13 files changed, 135 insertions, 43 deletions

diff --git a/mm/Kconfig b/mm/Kconfig
index 78a23c5c302d..be0ee11fa0d9 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -262,7 +262,14 @@ config COMPACTION
         select MIGRATION
         depends on MMU
         help
-          Allows the compaction of memory for the allocation of huge pages.
+          Compaction is the only memory management component to form
+          high order (larger physically contiguous) memory blocks
+          reliably. The page allocator relies on compaction heavily and
+          the lack of the feature can lead to unexpected OOM killer
+          invocations for high order memory requests. You shouldn't
+          disable this option unless there really is a strong reason for
+          it and then we would be really interested to hear about that at
+          linux-mm@kvack.org.
 
 #
 # support for page migration
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 2373f0a7d340..2db2112aa31e 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1512,7 +1512,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
         struct page *page;
         pgtable_t pgtable;
         pmd_t _pmd;
-        bool young, write, dirty;
+        bool young, write, dirty, soft_dirty;
         unsigned long addr;
         int i;
 
@@ -1546,6 +1546,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
         write = pmd_write(*pmd);
         young = pmd_young(*pmd);
         dirty = pmd_dirty(*pmd);
+        soft_dirty = pmd_soft_dirty(*pmd);
 
         pmdp_huge_split_prepare(vma, haddr, pmd);
         pgtable = pgtable_trans_huge_withdraw(mm, pmd);
@@ -1562,6 +1563,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                         swp_entry_t swp_entry;
                         swp_entry = make_migration_entry(page + i, write);
                         entry = swp_entry_to_pte(swp_entry);
+                        if (soft_dirty)
+                                entry = pte_swp_mksoft_dirty(entry);
                 } else {
                         entry = mk_pte(page + i, vma->vm_page_prot);
                         entry = maybe_mkwrite(entry, vma);
@@ -1569,6 +1572,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                                 entry = pte_wrprotect(entry);
                         if (!young)
                                 entry = pte_mkold(entry);
+                        if (soft_dirty)
+                                entry = pte_mksoft_dirty(entry);
                 }
                 if (dirty)
                         SetPageDirty(page + i);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b9aa1b0b38b0..87e11d8ad536 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1448,6 +1448,7 @@ static void dissolve_free_huge_page(struct page *page)
                 list_del(&page->lru);
                 h->free_huge_pages--;
                 h->free_huge_pages_node[nid]--;
+                h->max_huge_pages--;
                 update_and_free_page(h, page);
         }
         spin_unlock(&hugetlb_lock);
diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index b6728a33a4ac..baabaad4a4aa 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -217,11 +217,8 @@ void quarantine_reduce(void)
         new_quarantine_size = (READ_ONCE(totalram_pages) << PAGE_SHIFT) /
                 QUARANTINE_FRACTION;
         percpu_quarantines = QUARANTINE_PERCPU_SIZE * num_online_cpus();
-        if (WARN_ONCE(new_quarantine_size < percpu_quarantines,
-                "Too little memory, disabling global KASAN quarantine.\n"))
-                new_quarantine_size = 0;
-        else
-                new_quarantine_size -= percpu_quarantines;
+        new_quarantine_size = (new_quarantine_size < percpu_quarantines) ?
+                0 : new_quarantine_size - percpu_quarantines;
         WRITE_ONCE(quarantine_size, new_quarantine_size);
 
         last = global_quarantine.head;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index e74d7080ec9e..9a6a51a7c416 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4077,14 +4077,14 @@ static struct cftype mem_cgroup_legacy_files[] = {
 
 static DEFINE_IDR(mem_cgroup_idr);
 
-static void mem_cgroup_id_get(struct mem_cgroup *memcg)
+static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n)
 {
-        atomic_inc(&memcg->id.ref);
+        atomic_add(n, &memcg->id.ref);
 }
 
-static void mem_cgroup_id_put(struct mem_cgroup *memcg)
+static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n)
 {
-        if (atomic_dec_and_test(&memcg->id.ref)) {
+        if (atomic_sub_and_test(n, &memcg->id.ref)) {
                 idr_remove(&mem_cgroup_idr, memcg->id.id);
                 memcg->id.id = 0;
 
@@ -4093,6 +4093,16 @@ static void mem_cgroup_id_put(struct mem_cgroup *memcg)
         }
 }
 
+static inline void mem_cgroup_id_get(struct mem_cgroup *memcg)
+{
+        mem_cgroup_id_get_many(memcg, 1);
+}
+
+static inline void mem_cgroup_id_put(struct mem_cgroup *memcg)
+{
+        mem_cgroup_id_put_many(memcg, 1);
+}
+
 /**
  * mem_cgroup_from_id - look up a memcg from a memcg id
  * @id: the memcg id to look up
@@ -4727,6 +4737,8 @@ static void __mem_cgroup_clear_mc(void)
                 if (!mem_cgroup_is_root(mc.from))
                         page_counter_uncharge(&mc.from->memsw, mc.moved_swap);
 
