Merge tag 'v3.3' into staging/for_v3.4

* tag 'v3.3': (1646 commits)
  Linux 3.3
  Don't limit non-nested epoll paths
  netfilter: ctnetlink: fix race between delete and timeout expiration
  ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
  nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
  nilfs2: clamp ns_r_segments_percentage to [1, 99]
  afs: Remote abort can cause BUG in rxrpc code
  afs: Read of file returns EBADMSG
  C6X: remove dead code from entry.S
  wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
  net/hyperv: fix erroneous NETDEV_TX_BUSY use
  net/usbnet: reserve headroom on rx skbs
  bnx2x: fix memory leak in bnx2x_init_firmware()
  bnx2x: fix a crash on corrupt firmware file
  sch_sfq: revert dont put new flow at the end of flows
  ipv6: fix icmp6_dst_alloc()
  MAINTAINERS: Add Serge as maintainer of capabilities
  drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode
  MAINTAINERS: add entry for exynos mipi display drivers
  MAINTAINERS: fix link to Gustavo Padovans tree
  ...

25 files changed, 356 insertions, 245 deletions

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 7ba8feae11b8..dd8e2aafb07e 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -318,7 +318,7 @@ static void wakeup_timer_fn(unsigned long data)
         if (bdi->wb.task) {
                 trace_writeback_wake_thread(bdi);
                 wake_up_process(bdi->wb.task);
-        } else {
+        } else if (bdi->dev) {
                 /*
                  * When bdi tasks are inactive for long time, they are killed.
                  * In this case we have to wake-up the forker thread which
@@ -584,6 +584,8 @@ EXPORT_SYMBOL(bdi_register_dev);
  */
 static void bdi_wb_shutdown(struct backing_dev_info *bdi)
 {
+        struct task_struct *task;
+
         if (!bdi_cap_writeback_dirty(bdi))
                 return;
 
@@ -602,8 +604,13 @@ static void bdi_wb_shutdown(struct backing_dev_info *bdi)
          * Finally, kill the kernel thread. We don't need to be RCU
          * safe anymore, since the bdi is gone from visibility.
          */
-        if (bdi->wb.task)
-                kthread_stop(bdi->wb.task);
+        spin_lock_bh(&bdi->wb_lock);
+        task = bdi->wb.task;
+        bdi->wb.task = NULL;
+        spin_unlock_bh(&bdi->wb_lock);
+
+        if (task)
+                kthread_stop(task);
 }
 
 /*
@@ -623,7 +630,9 @@ static void bdi_prune_sb(struct backing_dev_info *bdi)
 
 void bdi_unregister(struct backing_dev_info *bdi)
 {
-        if (bdi->dev) {
+        struct device *dev = bdi->dev;
+
+        if (dev) {
                 bdi_set_min_ratio(bdi, 0);
                 trace_writeback_bdi_unregister(bdi);
                 bdi_prune_sb(bdi);
@@ -632,8 +641,12 @@ void bdi_unregister(struct backing_dev_info *bdi)
                 if (!bdi_cap_flush_forker(bdi))
                         bdi_wb_shutdown(bdi);
                 bdi_debug_unregister(bdi);
-                device_unregister(bdi->dev);
+
+                spin_lock_bh(&bdi->wb_lock);
                 bdi->dev = NULL;
+                spin_unlock_bh(&bdi->wb_lock);
+
+                device_unregister(dev);
         }
 }
 EXPORT_SYMBOL(bdi_unregister);
diff --git a/mm/compaction.c b/mm/compaction.c
index 71a58f67f481..d9ebebe1a2aa 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -313,12 +313,34 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
                 } else if (!locked)
                         spin_lock_irq(&zone->lru_lock);
 
+                /*
+                 * migrate_pfn does not necessarily start aligned to a
+                 * pageblock. Ensure that pfn_valid is called when moving
+                 * into a new MAX_ORDER_NR_PAGES range in case of large
+                 * memory holes within the zone
+                 */
+                if ((low_pfn & (MAX_ORDER_NR_PAGES - 1)) == 0) {
+                        if (!pfn_valid(low_pfn)) {
+                                low_pfn += MAX_ORDER_NR_PAGES - 1;
+                                continue;
+                        }
+                }
+
                 if (!pfn_valid_within(low_pfn))
                         continue;
                 nr_scanned++;
 
-                /* Get the page and skip if free */
+                /*
+                 * Get the page and ensure the page is within the same zone.
+                 * See the comment in isolate_freepages about overlapping
+                 * nodes. It is deliberate that the new zone lock is not taken
+                 * as memory compaction should not move pages between nodes.
+                 */
                 page = pfn_to_page(low_pfn);
+                if (page_zone(page) != zone)
+                        continue;
+
+                /* Skip if free */
                 if (PageBuddy(page))
                         continue;
 
diff --git a/mm/filemap.c b/mm/filemap.c
index 97f49ed35bd2..b66275757c28 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1400,15 +1400,12 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
         unsigned long seg = 0;
         size_t count;
         loff_t *ppos = &iocb->ki_pos;
-        struct blk_plug plug;
 
         count = 0;
         retval = generic_segment_checks(iov, &nr_segs, &count, VERIFY_WRITE);
         if (retval)
                 return retval;
 
