19 files changed, 182 insertions, 79 deletions

diff --git a/mm/dmapool.c b/mm/dmapool.c
index 306baa594f95..ba8019b063e1 100644
--- a/mm/dmapool.c
+++ b/mm/dmapool.c
@@ -176,7 +176,7 @@ struct dma_pool *dma_pool_create(const char *name, struct device *dev,
         if (list_empty(&dev->dma_pools) &&
             device_create_file(dev, &dev_attr_pools)) {
                 kfree(retval);
-                return NULL;
+                retval = NULL;
         } else
                 list_add(&retval->pools, &dev->dma_pools);
         mutex_unlock(&pools_lock);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index d9a21d06b862..f8ffd9412ec5 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1795,14 +1795,17 @@ static int __split_huge_page_map(struct page *page,
                 for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
                         pte_t *pte, entry;
                         BUG_ON(PageCompound(page+i));
+                        /*
+                         * Note that pmd_numa is not transferred deliberately
+                         * to avoid any possibility that pte_numa leaks to
+                         * a PROT_NONE VMA by accident.
+                         */
                         entry = mk_pte(page + i, vma->vm_page_prot);
                         entry = maybe_mkwrite(pte_mkdirty(entry), vma);
                         if (!pmd_write(*pmd))
                                 entry = pte_wrprotect(entry);
                         if (!pmd_young(*pmd))
                                 entry = pte_mkold(entry);
-                        if (pmd_numa(*pmd))
-                                entry = pte_mknuma(entry);
                         pte = pte_offset_map(&_pmd, haddr);
                         BUG_ON(!pte_none(*pte));
                         set_pte_at(mm, haddr, pte, entry);
diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index 9eebfadeeee1..a67c26e0f360 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -217,7 +217,7 @@ void hugetlb_cgroup_uncharge_page(int idx, unsigned long nr_pages,
 
         if (hugetlb_cgroup_disabled())
                 return;
-        VM_BUG_ON(!spin_is_locked(&hugetlb_lock));
+        lockdep_assert_held(&hugetlb_lock);
         h_cg = hugetlb_cgroup_from_page(page);
         if (unlikely(!h_cg))
                 return;
diff --git a/mm/iov_iter.c b/mm/iov_iter.c
index ab88dc0ea1d3..9a09f2034fcc 100644
--- a/mm/iov_iter.c
+++ b/mm/iov_iter.c
@@ -310,7 +310,7 @@ void iov_iter_init(struct iov_iter *i, int direction,
 EXPORT_SYMBOL(iov_iter_init);
 
 static ssize_t get_pages_iovec(struct iov_iter *i,
-                   struct page **pages, unsigned maxpages,
+                   struct page **pages, size_t maxsize, unsigned maxpages,
                    size_t *start)
 {
         size_t offset = i->iov_offset;
@@ -323,6 +323,8 @@ static ssize_t get_pages_iovec(struct iov_iter *i,
         len = iov->iov_len - offset;
         if (len > i->count)
                 len = i->count;
+        if (len > maxsize)
+                len = maxsize;
         addr = (unsigned long)iov->iov_base + offset;
         len += *start = addr & (PAGE_SIZE - 1);
         if (len > maxpages * PAGE_SIZE)
@@ -588,13 +590,15 @@ static unsigned long alignment_bvec(const struct iov_iter *i)
 }
 
 static ssize_t get_pages_bvec(struct iov_iter *i,
-                   struct page **pages, unsigned maxpages,
+                   struct page **pages, size_t maxsize, unsigned maxpages,
                    size_t *start)
 {
         const struct bio_vec *bvec = i->bvec;
         size_t len = bvec->bv_len - i->iov_offset;
         if (len > i->count)
                 len = i->count;
+        if (len > maxsize)
+                len = maxsize;
         /* can't be more than PAGE_SIZE */
         *start = bvec->bv_offset + i->iov_offset;
 