+                mem_cgroup_id_put_many(mc.from, mc.moved_swap);
+
                 /*
                  * we charged both to->memory and to->memsw, so we
                  * should uncharge to->memory.
@@ -4734,9 +4746,9 @@ static void __mem_cgroup_clear_mc(void)
                 if (!mem_cgroup_is_root(mc.to))
                         page_counter_uncharge(&mc.to->memory, mc.moved_swap);
 
-                css_put_many(&mc.from->css, mc.moved_swap);
+                mem_cgroup_id_get_many(mc.to, mc.moved_swap);
+                css_put_many(&mc.to->css, mc.moved_swap);
 
-                /* we've already done css_get(mc.to) */
                 mc.moved_swap = 0;
         }
         memcg_oom_recover(from);
@@ -5791,6 +5803,24 @@ static int __init mem_cgroup_init(void)
 subsys_initcall(mem_cgroup_init);
 
 #ifdef CONFIG_MEMCG_SWAP
+static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg)
+{
+        while (!atomic_inc_not_zero(&memcg->id.ref)) {
+                /*
+                 * The root cgroup cannot be destroyed, so it's refcount must
+                 * always be >= 1.
+                 */
+                if (WARN_ON_ONCE(memcg == root_mem_cgroup)) {
+                        VM_BUG_ON(1);
+                        break;
+                }
+                memcg = parent_mem_cgroup(memcg);
+                if (!memcg)
+                        memcg = root_mem_cgroup;
+        }
+        return memcg;
+}
+
 /**
  * mem_cgroup_swapout - transfer a memsw charge to swap
  * @page: page whose memsw charge to transfer
@@ -5800,7 +5830,7 @@ subsys_initcall(mem_cgroup_init);
  */
 void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
 {
-        struct mem_cgroup *memcg;
+        struct mem_cgroup *memcg, *swap_memcg;
         unsigned short oldid;
 
         VM_BUG_ON_PAGE(PageLRU(page), page);
@@ -5815,16 +5845,27 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
         if (!memcg)
                 return;
 
-        mem_cgroup_id_get(memcg);
-        oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
+        /*
+         * In case the memcg owning these pages has been offlined and doesn't
+         * have an ID allocated to it anymore, charge the closest online
+         * ancestor for the swap instead and transfer the memory+swap charge.
+         */
+        swap_memcg = mem_cgroup_id_get_online(memcg);
+        oldid = swap_cgroup_record(entry, mem_cgroup_id(swap_memcg));
         VM_BUG_ON_PAGE(oldid, page);
-        mem_cgroup_swap_statistics(memcg, true);
+        mem_cgroup_swap_statistics(swap_memcg, true);
 
         page->mem_cgroup = NULL;
 
         if (!mem_cgroup_is_root(memcg))
                 page_counter_uncharge(&memcg->memory, 1);
 
+        if (memcg != swap_memcg) {
+                if (!mem_cgroup_is_root(swap_memcg))
+                        page_counter_charge(&swap_memcg->memsw, 1);
+                page_counter_uncharge(&memcg->memsw, 1);
+        }
+
         /*
          * Interrupts should be disabled here because the caller holds the
          * mapping->tree_lock lock which is taken with interrupts-off. It is
@@ -5863,11 +5904,14 @@ int mem_cgroup_try_charge_swap(struct page *page, swp_entry_t entry)
         if (!memcg)
                 return 0;
 
+        memcg = mem_cgroup_id_get_online(memcg);
+
         if (!mem_cgroup_is_root(memcg) &&
-            !page_counter_try_charge(&memcg->swap, 1, &counter))
+            !page_counter_try_charge(&memcg->swap, 1, &counter)) {
+                mem_cgroup_id_put(memcg);
                 return -ENOMEM;
+        }
 
-        mem_cgroup_id_get(memcg);
         oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
         VM_BUG_ON_PAGE(oldid, page);
         mem_cgroup_swap_statistics(memcg, true);
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 3894b65b1555..41266dc29f33 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1219,6 +1219,7 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
 
         /* init node's zones as empty zones, we don't have any present pages.*/
         free_area_init_node(nid, zones_size, start_pfn, zholes_size);
+        pgdat->per_cpu_nodestats = alloc_percpu(struct per_cpu_nodestat);
 
