5 files changed, 19 insertions, 14 deletions

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 6034dc9e9796..ffbdfc86aedf 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -546,6 +546,7 @@ static void free_huge_page(struct page *page)
 
         mapping = (struct address_space *) page_private(page);
         set_page_private(page, 0);
+        page->mapping = NULL;
         BUG_ON(page_count(page));
         INIT_LIST_HEAD(&page->lru);
 
@@ -2447,8 +2448,10 @@ retry:
                         spin_lock(&inode->i_lock);
                         inode->i_blocks += blocks_per_huge_page(h);
                         spin_unlock(&inode->i_lock);
-                } else
+                } else {
                         lock_page(page);
+                        page->mapping = HUGETLB_POISON;
+                }
         }
 
         /*
diff --git a/mm/ksm.c b/mm/ksm.c
index 8cdfc2a1e8bf..956880f2ff49 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -365,7 +365,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr)
         do {
                 cond_resched();
                 page = follow_page(vma, addr, FOLL_GET);
-                if (!page)
+                if (IS_ERR_OR_NULL(page))
                         break;
                 if (PageKsm(page))
                         ret = handle_mm_fault(vma->vm_mm, vma, addr,
@@ -447,7 +447,7 @@ static struct page *get_mergeable_page(struct rmap_item *rmap_item)
                 goto out;
 
         page = follow_page(vma, addr, FOLL_GET);
-        if (!page)
+        if (IS_ERR_OR_NULL(page))
                 goto out;
         if (PageAnon(page)) {
                 flush_anon_page(vma, page, addr);
@@ -1086,7 +1086,7 @@ struct rmap_item *unstable_tree_search_insert(struct rmap_item *rmap_item,
                 cond_resched();
                 tree_rmap_item = rb_entry(*new, struct rmap_item, node);
                 tree_page = get_mergeable_page(tree_rmap_item);
-                if (!tree_page)
+                if (IS_ERR_OR_NULL(tree_page))
                         return NULL;
 
                 /*
@@ -1294,7 +1294,7 @@ next_mm:
                         if (ksm_test_exit(mm))
                                 break;
                         *page = follow_page(vma, ksm_scan.address, FOLL_GET);
-                        if (*page && PageAnon(*page)) {
+                        if (!IS_ERR_OR_NULL(*page) && PageAnon(*page)) {
                                 flush_anon_page(vma, *page, ksm_scan.address);
                                 flush_dcache_page(*page);
                                 rmap_item = get_next_rmap_item(slot,
@@ -1308,7 +1308,7 @@ next_mm:
                                 up_read(&mm->mmap_sem);
                                 return rmap_item;
                         }
-                        if (*page)
+                        if (!IS_ERR_OR_NULL(*page))
                                 put_page(*page);
                         ksm_scan.address += PAGE_SIZE;
                         cond_resched();
@@ -1367,7 +1367,7 @@ next_mm:
 static void ksm_do_scan(unsigned int scan_npages)
 {
         struct rmap_item *rmap_item;
-        struct page *page;
+        struct page *uninitialized_var(page);
 
         while (scan_npages--) {
                 cond_resched();
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f4ede99c8b9b..6c755de385f7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2429,11 +2429,11 @@ int mem_cgroup_prepare_migration(struct page *page, struct mem_cgroup **ptr)
         }
         unlock_page_cgroup(pc);
 
+        *ptr = mem;
         if (mem) {
-                ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, &mem, false);
+                ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false);
                 css_put(&mem->css);
         }
-        *ptr = mem;
         return ret;
 }
 
diff --git a/mm/mmap.c b/mm/mmap.c
index f90ea92f755a..456ec6f27889 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1977,7 +1977,8 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
                 return 0;
 
         /* Clean everything up if vma_adjust failed. */
-        new->vm_ops->close(new);
+        if (new->vm_ops && new->vm_ops->close)
+                new->vm_ops->close(new);
         if (new->vm_file) {
                 if (vma->vm_flags & VM_EXECUTABLE)
                         removed_exe_file_vma(mm);
diff --git a/mm/rmap.c b/mm/rmap.c
index 526704e8215d..07fc94758799 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -133,8 +133,8 @@ int anon_vma_prepare(struct vm_area_struct *vma)
                                 goto out_enomem_free_avc;
                         allocated = anon_vma;
                 }
-                spin_lock(&anon_vma->lock);
 
+                spin_lock(&anon_vma->lock);
                 /* page_table_lock to protect against threads */
                 spin_lock(&mm->page_table_lock);
                 if (likely(!vma->anon_vma)) {
@@ -144,14 +144,15 @@ int anon_vma_prepare(struct vm_area_struct *vma)
                         list_add(&avc->same_vma, &vma->anon_vma_chain);
                         list_add(&avc->same_anon_vma, &anon_vma->head);
                         allocated = NULL;
+                        avc = NULL;
                 }
                 spin_unlock(&mm->page_table_lock);
-
                 spin_unlock(&anon_vma->lock);
-                if (unlikely(allocated)) {
+
+                if (unlikely(allocated))
                         anon_vma_free(allocated);
+                if (unlikely(avc))
                         anon_vma_chain_free(avc);
-                }
         }
         return 0;