6 files changed, 124 insertions, 91 deletions

diff --git a/mm/Makefile b/mm/Makefile
index 3782eb66d4b3..c92e8af13206 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -28,6 +28,7 @@ obj-$(CONFIG_SLOB) += slob.o
 obj-$(CONFIG_MMU_NOTIFIER) += mmu_notifier.o
 obj-$(CONFIG_SLAB) += slab.o
 obj-$(CONFIG_SLUB) += slub.o
+obj-$(CONFIG_FAILSLAB) += failslab.o
 obj-$(CONFIG_MEMORY_HOTPLUG) += memory_hotplug.o
 obj-$(CONFIG_FS_XIP) += filemap_xip.o
 obj-$(CONFIG_MIGRATION) += migrate.o
diff --git a/mm/bounce.c b/mm/bounce.c
index bf0cf7c8387b..e590272fe7a8 100644
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -198,8 +198,13 @@ static void __blk_queue_bounce(struct request_queue *q, struct bio **bio_orig,
                 /*
                  * irk, bounce it
                  */
-                if (!bio)
-                        bio = bio_alloc(GFP_NOIO, (*bio_orig)->bi_vcnt);
+                if (!bio) {
+                        unsigned int cnt = (*bio_orig)->bi_vcnt;
+
+                        bio = bio_alloc(GFP_NOIO, cnt);
+                        memset(bio->bi_io_vec, 0, cnt * sizeof(struct bio_vec));
+                }
+                        
 
                 to = bio->bi_io_vec + i;
 
diff --git a/mm/failslab.c b/mm/failslab.c
new file mode 100644
index 000000000000..7c6ea6493f80
--- /dev/null
+++ b/mm/failslab.c
@@ -0,0 +1,59 @@
+#include <linux/fault-inject.h>
+
+static struct {
+        struct fault_attr attr;
+        u32 ignore_gfp_wait;
+#ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
+        struct dentry *ignore_gfp_wait_file;
+#endif
+} failslab = {
+        .attr = FAULT_ATTR_INITIALIZER,
+        .ignore_gfp_wait = 1,
+};
+
+bool should_failslab(size_t size, gfp_t gfpflags)
+{
+        if (gfpflags & __GFP_NOFAIL)
+                return false;
+
+        if (failslab.ignore_gfp_wait && (gfpflags & __GFP_WAIT))
+                return false;
+
+        return should_fail(&failslab.attr, size);
+}
+
+static int __init setup_failslab(char *str)
+{
+        return setup_fault_attr(&failslab.attr, str);
+}
+__setup("failslab=", setup_failslab);
+
+#ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
+
+static int __init failslab_debugfs_init(void)
+{
+        mode_t mode = S_IFREG | S_IRUSR | S_IWUSR;
+        struct dentry *dir;
+        int err;
+
+        err = init_fault_attr_dentries(&failslab.attr, "failslab");
+        if (err)
+                return err;
+        dir = failslab.attr.dentries.dir;
+
+        failslab.ignore_gfp_wait_file =
+                debugfs_create_bool("ignore-gfp-wait", mode, dir,
+                                      &failslab.ignore_gfp_wait);
+
+        if (!failslab.ignore_gfp_wait_file) {
+                err = -ENOMEM;
+                debugfs_remove(failslab.ignore_gfp_wait_file);
+                cleanup_fault_attr_dentries(&failslab.attr);
+        }
+
+        return err;
+}
+
+late_initcall(failslab_debugfs_init);
+
+#endif /* CONFIG_FAULT_INJECTION_DEBUG_FS */
diff --git a/mm/memory.c b/mm/memory.c
index f01b7eed6e16..0a2010a9518c 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3075,3 +3075,18 @@ void print_vma_addr(char *prefix, unsigned long ip)
         }
         up_read(&current->mm->mmap_sem);
 }
+
+#ifdef CONFIG_PROVE_LOCKING
+void might_fault(void)
+{
+        might_sleep();
+        /*
+         * it would be nicer only to annotate paths which are not under
+         * pagefault_disable, however that requires a larger audit and
+         * providing helpers like get_user_atomic.
+         */
+        if (!in_atomic() && current->mm)
+                might_lock_read(&current->mm->mmap_sem);
+}
+EXPORT_SYMBOL(might_fault);
+#endif
diff --git a/mm/slab.c b/mm/slab.c
index 7f72bb386a09..83075f36df7b 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2132,6 +2132,8 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep)
  *
  * @name must be valid until the cache is destroyed. This implies that
  * the module calling this has to destroy the cache before getting unloaded.
+ * Note that kmem_cache_name() is not guaranteed to return the same pointer,
+ * therefore applications must manage it themselves.
  *
  * The flags are
  *
@@ -2618,7 +2620,7 @@ static struct slab *alloc_slabmgmt(struct kmem_cache *cachep, void *objp,
         if (OFF_SLAB(cachep)) {
                 /* Slab management obj is off-slab. */
                 slabp = kmem_cache_alloc_node(cachep->slabp_cache,
-                                              local_flags & ~GFP_THISNODE, nodeid);
+                                              local_flags, nodeid);
                 if (!slabp)
                         return NULL;
         } else {
@@ -3006,7 +3008,7 @@ retry:
                  * there must be at least one object available for
                  * allocation.
                  */
-                BUG_ON(slabp->inuse < 0 || slabp->inuse >= cachep->num);
+                BUG_ON(slabp->inuse >= cachep->num);
 
                 while (slabp->inuse < cachep->num && batchcount--) {
                         STATS_INC_ALLOCED(cachep);
@@ -3115,79 +3117,14 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
 #define cache_alloc_debugcheck_after(a,b,objp,d) (objp)
 #endif
 