@@ -711,13 +715,13 @@ unsigned long iov_iter_alignment(const struct iov_iter *i)
 EXPORT_SYMBOL(iov_iter_alignment);
 
 ssize_t iov_iter_get_pages(struct iov_iter *i,
-                   struct page **pages, unsigned maxpages,
+                   struct page **pages, size_t maxsize, unsigned maxpages,
                    size_t *start)
 {
         if (i->type & ITER_BVEC)
-                return get_pages_bvec(i, pages, maxpages, start);
+                return get_pages_bvec(i, pages, maxsize, maxpages, start);
         else
-                return get_pages_iovec(i, pages, maxpages, start);
+                return get_pages_iovec(i, pages, maxsize, maxpages, start);
 }
 EXPORT_SYMBOL(iov_iter_get_pages);
 
diff --git a/mm/memblock.c b/mm/memblock.c
index 6d2f219a48b0..6ecb0d937fb5 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -192,8 +192,7 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size,
                                         phys_addr_t align, phys_addr_t start,
                                         phys_addr_t end, int nid)
 {
-        int ret;
-        phys_addr_t kernel_end;
+        phys_addr_t kernel_end, ret;
 
         /* pump up @end */
         if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
@@ -817,6 +816,10 @@ void __init_memblock __next_mem_range(u64 *idx, int nid,
                 if (nid != NUMA_NO_NODE && nid != m_nid)
                         continue;
 
+                /* skip hotpluggable memory regions if needed */
+                if (movable_node_is_enabled() && memblock_is_hotpluggable(m))
+                        continue;
+
                 if (!type_b) {
                         if (out_start)
                                 *out_start = m_start;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ec4dcf1b9562..28928ce9b07f 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -292,6 +292,9 @@ struct mem_cgroup {
         /* vmpressure notifications */
         struct vmpressure vmpressure;
 
+        /* css_online() has been completed */
+        int initialized;
+
         /*
          * the counter to account for mem+swap usage.
          */
@@ -1099,10 +1102,21 @@ skip_node:
          * skipping css reference should be safe.
          */
         if (next_css) {
-                if ((next_css == &root->css) ||
-                    ((next_css->flags & CSS_ONLINE) &&
-                     css_tryget_online(next_css)))
-                        return mem_cgroup_from_css(next_css);
+                struct mem_cgroup *memcg = mem_cgroup_from_css(next_css);
+
+                if (next_css == &root->css)
+                        return memcg;
+
+                if (css_tryget_online(next_css)) {
+                        /*
+                         * Make sure the memcg is initialized:
+                         * mem_cgroup_css_online() orders the the
+                         * initialization against setting the flag.
+                         */
+                        if (smp_load_acquire(&memcg->initialized))
+                                return memcg;
+                        css_put(next_css);
+                }
 
                 prev_css = next_css;
                 goto skip_node;
@@ -2534,6 +2548,8 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
         unsigned long long size;
         int ret = 0;
 
+        if (mem_cgroup_is_root(memcg))
+                goto done;
 retry:
         if (consume_stock(memcg, nr_pages))
                 goto done;
@@ -2611,9 +2627,7 @@ nomem:
         if (!(gfp_mask & __GFP_NOFAIL))
                 return -ENOMEM;
 bypass:
-        memcg = root_mem_cgroup;
-        ret = -EINTR;
-        goto retry;
+        return -EINTR;
 
 done_restock:
         if (batch > nr_pages)
@@ -2626,6 +2640,9 @@ static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
         unsigned long bytes = nr_pages * PAGE_SIZE;
 
+        if (mem_cgroup_is_root(memcg))
+                return;
+
         res_counter_uncharge(&memcg->res, bytes);
         if (do_swap_account)
                 res_counter_uncharge(&memcg->memsw, bytes);
@@ -2640,6 +2657,9 @@ static void __mem_cgroup_cancel_local_charge(struct mem_cgroup *memcg,
 {
         unsigned long bytes = nr_pages * PAGE_SIZE;
 
+        if (mem_cgroup_is_root(memcg))
+                return;
+
         res_counter_uncharge_until(&memcg->res, memcg->res.parent, bytes);
         if (do_swap_account)
                 res_counter_uncharge_until(&memcg->memsw,
@@ -4093,6 +4113,46 @@ out:
         return retval;
 }
 
