23 files changed, 73 insertions, 18 deletions

diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 225d1c58d2de..d9c299133111 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -338,6 +338,7 @@ static struct vm_area_struct gate_vma = {
 
 static int __init gate_vma_init(void)
 {
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_page_prot = PAGE_READONLY_EXEC;
         return 0;
 }
diff --git a/arch/arm/mach-rpc/ecard.c b/arch/arm/mach-rpc/ecard.c
index 39aef4876ed4..8db62cc54a6a 100644
--- a/arch/arm/mach-rpc/ecard.c
+++ b/arch/arm/mach-rpc/ecard.c
@@ -237,8 +237,8 @@ static void ecard_init_pgtables(struct mm_struct *mm)
 
         memcpy(dst_pgd, src_pgd, sizeof(pgd_t) * (EASI_SIZE / PGDIR_SIZE));
 
+        vma_init(&vma, mm);
         vma.vm_flags = VM_EXEC;
-        vma.vm_mm = mm;
 
         flush_tlb_range(&vma, IO_START, IO_START + IO_SIZE);
         flush_tlb_range(&vma, EASI_START, EASI_START + EASI_SIZE);
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index ffdaea7954bb..d87f2d646caa 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -37,7 +37,9 @@ static inline void __tlb_remove_table(void *_table)
 
 static inline void tlb_flush(struct mmu_gather *tlb)
 {
-        struct vm_area_struct vma = { .vm_mm = tlb->mm, };
+        struct vm_area_struct vma;
+
+        vma_init(&vma, tlb->mm);
 
         /*
          * The ASID allocator will either invalidate the ASID or mark
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index ecc6818191df..1854e49aa18a 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -108,11 +108,13 @@ static pte_t get_clear_flush(struct mm_struct *mm,
                              unsigned long pgsize,
                              unsigned long ncontig)
 {
-        struct vm_area_struct vma = { .vm_mm = mm };
+        struct vm_area_struct vma;
         pte_t orig_pte = huge_ptep_get(ptep);
         bool valid = pte_valid(orig_pte);
         unsigned long i, saddr = addr;
 
+        vma_init(&vma, mm);
+
         for (i = 0; i < ncontig; i++, addr += pgsize, ptep++) {
                 pte_t pte = ptep_get_and_clear(mm, addr, ptep);
 
@@ -145,9 +147,10 @@ static void clear_flush(struct mm_struct *mm,
                              unsigned long pgsize,
                              unsigned long ncontig)
 {
-        struct vm_area_struct vma = { .vm_mm = mm };
+        struct vm_area_struct vma;
         unsigned long i, saddr = addr;
 
+        vma_init(&vma, mm);
         for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
                 pte_clear(mm, addr, ptep);
 
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index 44f0ac0df308..db89e7306081 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -120,7 +120,7 @@ ia64_tlb_flush_mmu_tlbonly(struct mmu_gather *tlb, unsigned long start, unsigned
                  */
                 struct vm_area_struct vma;
 
-                vma.vm_mm = tlb->mm;
+                vma_init(&vma, tlb->mm);
                 /* flush the address range from the tlb: */
                 flush_tlb_range(&vma, start, end);
                 /* now flush the virt. page-table area mapping the address range: */
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index bdb14a369137..e6c6dfd98de2 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -273,7 +273,7 @@ static struct vm_area_struct gate_vma;
 
 static int __init gate_vma_init(void)
 {
-        gate_vma.vm_mm = NULL;
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_start = FIXADDR_USER_START;
         gate_vma.vm_end = FIXADDR_USER_END;
         gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index d594690d8b95..6b8f11521c41 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -890,7 +890,7 @@ static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache,
         if (cache->nobjs >= min)
                 return 0;
         while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
-                page = (void *)__get_free_page(GFP_KERNEL);
+                page = (void *)__get_free_page(GFP_KERNEL_ACCOUNT);
                 if (!page)
                         return -ENOMEM;
                 cache->objects[cache->nobjs++] = page;
diff --git a/arch/x86/um/mem_32.c b/arch/x86/um/mem_32.c
index 744afdc18cf3..56c44d865f7b 100644
--- a/arch/x86/um/mem_32.c
+++ b/arch/x86/um/mem_32.c
@@ -16,7 +16,7 @@ static int __init gate_vma_init(void)
         if (!FIXADDR_USER_START)
                 return 0;
 
