Merge branch 'akpm' (patches from Andrew)

Merge misc fixes from Andrew Morton:
 "15 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mm: numa: mark huge PTEs young when clearing NUMA hinting faults
  mm: numa: slow PTE scan rate if migration failures occur
  mm: numa: preserve PTE write permissions across a NUMA hinting fault
  mm: numa: group related processes based on VMA flags instead of page table flags
  hfsplus: fix B-tree corruption after insertion at position 0
  MAINTAINERS: add Jan as DMI/SMBIOS support maintainer
  fs/affs/file.c: unlock/release page on error
  mm/page_alloc.c: call kernel_map_pages in unset_migrateype_isolate
  mm/slub: fix lockups on PREEMPT && !SMP kernels
  mm/memory hotplug: postpone the reset of obsolete pgdat
  MAINTAINERS: correct rtc armada38x pattern entry
  mm/pagewalk.c: prevent positive return value of walk_page_test() from being passed to callers
  mm: fix anon_vma->degree underflow in anon_vma endless growing prevention
  drivers/rtc/rtc-mrst: fix suspend/resume
  aoe: update aoe maintainer information

9 files changed, 53 insertions, 38 deletions

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 626e93db28ba..6817b0350c71 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1260,6 +1260,7 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         int target_nid, last_cpupid = -1;
         bool page_locked;
         bool migrated = false;
+        bool was_writable;
         int flags = 0;
 
         /* A PROT_NONE fault should not end up here */
@@ -1291,17 +1292,8 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 flags |= TNF_FAULT_LOCAL;
         }
 
-        /*
-         * Avoid grouping on DSO/COW pages in specific and RO pages
-         * in general, RO pages shouldn't hurt as much anyway since
-         * they can be in shared cache state.
-         *
-         * FIXME! This checks "pmd_dirty()" as an approximation of
-         * "is this a read-only page", since checking "pmd_write()"
-         * is even more broken. We haven't actually turned this into
-         * a writable page, so pmd_write() will always be false.
-         */
-        if (!pmd_dirty(pmd))
+        /* See similar comment in do_numa_page for explanation */
+        if (!(vma->vm_flags & VM_WRITE))
                 flags |= TNF_NO_GROUP;
 
         /*
@@ -1358,12 +1350,17 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         if (migrated) {
                 flags |= TNF_MIGRATED;
                 page_nid = target_nid;
-        }
+        } else
+                flags |= TNF_MIGRATE_FAIL;
 
         goto out;
 clear_pmdnuma:
         BUG_ON(!PageLocked(page));
+        was_writable = pmd_write(pmd);
         pmd = pmd_modify(pmd, vma->vm_page_prot);
+        pmd = pmd_mkyoung(pmd);
+        if (was_writable)
+                pmd = pmd_mkwrite(pmd);
         set_pmd_at(mm, haddr, pmdp, pmd);
         update_mmu_cache_pmd(vma, addr, pmdp);
         unlock_page(page);
@@ -1487,6 +1484,7 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 
         if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
                 pmd_t entry;
+                bool preserve_write = prot_numa && pmd_write(*pmd);
                 ret = 1;
 
                 /*
@@ -1502,9 +1500,11 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                 if (!prot_numa || !pmd_protnone(*pmd)) {
                         entry = pmdp_get_and_clear_notify(mm, addr, pmd);
                         entry = pmd_modify(entry, newprot);
+                        if (preserve_write)
+                                entry = pmd_mkwrite(entry);
                         ret = HPAGE_PMD_NR;
                         set_pmd_at(mm, addr, pmd, entry);
-                        BUG_ON(pmd_write(entry));
+                        BUG_ON(!preserve_write && pmd_write(entry));
                 }
                 spin_unlock(ptl);
         }
diff --git a/mm/memory.c b/mm/memory.c
index 411144f977b1..97839f5c8c30 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3035,6 +3035,7 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         int last_cpupid;
         int target_nid;
         bool migrated = false;
+        bool was_writable = pte_write(pte);
         int flags = 0;
 
         /* A PROT_NONE fault should not end up here */
@@ -3059,6 +3060,8 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         /* Make it present again */
         pte = pte_modify(pte, vma->vm_page_prot);
         pte = pte_mkyoung(pte);
+        if (was_writable)
+                pte = pte_mkwrite(pte);
         set_pte_at(mm, addr, ptep, pte);
         update_mmu_cache(vma, addr, ptep);
 
@@ -3069,16 +3072,14 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         }
 
         /*
-         * Avoid grouping on DSO/COW pages in specific and RO pages
-         * in general, RO pages shouldn't hurt as much anyway since
-         * they can be in shared cache state.
-         *
-         * FIXME! This checks "pmd_dirty()" as an approximation of
-         * "is this a read-only page", since checking "pmd_write()"
-         * is even more broken. We haven't actually turned this into
-         * a writable page, so pmd_write() will always be false.
+         * Avoid grouping on RO pages in general. RO pages shouldn't hurt as
+         * much anyway since they can be in shared cache state. This misses
+         * the case where a mapping is writable but the process never writes
+         * to it but pte_write gets cleared during protection updates and
+         * pte_dirty has unpredictable behaviour between PTE scan updates,
+         * background writeback, dirty balancing and application behaviour.
          */
-        if (!pte_dirty(pte))
+        if (!(vma->vm_flags & VM_WRITE))
                 flags |= TNF_NO_GROUP;
 