+static unsigned long mem_cgroup_recursive_stat(struct mem_cgroup *memcg,
+                                               enum mem_cgroup_stat_index idx)
+{
+        struct mem_cgroup *iter;
+        long val = 0;
+
+        /* Per-cpu values can be negative, use a signed accumulator */
+        for_each_mem_cgroup_tree(iter, memcg)
+                val += mem_cgroup_read_stat(iter, idx);
+
+        if (val < 0) /* race ? */
+                val = 0;
+        return val;
+}
+
+static inline u64 mem_cgroup_usage(struct mem_cgroup *memcg, bool swap)
+{
+        u64 val;
+
+        if (!mem_cgroup_is_root(memcg)) {
+                if (!swap)
+                        return res_counter_read_u64(&memcg->res, RES_USAGE);
+                else
+                        return res_counter_read_u64(&memcg->memsw, RES_USAGE);
+        }
+
+        /*
+         * Transparent hugepages are still accounted for in MEM_CGROUP_STAT_RSS
+         * as well as in MEM_CGROUP_STAT_RSS_HUGE.
+         */
+        val = mem_cgroup_recursive_stat(memcg, MEM_CGROUP_STAT_CACHE);
+        val += mem_cgroup_recursive_stat(memcg, MEM_CGROUP_STAT_RSS);
+
+        if (swap)
+                val += mem_cgroup_recursive_stat(memcg, MEM_CGROUP_STAT_SWAP);
+
+        return val << PAGE_SHIFT;
+}
+
+
 static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
                                struct cftype *cft)
 {
@@ -4102,8 +4162,12 @@ static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
 
         switch (type) {
         case _MEM:
+                if (name == RES_USAGE)
+                        return mem_cgroup_usage(memcg, false);
                 return res_counter_read_u64(&memcg->res, name);
         case _MEMSWAP:
+                if (name == RES_USAGE)
+                        return mem_cgroup_usage(memcg, true);
                 return res_counter_read_u64(&memcg->memsw, name);
         case _KMEM:
                 return res_counter_read_u64(&memcg->kmem, name);
@@ -4572,10 +4636,7 @@ static void __mem_cgroup_threshold(struct mem_cgroup *memcg, bool swap)
         if (!t)
                 goto unlock;
 
-        if (!swap)
-                usage = res_counter_read_u64(&memcg->res, RES_USAGE);
-        else
-                usage = res_counter_read_u64(&memcg->memsw, RES_USAGE);
+        usage = mem_cgroup_usage(memcg, swap);
 
         /*
          * current_threshold points to threshold just below or equal to usage.
@@ -4673,10 +4734,10 @@ static int __mem_cgroup_usage_register_event(struct mem_cgroup *memcg,
 
         if (type == _MEM) {
                 thresholds = &memcg->thresholds;
-                usage = res_counter_read_u64(&memcg->res, RES_USAGE);
+                usage = mem_cgroup_usage(memcg, false);
         } else if (type == _MEMSWAP) {
                 thresholds = &memcg->memsw_thresholds;
-                usage = res_counter_read_u64(&memcg->memsw, RES_USAGE);
+                usage = mem_cgroup_usage(memcg, true);
         } else
                 BUG();
 
@@ -4762,10 +4823,10 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg,
 
         if (type == _MEM) {
                 thresholds = &memcg->thresholds;
-                usage = res_counter_read_u64(&memcg->res, RES_USAGE);
+                usage = mem_cgroup_usage(memcg, false);
         } else if (type == _MEMSWAP) {
                 thresholds = &memcg->memsw_thresholds;
-                usage = res_counter_read_u64(&memcg->memsw, RES_USAGE);
+                usage = mem_cgroup_usage(memcg, true);
         } else
                 BUG();
 