-#ifdef CONFIG_FAILSLAB
-
-static struct failslab_attr {
-
-        struct fault_attr attr;
-
-        u32 ignore_gfp_wait;
-#ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
-        struct dentry *ignore_gfp_wait_file;
-#endif
-
-} failslab = {
-        .attr = FAULT_ATTR_INITIALIZER,
-        .ignore_gfp_wait = 1,
-};
-
-static int __init setup_failslab(char *str)
-{
-        return setup_fault_attr(&failslab.attr, str);
-}
-__setup("failslab=", setup_failslab);
-
-static int should_failslab(struct kmem_cache *cachep, gfp_t flags)
+static bool slab_should_failslab(struct kmem_cache *cachep, gfp_t flags)
 {
         if (cachep == &cache_cache)
-                return 0;
-        if (flags & __GFP_NOFAIL)
-                return 0;
-        if (failslab.ignore_gfp_wait && (flags & __GFP_WAIT))
-                return 0;
+                return false;
 
-        return should_fail(&failslab.attr, obj_size(cachep));
+        return should_failslab(obj_size(cachep), flags);
 }
 
-#ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
-
-static int __init failslab_debugfs(void)
-{
-        mode_t mode = S_IFREG | S_IRUSR | S_IWUSR;
-        struct dentry *dir;
-        int err;
-
-        err = init_fault_attr_dentries(&failslab.attr, "failslab");
-        if (err)
-                return err;
-        dir = failslab.attr.dentries.dir;
-
-        failslab.ignore_gfp_wait_file =
-                debugfs_create_bool("ignore-gfp-wait", mode, dir,
-                                      &failslab.ignore_gfp_wait);
-
-        if (!failslab.ignore_gfp_wait_file) {
-                err = -ENOMEM;
-                debugfs_remove(failslab.ignore_gfp_wait_file);
-                cleanup_fault_attr_dentries(&failslab.attr);
-        }
-
-        return err;
-}
-
-late_initcall(failslab_debugfs);
-
-#endif /* CONFIG_FAULT_INJECTION_DEBUG_FS */
-
-#else /* CONFIG_FAILSLAB */
-
-static inline int should_failslab(struct kmem_cache *cachep, gfp_t flags)
-{
-        return 0;
-}
-
-#endif /* CONFIG_FAILSLAB */
-
 static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags)
 {
         void *objp;
@@ -3390,7 +3327,7 @@ __cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid,
         unsigned long save_flags;
         void *ptr;
 
-        if (should_failslab(cachep, flags))
+        if (slab_should_failslab(cachep, flags))
                 return NULL;
 
         cache_alloc_debugcheck_before(cachep, flags);
@@ -3466,7 +3403,7 @@ __cache_alloc(struct kmem_cache *cachep, gfp_t flags, void *caller)
         unsigned long save_flags;
         void *objp;
 
-        if (should_failslab(cachep, flags))
+        if (slab_should_failslab(cachep, flags))
                 return NULL;
 
         cache_alloc_debugcheck_before(cachep, flags);
diff --git a/mm/slub.c b/mm/slub.c
index 7bf8cf8ec082..4fac7bbb029a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -25,6 +25,7 @@
 #include <linux/kallsyms.h>
 #include <linux/memory.h>
 #include <linux/math64.h>
+#include <linux/fault-inject.h>
 
 /*
  * Lock order:
@@ -154,6 +155,10 @@
 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
 #endif
 
+#define OO_SHIFT        16
+#define OO_MASK         ((1 << OO_SHIFT) - 1)
+#define MAX_OBJS_PER_PAGE       65535 /* since page.objects is u16 */
+
 /* Internal SLUB flags */
 #define __OBJECT_POISON         0x80000000 /* Poison object */
 #define __SYSFS_ADD_DEFERRED    0x40000000 /* Not yet visible via sysfs */
@@ -291,7 +296,7 @@ static inline struct kmem_cache_order_objects oo_make(int order,
                                                 unsigned long size)
 {
         struct kmem_cache_order_objects x = {
-                (order << 16) + (PAGE_SIZE << order) / size
+                (order << OO_SHIFT) + (PAGE_SIZE << order) / size
         };
 
         return x;
@@ -299,12 +304,12 @@ static inline struct kmem_cache_order_objects oo_make(int order,
 
 static inline int oo_order(struct kmem_cache_order_objects x)
 {
-        return x.x >> 16;
+        return x.x >> OO_SHIFT;
 }
 
 static inline int oo_objects(struct kmem_cache_order_objects x)
 {
-        return x.x & ((1 << 16) - 1);
+        return x.x & OO_MASK;
 }
 