         /*
          * The node we allocated has no zone fallback lists. For avoiding
@@ -1249,6 +1250,7 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
 static void rollback_node_hotadd(int nid, pg_data_t *pgdat)
 {
         arch_refresh_nodedata(nid, NULL);
+        free_percpu(pgdat->per_cpu_nodestats);
         arch_free_nodedata(pgdat);
         return;
 }
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 7d0a275df822..d53a9aa00977 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -764,7 +764,7 @@ bool task_will_free_mem(struct task_struct *task)
 {
         struct mm_struct *mm = task->mm;
         struct task_struct *p;
-        bool ret;
+        bool ret = true;
 
         /*
          * Skip tasks without mm because it might have passed its exit_mm and
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index ee744fa3b93d..3fbe73a6fe4b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4060,7 +4060,7 @@ long si_mem_available(void)
         int lru;
 
         for (lru = LRU_BASE; lru < NR_LRU_LISTS; lru++)
-                pages[lru] = global_page_state(NR_LRU_BASE + lru);
+                pages[lru] = global_node_page_state(NR_LRU_BASE + lru);
 
         for_each_zone(zone)
                 wmark_low += zone->watermark[WMARK_LOW];
@@ -4757,6 +4757,8 @@ int local_memory_node(int node)
 }
 #endif
 
+static void setup_min_unmapped_ratio(void);
+static void setup_min_slab_ratio(void);
 #else   /* CONFIG_NUMA */
 
 static void set_zonelist_order(void)
@@ -5878,9 +5880,6 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat)
                 zone->managed_pages = is_highmem_idx(j) ? realsize : freesize;
 #ifdef CONFIG_NUMA
                 zone->node = nid;
-                pgdat->min_unmapped_pages += (freesize*sysctl_min_unmapped_ratio)
-                                                / 100;
-                pgdat->min_slab_pages += (freesize * sysctl_min_slab_ratio) / 100;
 #endif
                 zone->name = zone_names[j];
                 zone->zone_pgdat = pgdat;
@@ -6801,6 +6800,12 @@ int __meminit init_per_zone_wmark_min(void)
         setup_per_zone_wmarks();
         refresh_zone_stat_thresholds();
         setup_per_zone_lowmem_reserve();
+
+#ifdef CONFIG_NUMA
+        setup_min_unmapped_ratio();
+        setup_min_slab_ratio();
+#endif
+
         return 0;
 }
 core_initcall(init_per_zone_wmark_min)
@@ -6842,43 +6847,58 @@ int watermark_scale_factor_sysctl_handler(struct ctl_table *table, int write,
 }
 
 #ifdef CONFIG_NUMA
+static void setup_min_unmapped_ratio(void)
+{
+        pg_data_t *pgdat;
+        struct zone *zone;
+
+        for_each_online_pgdat(pgdat)
+                pgdat->min_unmapped_pages = 0;
+
+        for_each_zone(zone)
+                zone->zone_pgdat->min_unmapped_pages += (zone->managed_pages *
+                                sysctl_min_unmapped_ratio) / 100;
+}
+
+
 int sysctl_min_unmapped_ratio_sysctl_handler(struct ctl_table *table, int write,
         void __user *buffer, size_t *length, loff_t *ppos)
 {
-        struct pglist_data *pgdat;
-        struct zone *zone;
         int rc;
 
         rc = proc_dointvec_minmax(table, write, buffer, length, ppos);
         if (rc)
                 return rc;
 
+        setup_min_unmapped_ratio();
+
+        return 0;
+}
+
+static void setup_min_slab_ratio(void)
+{
+        pg_data_t *pgdat;
+        struct zone *zone;
+
         for_each_online_pgdat(pgdat)
                 pgdat->min_slab_pages = 0;
 
         for_each_zone(zone)
-                zone->zone_pgdat->min_unmapped_pages += (zone->managed_pages *
-                                sysctl_min_unmapped_ratio) / 100;
-        return 0;
+                zone->zone_pgdat->min_slab_pages += (zone->managed_pages *
+                                sysctl_min_slab_ratio) / 100;
 }
 
 int sysctl_min_slab_ratio_sysctl_handler(struct ctl_table *table, int write,
         void __user *buffer, size_t *length, loff_t *ppos)
 {
-        struct pglist_data *pgdat;
-        struct zone *zone;
         int rc;
 
         rc = proc_dointvec_minmax(table, write, buffer, length, ppos);
         if (rc)
                 return rc;
 
-        for_each_online_pgdat(pgdat)
-                pgdat->min_slab_pages = 0;
+        setup_min_slab_ratio();
 
