6 files changed, 32 insertions, 28 deletions

diff --git a/arch/powerpc/mm/gup.c b/arch/powerpc/mm/gup.c
index fec13200868f..d7efdbf640c7 100644
--- a/arch/powerpc/mm/gup.c
+++ b/arch/powerpc/mm/gup.c
@@ -16,16 +16,6 @@
 
 #ifdef __HAVE_ARCH_PTE_SPECIAL
 
-static inline void get_huge_page_tail(struct page *page)
-{
-        /*
-         * __split_huge_page_refcount() cannot run
-         * from under us.
-         */
-        VM_BUG_ON(atomic_read(&page->_count) < 0);
-        atomic_inc(&page->_count);
-}
-
 /*
  * The performance critical leaf functions are made noinline otherwise gcc
  * inlines everything into a single function which results in too much
@@ -57,8 +47,6 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                         put_page(page);
                         return 0;
                 }
-                if (PageTail(page))
-                        get_huge_page_tail(page);
                 pages[*nr] = page;
                 (*nr)++;
 
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 0b9a5c1901b9..da5eb3885702 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -390,7 +390,7 @@ static noinline int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long add
 {
         unsigned long mask;
         unsigned long pte_end;
-        struct page *head, *page;
+        struct page *head, *page, *tail;
         pte_t pte;
         int refs;
 
@@ -413,6 +413,7 @@ static noinline int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long add
         head = pte_page(pte);
 
         page = head + ((addr & (sz-1)) >> PAGE_SHIFT);
+        tail = page;
         do {
                 VM_BUG_ON(compound_head(page) != head);
                 pages[*nr] = page;
@@ -428,10 +429,20 @@ static noinline int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long add
 
         if (unlikely(pte_val(pte) != pte_val(*ptep))) {
                 /* Could be optimized better */
-                while (*nr) {
-                        put_page(page);
-                        (*nr)--;
-                }
+                *nr -= refs;
+                while (refs--)
+                        put_page(head);
+                return 0;
+        }
+
+        /*
+         * Any tail page need their mapcount reference taken before we
+         * return.
+         */
+        while (refs--) {
+                if (PageTail(tail))
+                        get_huge_page_tail(tail);
+                tail++;
         }
 
         return 1;
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index c65f75aa7ff7..22ffccd8bef5 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -1608,6 +1608,7 @@ int fsl_rio_setup(struct platform_device *dev)
         return 0;
 err:
         iounmap(priv->regs_win);
+        release_resource(&port->iores);
 err_res:
         kfree(priv);
 err_priv:
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
index 45b405ca2567..65cb06e2af4e 100644
--- a/arch/s390/mm/gup.c
+++ b/arch/s390/mm/gup.c
@@ -52,7 +52,7 @@ static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
                 unsigned long end, int write, struct page **pages, int *nr)
 {
         unsigned long mask, result;
-        struct page *head, *page;
+        struct page *head, *page, *tail;
         int refs;
 
         result = write ? 0 : _SEGMENT_ENTRY_RO;
@@ -64,6 +64,7 @@ static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
         refs = 0;
         head = pmd_page(pmd);
         page = head + ((addr & ~PMD_MASK) >> PAGE_SHIFT);
+        tail = page;
         do {
                 VM_BUG_ON(compound_head(page) != head);
                 pages[*nr] = page;
@@ -81,6 +82,17 @@ static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
                 *nr -= refs;
                 while (refs--)
                         put_page(head);
+                return 0;
+        }
+
+        /*
+         * Any tail page need their mapcount reference taken before we
+         * return.
+         */
+        while (refs--) {
+                if (PageTail(tail))
+                        get_huge_page_tail(tail);
+                tail++;
         }
 
         return 1;
diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c
index a986b5d05712..42c55df3aec3 100644
--- a/arch/sparc/mm/gup.c
+++ b/arch/sparc/mm/gup.c
@@ -56,6 +56,8 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                         put_page(head);
                         return 0;
                 }
+                if (head != page)
+                        get_huge_page_tail(page);
 
                 pages[*nr] = page;
                 (*nr)++;
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index dbe34b931374..ea305856151c 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -108,16 +108,6 @@ static inline void get_head_page_multiple(struct page *page, int nr)
         SetPageReferenced(page);
 }
 
-static inline void get_huge_page_tail(struct page *page)
-{
-        /*
-         * __split_huge_page_refcount() cannot run
-         * from under us.
-         */
-        VM_BUG_ON(atomic_read(&page->_count) < 0);
-        atomic_inc(&page->_count);
-}
-
 static noinline int gup_huge_pmd(pmd_t pmd, unsigned long addr,
                 unsigned long end, int write, struct page **pages, int *nr)
 {