         /*
@@ -3102,7 +3103,8 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         if (migrated) {
                 page_nid = target_nid;
                 flags |= TNF_MIGRATED;
-        }
+        } else
+                flags |= TNF_MIGRATE_FAIL;
 
 out:
         if (page_nid != -1)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9fab10795bea..65842d688b7c 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1092,6 +1092,10 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
                         return NULL;
 
                 arch_refresh_nodedata(nid, pgdat);
+        } else {
+                /* Reset the nr_zones and classzone_idx to 0 before reuse */
+                pgdat->nr_zones = 0;
+                pgdat->classzone_idx = 0;
         }
 
         /* we can use NODE_DATA(nid) from here */
@@ -1977,15 +1981,6 @@ void try_offline_node(int nid)
                 if (is_vmalloc_addr(zone->wait_table))
                         vfree(zone->wait_table);
         }
-
-        /*
-         * Since there is no way to guarentee the address of pgdat/zone is not
-         * on stack of any kernel threads or used by other kernel objects
-         * without reference counting or other symchronizing method, do not
-         * reset node_data and free pgdat here. Just reset it to 0 and reuse
-         * the memory when the node is online again.
-         */
-        memset(pgdat, 0, sizeof(*pgdat));
 }
 EXPORT_SYMBOL(try_offline_node);
 
diff --git a/mm/mmap.c b/mm/mmap.c
index da9990acc08b..9ec50a368634 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -774,10 +774,8 @@ again:			remove_next = 1 + (end > next->vm_end);
 
                         importer->anon_vma = exporter->anon_vma;
                         error = anon_vma_clone(importer, exporter);
-                        if (error) {
-                                importer->anon_vma = NULL;
+                        if (error)
                                 return error;
-                        }
                 }
         }
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 44727811bf4c..88584838e704 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -75,6 +75,7 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                 oldpte = *pte;
                 if (pte_present(oldpte)) {
                         pte_t ptent;
+                        bool preserve_write = prot_numa && pte_write(oldpte);
 
                         /*
                          * Avoid trapping faults against the zero or KSM
@@ -94,6 +95,8 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
 
                         ptent = ptep_modify_prot_start(mm, addr, pte);
                         ptent = pte_modify(ptent, newprot);
+                        if (preserve_write)
+                                ptent = pte_mkwrite(ptent);
 
                         /* Avoid taking write faults for known dirty pages */
                         if (dirty_accountable && pte_dirty(ptent) &&
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index 72f5ac381ab3..755a42c76eb4 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -103,6 +103,7 @@ void unset_migratetype_isolate(struct page *page, unsigned migratetype)
 
                         if (!is_migrate_isolate_page(buddy)) {
                                 __isolate_free_page(page, order);
+                                kernel_map_pages(page, (1 << order), 1);
                                 set_page_refcounted(page);
                                 isolated_page = page;
                         }
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 75c1f2878519..29f2f8b853ae 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -265,8 +265,15 @@ int walk_page_range(unsigned long start, unsigned long end,
                         vma = vma->vm_next;
 
                         err = walk_page_test(start, next, walk);
-                        if (err > 0)
+                        if (err > 0) {
+                                /*
+                                 * positive return values are purely for
+                                 * controlling the pagewalk, so should never
+                                 * be passed to the callers.
+                                 */
+                                err = 0;
                                 continue;
+                        }
                         if (err < 0)
                                 break;
                 }
diff --git a/mm/rmap.c b/mm/rmap.c
index 5e3e09081164..c161a14b6a8f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -287,6 +287,13 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
         return 0;
 
  enomem_failure:
+        /*
+         * dst->anon_vma is dropped here otherwise its degree can be incorrectly
+         * decremented in unlink_anon_vmas().
+         * We can safely do this because callers of anon_vma_clone() don't care
+         * about dst->anon_vma if anon_vma_clone() failed.
+         */
+        dst->anon_vma = NULL;
         unlink_anon_vmas(dst);
         return -ENOMEM;
 }
diff --git a/mm/slub.c b/mm/slub.c
index 6832c4eab104..82c473780c91 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2449,7 +2449,8 @@ redo:
         do {
                 tid = this_cpu_read(s->cpu_slab->tid);
                 c = raw_cpu_ptr(s->cpu_slab);
-        } while (IS_ENABLED(CONFIG_PREEMPT) && unlikely(tid != c->tid));
+        } while (IS_ENABLED(CONFIG_PREEMPT) &&
+                 unlikely(tid != READ_ONCE(c->tid)));
 
         /*
          * Irqless object alloc/free algorithm used here depends on sequence
@@ -2718,7 +2719,8 @@ redo:
         do {
                 tid = this_cpu_read(s->cpu_slab->tid);
                 c = raw_cpu_ptr(s->cpu_slab);
-        } while (IS_ENABLED(CONFIG_PREEMPT) && unlikely(tid != c->tid));
+        } while (IS_ENABLED(CONFIG_PREEMPT) &&
+                 unlikely(tid != READ_ONCE(c->tid)));
 
         /* Same with comment on barrier() in slab_alloc_node() */
         barrier();