1 files changed, 36 insertions, 6 deletions

diff --git a/kernel/fork.c b/kernel/fork.c
index 2b44d82b8237..8e7e135d0817 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -383,15 +383,14 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                         get_file(file);
                         if (tmp->vm_flags & VM_DENYWRITE)
                                 atomic_dec(&inode->i_writecount);
-                        spin_lock(&mapping->i_mmap_lock);
+                        mutex_lock(&mapping->i_mmap_mutex);
                         if (tmp->vm_flags & VM_SHARED)
                                 mapping->i_mmap_writable++;
-                        tmp->vm_truncate_count = mpnt->vm_truncate_count;
                         flush_dcache_mmap_lock(mapping);
                         /* insert tmp into the share list, just after mpnt */
                         vma_prio_tree_add(tmp, mpnt);
                         flush_dcache_mmap_unlock(mapping);
-                        spin_unlock(&mapping->i_mmap_lock);
+                        mutex_unlock(&mapping->i_mmap_mutex);
                 }
 
                 /*
@@ -486,6 +485,20 @@ static void mm_init_aio(struct mm_struct *mm)
 #endif
 }
 
+int mm_init_cpumask(struct mm_struct *mm, struct mm_struct *oldmm)
+{
+#ifdef CONFIG_CPUMASK_OFFSTACK
+        if (!alloc_cpumask_var(&mm->cpu_vm_mask_var, GFP_KERNEL))
+                return -ENOMEM;
+
+        if (oldmm)
+                cpumask_copy(mm_cpumask(mm), mm_cpumask(oldmm));
+        else
+                memset(mm_cpumask(mm), 0, cpumask_size());
+#endif
+        return 0;
+}
+
 static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
 {
         atomic_set(&mm->mm_users, 1);
@@ -522,10 +535,20 @@ struct mm_struct * mm_alloc(void)
         struct mm_struct * mm;
 
         mm = allocate_mm();
-        if (mm) {
-                memset(mm, 0, sizeof(*mm));
-                mm = mm_init(mm, current);
+        if (!mm)
+                return NULL;
+
+        memset(mm, 0, sizeof(*mm));
+        mm = mm_init(mm, current);
+        if (!mm)
+                return NULL;
+
+        if (mm_init_cpumask(mm, NULL)) {
+                mm_free_pgd(mm);
+                free_mm(mm);
+                return NULL;
         }
+
         return mm;
 }
 
@@ -537,6 +560,7 @@ struct mm_struct * mm_alloc(void)
 void __mmdrop(struct mm_struct *mm)
 {
         BUG_ON(mm == &init_mm);
+        free_cpumask_var(mm->cpu_vm_mask_var);
         mm_free_pgd(mm);
         destroy_context(mm);
         mmu_notifier_mm_destroy(mm);
@@ -691,6 +715,9 @@ struct mm_struct *dup_mm(struct task_struct *tsk)
         if (!mm_init(mm, tsk))
                 goto fail_nomem;
 
+        if (mm_init_cpumask(mm, oldmm))
+                goto fail_nocpumask;
+
         if (init_new_context(tsk, mm))
                 goto fail_nocontext;
 
@@ -717,6 +744,9 @@ fail_nomem:
         return NULL;
 
 fail_nocontext:
+        free_cpumask_var(mm->cpu_vm_mask_var);
+
+fail_nocpumask:
         /*
          * If init_new_context() failed, we cannot use mmput() to free the mm
          * because it calls destroy_context()