@@ -5502,6 +5563,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
         struct mem_cgroup *parent = mem_cgroup_from_css(css->parent);
+        int ret;
 
         if (css->id > MEM_CGROUP_ID_MAX)
                 return -ENOSPC;
@@ -5525,9 +5587,9 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
                  * core guarantees its existence.
                  */
         } else {
-                res_counter_init(&memcg->res, &root_mem_cgroup->res);
-                res_counter_init(&memcg->memsw, &root_mem_cgroup->memsw);
-                res_counter_init(&memcg->kmem, &root_mem_cgroup->kmem);
+                res_counter_init(&memcg->res, NULL);
+                res_counter_init(&memcg->memsw, NULL);
+                res_counter_init(&memcg->kmem, NULL);
                 /*
                  * Deeper hierachy with use_hierarchy == false doesn't make
                  * much sense so let cgroup subsystem know about this
@@ -5538,7 +5600,18 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css)
         }
         mutex_unlock(&memcg_create_mutex);
 
-        return memcg_init_kmem(memcg, &memory_cgrp_subsys);
+        ret = memcg_init_kmem(memcg, &memory_cgrp_subsys);
+        if (ret)
+                return ret;
+
+        /*
+         * Make sure the memcg is initialized: mem_cgroup_iter()
+         * orders reading memcg->initialized against its callers
+         * reading the memcg members.
+         */
+        smp_store_release(&memcg->initialized, 1);
+
+        return 0;
 }
 
 /*
@@ -5969,8 +6042,9 @@ static void __mem_cgroup_clear_mc(void)
         /* we must fixup refcnts and charges */
         if (mc.moved_swap) {
                 /* uncharge swap account from the old cgroup */
-                res_counter_uncharge(&mc.from->memsw,
-                                     PAGE_SIZE * mc.moved_swap);
+                if (!mem_cgroup_is_root(mc.from))
+                        res_counter_uncharge(&mc.from->memsw,
+                                             PAGE_SIZE * mc.moved_swap);
 
                 for (i = 0; i < mc.moved_swap; i++)
                         css_put(&mc.from->css);
@@ -5979,8 +6053,9 @@ static void __mem_cgroup_clear_mc(void)
                  * we charged both to->res and to->memsw, so we should
                  * uncharge to->res.
                  */
-                res_counter_uncharge(&mc.to->res,
-                                     PAGE_SIZE * mc.moved_swap);
+                if (!mem_cgroup_is_root(mc.to))
+                        res_counter_uncharge(&mc.to->res,
+                                             PAGE_SIZE * mc.moved_swap);
                 /* we've already done css_get(mc.to) */
                 mc.moved_swap = 0;
         }
@@ -6345,7 +6420,8 @@ void mem_cgroup_uncharge_swap(swp_entry_t entry)
         rcu_read_lock();
         memcg = mem_cgroup_lookup(id);
         if (memcg) {
-                res_counter_uncharge(&memcg->memsw, PAGE_SIZE);
+                if (!mem_cgroup_is_root(memcg))
+                        res_counter_uncharge(&memcg->memsw, PAGE_SIZE);
                 mem_cgroup_swap_statistics(memcg, false);
                 css_put(&memcg->css);
         }
@@ -6509,12 +6585,15 @@ static void uncharge_batch(struct mem_cgroup *memcg, unsigned long pgpgout,
 {
         unsigned long flags;
 
-        if (nr_mem)
-                res_counter_uncharge(&memcg->res, nr_mem * PAGE_SIZE);
-        if (nr_memsw)
-                res_counter_uncharge(&memcg->memsw, nr_memsw * PAGE_SIZE);
-
-        memcg_oom_recover(memcg);
+        if (!mem_cgroup_is_root(memcg)) {
+                if (nr_mem)
+                        res_counter_uncharge(&memcg->res,
+                                             nr_mem * PAGE_SIZE);
+                if (nr_memsw)
+                        res_counter_uncharge(&memcg->memsw,
+                                             nr_memsw * PAGE_SIZE);
+                memcg_oom_recover(memcg);
+        }
 
         local_irq_save(flags);
         __this_cpu_sub(memcg->stat->count[MEM_CGROUP_STAT_RSS], nr_anon);
diff --git a/mm/memory.c b/mm/memory.c
index ab3537bcfed2..e229970e4223 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -118,6 +118,8 @@ __setup("norandmaps", disable_randmaps);
 unsigned long zero_pfn __read_mostly;
 unsigned long highest_memmap_pfn __read_mostly;
 
