10 files changed, 66 insertions, 28 deletions

diff --git a/mm/bounce.c b/mm/bounce.c
index b6d2d0f1019b..06722c403058 100644
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -267,7 +267,7 @@ void blk_queue_bounce(struct request_queue *q, struct bio **bio_orig)
         /*
          * Data-less bio, nothing to bounce
          */
-        if (bio_empty_barrier(*bio_orig))
+        if (!bio_has_data(*bio_orig))
                 return;
 
         /*
diff --git a/mm/highmem.c b/mm/highmem.c
index e16e1523b688..b36b83b920ff 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -70,6 +70,7 @@ static DECLARE_WAIT_QUEUE_HEAD(pkmap_map_wait);
 static void flush_all_zero_pkmaps(void)
 {
         int i;
+        int need_flush = 0;
 
         flush_cache_kmaps();
 
@@ -101,8 +102,10 @@ static void flush_all_zero_pkmaps(void)
                           &pkmap_page_table[i]);
 
                 set_page_address(page, NULL);
+                need_flush = 1;
         }
-        flush_tlb_kernel_range(PKMAP_ADDR(0), PKMAP_ADDR(LAST_PKMAP));
+        if (need_flush)
+                flush_tlb_kernel_range(PKMAP_ADDR(0), PKMAP_ADDR(LAST_PKMAP));
 }
 
 /**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 0f1f7a7374ba..36896f3eb7f5 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -250,6 +250,14 @@ static struct mem_cgroup *mem_cgroup_from_cont(struct cgroup *cont)
 
 struct mem_cgroup *mem_cgroup_from_task(struct task_struct *p)
 {
+        /*
+         * mm_update_next_owner() may clear mm->owner to NULL
+         * if it races with swapoff, page migration, etc.
+         * So this can be called with p == NULL.
+         */
+        if (unlikely(!p))
+                return NULL;
+
         return container_of(task_subsys_state(p, mem_cgroup_subsys_id),
                                 struct mem_cgroup, css);
 }
@@ -549,6 +557,11 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
         if (likely(!memcg)) {
                 rcu_read_lock();
                 mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
+                if (unlikely(!mem)) {
+                        rcu_read_unlock();
+                        kmem_cache_free(page_cgroup_cache, pc);
+                        return 0;
+                }
                 /*
                  * For every charge from the cgroup, increment reference count
                  */
@@ -801,11 +814,16 @@ int mem_cgroup_shrink_usage(struct mm_struct *mm, gfp_t gfp_mask)
 
         rcu_read_lock();
         mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
+        if (unlikely(!mem)) {
+                rcu_read_unlock();
+                return 0;
+        }
         css_get(&mem->css);
         rcu_read_unlock();
 
         do {
                 progress = try_to_free_mem_cgroup_pages(mem, gfp_mask);
+                progress += res_counter_check_under_limit(&mem->res);
         } while (!progress && --retry);
 
         css_put(&mem->css);
diff --git a/mm/mmzone.c b/mm/mmzone.c
index 486ed595ee6f..16ce8b955dcf 100644
--- a/mm/mmzone.c
+++ b/mm/mmzone.c
@@ -69,6 +69,6 @@ struct zoneref *next_zones_zonelist(struct zoneref *z,
                                 (z->zone && !zref_in_nodemask(z, nodes)))
                         z++;
 
-        *zone = zonelist_zone(z++);
+        *zone = zonelist_zone(z);
         return z;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e293c58bea58..27b8681139fd 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -268,13 +268,14 @@ void prep_compound_page(struct page *page, unsigned long order)
 {
         int i;
         int nr_pages = 1 << order;
+        struct page *p = page + 1;
 
         set_compound_page_dtor(page, free_compound_page);
         set_compound_order(page, order);
         __SetPageHead(page);
-        for (i = 1; i < nr_pages; i++) {
-                struct page *p = page + i;
-
+        for (i = 1; i < nr_pages; i++, p++) {
+                if (unlikely((i & (MAX_ORDER_NR_PAGES - 1)) == 0))
+                        p = pfn_to_page(page_to_pfn(page) + i);
                 __SetPageTail(p);
                 p->first_page = page;
         }
@@ -284,6 +285,7 @@ static void destroy_compound_page(struct page *page, unsigned long order)
 {
         int i;
         int nr_pages = 1 << order;
+        struct page *p = page + 1;
 
         if (unlikely(compound_order(page) != order))
                 bad_page(page);
@@ -291,8 +293,9 @@ static void destroy_compound_page(struct page *page, unsigned long order)
         if (unlikely(!PageHead(page)))
                         bad_page(page);
         __ClearPageHead(page);
-        for (i = 1; i < nr_pages; i++) {
-                struct page *p = page + i;
+        for (i = 1; i < nr_pages; i++, p++) {
+                if (unlikely((i & (MAX_ORDER_NR_PAGES - 1)) == 0))
+                        p = pfn_to_page(page_to_pfn(page) + i);
 