-        blk_start_plug(&plug);
-
         /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
         if (filp->f_flags & O_DIRECT) {
                 loff_t size;
@@ -1424,8 +1421,12 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
                         retval = filemap_write_and_wait_range(mapping, pos,
                                         pos + iov_length(iov, nr_segs) - 1);
                         if (!retval) {
+                                struct blk_plug plug;
+
+                                blk_start_plug(&plug);
                                 retval = mapping->a_ops->direct_IO(READ, iocb,
                                                         iov, pos, nr_segs);
+                                blk_finish_plug(&plug);
                         }
                         if (retval > 0) {
                                 *ppos = pos + retval;
@@ -1481,7 +1482,6 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
                         break;
         }
 out:
-        blk_finish_plug(&plug);
         return retval;
 }
 EXPORT_SYMBOL(generic_file_aio_read);
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index f91b2f687343..a4eb31132229 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -263,7 +263,12 @@ found:
                                                         xip_pfn);
                 if (err == -ENOMEM)
                         return VM_FAULT_OOM;
-                BUG_ON(err);
+                /*
+                 * err == -EBUSY is fine, we've raced against another thread
+                 * that faulted-in the same page
+                 */
+                if (err != -EBUSY)
+                        BUG_ON(err);
                 return VM_FAULT_NOPAGE;
         } else {
                 int err, ret = VM_FAULT_OOM;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index b3ffc21ce801..8f7fc394f636 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -671,6 +671,7 @@ static int __do_huge_pmd_anonymous_page(struct mm_struct *mm,
                 set_pmd_at(mm, haddr, pmd, entry);
                 prepare_pmd_huge_pte(pgtable, mm);
                 add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
+                mm->nr_ptes++;
                 spin_unlock(&mm->page_table_lock);
         }
 
@@ -789,6 +790,7 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
         pmd = pmd_mkold(pmd_wrprotect(pmd));
         set_pmd_at(dst_mm, addr, dst_pmd, pmd);
         prepare_pmd_huge_pte(pgtable, dst_mm);
+        dst_mm->nr_ptes++;
 
         ret = 0;
 out_unlock:
@@ -887,7 +889,6 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
         }
         kfree(pages);
 
-        mm->nr_ptes++;
         smp_wmb(); /* make pte visible before pmd */
         pmd_populate(mm, pmd, pgtable);
         page_remove_rmap(page);
@@ -1047,6 +1048,7 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
                         VM_BUG_ON(page_mapcount(page) < 0);
                         add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
                         VM_BUG_ON(!PageHead(page));
+                        tlb->mm->nr_ptes--;
                         spin_unlock(&tlb->mm->page_table_lock);
                         tlb_remove_page(tlb, page);
                         pte_free(tlb->mm, pgtable);
@@ -1375,7 +1377,6 @@ static int __split_huge_page_map(struct page *page,
                         pte_unmap(pte);
                 }
 
-                mm->nr_ptes++;
                 smp_wmb(); /* make pte visible before pmd */
                 /*
                  * Up to this point the pmd is present and huge and
@@ -1988,7 +1989,6 @@ static void collapse_huge_page(struct mm_struct *mm,
         set_pmd_at(mm, address, pmd, _pmd);
         update_mmu_cache(vma, address, _pmd);
         prepare_pmd_huge_pte(pgtable, mm);
-        mm->nr_ptes--;
         spin_unlock(&mm->page_table_lock);
 
 #ifndef CONFIG_NUMA
@@ -2083,7 +2083,7 @@ static void collect_mm_slot(struct mm_slot *mm_slot)
 {
         struct mm_struct *mm = mm_slot->mm;
 
-        VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock));
+        VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
 
         if (khugepaged_test_exit(mm)) {
                 /* free mm_slot */
@@ -2113,7 +2113,7 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
         int progress = 0;
 
         VM_BUG_ON(!pages);
-        VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock));
+        VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
 
         if (khugepaged_scan.mm_slot)
                 mm_slot = khugepaged_scan.mm_slot;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ea8c3a4cd2ae..a876871f6be5 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2277,8 +2277,8 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
                         set_page_dirty(page);
                 list_add(&page->lru, &page_list);
         }
-        spin_unlock(&mm->page_table_lock);
         flush_tlb_range(vma, start, end);
+        spin_unlock(&mm->page_table_lock);
         mmu_notifier_invalidate_range_end(mm, start, end);
         list_for_each_entry_safe(page, tmp, &page_list, lru) {
                 page_remove_rmap(page);
@@ -2508,6 +2508,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
 {
         struct hstate *h = hstate_vma(vma);
         int ret = VM_FAULT_SIGBUS;
+        int anon_rmap = 0;
         pgoff_t idx;
         unsigned long size;
         struct page *page;
@@ -2562,14 +2563,13 @@ retry:
                         spin_lock(&inode->i_lock);
                         inode->i_blocks += blocks_per_huge_page(h);
                         spin_unlock(&inode->i_lock);
-                        page_dup_rmap(page);
                 } else {
                         lock_page(page);
                         if (unlikely(anon_vma_prepare(vma))) {
                                 ret = VM_FAULT_OOM;
                                 goto backout_unlocked;
                         }
-                        hugepage_add_new_anon_rmap(page, vma, address);
+                        anon_rmap = 1;
                 }
         } else {
                 /*
@@ -2582,7 +2582,6 @@ retry:
                               VM_FAULT_SET_HINDEX(h - hstates);
                         goto backout_unlocked;
                 }
-                page_dup_rmap(page);
         }
 
         /*
@@ -2606,6 +2605,10 @@ retry:
         if (!huge_pte_none(huge_ptep_get(ptep)))
                 goto backout;
 
+        if (anon_rmap)
+                hugepage_add_new_anon_rmap(page, vma, address);
+        else
+                page_dup_rmap(page);
         new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE)
                                 && (vma->vm_flags & VM_SHARED)));
         set_huge_pte_at(mm, address, ptep, new_pte);
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index c833addd94d7..45eb6217bf38 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1036,7 +1036,7 @@ void __ref kmemleak_scan_area(const void *ptr, size_t size, gfp_t gfp)
 {
         pr_debug("%s(0x%p)\n", __func__, ptr);
 
-        if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr))
+        if (atomic_read(&kmemleak_enabled) && ptr && size && !IS_ERR(ptr))
                 add_scan_area((unsigned long)ptr, size, gfp);
         else if (atomic_read(&kmemleak_early_log))
                 log_early(KMEMLEAK_SCAN_AREA, ptr, size, 0);
@@ -1757,6 +1757,7 @@ void __init kmemleak_init(void)
 
