode,
+                                            struct wb_lock_cookie *cookie)
 {
-        if (unlikely(locked))
-                xa_unlock_irq(&inode->i_mapping->i_pages);
+        if (unlikely(cookie->locked))
+                xa_unlock_irqrestore(&inode->i_mapping->i_pages, cookie->flags);
 
         rcu_read_unlock();
 }
@@ -435,12 +436,13 @@ static inline struct bdi_writeback *inode_to_wb(struct inode *inode)
 }
 
 static inline struct bdi_writeback *
-unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp)
+unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie)
 {
         return inode_to_wb(inode);
 }
 
-static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked)
+static inline void unlocked_inode_to_wb_end(struct inode *inode,
+                                            struct wb_lock_cookie *cookie)
 {
 }
 
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index ceb96ecab96e..7d98e263e048 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -25,6 +25,9 @@
 #define __SANITIZE_ADDRESS__
 #endif
 
+#undef __no_sanitize_address
+#define __no_sanitize_address __attribute__((no_sanitize("address")))
+
 /* Clang doesn't have a way to turn it off per-function, yet. */
 #ifdef __noretpoline
 #undef __noretpoline
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index 34f053a150a9..cf2862bd134a 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -43,11 +43,7 @@ enum {
 #define THREAD_ALIGN    THREAD_SIZE
 #endif
 
-#if IS_ENABLED(CONFIG_DEBUG_STACK_USAGE) || IS_ENABLED(CONFIG_DEBUG_KMEMLEAK)
-# define THREADINFO_GFP         (GFP_KERNEL_ACCOUNT | __GFP_ZERO)
-#else
-# define THREADINFO_GFP         (GFP_KERNEL_ACCOUNT)
-#endif
+#define THREADINFO_GFP          (GFP_KERNEL_ACCOUNT | __GFP_ZERO)
 
 /*
  * flag set/clear/test wrappers
diff --git a/kernel/fork.c b/kernel/fork.c
index 242c8c93d285..a5d21c42acfc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -216,10 +216,9 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
                 if (!s)
                         continue;
 
-#ifdef CONFIG_DEBUG_KMEMLEAK
                 /* Clear stale pointers from reused stack. */
                 memset(s->addr, 0, THREAD_SIZE);
-#endif
+
                 tsk->stack_vm_area = s;
                 return s->addr;
         }
diff --git a/mm/filemap.c b/mm/filemap.c
index 9276bdb2343c..0604cb02e6f3 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
         VM_BUG_ON_PAGE(!PageLocked(new), new);
         VM_BUG_ON_PAGE(new->mapping, new);
 
-        error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
+        error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
         if (!error) {
                 struct address_space *mapping = old->mapping;
                 void (*freepage)(struct page *);
@@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page,
                         return error;
         }
 
-        error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
+        error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
         if (error) {
                 if (!huge)
                         mem_cgroup_cancel_charge(page, memcg, false);
@@ -1585,8 +1585,7 @@ no_page:
                 if (fgp_flags & FGP_ACCESSED)
                         __SetPageReferenced(page);
 
-                err = add_to_page_cache_lru(page, mapping, offset,
-                                gfp_mask & GFP_RECLAIM_MASK);
+                err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
                 if (unlikely(err)) {
                         put_page(page);
                         page = NULL;
@@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
                 if (!page)
                         return -ENOMEM;
 
-                ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
+                ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
                 if (ret == 0)
                         ret = mapping->a_ops->readpage(file, page);
                 else if (ret == -EEXIST)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 14ed6ee5e02f..a3a1815f8e11 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2925,7 +2925,10 @@ void remove_migration_pmd(struct page_vma_mapped_walk *pvmw, struct page *new)
                 pmde = maybe_pmd_mkwrite(pmde, vma);
 
         flush_cache_range(vma, mmun_start, mmun_start + HPAGE_PMD_SIZE);
-        page_add_anon_rmap(new, vma, mmun_start, true);
+        if (PageAnon(new))
+                page_add_anon_rmap(new, vma, mmun_start, true);
+        else
+                page_add_file_rmap(new, true);
         set_pmd_at(mm, mmun_start, pvmw->pmd, pmde);
         if (vma->vm_flags & VM_LOCKED)
                 mlock_vma_page(new);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index e074f7c637aa..2bd3df3d101a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2192,7 +2192,7 @@ static void __memcg_schedule_kmem_cache_create(struct mem_cgroup *memcg,
 {
         struct memcg_kmem_cache_create_work *cw;
 
-        cw = kmalloc(sizeof(*cw), GFP_NOWAIT);
+        cw = kmalloc(sizeof(*cw), GFP_NOWAIT | __GFP_NOWARN);
         if (!cw)
                 return;
 
diff --git a/mm/migrate.c b/mm/migrate.c
index f65dd69e1fd1..568433023831 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -472,7 +472,7 @@ int migrate_page_move_mapping(struct address_space *mapping,
         pslot = radix_tree_lookup_slot(&mapping->i_pages,
                                         page_index(page));
 