+EXPORT_SYMBOL(zero_pfn);
+
 /*
  * CONFIG_MMU architectures set up ZERO_PAGE in their paging_init()
  */
@@ -751,7 +753,7 @@ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
         unsigned long pfn = pte_pfn(pte);
 
         if (HAVE_PTE_SPECIAL) {
-                if (likely(!pte_special(pte) || pte_numa(pte)))
+                if (likely(!pte_special(pte)))
                         goto check_pfn;
                 if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
                         return NULL;
@@ -777,15 +779,14 @@ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
                 }
         }
 
+        if (is_zero_pfn(pfn))
+                return NULL;
 check_pfn:
         if (unlikely(pfn > highest_memmap_pfn)) {
                 print_bad_pte(vma, addr, pte, NULL);
                 return NULL;
         }
 
-        if (is_zero_pfn(pfn))
-                return NULL;
-
         /*
          * NOTE! We still have PageReserved() pages in the page tables.
          * eg. VDSO mappings can cause them to exist.
@@ -1126,7 +1127,7 @@ again:
                                                 addr) != page->index) {
                                 pte_t ptfile = pgoff_to_pte(page->index);
                                 if (pte_soft_dirty(ptent))
-                                        pte_file_mksoft_dirty(ptfile);
+                                        ptfile = pte_file_mksoft_dirty(ptfile);
                                 set_pte_at(mm, addr, pte, ptfile);
                         }
                         if (PageAnon(page))
diff --git a/mm/migrate.c b/mm/migrate.c
index f78ec9bd454d..2740360cd216 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -146,8 +146,11 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
         pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
         if (pte_swp_soft_dirty(*ptep))
                 pte = pte_mksoft_dirty(pte);
+
+        /* Recheck VMA as permissions can change since migration started  */
         if (is_write_migration_entry(entry))
-                pte = pte_mkwrite(pte);
+                pte = maybe_mkwrite(pte, vma);
+
 #ifdef CONFIG_HUGETLB_PAGE
         if (PageHuge(new)) {
                 pte = pte_mkhuge(pte);
diff --git a/mm/mmap.c b/mm/mmap.c
index c1f2ea4a0b99..c0a3637cdb64 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -369,20 +369,20 @@ static int browse_rb(struct rb_root *root)
                 struct vm_area_struct *vma;
                 vma = rb_entry(nd, struct vm_area_struct, vm_rb);
                 if (vma->vm_start < prev) {
-                        pr_info("vm_start %lx prev %lx\n", vma->vm_start, prev);
+                        pr_emerg("vm_start %lx prev %lx\n", vma->vm_start, prev);
                         bug = 1;
                 }
                 if (vma->vm_start < pend) {
-                        pr_info("vm_start %lx pend %lx\n", vma->vm_start, pend);
+                        pr_emerg("vm_start %lx pend %lx\n", vma->vm_start, pend);
                         bug = 1;
                 }
                 if (vma->vm_start > vma->vm_end) {
-                        pr_info("vm_end %lx < vm_start %lx\n",
+                        pr_emerg("vm_end %lx < vm_start %lx\n",
                                 vma->vm_end, vma->vm_start);
                         bug = 1;
                 }
                 if (vma->rb_subtree_gap != vma_compute_subtree_gap(vma)) {
-                        pr_info("free gap %lx, correct %lx\n",
+                        pr_emerg("free gap %lx, correct %lx\n",
                                vma->rb_subtree_gap,
                                vma_compute_subtree_gap(vma));
                         bug = 1;
@@ -396,7 +396,7 @@ static int browse_rb(struct rb_root *root)
         for (nd = pn; nd; nd = rb_prev(nd))
                 j++;
         if (i != j) {
-                pr_info("backwards %d, forwards %d\n", j, i);
+                pr_emerg("backwards %d, forwards %d\n", j, i);
                 bug = 1;
         }
         return bug ? -1 : i;
@@ -431,17 +431,17 @@ static void validate_mm(struct mm_struct *mm)
                 i++;
         }
         if (i != mm->map_count) {
-                pr_info("map_count %d vm_next %d\n", mm->map_count, i);
+                pr_emerg("map_count %d vm_next %d\n", mm->map_count, i);
                 bug = 1;
         }
         if (highest_address != mm->highest_vm_end) {
-                pr_info("mm->highest_vm_end %lx, found %lx\n",
+                pr_emerg("mm->highest_vm_end %lx, found %lx\n",
                        mm->highest_vm_end, highest_address);
                 bug = 1;
         }
         i = browse_rb(&mm->mm_rb);
         if (i != mm->map_count) {
-                pr_info("map_count %d rb %d\n", mm->map_count, i);
+                pr_emerg("map_count %d rb %d\n", mm->map_count, i);
                 bug = 1;
         }
         BUG_ON(bug);
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 7ed58602e71b..7c7ab32ee503 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -119,6 +119,8 @@ static unsigned long __init free_low_memory_core_early(void)
         phys_addr_t start, end;
         u64 i;
 