 #ifdef CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF
         if (!kmemleak_skip_disable) {
+                atomic_set(&kmemleak_early_log, 0);
                 kmemleak_disable();
                 return;
         }
diff --git a/mm/ksm.c b/mm/ksm.c
index 1925ffbfb27f..310544a379ae 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -28,7 +28,6 @@
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
-#include <linux/memcontrol.h>
 #include <linux/rbtree.h>
 #include <linux/memory.h>
 #include <linux/mmu_notifier.h>
@@ -1572,16 +1571,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
 
         new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
         if (new_page) {
-                /*
-                 * The memcg-specific accounting when moving
-                 * pages around the LRU lists relies on the
-                 * page's owner (memcg) to be valid.  Usually,
-                 * pages are assigned to a new owner before
-                 * being put on the LRU list, but since this
-                 * is not the case here, the stale owner from
-                 * a previous allocation cycle must be reset.
-                 */
-                mem_cgroup_reset_owner(new_page);
                 copy_user_highpage(new_page, page, address, vma);
 
                 SetPageDirty(new_page);
diff --git a/mm/memblock.c b/mm/memblock.c
index 2f55f19b7c86..99f285599501 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -99,21 +99,21 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t start,
         phys_addr_t this_start, this_end, cand;
         u64 i;
 
-        /* align @size to avoid excessive fragmentation on reserved array */
-        size = round_up(size, align);
-
         /* pump up @end */
         if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
                 end = memblock.current_limit;
 
-        /* adjust @start to avoid underflow and allocating the first page */
-        start = max3(start, size, (phys_addr_t)PAGE_SIZE);
+        /* avoid allocating the first page */
+        start = max_t(phys_addr_t, start, PAGE_SIZE);
         end = max(start, end);
 
         for_each_free_mem_range_reverse(i, nid, &this_start, &this_end, NULL) {
                 this_start = clamp(this_start, start, end);
                 this_end = clamp(this_end, start, end);
 
+                if (this_end < size)
+                        continue;
+
                 cand = round_down(this_end - size, align);
                 if (cand >= this_start)
                         return cand;
@@ -728,6 +728,9 @@ static phys_addr_t __init memblock_alloc_base_nid(phys_addr_t size,
 {
         phys_addr_t found;
 
+        /* align @size to avoid excessive fragmentation on reserved array */
+        size = round_up(size, align);
+
         found = memblock_find_in_range_node(0, max_addr, size, align, nid);
         if (found && !memblock_reserve(found, size))
                 return found;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3dbff4dcde35..58a08fc7414a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -230,10 +230,30 @@ struct mem_cgroup {
          * the counter to account for memory usage
          */
         struct res_counter res;
-        /*
-         * the counter to account for mem+swap usage.
-         */
-        struct res_counter memsw;
+
+        union {
+                /*
+                 * the counter to account for mem+swap usage.
+                 */
+                struct res_counter memsw;
+
+                /*
+                 * rcu_freeing is used only when freeing struct mem_cgroup,
+                 * so put it into a union to avoid wasting more memory.
+                 * It must be disjoint from the css field.  It could be
+                 * in a union with the res field, but res plays a much
+                 * larger part in mem_cgroup life than memsw, and might
+                 * be of interest, even at time of free, when debugging.
+                 * So share rcu_head with the less interesting memsw.
+                 */
+                struct rcu_head rcu_freeing;
+                /*
+                 * But when using vfree(), that cannot be done at
+                 * interrupt time, so we must then queue the work.
+                 */
+                struct work_struct work_freeing;
+        };
+
         /*
          * Per cgroup active and inactive list, similar to the
          * per zone LRU lists.
@@ -379,7 +399,7 @@ static void mem_cgroup_put(struct mem_cgroup *memcg);
 static bool mem_cgroup_is_root(struct mem_cgroup *memcg);
 void sock_update_memcg(struct sock *sk)
 {
-        if (static_branch(&memcg_socket_limit_enabled)) {
+        if (mem_cgroup_sockets_enabled) {
                 struct mem_cgroup *memcg;
 
                 BUG_ON(!sk->sk_prot->proto_cgroup);
@@ -411,7 +431,7 @@ EXPORT_SYMBOL(sock_update_memcg);
 
 void sock_release_memcg(struct sock *sk)
 {
-        if (static_branch(&memcg_socket_limit_enabled) && sk->sk_cgrp) {
+        if (mem_cgroup_sockets_enabled && sk->sk_cgrp) {
                 struct mem_cgroup *memcg;
                 WARN_ON(!sk->sk_cgrp->memcg);
                 memcg = sk->sk_cgrp->memcg;
@@ -776,7 +796,8 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page)
         /* threshold event is triggered in finer grain than soft limit */
         if (unlikely(mem_cgroup_event_ratelimit(memcg,
                                                 MEM_CGROUP_TARGET_THRESH))) {
-                bool do_softlimit, do_numainfo;
+                bool do_softlimit;
+                bool do_numainfo __maybe_unused;
 
                 do_softlimit = mem_cgroup_event_ratelimit(memcg,
                                                 MEM_CGROUP_TARGET_SOFTLIMIT);
@@ -1041,6 +1062,19 @@ struct lruvec *mem_cgroup_lru_add_list(struct zone *zone, struct page *page,
 
         pc = lookup_page_cgroup(page);
         memcg = pc->mem_cgroup;
+
+        /*
+         * Surreptitiously switch any uncharged page to root:
+         * an uncharged page off lru does nothing to secure
+         * its former mem_cgroup from sudden removal.
+         *
+         * Our caller holds lru_lock, and PageCgroupUsed is updated
+         * under page_cgroup lock: between them, they make all uses
+         * of pc->mem_cgroup safe.
+         */
+        if (!PageCgroupUsed(pc) && memcg != root_mem_cgroup)
+                pc->mem_cgroup = memcg = root_mem_cgroup;
+
         mz = page_cgroup_zoneinfo(memcg, page);
         /* compound_order() is stabilized through lru_lock */
         MEM_CGROUP_ZSTAT(mz, lru) += 1 << compound_order(page);
@@ -2407,8 +2441,12 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                                        struct page *page,
                                        unsigned int nr_pages,
                                        struct page_cgroup *pc,
-                                       enum charge_type ctype)
+                                       enum charge_type ctype,
+                                       bool lrucare)
 {
+        struct zone *uninitialized_var(zone);
+        bool was_on_lru = false;
+
         lock_page_cgroup(pc);
         if (unlikely(PageCgroupUsed(pc))) {
                 unlock_page_cgroup(pc);
@@ -2419,6 +2457,21 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
          * we don't need page_cgroup_lock about tail pages, becase they are not
          * accessed by any other context at this point.
          */
+
+        /*
+         * In some cases, SwapCache and FUSE(splice_buf->radixtree), the page
+         * may already be on some other mem_cgroup's LRU.  Take care of it.
+         */
+        if (lrucare) {
+                zone = page_zone(page);
+                spin_lock_irq(&zone->lru_lock);
+                if (PageLRU(page)) {
+                        ClearPageLRU(page);
+                        del_page_from_lru_list(zone, page, page_lru(page));
+                        was_on_lru = true;
+                }
+        }
+
         pc->mem_cgroup = memcg;
         /*
          * We access a page_cgroup asynchronously without lock_page_cgroup().
@@ -2442,9 +2495,18 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                 break;
         }
 
