Merge branch 'akpm' (patches from Andrew)

Merge misc fixes from Andrew Morton:
 "16 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mm/memblock.c: fix a typo in __next_mem_pfn_range() comments
  mm, page_alloc: check for max order in hot path
  scripts/spdxcheck.py: make python3 compliant
  tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
  lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn
  mm/vmstat.c: fix NUMA statistics updates
  mm/gup.c: fix follow_page_mask() kerneldoc comment
  ocfs2: free up write context when direct IO failed
  scripts/faddr2line: fix location of start_kernel in comment
  mm: don't reclaim inodes with many attached pages
  mm, memory_hotplug: check zone_movable in has_unmovable_pages
  mm/swapfile.c: use kvzalloc for swap_info_struct allocation
  MAINTAINERS: update OMAP MMC entry
  hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!
  kernel/sched/psi.c: simplify cgroup_move_task()
  z3fold: fix possible reclaim races

1 files changed, 19 insertions, 4 deletions

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index c007fb5fb8d5..7f2a28ab46d5 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3233,7 +3233,7 @@ static int is_hugetlb_entry_hwpoisoned(pte_t pte)
 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                             struct vm_area_struct *vma)
 {
-        pte_t *src_pte, *dst_pte, entry;
+        pte_t *src_pte, *dst_pte, entry, dst_entry;
         struct page *ptepage;
         unsigned long addr;
         int cow;
@@ -3261,15 +3261,30 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                         break;
                 }
 
-                /* If the pagetables are shared don't copy or take references */
-                if (dst_pte == src_pte)
+                /*
+                 * If the pagetables are shared don't copy or take references.
+                 * dst_pte == src_pte is the common case of src/dest sharing.
+                 *
+                 * However, src could have 'unshared' and dst shares with
+                 * another vma.  If dst_pte !none, this implies sharing.
+                 * Check here before taking page table lock, and once again
+                 * after taking the lock below.
+                 */
+                dst_entry = huge_ptep_get(dst_pte);
+                if ((dst_pte == src_pte) || !huge_pte_none(dst_entry))
                         continue;
 
                 dst_ptl = huge_pte_lock(h, dst, dst_pte);
                 src_ptl = huge_pte_lockptr(h, src, src_pte);
                 spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
                 entry = huge_ptep_get(src_pte);
-                if (huge_pte_none(entry)) { /* skip none entry */
+                dst_entry = huge_ptep_get(dst_pte);
+                if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) {
+                        /*
+                         * Skip if src entry none.  Also, skip in the
+                         * unlikely case dst entry !none as this implies
+                         * sharing with another vma.
+                         */
                         ;
                 } else if (unlikely(is_hugetlb_entry_migration(entry) ||
                                     is_hugetlb_entry_hwpoisoned(entry))) {