                 if (unlikely(!PageTail(p) |
                                 (p->first_page != page)))
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index c69f84fe038d..b70a7fec1ff6 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -114,8 +114,10 @@ __test_page_isolated_in_pageblock(unsigned long pfn, unsigned long end_pfn)
 
 int test_pages_isolated(unsigned long start_pfn, unsigned long end_pfn)
 {
-        unsigned long pfn;
+        unsigned long pfn, flags;
         struct page *page;
+        struct zone *zone;
+        int ret;
 
         pfn = start_pfn;
         /*
@@ -131,7 +133,9 @@ int test_pages_isolated(unsigned long start_pfn, unsigned long end_pfn)
         if (pfn < end_pfn)
                 return -EBUSY;
         /* Check all pages are free or Marked as ISOLATED */
-        if (__test_page_isolated_in_pageblock(start_pfn, end_pfn))
-                return 0;
-        return -EBUSY;
+        zone = page_zone(pfn_to_page(pfn));
+        spin_lock_irqsave(&zone->lock, flags);
+        ret = __test_page_isolated_in_pageblock(start_pfn, end_pfn);
+        spin_unlock_irqrestore(&zone->lock, flags);
+        return ret ? 0 : -EBUSY;
 }
diff --git a/mm/slob.c b/mm/slob.c
index 4c82dd41f32e..cb675d126791 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -514,9 +514,11 @@ size_t ksize(const void *block)
                 return 0;
 
         sp = (struct slob_page *)virt_to_page(block);
-        if (slob_page(sp))
-                return ((slob_t *)block - 1)->units + SLOB_UNIT;
-        else
+        if (slob_page(sp)) {
+                int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+                unsigned int *m = (unsigned int *)(block - align);
+                return SLOB_UNITS(*m) * SLOB_UNIT;
+        } else
                 return sp->page.private;
 }
 
diff --git a/mm/slub.c b/mm/slub.c
index fb486d5540f8..0c83e6afe7b2 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1932,6 +1932,7 @@ init_kmem_cache_node(struct kmem_cache_node *n, struct kmem_cache *s)
         INIT_LIST_HEAD(&n->partial);
 #ifdef CONFIG_SLUB_DEBUG
         atomic_long_set(&n->nr_slabs, 0);
+        atomic_long_set(&n->total_objects, 0);
         INIT_LIST_HEAD(&n->full);
 #endif
 }
diff --git a/mm/tiny-shmem.c b/mm/tiny-shmem.c
index ae532f501943..8d7a27a6335c 100644
--- a/mm/tiny-shmem.c
+++ b/mm/tiny-shmem.c
@@ -65,31 +65,31 @@ struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags)
         if (!dentry)
                 goto put_memory;
 
+        error = -ENFILE;
+        file = get_empty_filp();
+        if (!file)
+                goto put_dentry;
+
         error = -ENOSPC;
         inode = ramfs_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0);
         if (!inode)
-                goto put_dentry;
+                goto close_file;
 
         d_instantiate(dentry, inode);
-        error = -ENFILE;
-        file = alloc_file(shm_mnt, dentry, FMODE_WRITE | FMODE_READ,
-                        &ramfs_file_operations);
-        if (!file)
-                goto put_dentry;
-
+        inode->i_size = size;
         inode->i_nlink = 0;     /* It is unlinked */
+        init_file(file, shm_mnt, dentry, FMODE_WRITE | FMODE_READ,
+                        &ramfs_file_operations);
 
-        /* notify everyone as to the change of file size */
-        error = do_truncate(dentry, size, 0, file);
-        if (error < 0)
+#ifndef CONFIG_MMU
+        error = ramfs_nommu_expand_for_mapping(inode, size);
+        if (error)
                 goto close_file;
-
+#endif
         return file;
 
 close_file:
         put_filp(file);
-        return ERR_PTR(error);
-
 put_dentry:
         dput(dentry);
 put_memory:
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 85b9a0d2c877..bba06c41fc59 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -180,6 +180,13 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
         pmd_t *pmd;
         pte_t *ptep, pte;
 
+        /*
+         * XXX we might need to change this if we add VIRTUAL_BUG_ON for
+         * architectures that do not vmalloc module space
+         */
+        VIRTUAL_BUG_ON(!is_vmalloc_addr(vmalloc_addr) &&
+                        !is_module_address(addr));
+
         if (!pgd_none(*pgd)) {
                 pud = pud_offset(pgd, addr);
                 if (!pud_none(*pud)) {