+        if (lrucare) {
+                if (was_on_lru) {
+                        VM_BUG_ON(PageLRU(page));
+                        SetPageLRU(page);
+                        add_page_to_lru_list(zone, page, page_lru(page));
+                }
+                spin_unlock_irq(&zone->lru_lock);
+        }
+
         mem_cgroup_charge_statistics(memcg, PageCgroupCache(pc), nr_pages);
         unlock_page_cgroup(pc);
-        WARN_ON_ONCE(PageLRU(page));
+
         /*
          * "charge_statistics" updated event counter. Then, check it.
          * Insert ancestor (and ancestor's ancestors), to softlimit RB-tree.
@@ -2642,7 +2704,7 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
         ret = __mem_cgroup_try_charge(mm, gfp_mask, nr_pages, &memcg, oom);
         if (ret == -ENOMEM)
                 return ret;
-        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype, false);
         return 0;
 }
 
@@ -2662,35 +2724,6 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *ptr,
                                         enum charge_type ctype);
 
-static void
-__mem_cgroup_commit_charge_lrucare(struct page *page, struct mem_cgroup *memcg,
-                                        enum charge_type ctype)
-{
-        struct page_cgroup *pc = lookup_page_cgroup(page);
-        struct zone *zone = page_zone(page);
-        unsigned long flags;
-        bool removed = false;
-
-        /*
-         * In some case, SwapCache, FUSE(splice_buf->radixtree), the page
-         * is already on LRU. It means the page may on some other page_cgroup's
-         * LRU. Take care of it.
-         */
-        spin_lock_irqsave(&zone->lru_lock, flags);
-        if (PageLRU(page)) {
-                del_page_from_lru_list(zone, page, page_lru(page));
-                ClearPageLRU(page);
-                removed = true;
-        }
-        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype);
-        if (removed) {
-                add_page_to_lru_list(zone, page, page_lru(page));
-                SetPageLRU(page);
-        }
-        spin_unlock_irqrestore(&zone->lru_lock, flags);
-        return;
-}
-
 int mem_cgroup_cache_charge(struct page *page, struct mm_struct *mm,
                                 gfp_t gfp_mask)
 {
@@ -2768,13 +2801,16 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *memcg,
                                         enum charge_type ctype)
 {
+        struct page_cgroup *pc;
+
         if (mem_cgroup_disabled())
                 return;
         if (!memcg)
                 return;
         cgroup_exclude_rmdir(&memcg->css);
 
-        __mem_cgroup_commit_charge_lrucare(page, memcg, ctype);
+        pc = lookup_page_cgroup(page);
+        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype, true);
         /*
          * Now swap is on-memory. This means this page may be
          * counted both as mem and swap....double count.
@@ -3026,23 +3062,6 @@ void mem_cgroup_uncharge_end(void)
         batch->memcg = NULL;
 }
 
-/*
- * A function for resetting pc->mem_cgroup for newly allocated pages.
- * This function should be called if the newpage will be added to LRU
- * before start accounting.
- */
-void mem_cgroup_reset_owner(struct page *newpage)
-{
-        struct page_cgroup *pc;
-
-        if (mem_cgroup_disabled())
-                return;
-
-        pc = lookup_page_cgroup(newpage);
-        VM_BUG_ON(PageCgroupUsed(pc));
-        pc->mem_cgroup = root_mem_cgroup;
-}
-
 #ifdef CONFIG_SWAP
 /*
  * called after __delete_from_swap_cache() and drop "page" account.
@@ -3247,7 +3266,7 @@ int mem_cgroup_prepare_migration(struct page *page,
                 ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
         else
                 ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype, false);
         return ret;
 }
 
@@ -3331,7 +3350,7 @@ void mem_cgroup_replace_page_cache(struct page *oldpage,
          * the newpage may be on LRU(or pagevec for LRU) already. We lock
          * LRU while we overwrite pc->mem_cgroup.
          */
-        __mem_cgroup_commit_charge_lrucare(newpage, memcg, type);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type, true);
 }
 
 #ifdef CONFIG_DEBUG_VM
@@ -4413,6 +4432,9 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
          */
         BUG_ON(!thresholds);
 
+        if (!thresholds->primary)
+                goto unlock;
+
         usage = mem_cgroup_usage(memcg, type == _MEMSWAP);
 
         /* Check if a threshold crossed before removing */
@@ -4461,7 +4483,7 @@ swap_buffers:
 
         /* To be sure that nobody uses thresholds */
         synchronize_rcu();
-
+unlock:
         mutex_unlock(&memcg->thresholds_lock);
 }
 
