4 files changed, 35 insertions, 20 deletions

diff --git a/mm/filemap.c b/mm/filemap.c
index 5c74b68935ac..df343d1e6345 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -28,7 +28,6 @@
 #include <linux/backing-dev.h>
 #include <linux/pagevec.h>
 #include <linux/blkdev.h>
-#include <linux/backing-dev.h>
 #include <linux/security.h>
 #include <linux/syscalls.h>
 #include <linux/cpuset.h>
@@ -1743,21 +1742,27 @@ size_t iov_iter_copy_from_user(struct page *page,
 }
 EXPORT_SYMBOL(iov_iter_copy_from_user);
 
-static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
+void iov_iter_advance(struct iov_iter *i, size_t bytes)
 {
+        BUG_ON(i->count < bytes);
+
         if (likely(i->nr_segs == 1)) {
                 i->iov_offset += bytes;
+                i->count -= bytes;
         } else {
                 const struct iovec *iov = i->iov;
                 size_t base = i->iov_offset;
 
                 /*
                  * The !iov->iov_len check ensures we skip over unlikely
-                 * zero-length segments.
+                 * zero-length segments (without overruning the iovec).
                  */
-                while (bytes || !iov->iov_len) {
-                        int copy = min(bytes, iov->iov_len - base);
+                while (bytes || unlikely(!iov->iov_len && i->count)) {
+                        int copy;
 
+                        copy = min(bytes, iov->iov_len - base);
+                        BUG_ON(!i->count || i->count < copy);
+                        i->count -= copy;
                         bytes -= copy;
                         base += copy;
                         if (iov->iov_len == base) {
@@ -1769,14 +1774,6 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
                 i->iov_offset = base;
         }
 }
-
-void iov_iter_advance(struct iov_iter *i, size_t bytes)
-{
-        BUG_ON(i->count < bytes);
-
-        __iov_iter_advance_iov(i, bytes);
-        i->count -= bytes;
-}
 EXPORT_SYMBOL(iov_iter_advance);
 
 /*
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index dcacc811e70e..74c1b6b0b37b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -286,6 +286,12 @@ static struct page *alloc_buddy_huge_page(struct vm_area_struct *vma,
 
         spin_lock(&hugetlb_lock);
         if (page) {
+                /*
+                 * This page is now managed by the hugetlb allocator and has
+                 * no users -- drop the buddy allocator's reference.
+                 */
+                put_page_testzero(page);
+                VM_BUG_ON(page_count(page));
                 nid = page_to_nid(page);
                 set_compound_page_dtor(page, free_huge_page);
                 /*
@@ -369,13 +375,14 @@ free:
                         enqueue_huge_page(page);
                 else {
                         /*
-                         * Decrement the refcount and free the page using its
-                         * destructor.  This must be done with hugetlb_lock
+                         * The page has a reference count of zero already, so
+                         * call free_huge_page directly instead of using
+                         * put_page.  This must be done with hugetlb_lock
                          * unlocked which is safe because free_huge_page takes
                          * hugetlb_lock before deciding how to free the page.
                          */
                         spin_unlock(&hugetlb_lock);
-                        put_page(page);
+                        free_huge_page(page);
                         spin_lock(&hugetlb_lock);
                 }
         }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 6c7ba1a63d23..3c3601121509 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1296,7 +1296,9 @@ struct zonelist *huge_zonelist(struct vm_area_struct *vma, unsigned long addr,
                 unsigned nid;
 
                 nid = interleave_nid(pol, vma, addr, HPAGE_SHIFT);
-                __mpol_free(pol);               /* finished with pol */
+                if (unlikely(pol != &default_policy &&
+                                pol != current->mempolicy))
+                        __mpol_free(pol);       /* finished with pol */
                 return NODE_DATA(nid)->node_zonelists + gfp_zone(gfp_flags);
         }
 
@@ -1360,6 +1362,9 @@ alloc_page_vma(gfp_t gfp, struct vm_area_struct *vma, unsigned long addr)
                 unsigned nid;
 
                 nid = interleave_nid(pol, vma, addr, PAGE_SHIFT);
+                if (unlikely(pol != &default_policy &&
+                                pol != current->mempolicy))
+                        __mpol_free(pol);       /* finished with pol */
                 return alloc_page_interleave(gfp, 0, nid);
         }
         zl = zonelist_policy(gfp, pol);
diff --git a/mm/slub.c b/mm/slub.c
index 96d63eb3ab17..ca71d5b81e4a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1536,9 +1536,15 @@ new_slab:
          * That is only possible if certain conditions are met that are being
          * checked when a slab is created.
          */
-        if (!(gfpflags & __GFP_NORETRY) && (s->flags & __PAGE_ALLOC_FALLBACK))
-                return kmalloc_large(s->objsize, gfpflags);
-
+        if (!(gfpflags & __GFP_NORETRY) &&
+                                (s->flags & __PAGE_ALLOC_FALLBACK)) {
+                if (gfpflags & __GFP_WAIT)
+                        local_irq_enable();
+                object = kmalloc_large(s->objsize, gfpflags);
+                if (gfpflags & __GFP_WAIT)
+                        local_irq_disable();
+                return object;
+        }
         return NULL;
 debug:
         if (!alloc_debug_processing(s, c->page, object, addr))