-        expected_count += 1 + page_has_private(page);
+        expected_count += hpage_nr_pages(page) + page_has_private(page);
         if (page_count(page) != expected_count ||
                 radix_tree_deref_slot_protected(pslot,
                                         &mapping->i_pages.xa_lock) != page) {
@@ -505,7 +505,7 @@ int migrate_page_move_mapping(struct address_space *mapping,
          */
         newpage->index = page->index;
         newpage->mapping = page->mapping;
-        get_page(newpage);      /* add cache reference */
+        page_ref_add(newpage, hpage_nr_pages(page)); /* add cache reference */
         if (PageSwapBacked(page)) {
                 __SetPageSwapBacked(newpage);
                 if (PageSwapCache(page)) {
@@ -524,13 +524,26 @@ int migrate_page_move_mapping(struct address_space *mapping,
         }
 
         radix_tree_replace_slot(&mapping->i_pages, pslot, newpage);
+        if (PageTransHuge(page)) {
+                int i;
+                int index = page_index(page);
+
+                for (i = 0; i < HPAGE_PMD_NR; i++) {
+                        pslot = radix_tree_lookup_slot(&mapping->i_pages,
+                                                       index + i);
+                        radix_tree_replace_slot(&mapping->i_pages, pslot,
+                                                newpage + i);
+                }
+        } else {
+                radix_tree_replace_slot(&mapping->i_pages, pslot, newpage);
+        }
 
         /*
          * Drop cache reference from old page by unfreezing
          * to one less reference.
          * We know this isn't the last reference.
          */
-        page_ref_unfreeze(page, expected_count - 1);
+        page_ref_unfreeze(page, expected_count - hpage_nr_pages(page));
 
         xa_unlock(&mapping->i_pages);
         /* Leave irq disabled to prevent preemption while updating stats */
@@ -1622,6 +1635,9 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
                 current_node = NUMA_NO_NODE;
         }
 out_flush:
+        if (list_empty(&pagelist))
+                return err;
+
         /* Make sure we do not overwrite the existing error */
         err1 = do_move_pages_to_node(mm, &pagelist, current_node);
         if (!err1)
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 5c1a3279e63f..337c6afb3345 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2502,13 +2502,13 @@ void account_page_redirty(struct page *page)
         if (mapping && mapping_cap_account_dirty(mapping)) {
                 struct inode *inode = mapping->host;
                 struct bdi_writeback *wb;
-                bool locked;
+                struct wb_lock_cookie cookie = {};
 
-                wb = unlocked_inode_to_wb_begin(inode, &locked);
+                wb = unlocked_inode_to_wb_begin(inode, &cookie);
                 current->nr_dirtied--;
                 dec_node_page_state(page, NR_DIRTIED);
                 dec_wb_stat(wb, WB_DIRTIED);
-                unlocked_inode_to_wb_end(inode, locked);
+                unlocked_inode_to_wb_end(inode, &cookie);
         }
 }
 EXPORT_SYMBOL(account_page_redirty);
@@ -2614,15 +2614,15 @@ void __cancel_dirty_page(struct page *page)
         if (mapping_cap_account_dirty(mapping)) {
                 struct inode *inode = mapping->host;
                 struct bdi_writeback *wb;
-                bool locked;
+                struct wb_lock_cookie cookie = {};
 
                 lock_page_memcg(page);
-                wb = unlocked_inode_to_wb_begin(inode, &locked);
+                wb = unlocked_inode_to_wb_begin(inode, &cookie);
 
                 if (TestClearPageDirty(page))
                         account_page_cleaned(page, mapping, wb);
 
-                unlocked_inode_to_wb_end(inode, locked);
+                unlocked_inode_to_wb_end(inode, &cookie);
                 unlock_page_memcg(page);
         } else {
                 ClearPageDirty(page);
@@ -2654,7 +2654,7 @@ int clear_page_dirty_for_io(struct page *page)
         if (mapping && mapping_cap_account_dirty(mapping)) {
                 struct inode *inode = mapping->host;
                 struct bdi_writeback *wb;
-                bool locked;
+                struct wb_lock_cookie cookie = {};
 
                 /*
                  * Yes, Virginia, this is indeed insane.
@@ -2691,14 +2691,14 @@ int clear_page_dirty_for_io(struct page *page)
                  * always locked coming in here, so we get the desired
                  * exclusion.
                  */
-                wb = unlocked_inode_to_wb_begin(inode, &locked);
+                wb = unlocked_inode_to_wb_begin(inode, &cookie);
                 if (TestClearPageDirty(page)) {
                         dec_lruvec_page_state(page, NR_FILE_DIRTY);
                         dec_zone_page_state(page, NR_ZONE_WRITE_PENDING);
                         dec_wb_stat(wb, WB_RECLAIMABLE);
                         ret = 1;
                 }
-                unlocked_inode_to_wb_end(inode, locked);
+                unlocked_inode_to_wb_end(inode, &cookie);
                 return ret;
         }
         return TestClearPageDirty(page);
diff --git a/mm/rmap.c b/mm/rmap.c
index f0dd4e4565bc..8d5337fed37b 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1374,9 +1374,6 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                 if (!pvmw.pte && (flags & TTU_MIGRATION)) {
                         VM_BUG_ON_PAGE(PageHuge(page) || !PageTransCompound(page), page);
 
-                        if (!PageAnon(page))
-                                continue;
-
                         set_pmd_migration_entry(&pvmw, page);
                         continue;
                 }