@@ -4778,6 +4800,27 @@ out_free:
 }
 
 /*
+ * Helpers for freeing a vzalloc()ed mem_cgroup by RCU,
+ * but in process context.  The work_freeing structure is overlaid
+ * on the rcu_freeing structure, which itself is overlaid on memsw.
+ */
+static void vfree_work(struct work_struct *work)
+{
+        struct mem_cgroup *memcg;
+
+        memcg = container_of(work, struct mem_cgroup, work_freeing);
+        vfree(memcg);
+}
+static void vfree_rcu(struct rcu_head *rcu_head)
+{
+        struct mem_cgroup *memcg;
+
+        memcg = container_of(rcu_head, struct mem_cgroup, rcu_freeing);
+        INIT_WORK(&memcg->work_freeing, vfree_work);
+        schedule_work(&memcg->work_freeing);
+}
+
+/*
  * At destroying mem_cgroup, references from swap_cgroup can remain.
  * (scanning all at force_empty is too costly...)
  *
@@ -4800,9 +4843,9 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
 
         free_percpu(memcg->stat);
         if (sizeof(struct mem_cgroup) < PAGE_SIZE)
-                kfree(memcg);
+                kfree_rcu(memcg, rcu_freeing);
         else
-                vfree(memcg);
+                call_rcu(&memcg->rcu_freeing, vfree_rcu);
 }
 
 static void mem_cgroup_get(struct mem_cgroup *memcg)
diff --git a/mm/memory.c b/mm/memory.c
index 5e30583c2605..fa2f04e0337c 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -878,15 +878,24 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                         }
                         if (likely(!non_swap_entry(entry)))
                                 rss[MM_SWAPENTS]++;
-                        else if (is_write_migration_entry(entry) &&
-                                        is_cow_mapping(vm_flags)) {
-                                /*
-                                 * COW mappings require pages in both parent
-                                 * and child to be set to read.
-                                 */
-                                make_migration_entry_read(&entry);
-                                pte = swp_entry_to_pte(entry);
-                                set_pte_at(src_mm, addr, src_pte, pte);
+                        else if (is_migration_entry(entry)) {
+                                page = migration_entry_to_page(entry);
+
+                                if (PageAnon(page))
+                                        rss[MM_ANONPAGES]++;
+                                else
+                                        rss[MM_FILEPAGES]++;
+
+                                if (is_write_migration_entry(entry) &&
+                                    is_cow_mapping(vm_flags)) {
+                                        /*
+                                         * COW mappings require pages in both
+                                         * parent and child to be set to read.
+                                         */
+                                        make_migration_entry_read(&entry);
+                                        pte = swp_entry_to_pte(entry);
+                                        set_pte_at(src_mm, addr, src_pte, pte);
+                                }
                         }
                 }
                 goto out_set_pte;
@@ -1191,6 +1200,16 @@ again:
 
                         if (!non_swap_entry(entry))
                                 rss[MM_SWAPENTS]--;
+                        else if (is_migration_entry(entry)) {
+                                struct page *page;
+
+                                page = migration_entry_to_page(entry);
+
+                                if (PageAnon(page))
+                                        rss[MM_ANONPAGES]--;
+                                else
+                                        rss[MM_FILEPAGES]--;
+                        }
                         if (unlikely(!free_swap_and_cache(entry)))
                                 print_bad_pte(vma, addr, ptent, NULL);
                 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 06b145fb64ab..47296fee23db 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -640,10 +640,11 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
         unsigned long vmstart;
         unsigned long vmend;
 
-        vma = find_vma_prev(mm, start, &prev);
+        vma = find_vma(mm, start);
         if (!vma || vma->vm_start > start)
                 return -EFAULT;
 
+        prev = vma->vm_prev;
         if (start > vma->vm_start)
                 prev = vma;
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 9871a56d82c3..1503b6b54ecb 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -445,7 +445,6 @@ void migrate_page_copy(struct page *newpage, struct page *page)
         ClearPageSwapCache(page);
         ClearPagePrivate(page);
         set_page_private(page, 0);
-        page->mapping = NULL;
 
         /*
          * If any waiters have accumulated on the new page then
@@ -667,6 +666,7 @@ static int move_to_new_page(struct page *newpage, struct page *page,
         } else {
                 if (remap_swapcache)
                         remove_migration_ptes(page, newpage);
+                page->mapping = NULL;
         }
 
         unlock_page(newpage);
@@ -839,8 +839,6 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         if (!newpage)
                 return -ENOMEM;
 
-        mem_cgroup_reset_owner(newpage);
-
         if (page_count(page) == 1) {
                 /* page was freed from under us. So we are done. */
                 goto out;
diff --git a/mm/mlock.c b/mm/mlock.c
index 4f4f53bdc65d..ef726e8aa8e9 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -385,10 +385,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
                 return -EINVAL;
         if (end == start)
                 return 0;
-        vma = find_vma_prev(current->mm, start, &prev);
+        vma = find_vma(current->mm, start);
         if (!vma || vma->vm_start > start)
                 return -ENOMEM;
 
+        prev = vma->vm_prev;
         if (start > vma->vm_start)
                 prev = vma;
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 3f758c7f4c81..da15a79b1441 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1266,8 +1266,9 @@ munmap_back:
         vma->vm_pgoff = pgoff;
         INIT_LIST_HEAD(&vma->anon_vma_chain);
 
+        error = -EINVAL;        /* when rejecting VM_GROWSDOWN|VM_GROWSUP */
+
         if (file) {
-                error = -EINVAL;
                 if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
                         goto free_vma;
                 if (vm_flags & VM_DENYWRITE) {
@@ -1293,6 +1294,8 @@ munmap_back:
                 pgoff = vma->vm_pgoff;
                 vm_flags = vma->vm_flags;
         } else if (vm_flags & VM_SHARED) {
+                if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
+                        goto free_vma;
                 error = shmem_zero_setup(vma);
                 if (error)
                         goto free_vma;
@@ -1605,7 +1608,6 @@ EXPORT_SYMBOL(find_vma);
 
 /*
  * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
- * Note: pprev is set to NULL when return value is NULL.
  */
 struct vm_area_struct *
 find_vma_prev(struct mm_struct *mm, unsigned long addr,
@@ -1614,7 +1616,16 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
         struct vm_area_struct *vma;
 
         vma = find_vma(mm, addr);
-        *pprev = vma ? vma->vm_prev : NULL;
+        if (vma) {
+                *pprev = vma->vm_prev;
+        } else {
+                struct rb_node *rb_node = mm->mm_rb.rb_node;
+                *pprev = NULL;
+                while (rb_node) {
+                        *pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
+                        rb_node = rb_node->rb_right;
+                }
+        }
         return vma;
 }
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 5a688a2756be..f437d054c3bf 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -262,10 +262,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
 
         down_write(&current->mm->mmap_sem);
 