-        for_each_zone(zone)
-                zone->zone_pgdat->min_slab_pages += (zone->managed_pages *
-                                sysctl_min_slab_ratio) / 100;
         return 0;
 }
 #endif
diff --git a/mm/readahead.c b/mm/readahead.c
index 65ec288dc057..c8a955b1297e 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/dax.h>
 #include <linux/gfp.h>
 #include <linux/export.h>
 #include <linux/blkdev.h>
@@ -544,6 +545,14 @@ do_readahead(struct address_space *mapping, struct file *filp,
         if (!mapping || !mapping->a_ops)
                 return -EINVAL;
 
+        /*
+         * Readahead doesn't make sense for DAX inodes, but we don't want it
+         * to report a failure either.  Instead, we just return success and
+         * don't do any work.
+         */
+        if (dax_mapping(mapping))
+                return 0;
+
         return force_page_cache_readahead(mapping, filp, index, nr);
 }
 
diff --git a/mm/rmap.c b/mm/rmap.c
index 709bc83703b1..1ef36404e7b2 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1284,8 +1284,9 @@ void page_add_file_rmap(struct page *page, bool compound)
                 VM_BUG_ON_PAGE(!PageSwapBacked(page), page);
                 __inc_node_page_state(page, NR_SHMEM_PMDMAPPED);
         } else {
-                if (PageTransCompound(page)) {
-                        VM_BUG_ON_PAGE(!PageLocked(page), page);
+                if (PageTransCompound(page) && page_mapping(page)) {
+                        VM_WARN_ON_ONCE(!PageLocked(page));
+
                         SetPageDoubleMap(compound_head(page));
                         if (PageMlocked(page))
                                 clear_page_mlock(compound_head(page));
@@ -1303,7 +1304,7 @@ static void page_remove_file_rmap(struct page *page, bool compound)
 {
         int i, nr = 1;
 
-        VM_BUG_ON_PAGE(compound && !PageTransHuge(page), page);
+        VM_BUG_ON_PAGE(compound && !PageHead(page), page);
         lock_page_memcg(page);
 
         /* Hugepages are not counted in NR_FILE_MAPPED for now. */
diff --git a/mm/shmem.c b/mm/shmem.c
index 7f7748a0f9e1..fd8b2b5741b1 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3975,7 +3975,9 @@ static ssize_t shmem_enabled_store(struct kobject *kobj,
 
 struct kobj_attribute shmem_enabled_attr =
         __ATTR(shmem_enabled, 0644, shmem_enabled_show, shmem_enabled_store);
+#endif /* CONFIG_TRANSPARENT_HUGE_PAGECACHE && CONFIG_SYSFS */
 
+#ifdef CONFIG_TRANSPARENT_HUGE_PAGECACHE
 bool shmem_huge_enabled(struct vm_area_struct *vma)
 {
         struct inode *inode = file_inode(vma->vm_file);
@@ -4006,7 +4008,7 @@ bool shmem_huge_enabled(struct vm_area_struct *vma)
                         return false;
         }
 }
-#endif /* CONFIG_TRANSPARENT_HUGE_PAGECACHE && CONFIG_SYSFS */
+#endif /* CONFIG_TRANSPARENT_HUGE_PAGECACHE */
 
 #else /* !CONFIG_SHMEM */
 
diff --git a/mm/slub.c b/mm/slub.c
index cead06394e9e..9adae58462f8 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3629,6 +3629,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
  */
 static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
 {
+        LIST_HEAD(discard);
         struct page *page, *h;
 
         BUG_ON(irqs_disabled());
@@ -3636,13 +3637,16 @@ static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
         list_for_each_entry_safe(page, h, &n->partial, lru) {
                 if (!page->inuse) {
                         remove_partial(n, page);
-                        discard_slab(s, page);
+                        list_add(&page->lru, &discard);
                 } else {
                         list_slab_objects(s, page,
                         "Objects remaining in %s on __kmem_cache_shutdown()");
                 }
         }
         spin_unlock_irq(&n->list_lock);
+
+        list_for_each_entry_safe(page, h, &discard, lru)
+                discard_slab(s, page);
 }
 
 /*
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 8ebae91a6b55..a3cc3052f830 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -83,7 +83,7 @@ static bool overlaps(const void *ptr, unsigned long n, unsigned long low,
         unsigned long check_high = check_low + n;
 
         /* Does not overlap if entirely above or entirely below. */
-        if (check_low >= high || check_high < low)
+        if (check_low >= high || check_high <= low)
                 return false;
 
         return true;
@@ -124,7 +124,7 @@ static inline const char *check_kernel_text_object(const void *ptr,
 static inline const char *check_bogus_address(const void *ptr, unsigned long n)
 {
         /* Reject if object wraps past end of memory. */
-        if (ptr + n < ptr)
+        if ((unsigned long)ptr + n < (unsigned long)ptr)
                 return "<wrapped address>";
 
         /* Reject if NULL or ZERO-allocation. */