1 files changed, 39 insertions, 22 deletions

diff --git a/mm/memory.c b/mm/memory.c
index 6105f475fa86..2466d1250231 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1225,7 +1225,15 @@ static inline unsigned long zap_pmd_range(struct mmu_gather *tlb,
                 next = pmd_addr_end(addr, end);
                 if (pmd_trans_huge(*pmd)) {
                         if (next - addr != HPAGE_PMD_SIZE) {
-                                VM_BUG_ON(!rwsem_is_locked(&tlb->mm->mmap_sem));
+#ifdef CONFIG_DEBUG_VM
+                                if (!rwsem_is_locked(&tlb->mm->mmap_sem)) {
+                                        pr_err("%s: mmap_sem is unlocked! addr=0x%lx end=0x%lx vma->vm_start=0x%lx vma->vm_end=0x%lx\n",
+                                                __func__, addr, end,
+                                                vma->vm_start,
+                                                vma->vm_end);
+                                        BUG();
+                                }
+#endif
                                 split_huge_page_pmd(vma->vm_mm, pmd);
                         } else if (zap_huge_pmd(tlb, vma, pmd, addr))
                                 goto next;
@@ -1295,7 +1303,7 @@ static void unmap_page_range(struct mmu_gather *tlb,
 
 static void unmap_single_vma(struct mmu_gather *tlb,
                 struct vm_area_struct *vma, unsigned long start_addr,
-                unsigned long end_addr, unsigned long *nr_accounted,
+                unsigned long end_addr,
                 struct zap_details *details)
 {
         unsigned long start = max(vma->vm_start, start_addr);
@@ -1307,8 +1315,8 @@ static void unmap_single_vma(struct mmu_gather *tlb,
         if (end <= vma->vm_start)
                 return;
 
-        if (vma->vm_flags & VM_ACCOUNT)
-                *nr_accounted += (end - start) >> PAGE_SHIFT;
+        if (vma->vm_file)
+                uprobe_munmap(vma, start, end);
 
         if (unlikely(is_pfn_mapping(vma)))
                 untrack_pfn_vma(vma, 0, 0);
@@ -1339,8 +1347,6 @@ static void unmap_single_vma(struct mmu_gather *tlb,
  * @vma: the starting vma
  * @start_addr: virtual address at which to start unmapping
  * @end_addr: virtual address at which to end unmapping
- * @nr_accounted: Place number of unmapped pages in vm-accountable vma's here
- * @details: details of nonlinear truncation or shared cache invalidation
  *
  * Unmap all pages in the vma list.
  *
@@ -1355,40 +1361,40 @@ static void unmap_single_vma(struct mmu_gather *tlb,
  */
 void unmap_vmas(struct mmu_gather *tlb,
                 struct vm_area_struct *vma, unsigned long start_addr,
-                unsigned long end_addr, unsigned long *nr_accounted,
-                struct zap_details *details)
+                unsigned long end_addr)
 {
         struct mm_struct *mm = vma->vm_mm;
 
         mmu_notifier_invalidate_range_start(mm, start_addr, end_addr);
         for ( ; vma && vma->vm_start < end_addr; vma = vma->vm_next)
-                unmap_single_vma(tlb, vma, start_addr, end_addr, nr_accounted,
-                                 details);
+                unmap_single_vma(tlb, vma, start_addr, end_addr, NULL);
         mmu_notifier_invalidate_range_end(mm, start_addr, end_addr);
 }
 
 /**
  * zap_page_range - remove user pages in a given range
  * @vma: vm_area_struct holding the applicable pages
- * @address: starting address of pages to zap
+ * @start: starting address of pages to zap
  * @size: number of bytes to zap
  * @details: details of nonlinear truncation or shared cache invalidation
  *
  * Caller must protect the VMA list
  */
-void zap_page_range(struct vm_area_struct *vma, unsigned long address,
+void zap_page_range(struct vm_area_struct *vma, unsigned long start,
                 unsigned long size, struct zap_details *details)
 {
         struct mm_struct *mm = vma->vm_mm;
         struct mmu_gather tlb;
-        unsigned long end = address + size;
-        unsigned long nr_accounted = 0;
+        unsigned long end = start + size;
 
         lru_add_drain();
         tlb_gather_mmu(&tlb, mm, 0);
         update_hiwater_rss(mm);
-        unmap_vmas(&tlb, vma, address, end, &nr_accounted, details);
-        tlb_finish_mmu(&tlb, address, end);
+        mmu_notifier_invalidate_range_start(mm, start, end);
+        for ( ; vma && vma->vm_start < end; vma = vma->vm_next)
+                unmap_single_vma(&tlb, vma, start, end, details);
+        mmu_notifier_invalidate_range_end(mm, start, end);
+        tlb_finish_mmu(&tlb, start, end);
 }
 
 /**
@@ -1406,13 +1412,12 @@ static void zap_page_range_single(struct vm_area_struct *vma, unsigned long addr
         struct mm_struct *mm = vma->vm_mm;
         struct mmu_gather tlb;
         unsigned long end = address + size;
-        unsigned long nr_accounted = 0;
 
         lru_add_drain();
         tlb_gather_mmu(&tlb, mm, 0);
         update_hiwater_rss(mm);
         mmu_notifier_invalidate_range_start(mm, address, end);
-        unmap_single_vma(&tlb, vma, address, end, &nr_accounted, details);
+        unmap_single_vma(&tlb, vma, address, end, details);
         mmu_notifier_invalidate_range_end(mm, address, end);
         tlb_finish_mmu(&tlb, address, end);
 }
@@ -2911,7 +2916,6 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
         delayacct_set_flag(DELAYACCT_PF_SWAPIN);
         page = lookup_swap_cache(entry);
         if (!page) {
-                grab_swap_token(mm); /* Contend for token _before_ read-in */
                 page = swapin_readahead(entry,
                                         GFP_HIGHUSER_MOVABLE, vma, address);
                 if (!page) {
@@ -2941,6 +2945,7 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
         }
 
         locked = lock_page_or_retry(page, mm, flags);
+
         delayacct_clear_flag(DELAYACCT_PF_SWAPIN);
         if (!locked) {
                 ret |= VM_FAULT_RETRY;
@@ -3489,6 +3494,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         if (unlikely(is_vm_hugetlb_page(vma)))
                 return hugetlb_fault(mm, vma, address, flags);
 
+retry:
         pgd = pgd_offset(mm, address);
         pud = pud_alloc(mm, pgd, address);
         if (!pud)
@@ -3502,13 +3508,24 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                                                           pmd, flags);
         } else {
                 pmd_t orig_pmd = *pmd;
+                int ret;
+
                 barrier();
                 if (pmd_trans_huge(orig_pmd)) {
                         if (flags & FAULT_FLAG_WRITE &&
                             !pmd_write(orig_pmd) &&
-                            !pmd_trans_splitting(orig_pmd))
-                                return do_huge_pmd_wp_page(mm, vma, address,
-                                                           pmd, orig_pmd);
+                            !pmd_trans_splitting(orig_pmd)) {
+                                ret = do_huge_pmd_wp_page(mm, vma, address, pmd,
+                                                          orig_pmd);
+                                /*
+                                 * If COW results in an oom, the huge pmd will
+                                 * have been split, so retry the fault on the
+                                 * pte for a smaller charge.
+                                 */
+                                if (unlikely(ret & VM_FAULT_OOM))
+                                        goto retry;
+                                return ret;
+                        }
                         return 0;
                 }
         }