+        memblock_clear_hotplug(0, -1);
+
         for_each_free_mem_range(i, NUMA_NO_NODE, &start, &end, NULL)
                 count += __free_memory_core(start, end);
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 18cee0d4c8a2..eee961958021 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1612,7 +1612,7 @@ again:
         }
 
         __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
-        if (zone_page_state(zone, NR_ALLOC_BATCH) == 0 &&
+        if (atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]) <= 0 &&
             !zone_is_fair_depleted(zone))
                 zone_set_flag(zone, ZONE_FAIR_DEPLETED);
 
@@ -5701,9 +5701,8 @@ static void __setup_per_zone_wmarks(void)
                 zone->watermark[WMARK_HIGH] = min_wmark_pages(zone) + (tmp >> 1);
 
                 __mod_zone_page_state(zone, NR_ALLOC_BATCH,
-                                      high_wmark_pages(zone) -
-                                      low_wmark_pages(zone) -
-                                      zone_page_state(zone, NR_ALLOC_BATCH));
+                        high_wmark_pages(zone) - low_wmark_pages(zone) -
+                        atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]));
 
                 setup_zone_migrate_reserve(zone);
                 spin_unlock_irqrestore(&zone->lock, flags);
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 3707c71ae4cd..51108165f829 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
                             int page_start, int page_end)
 {
         const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
-        unsigned int cpu;
+        unsigned int cpu, tcpu;
         int i;
 
         for_each_possible_cpu(cpu) {
@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
                         struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
 
                         *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
-                        if (!*pagep) {
-                                pcpu_free_pages(chunk, pages, populated,
-                                                page_start, page_end);
-                                return -ENOMEM;
-                        }
+                        if (!*pagep)
+                                goto err;
                 }
         }
         return 0;
+
+err:
+        while (--i >= page_start)
+                __free_page(pages[pcpu_page_idx(cpu, i)]);
+
+        for_each_possible_cpu(tcpu) {
+                if (tcpu == cpu)
+                        break;
+                for (i = page_start; i < page_end; i++)
+                        __free_page(pages[pcpu_page_idx(tcpu, i)]);
+        }
+        return -ENOMEM;
 }
 
 /**
@@ -263,6 +272,7 @@ err:
                 __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
                                    page_end - page_start);
         }
+        pcpu_post_unmap_tlb_flush(chunk, page_start, page_end);
         return err;
 }
 
diff --git a/mm/percpu.c b/mm/percpu.c
index 2139e30a4b44..da997f9800bd 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1932,6 +1932,8 @@ void __init setup_per_cpu_areas(void)
 
         if (pcpu_setup_first_chunk(ai, fc) < 0)
                 panic("Failed to initialize percpu areas.");
+
+        pcpu_free_alloc_info(ai);
 }
 