-        vma = find_vma_prev(current->mm, start, &prev);
+        vma = find_vma(current->mm, start);
         error = -ENOMEM;
         if (!vma)
                 goto out;
+        prev = vma->vm_prev;
         if (unlikely(grows & PROT_GROWSDOWN)) {
                 if (vma->vm_start >= end)
                         goto out;
diff --git a/mm/nommu.c b/mm/nommu.c
index b982290fd962..f59e170fceb4 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -696,9 +696,11 @@ static void add_vma_to_mm(struct mm_struct *mm, struct vm_area_struct *vma)
         if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
 
+                mutex_lock(&mapping->i_mmap_mutex);
                 flush_dcache_mmap_lock(mapping);
                 vma_prio_tree_insert(vma, &mapping->i_mmap);
                 flush_dcache_mmap_unlock(mapping);
+                mutex_unlock(&mapping->i_mmap_mutex);
         }
 
         /* add the VMA to the tree */
@@ -760,9 +762,11 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
         if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
 
+                mutex_lock(&mapping->i_mmap_mutex);
                 flush_dcache_mmap_lock(mapping);
                 vma_prio_tree_remove(vma, &mapping->i_mmap);
                 flush_dcache_mmap_unlock(mapping);
+                mutex_unlock(&mapping->i_mmap_mutex);
         }
 
         /* remove from the MM's tree and list */
@@ -775,8 +779,6 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
 
         if (vma->vm_next)
                 vma->vm_next->vm_prev = vma->vm_prev;
-
-        vma->vm_mm = NULL;
 }
 
 /*
@@ -2052,6 +2054,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
         high = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
 
         down_write(&nommu_region_sem);
+        mutex_lock(&inode->i_mapping->i_mmap_mutex);
 
         /* search for VMAs that fall within the dead zone */
         vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
@@ -2059,6 +2062,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
                 /* found one - only interested if it's shared out of the page
                  * cache */
                 if (vma->vm_flags & VM_SHARED) {
+                        mutex_unlock(&inode->i_mapping->i_mmap_mutex);
                         up_write(&nommu_region_sem);
                         return -ETXTBSY; /* not quite true, but near enough */
                 }
@@ -2086,6 +2090,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
                 }
         }
 
+        mutex_unlock(&inode->i_mapping->i_mmap_mutex);
         up_write(&nommu_region_sem);
         return 0;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 0027d8f4a1bb..a13ded1938f0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5236,6 +5236,7 @@ void *__init alloc_large_system_hash(const char *tablename,
                 max = ((unsigned long long)nr_all_pages << PAGE_SHIFT) >> 4;
                 do_div(max, bucketsize);
         }
+        max = min(max, 0x80000000ULL);
 
         if (numentries > max)
                 numentries = max;
@@ -5413,7 +5414,25 @@ __count_immobile_pages(struct zone *zone, struct page *page, int count)
 
 bool is_pageblock_removable_nolock(struct page *page)
 {
-        struct zone *zone = page_zone(page);
+        struct zone *zone;
+        unsigned long pfn;
+
+        /*
+         * We have to be careful here because we are iterating over memory
+         * sections which are not zone aware so we might end up outside of
+         * the zone but still within the section.
+         * We have to take care about the node as well. If the node is offline
+         * its NODE_DATA will be NULL - see page_zone.
+         */
+        if (!node_online(page_to_nid(page)))
+                return false;
+
+        zone = page_zone(page);
+        pfn = page_to_pfn(page);
+        if (zone->zone_start_pfn > pfn ||
+                        zone->zone_start_pfn + zone->spanned_pages <= pfn)
+                return false;
+
         return __count_immobile_pages(zone, page, 0);
 }
 
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index de1616aa9b1e..1ccbd714059c 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -379,13 +379,15 @@ static struct swap_cgroup *lookup_swap_cgroup(swp_entry_t ent,
         pgoff_t offset = swp_offset(ent);
         struct swap_cgroup_ctrl *ctrl;
         struct page *mappage;
+        struct swap_cgroup *sc;
 
         ctrl = &swap_cgroup_ctrl[swp_type(ent)];
         if (ctrlp)
                 *ctrlp = ctrl;
 
         mappage = ctrl->map[offset / SC_PER_PAGE];
-        return page_address(mappage) + offset % SC_PER_PAGE;
+        sc = page_address(mappage);
+        return sc + offset % SC_PER_PAGE;
 }
 
 /**
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 12a48a88c0d8..405d331804c3 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -184,8 +184,7 @@ static void pcpu_unmap_pages(struct pcpu_chunk *chunk,
                                    page_end - page_start);
         }
 
-        for (i = page_start; i < page_end; i++)
-                __clear_bit(i, populated);
+        bitmap_clear(populated, page_start, page_end - page_start);
 }
 
 /**
diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
index e920aa3ce104..c20ff48994c2 100644
--- a/mm/process_vm_access.c
+++ b/mm/process_vm_access.c
@@ -298,23 +298,18 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
                 goto free_proc_pages;
         }
 
-        task_lock(task);
-        if (__ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
-                task_unlock(task);
-                rc = -EPERM;
-                goto put_task_struct;
-        }
-        mm = task->mm;
-
-        if (!mm || (task->flags & PF_KTHREAD)) {
-                task_unlock(task);
-                rc = -EINVAL;
+        mm = mm_access(task, PTRACE_MODE_ATTACH);
+        if (!mm || IS_ERR(mm)) {
+                rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
+                /*
+                 * Explicitly map EACCES to EPERM as EPERM is a more a
+                 * appropriate error code for process_vw_readv/writev
+                 */
+                if (rc == -EACCES)
+                        rc = -EPERM;
                 goto put_task_struct;
         }
 