-        gate_vma.vm_mm = NULL;
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_start = FIXADDR_USER_START;
         gate_vma.vm_end = FIXADDR_USER_END;
         gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index ffeb60d3434c..df66a9dd0aae 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -708,6 +708,7 @@ static int mmap_zero(struct file *file, struct vm_area_struct *vma)
 #endif
         if (vma->vm_flags & VM_SHARED)
                 return shmem_zero_setup(vma);
+        vma_set_anonymous(vma);
         return 0;
 }
 
diff --git a/fs/exec.c b/fs/exec.c
index 72e961a62adb..bdd0eacefdf5 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -293,6 +293,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
         bprm->vma = vma = vm_area_alloc(mm);
         if (!vma)
                 return -ENOMEM;
+        vma_set_anonymous(vma);
 
         if (down_write_killable(&mm->mmap_sem)) {
                 err = -EINTR;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index d508c7844681..40d4c66c7751 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -411,6 +411,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
         bool truncate_op = (lend == LLONG_MAX);
 
         memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
+        vma_init(&pseudo_vma, current->mm);
         pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
         pagevec_init(&pvec);
         next = start;
@@ -595,6 +596,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
          * as input to create an allocation policy.
          */
         memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
+        vma_init(&pseudo_vma, mm);
         pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
         pseudo_vma.vm_file = file;
 
diff --git a/include/linux/delayacct.h b/include/linux/delayacct.h
index e6c0448ebcc7..31c865d1842e 100644
--- a/include/linux/delayacct.h
+++ b/include/linux/delayacct.h
@@ -124,7 +124,7 @@ static inline void delayacct_blkio_start(void)
 
 static inline void delayacct_blkio_end(struct task_struct *p)
 {
-        if (current->delays)
+        if (p->delays)
                 __delayacct_blkio_end(p);
         delayacct_clear_flag(DELAYACCT_PF_BLKIO);
 }
diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
index 7094718b653b..ffcc7724ca21 100644
--- a/include/linux/eventfd.h
+++ b/include/linux/eventfd.h
@@ -11,6 +11,7 @@
 
 #include <linux/fcntl.h>
 #include <linux/wait.h>
+#include <linux/err.h>
 
 /*
  * CAREFUL: Check include/uapi/asm-generic/fcntl.h when defining
diff --git a/include/linux/mm.h b/include/linux/mm.h
index d3a3842316b8..7ba6d356d18f 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -452,6 +452,20 @@ struct vm_operations_struct {
                                           unsigned long addr);
 };
 
+static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm)
+{
+        static const struct vm_operations_struct dummy_vm_ops = {};
+
+        vma->vm_mm = mm;
+        vma->vm_ops = &dummy_vm_ops;
+        INIT_LIST_HEAD(&vma->anon_vma_chain);
+}
+
+static inline void vma_set_anonymous(struct vm_area_struct *vma)
+{
+        vma->vm_ops = NULL;
+}
+
 struct mmu_gather;
 struct inode;
 
diff --git a/ipc/sem.c b/ipc/sem.c
index 5af1943ad782..76e95e4f3aa2 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -2118,7 +2118,7 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
         }
 
         do {
-                queue.status = -EINTR;
+                WRITE_ONCE(queue.status, -EINTR);
                 queue.sleeper = current;
 
                 __set_current_state(TASK_INTERRUPTIBLE);
diff --git a/kernel/fork.c b/kernel/fork.c
index a191c05e757d..1b27babc4c78 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -312,10 +312,8 @@ struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
 {
         struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
 
-        if (vma) {
-                vma->vm_mm = mm;
-                INIT_LIST_HEAD(&vma->anon_vma_chain);
-        }
+        if (vma)
+                vma_init(vma, mm);
         return vma;
 }
 
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 5857267a4af5..38283363da06 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -176,10 +176,27 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
         unsigned long pfn, pgoff, order;
         pgprot_t pgprot = PAGE_KERNEL;
         int error, nid, is_ram;
+        struct dev_pagemap *conflict_pgmap;
 
