4 files changed, 35 insertions, 28 deletions

diff --git a/lib/ioremap.c b/lib/ioremap.c
index 86c8911b0e3a..a3e14ce92a56 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -144,4 +144,3 @@ int ioremap_page_range(unsigned long addr,
 
         return err;
 }
-EXPORT_SYMBOL_GPL(ioremap_page_range);
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 25f572303801..e68604ae3ced 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -730,43 +730,50 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
 }
 EXPORT_SYMBOL(iov_iter_copy_from_user_atomic);
 
+static inline void pipe_truncate(struct iov_iter *i)
+{
+        struct pipe_inode_info *pipe = i->pipe;
+        if (pipe->nrbufs) {
+                size_t off = i->iov_offset;
+                int idx = i->idx;
+                int nrbufs = (idx - pipe->curbuf) & (pipe->buffers - 1);
+                if (off) {
+                        pipe->bufs[idx].len = off - pipe->bufs[idx].offset;
+                        idx = next_idx(idx, pipe);
+                        nrbufs++;
+                }
+                while (pipe->nrbufs > nrbufs) {
+                        pipe_buf_release(pipe, &pipe->bufs[idx]);
+                        idx = next_idx(idx, pipe);
+                        pipe->nrbufs--;
+                }
+        }
+}
+
 static void pipe_advance(struct iov_iter *i, size_t size)
 {
         struct pipe_inode_info *pipe = i->pipe;
-        struct pipe_buffer *buf;
-        int idx = i->idx;
-        size_t off = i->iov_offset, orig_sz;
-        
         if (unlikely(i->count < size))
                 size = i->count;
-        orig_sz = size;
-
         if (size) {
+                struct pipe_buffer *buf;
+                size_t off = i->iov_offset, left = size;
+                int idx = i->idx;
                 if (off) /* make it relative to the beginning of buffer */
-                        size += off - pipe->bufs[idx].offset;
+                        left += off - pipe->bufs[idx].offset;
                 while (1) {
                         buf = &pipe->bufs[idx];
-                        if (size <= buf->len)
+                        if (left <= buf->len)
                                 break;
-                        size -= buf->len;
+                        left -= buf->len;
                         idx = next_idx(idx, pipe);
                 }
-                buf->len = size;
                 i->idx = idx;
-                off = i->iov_offset = buf->offset + size;
-        }
-        if (off)
-                idx = next_idx(idx, pipe);
-        if (pipe->nrbufs) {
-                int unused = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
-                /* [curbuf,unused) is in use.  Free [idx,unused) */
-                while (idx != unused) {
-                        pipe_buf_release(pipe, &pipe->bufs[idx]);
-                        idx = next_idx(idx, pipe);
-                        pipe->nrbufs--;
-                }
+                i->iov_offset = buf->offset + left;
         }
-        i->count -= orig_sz;
+        i->count -= size;
+        /* ... and discard everything past that point */
+        pipe_truncate(i);
 }
 
 void iov_iter_advance(struct iov_iter *i, size_t size)
@@ -826,6 +833,7 @@ void iov_iter_pipe(struct iov_iter *i, int direction,
                         size_t count)
 {
         BUG_ON(direction != ITER_PIPE);
+        WARN_ON(pipe->nrbufs == pipe->buffers);
         i->type = direction;
         i->pipe = pipe;
         i->idx = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 0b92d605fb69..84812a9fb16f 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -769,7 +769,7 @@ static void radix_tree_free_nodes(struct radix_tree_node *node)
                         struct radix_tree_node *old = child;
                         offset = child->offset + 1;
                         child = child->parent;
-                        WARN_ON_ONCE(!list_empty(&node->private_list));
+                        WARN_ON_ONCE(!list_empty(&old->private_list));
                         radix_tree_node_free(old);
                         if (old == entry_to_node(node))
                                 return;
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 975b8fc4f1e1..a8d74a733a38 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -483,11 +483,11 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev,
                     : 1UL << (BITS_PER_LONG - IO_TLB_SHIFT);
 
         /*
-         * For mappings greater than a page, we limit the stride (and
-         * hence alignment) to a page size.
+         * For mappings greater than or equal to a page, we limit the stride
+         * (and hence alignment) to a page size.
          */
         nslots = ALIGN(size, 1 << IO_TLB_SHIFT) >> IO_TLB_SHIFT;
-        if (size > PAGE_SIZE)
+        if (size >= PAGE_SIZE)
                 stride = (1 << (PAGE_SHIFT - IO_TLB_SHIFT));
         else
                 stride = 1;