-        atomic_inc(&mm->mm_users);
-        task_unlock(task);
-
         for (i = 0; i < riovcnt && iov_l_curr_idx < liovcnt; i++) {
                 rc = process_vm_rw_single_vec(
                         (unsigned long)rvec[i].iov_base, rvec[i].iov_len,
diff --git a/mm/shmem.c b/mm/shmem.c
index feead1943d92..269d049294ab 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -379,7 +379,7 @@ static int shmem_free_swap(struct address_space *mapping,
 /*
  * Pagevec may contain swap entries, so shuffle up pages before releasing.
  */
-static void shmem_pagevec_release(struct pagevec *pvec)
+static void shmem_deswap_pagevec(struct pagevec *pvec)
 {
         int i, j;
 
@@ -389,7 +389,36 @@ static void shmem_pagevec_release(struct pagevec *pvec)
                         pvec->pages[j++] = page;
         }
         pvec->nr = j;
-        pagevec_release(pvec);
+}
+
+/*
+ * SysV IPC SHM_UNLOCK restore Unevictable pages to their evictable lists.
+ */
+void shmem_unlock_mapping(struct address_space *mapping)
+{
+        struct pagevec pvec;
+        pgoff_t indices[PAGEVEC_SIZE];
+        pgoff_t index = 0;
+
+        pagevec_init(&pvec, 0);
+        /*
+         * Minor point, but we might as well stop if someone else SHM_LOCKs it.
+         */
+        while (!mapping_unevictable(mapping)) {
+                /*
+                 * Avoid pagevec_lookup(): find_get_pages() returns 0 as if it
+                 * has finished, if it hits a row of PAGEVEC_SIZE swap entries.
+                 */
+                pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
+                                        PAGEVEC_SIZE, pvec.pages, indices);
+                if (!pvec.nr)
+                        break;
+                index = indices[pvec.nr - 1] + 1;
+                shmem_deswap_pagevec(&pvec);
+                check_move_unevictable_pages(pvec.pages, pvec.nr);
+                pagevec_release(&pvec);
+                cond_resched();
+        }
 }
 
 /*
@@ -440,7 +469,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         }
                         unlock_page(page);
                 }
-                shmem_pagevec_release(&pvec);
+                shmem_deswap_pagevec(&pvec);
+                pagevec_release(&pvec);
                 mem_cgroup_uncharge_end();
                 cond_resched();
                 index++;
@@ -470,7 +500,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         continue;
                 }
                 if (index == start && indices[0] > end) {
-                        shmem_pagevec_release(&pvec);
+                        shmem_deswap_pagevec(&pvec);
+                        pagevec_release(&pvec);
                         break;
                 }
                 mem_cgroup_uncharge_start();
@@ -494,7 +525,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         }
                         unlock_page(page);
                 }
-                shmem_pagevec_release(&pvec);
+                shmem_deswap_pagevec(&pvec);
+                pagevec_release(&pvec);
                 mem_cgroup_uncharge_end();
                 index++;
         }
@@ -1068,13 +1100,6 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
                 user_shm_unlock(inode->i_size, user);
                 info->flags &= ~VM_LOCKED;
                 mapping_clear_unevictable(file->f_mapping);
-                /*
-                 * Ensure that a racing putback_lru_page() can see
-                 * the pages of this mapping are evictable when we
-                 * skip them due to !PageLRU during the scan.
-                 */
-                smp_mb__after_clear_bit();
-                scan_mapping_unevictable_pages(file->f_mapping);
         }
         retval = 0;
 
@@ -2445,6 +2470,10 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
         return 0;
 }
 
+void shmem_unlock_mapping(struct address_space *mapping)
+{
+}
+
 void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
 {
         truncate_inode_pages_range(inode->i_mapping, lstart, lend);
diff --git a/mm/swap.c b/mm/swap.c
index b0f529b38979..14380e9fbe33 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -652,14 +652,14 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct zone* zone,
                        struct page *page, struct page *page_tail)
 {
-        int active;
+        int uninitialized_var(active);
         enum lru_list lru;
         const int file = 0;
 
         VM_BUG_ON(!PageHead(page));
         VM_BUG_ON(PageCompound(page_tail));
         VM_BUG_ON(PageLRU(page_tail));
-        VM_BUG_ON(!spin_is_locked(&zone->lru_lock));
+        VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&zone->lru_lock));
 
         SetPageLRU(page_tail);
 
@@ -672,7 +672,6 @@ void lru_add_page_tail(struct zone* zone,
                         active = 0;
                         lru = LRU_INACTIVE_ANON;
                 }
-                update_page_reclaim_stat(zone, page_tail, file, active);
         } else {
                 SetPageUnevictable(page_tail);
                 lru = LRU_UNEVICTABLE;
@@ -693,6 +692,9 @@ void lru_add_page_tail(struct zone* zone,
                 list_head = page_tail->lru.prev;
                 list_move_tail(&page_tail->lru, list_head);
         }
+
+        if (!PageUnevictable(page))
+                update_page_reclaim_stat(zone, page_tail, file, active);
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
@@ -710,8 +712,8 @@ static void __pagevec_lru_add_fn(struct page *page, void *arg)
         SetPageLRU(page);
         if (active)
                 SetPageActive(page);
-        update_page_reclaim_stat(zone, page, file, active);
         add_page_to_lru_list(zone, page, lru);
+        update_page_reclaim_stat(zone, page, file, active);
 }
 
 /*
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 470038a91873..ea6b32d61873 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -300,16 +300,6 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                         new_page = alloc_page_vma(gfp_mask, vma, addr);
                         if (!new_page)
                                 break;          /* Out of memory */
-                        /*
-                         * The memcg-specific accounting when moving
-                         * pages around the LRU lists relies on the
-                         * page's owner (memcg) to be valid.  Usually,
-                         * pages are assigned to a new owner before
-                         * being put on the LRU list, but since this
-                         * is not the case here, the stale owner from
-                         * a previous allocation cycle must be reset.
-                         */
-                        mem_cgroup_reset_owner(new_page);
                 }
 