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
                 - align_start;
+        align_end = align_start + align_size - 1;
+
+        conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_start), NULL);
+        if (conflict_pgmap) {
+                dev_WARN(dev, "Conflicting mapping in same section\n");
+                put_dev_pagemap(conflict_pgmap);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_end), NULL);
+        if (conflict_pgmap) {
+                dev_WARN(dev, "Conflicting mapping in same section\n");
+                put_dev_pagemap(conflict_pgmap);
+                return ERR_PTR(-ENOMEM);
+        }
+
         is_ram = region_intersects(align_start, align_size,
                 IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE);
 
@@ -199,7 +216,6 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
 
         mutex_lock(&pgmap_lock);
         error = 0;
-        align_end = align_start + align_size - 1;
 
         foreach_order_pgoff(res, order, pgoff) {
                 error = __radix_tree_insert(&pgmap_radix,
@@ -305,7 +321,7 @@ EXPORT_SYMBOL_GPL(get_dev_pagemap);
 
 #ifdef CONFIG_DEV_PAGEMAP_OPS
 DEFINE_STATIC_KEY_FALSE(devmap_managed_key);
-EXPORT_SYMBOL_GPL(devmap_managed_key);
+EXPORT_SYMBOL(devmap_managed_key);
 static atomic_t devmap_enable;
 
 /*
@@ -346,5 +362,5 @@ void __put_devmap_managed_page(struct page *page)
         } else if (!count)
                 __put_page(page);
 }
-EXPORT_SYMBOL_GPL(__put_devmap_managed_page);
+EXPORT_SYMBOL(__put_devmap_managed_page);
 #endif /* CONFIG_DEV_PAGEMAP_OPS */
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index c253c1b46c6b..befb127507c0 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -5,7 +5,7 @@ if HAVE_ARCH_KASAN
 
 config KASAN
         bool "KASan: runtime memory debugger"
-        depends on SLUB || (SLAB && !DEBUG_SLAB)
+        depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB)
         select SLUB_DEBUG if SLUB
         select CONSTRUCTORS
         select STACKDEPOT
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 9ac49ef17b4e..01f1a14facc4 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2505,6 +2505,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
 
                 /* Create pseudo-vma that contains just the policy */
                 memset(&pvma, 0, sizeof(struct vm_area_struct));
+                vma_init(&pvma, NULL);
                 pvma.vm_end = TASK_SIZE;        /* policy covers entire file */
                 mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
 
diff --git a/mm/mmap.c b/mm/mmap.c
index ff1944d8d458..17bbf4d3e24f 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1778,6 +1778,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
                 error = shmem_zero_setup(vma);
                 if (error)
                         goto free_vma;
+        } else {
+                vma_set_anonymous(vma);
         }
 
         vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -2983,6 +2985,7 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla
                 return -ENOMEM;
         }
 
+        vma_set_anonymous(vma);
         vma->vm_start = addr;
         vma->vm_end = addr + len;
         vma->vm_pgoff = pgoff;
diff --git a/mm/nommu.c b/mm/nommu.c
index 1d22fdbf7d7c..9fc9e43335b6 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1145,6 +1145,8 @@ static int do_mmap_private(struct vm_area_struct *vma,
                 if (ret < len)
                         memset(base + ret, 0, len - ret);
 
+        } else {
+                vma_set_anonymous(vma);
         }
 
         return 0;
diff --git a/mm/shmem.c b/mm/shmem.c
index 2cab84403055..41b9bbf24e16 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1421,6 +1421,7 @@ static void shmem_pseudo_vma_init(struct vm_area_struct *vma,
 {
         /* Create a pseudo vma that just contains the policy */
         memset(vma, 0, sizeof(*vma));
+        vma_init(vma, NULL);
         /* Bias interleave by inode number to distribute better across nodes */
         vma->vm_pgoff = index + info->vfs_inode.i_ino;
         vma->vm_policy = mpol_shared_policy_lookup(&info->policy, index);
diff --git a/mm/zswap.c b/mm/zswap.c
index 7d34e69507e3..cd91fd9d96b8 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1026,6 +1026,15 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset,
                         ret = -ENOMEM;
                         goto reject;
                 }
+
+                /* A second zswap_is_full() check after
+                 * zswap_shrink() to make sure it's now
+                 * under the max_pool_percent
+                 */
+                if (zswap_is_full()) {
+                        ret = -ENOMEM;
+                        goto reject;
+                }
         }
 
         /* allocate entry */