 #ifdef CONFIG_SLUB_DEBUG
@@ -693,7 +698,7 @@ static int check_object(struct kmem_cache *s, struct page *page,
         if (!check_valid_pointer(s, page, get_freepointer(s, p))) {
                 object_err(s, page, p, "Freepointer corrupt");
                 /*
-                 * No choice but to zap it and thus loose the remainder
+                 * No choice but to zap it and thus lose the remainder
                  * of the free objects in this slab. May cause
                  * another error because the object count is now wrong.
                  */
@@ -765,8 +770,8 @@ static int on_freelist(struct kmem_cache *s, struct page *page, void *search)
         }
 
         max_objects = (PAGE_SIZE << compound_order(page)) / s->size;
-        if (max_objects > 65535)
-                max_objects = 65535;
+        if (max_objects > MAX_OBJS_PER_PAGE)
+                max_objects = MAX_OBJS_PER_PAGE;
 
         if (page->objects != max_objects) {
                 slab_err(s, page, "Wrong number of objects. Found %d but "
@@ -1592,6 +1597,11 @@ static __always_inline void *slab_alloc(struct kmem_cache *s,
         unsigned long flags;
         unsigned int objsize;
 
+        might_sleep_if(gfpflags & __GFP_WAIT);
+
+        if (should_failslab(s->objsize, gfpflags))
+                return NULL;
+
         local_irq_save(flags);
         c = get_cpu_slab(s, smp_processor_id());
         objsize = c->objsize;
@@ -1766,7 +1776,7 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
 }
 EXPORT_SYMBOL(kmem_cache_free);
 
-/* Figure out on which slab object the object resides */
+/* Figure out on which slab page the object resides */
 static struct page *get_object_page(const void *x)
 {
         struct page *page = virt_to_head_page(x);
@@ -1838,8 +1848,8 @@ static inline int slab_order(int size, int min_objects,
         int rem;
         int min_order = slub_min_order;
 
-        if ((PAGE_SIZE << min_order) / size > 65535)
-                return get_order(size * 65535) - 1;
+        if ((PAGE_SIZE << min_order) / size > MAX_OBJS_PER_PAGE)
+                return get_order(size * MAX_OBJS_PER_PAGE) - 1;
 
         for (order = max(min_order,
                                 fls(min_objects * size - 1) - PAGE_SHIFT);
@@ -2104,8 +2114,7 @@ static inline int alloc_kmem_cache_cpus(struct kmem_cache *s, gfp_t flags)
  * when allocating for the kmalloc_node_cache. This is used for bootstrapping
  * memory on a fresh node that has no slab structures yet.
  */
-static struct kmem_cache_node *early_kmem_cache_node_alloc(gfp_t gfpflags,
-                                                           int node)
+static void early_kmem_cache_node_alloc(gfp_t gfpflags, int node)
 {
         struct page *page;
         struct kmem_cache_node *n;
@@ -2143,7 +2152,6 @@ static struct kmem_cache_node *early_kmem_cache_node_alloc(gfp_t gfpflags,
         local_irq_save(flags);
         add_partial(n, page, 0);
         local_irq_restore(flags);
-        return n;
 }
 
 static void free_kmem_cache_nodes(struct kmem_cache *s)
@@ -2175,8 +2183,7 @@ static int init_kmem_cache_nodes(struct kmem_cache *s, gfp_t gfpflags)
                         n = &s->local_node;
                 else {
                         if (slab_state == DOWN) {
-                                n = early_kmem_cache_node_alloc(gfpflags,
-                                                                node);
+                                early_kmem_cache_node_alloc(gfpflags, node);
                                 continue;
                         }
                         n = kmem_cache_alloc_node(kmalloc_caches,
@@ -3176,8 +3183,12 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
                 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
                 up_write(&slub_lock);
 
-                if (sysfs_slab_alias(s, name))
+                if (sysfs_slab_alias(s, name)) {
+                        down_write(&slub_lock);
+                        s->refcount--;
+                        up_write(&slub_lock);
                         goto err;
+                }
                 return s;
         }
 
@@ -3187,8 +3198,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
                                 size, align, flags, ctor)) {
                         list_add(&s->list, &slab_caches);
                         up_write(&slub_lock);
-                        if (sysfs_slab_add(s))
+                        if (sysfs_slab_add(s)) {
+                                down_write(&slub_lock);
+                                list_del(&s->list);
+                                up_write(&slub_lock);
+                                kfree(s);
                                 goto err;
+                        }
                         return s;
                 }
                 kfree(s);
@@ -4412,7 +4428,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
 
 /*
  * Need to buffer aliases during bootup until sysfs becomes
- * available lest we loose that information.
+ * available lest we lose that information.
  */
 struct saved_alias {
         struct kmem_cache *s;