                 /*
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2880396f7953..c52b23552659 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -26,7 +26,6 @@
 #include <linux/buffer_head.h>  /* for try_to_release_page(),
                                         buffer_heads_over_limit */
 #include <linux/mm_inline.h>
-#include <linux/pagevec.h>
 #include <linux/backing-dev.h>
 #include <linux/rmap.h>
 #include <linux/topology.h>
@@ -661,7 +660,7 @@ redo:
                  * When racing with an mlock or AS_UNEVICTABLE clearing
                  * (page is unlocked) make sure that if the other thread
                  * does not observe our setting of PG_lru and fails
-                 * isolation/check_move_unevictable_page,
+                 * isolation/check_move_unevictable_pages,
                  * we see PG_mlocked/AS_UNEVICTABLE cleared below and move
                  * the page back to the evictable list.
                  *
@@ -3499,100 +3498,61 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
         return 1;
 }
 
+#ifdef CONFIG_SHMEM
 /**
- * check_move_unevictable_page - check page for evictability and move to appropriate zone lru list
- * @page: page to check evictability and move to appropriate lru list
- * @zone: zone page is in
+ * check_move_unevictable_pages - check pages for evictability and move to appropriate zone lru list
+ * @pages:      array of pages to check
+ * @nr_pages:   number of pages to check
  *
- * Checks a page for evictability and moves the page to the appropriate
- * zone lru list.
+ * Checks pages for evictability and moves them to the appropriate lru list.
  *
- * Restrictions: zone->lru_lock must be held, page must be on LRU and must
- * have PageUnevictable set.
+ * This function is only used for SysV IPC SHM_UNLOCK.
  */
-static void check_move_unevictable_page(struct page *page, struct zone *zone)
+void check_move_unevictable_pages(struct page **pages, int nr_pages)
 {
         struct lruvec *lruvec;
+        struct zone *zone = NULL;
+        int pgscanned = 0;
+        int pgrescued = 0;
+        int i;
 
-        VM_BUG_ON(PageActive(page));
-retry:
-        ClearPageUnevictable(page);
-        if (page_evictable(page, NULL)) {
-                enum lru_list l = page_lru_base_type(page);
-
-                __dec_zone_state(zone, NR_UNEVICTABLE);
-                lruvec = mem_cgroup_lru_move_lists(zone, page,
-                                                   LRU_UNEVICTABLE, l);
-                list_move(&page->lru, &lruvec->lists[l]);
-                __inc_zone_state(zone, NR_INACTIVE_ANON + l);
-                __count_vm_event(UNEVICTABLE_PGRESCUED);
-        } else {
-                /*
-                 * rotate unevictable list
-                 */
-                SetPageUnevictable(page);
-                lruvec = mem_cgroup_lru_move_lists(zone, page, LRU_UNEVICTABLE,
-                                                   LRU_UNEVICTABLE);
-                list_move(&page->lru, &lruvec->lists[LRU_UNEVICTABLE]);
-                if (page_evictable(page, NULL))
-                        goto retry;
-        }
-}
-
-/**
- * scan_mapping_unevictable_pages - scan an address space for evictable pages
- * @mapping: struct address_space to scan for evictable pages
- *
- * Scan all pages in mapping.  Check unevictable pages for
- * evictability and move them to the appropriate zone lru list.
- */
-void scan_mapping_unevictable_pages(struct address_space *mapping)
-{
-        pgoff_t next = 0;
-        pgoff_t end   = (i_size_read(mapping->host) + PAGE_CACHE_SIZE - 1) >>
-                         PAGE_CACHE_SHIFT;
-        struct zone *zone;
-        struct pagevec pvec;
-
-        if (mapping->nrpages == 0)
-                return;
-
-        pagevec_init(&pvec, 0);
-        while (next < end &&
-                pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)) {
-                int i;
-                int pg_scanned = 0;
-
-                zone = NULL;
-
-                for (i = 0; i < pagevec_count(&pvec); i++) {
-                        struct page *page = pvec.pages[i];
-                        pgoff_t page_index = page->index;
-                        struct zone *pagezone = page_zone(page);
+        for (i = 0; i < nr_pages; i++) {
+                struct page *page = pages[i];
+                struct zone *pagezone;
 
-                        pg_scanned++;
-                        if (page_index > next)
-                                next = page_index;
-                        next++;
+                pgscanned++;
+                pagezone = page_zone(page);
+                if (pagezone != zone) {
+                        if (zone)
+                                spin_unlock_irq(&zone->lru_lock);
+                        zone = pagezone;
+                        spin_lock_irq(&zone->lru_lock);
+                }
 
-                        if (pagezone != zone) {
-                                if (zone)
-                                        spin_unlock_irq(&zone->lru_lock);
-                                zone = pagezone;
-                                spin_lock_irq(&zone->lru_lock);
-                        }
+                if (!PageLRU(page) || !PageUnevictable(page))
+                        continue;
 
-                        if (PageLRU(page) && PageUnevictable(page))
-                                check_move_unevictable_page(page, zone);
+                if (page_evictable(page, NULL)) {
+                        enum lru_list lru = page_lru_base_type(page);
+
+                        VM_BUG_ON(PageActive(page));
+                        ClearPageUnevictable(page);
+                        __dec_zone_state(zone, NR_UNEVICTABLE);
+                        lruvec = mem_cgroup_lru_move_lists(zone, page,
+                                                LRU_UNEVICTABLE, lru);
+                        list_move(&page->lru, &lruvec->lists[lru]);
+                        __inc_zone_state(zone, NR_INACTIVE_ANON + lru);
+                        pgrescued++;
                 }
-                if (zone)
-                        spin_unlock_irq(&zone->lru_lock);
-                pagevec_release(&pvec);
-
-                count_vm_events(UNEVICTABLE_PGSCANNED, pg_scanned);
         }
 
+        if (zone) {
+                __count_vm_events(UNEVICTABLE_PGRESCUED, pgrescued);
+                __count_vm_events(UNEVICTABLE_PGSCANNED, pgscanned);
+                spin_unlock_irq(&zone->lru_lock);
+        }
 }
+#endif /* CONFIG_SHMEM */
 
 static void warn_scan_unevictable_pages(void)
 {