5 files changed, 35 insertions, 19 deletions

diff --git a/mm/filemap.c b/mm/filemap.c
index bcdc393b6580..d7b10578a64b 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1982,16 +1982,26 @@ static int __remove_suid(struct dentry *dentry, int kill)
 int file_remove_suid(struct file *file)
 {
         struct dentry *dentry = file->f_path.dentry;
-        int killsuid = should_remove_suid(dentry);
-        int killpriv = security_inode_need_killpriv(dentry);
+        struct inode *inode = dentry->d_inode;
+        int killsuid;
+        int killpriv;
         int error = 0;
 
+        /* Fast path for nothing security related */
+        if (IS_NOSEC(inode))
+                return 0;
+
+        killsuid = should_remove_suid(dentry);
+        killpriv = security_inode_need_killpriv(dentry);
+
         if (killpriv < 0)
                 return killpriv;
         if (killpriv)
                 error = security_inode_killpriv(dentry);
         if (!error && killsuid)
                 error = __remove_suid(dentry, killsuid);
+        if (!error)
+                inode->i_flags |= S_NOSEC;
 
         return error;
 }
@@ -2327,7 +2337,7 @@ struct page *grab_cache_page_write_begin(struct address_space *mapping,
 repeat:
         page = find_lock_page(mapping, index);
         if (page)
-                return page;
+                goto found;
 
         page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~gfp_notmask);
         if (!page)
@@ -2340,6 +2350,8 @@ repeat:
                         goto repeat;
                 return NULL;
         }
+found:
+        wait_on_page_writeback(page);
         return page;
 }
 EXPORT_SYMBOL(grab_cache_page_write_begin);
diff --git a/mm/maccess.c b/mm/maccess.c
index e2b6f5634e0d..4cee182ab5f3 100644
--- a/mm/maccess.c
+++ b/mm/maccess.c
@@ -15,10 +15,10 @@
  * happens, handle that and return -EFAULT.
  */
 
-long __weak probe_kernel_read(void *dst, void *src, size_t size)
+long __weak probe_kernel_read(void *dst, const void *src, size_t size)
     __attribute__((alias("__probe_kernel_read")));
 
-long __probe_kernel_read(void *dst, void *src, size_t size)
+long __probe_kernel_read(void *dst, const void *src, size_t size)
 {
         long ret;
         mm_segment_t old_fs = get_fs();
@@ -43,10 +43,10 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
  * Safely write to address @dst from the buffer at @src.  If a kernel fault
  * happens, handle that and return -EFAULT.
  */
-long __weak probe_kernel_write(void *dst, void *src, size_t size)
+long __weak probe_kernel_write(void *dst, const void *src, size_t size)
     __attribute__((alias("__probe_kernel_write")));
 
-long __probe_kernel_write(void *dst, void *src, size_t size)
+long __probe_kernel_write(void *dst, const void *src, size_t size)
 {
         long ret;
         mm_segment_t old_fs = get_fs();
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a4e1db3f1981..4e8985acdab8 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2247,10 +2247,6 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
 
         if (should_fail_alloc_page(gfp_mask, order))
                 return NULL;
-#ifndef CONFIG_ZONE_DMA
-        if (WARN_ON_ONCE(gfp_mask & __GFP_DMA))
-                return NULL;
-#endif
 
         /*
          * Check the zones suitable for the gfp_mask contain at least one
diff --git a/mm/rmap.c b/mm/rmap.c
index 3a39b518a653..0eb463ea88dd 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -352,6 +352,11 @@ void __init anon_vma_init(void)
  * The page might have been remapped to a different anon_vma or the anon_vma
  * returned may already be freed (and even reused).
  *
+ * In case it was remapped to a different anon_vma, the new anon_vma will be a
+ * child of the old anon_vma, and the anon_vma lifetime rules will therefore
+ * ensure that any anon_vma obtained from the page will still be valid for as
+ * long as we observe page_mapped() [ hence all those page_mapped() tests ].
+ *
  * All users of this function must be very careful when walking the anon_vma
  * chain and verify that the page in question is indeed mapped in it
  * [ something equivalent to page_mapped_in_vma() ].
@@ -405,6 +410,7 @@ out:
 struct anon_vma *page_lock_anon_vma(struct page *page)
 {
         struct anon_vma *anon_vma = NULL;
+        struct anon_vma *root_anon_vma;
         unsigned long anon_mapping;
 
         rcu_read_lock();
@@ -415,13 +421,15 @@ struct anon_vma *page_lock_anon_vma(struct page *page)
                 goto out;
 
         anon_vma = (struct anon_vma *) (anon_mapping - PAGE_MAPPING_ANON);
-        if (mutex_trylock(&anon_vma->root->mutex)) {
+        root_anon_vma = ACCESS_ONCE(anon_vma->root);
+        if (mutex_trylock(&root_anon_vma->mutex)) {
                 /*
-                 * If we observe a !0 refcount, then holding the lock ensures
-                 * the anon_vma will not go away, see __put_anon_vma().
+                 * If the page is still mapped, then this anon_vma is still
+                 * its anon_vma, and holding the mutex ensures that it will
+                 * not go away, see anon_vma_free().
                  */
-                if (!atomic_read(&anon_vma->refcount)) {
-                        anon_vma_unlock(anon_vma);
+                if (!page_mapped(page)) {
+                        mutex_unlock(&root_anon_vma->mutex);
                         anon_vma = NULL;
                 }
                 goto out;
@@ -1014,7 +1022,7 @@ void do_page_add_anon_rmap(struct page *page,
                 return;
 
         VM_BUG_ON(!PageLocked(page));
-        VM_BUG_ON(address < vma->vm_start || address >= vma->vm_end);
+        /* address might be in next vma when migration races vma_adjust */
         if (first)
                 __page_set_anon_rmap(page, vma, address, exclusive);
         else
@@ -1709,7 +1717,7 @@ void hugepage_add_anon_rmap(struct page *page,
 
         BUG_ON(!PageLocked(page));
         BUG_ON(!anon_vma);
-        BUG_ON(address < vma->vm_start || address >= vma->vm_end);
+        /* address might be in next vma when migration races vma_adjust */
         first = atomic_inc_and_test(&page->_mapcount);
         if (first)
                 __hugepage_set_anon_rmap(page, vma, address, 0);
diff --git a/mm/shmem.c b/mm/shmem.c
index 1acfb2687bfa..d221a1cfd7b1 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1114,8 +1114,8 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
                 delete_from_page_cache(page);
                 shmem_swp_set(info, entry, swap.val);
                 shmem_swp_unmap(entry);
-                spin_unlock(&info->lock);
                 swap_shmem_alloc(swap);
+                spin_unlock(&info->lock);
                 BUG_ON(page_mapped(page));
                 swap_writepage(page, wbc);
                 return 0;