 #endif  /* CONFIG_SMP */
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index a8b919925934..dfb79e028ecb 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -195,7 +195,7 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
         pmd_t entry = *pmdp;
         if (pmd_numa(entry))
                 entry = pmd_mknonnuma(entry);
-        set_pmd_at(vma->vm_mm, address, pmdp, pmd_mknotpresent(*pmdp));
+        set_pmd_at(vma->vm_mm, address, pmdp, pmd_mknotpresent(entry));
         flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
diff --git a/mm/shmem.c b/mm/shmem.c
index 0e5fb225007c..469f90d56051 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2367,8 +2367,10 @@ static int shmem_rename2(struct inode *old_dir, struct dentry *old_dentry, struc
 
         if (new_dentry->d_inode) {
                 (void) shmem_unlink(new_dir, new_dentry);
-                if (they_are_dirs)
+                if (they_are_dirs) {
+                        drop_nlink(new_dentry->d_inode);
                         drop_nlink(old_dir);
+                }
         } else if (they_are_dirs) {
                 drop_nlink(old_dir);
                 inc_nlink(new_dir);
diff --git a/mm/slab.c b/mm/slab.c
index a467b308c682..7c52b3890d25 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2124,7 +2124,8 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
 int
 __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
 {
-        size_t left_over, freelist_size, ralign;
+        size_t left_over, freelist_size;
+        size_t ralign = BYTES_PER_WORD;
         gfp_t gfp;
         int err;
         size_t size = cachep->size;
@@ -2157,14 +2158,6 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
                 size &= ~(BYTES_PER_WORD - 1);
         }
 
-        /*
-         * Redzoning and user store require word alignment or possibly larger.
-         * Note this will be overridden by architecture or caller mandated
-         * alignment if either is greater than BYTES_PER_WORD.
-         */
-        if (flags & SLAB_STORE_USER)
-                ralign = BYTES_PER_WORD;
-
         if (flags & SLAB_RED_ZONE) {
                 ralign = REDZONE_ALIGN;
                 /* If redzoning, ensure that the second redzone is suitably
@@ -2994,7 +2987,7 @@ out:
 
 #ifdef CONFIG_NUMA
 /*
- * Try allocating on another node if PF_SPREAD_SLAB is a mempolicy is set.
+ * Try allocating on another node if PFA_SPREAD_SLAB is a mempolicy is set.
  *
  * If we are in_interrupt, then process context, including cpusets and
  * mempolicy, may not apply and should not be used for allocation policy.
@@ -3226,7 +3219,7 @@ __do_cache_alloc(struct kmem_cache *cache, gfp_t flags)
 {
         void *objp;
 
-        if (current->mempolicy || unlikely(current->flags & PF_SPREAD_SLAB)) {
+        if (current->mempolicy || cpuset_do_slab_mem_spread()) {
                 objp = alternate_node_alloc(cache, flags);
                 if (objp)
                         goto out;
diff --git a/mm/zbud.c b/mm/zbud.c
index a05790b1915e..f26e7fcc7fa2 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -195,6 +195,7 @@ static struct zpool_driver zbud_zpool_driver = {
         .total_size =   zbud_zpool_total_size,
 };
 
+MODULE_ALIAS("zpool-zbud");
 #endif /* CONFIG_ZPOOL */
 
 /*****************
diff --git a/mm/zpool.c b/mm/zpool.c
index e40612a1df00..739cdf0d183a 100644
--- a/mm/zpool.c
+++ b/mm/zpool.c
@@ -150,7 +150,7 @@ struct zpool *zpool_create_pool(char *type, gfp_t gfp, struct zpool_ops *ops)
         driver = zpool_get_driver(type);
 
         if (!driver) {
-                request_module(type);
+                request_module("zpool-%s", type);
                 driver = zpool_get_driver(type);
         }
 
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 4e2fc83cb394..94f38fac5e81 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -315,6 +315,7 @@ static struct zpool_driver zs_zpool_driver = {
         .total_size =   zs_zpool_total_size,
 };
 
+MODULE_ALIAS("zpool-zsmalloc");
 #endif /* CONFIG_ZPOOL */
 
 /* per-cpu VM mapping areas for zspage accesses that cross page boundaries */