7 files changed, 26 insertions, 6 deletions

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index b0ceb29da4c7..e8644b1e5527 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -7,7 +7,7 @@
 
 int bdi_init(struct backing_dev_info *bdi)
 {
-        int i, j;
+        int i;
         int err;
 
         for (i = 0; i < NR_BDI_STAT_ITEMS; i++) {
@@ -21,7 +21,7 @@ int bdi_init(struct backing_dev_info *bdi)
 
         if (err) {
 err:
-                for (j = 0; j < i; j++)
+                while (i--)
                         percpu_counter_destroy(&bdi->bdi_stat[i]);
         }
 
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index 32132f3cd641..e233fff61b4b 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -314,7 +314,7 @@ __xip_file_write(struct file *filp, const char __user *buf,
                 fault_in_pages_readable(buf, bytes);
                 kaddr = kmap_atomic(page, KM_USER0);
                 copied = bytes -
-                        __copy_from_user_inatomic_nocache(kaddr, buf, bytes);
+                        __copy_from_user_inatomic_nocache(kaddr + offset, buf, bytes);
                 kunmap_atomic(kaddr, KM_USER0);
                 flush_dcache_page(page);
 
diff --git a/mm/mmap.c b/mm/mmap.c
index facc1a75bd4f..15678aa6ec73 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -912,6 +912,9 @@ unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
         if (!len)
                 return -EINVAL;
 
+        if (!(flags & MAP_FIXED))
+                addr = round_hint_to_min(addr);
+
         error = arch_mmap_check(addr, len, flags);
         if (error)
                 return error;
@@ -1615,6 +1618,12 @@ static inline int expand_downwards(struct vm_area_struct *vma,
          */
         if (unlikely(anon_vma_prepare(vma)))
                 return -ENOMEM;
+
+        address &= PAGE_MASK;
+        error = security_file_mmap(0, 0, 0, 0, address, 1);
+        if (error)
+                return error;
+
         anon_vma_lock(vma);
 
         /*
@@ -1622,8 +1631,6 @@ static inline int expand_downwards(struct vm_area_struct *vma,
          * is required to hold the mmap_sem in read mode.  We need the
          * anon_vma lock to serialize against concurrent expand_stacks.
          */
-        address &= PAGE_MASK;
-        error = 0;
 
         /* Somebody else might have raced and expanded it already */
         if (address < vma->vm_start) {
@@ -1934,6 +1941,10 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
         if (is_hugepage_only_range(mm, addr, len))
                 return -EINVAL;
 
+        error = security_file_mmap(0, 0, 0, 0, addr, 1);
+        if (error)
+                return error;
+
         flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
 
         error = arch_mmap_check(addr, len, flags);
diff --git a/mm/nommu.c b/mm/nommu.c
index 35622c590925..b989cb928a7c 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -829,6 +829,9 @@ unsigned long do_mmap_pgoff(struct file *file,
         void *result;
         int ret;
 
+        if (!(flags & MAP_FIXED))
+                addr = round_hint_to_min(addr);
+
         /* decide whether we should attempt the mapping, and if so what sort of
          * mapping */
         ret = validate_mmap_request(file, addr, len, prot, flags, pgoff,
diff --git a/mm/slab.c b/mm/slab.c
index 202465a193c1..2e338a5f7b14 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4475,3 +4475,4 @@ size_t ksize(const void *objp)
 
         return obj_size(virt_to_cache(objp));
 }
+EXPORT_SYMBOL(ksize);
diff --git a/mm/slob.c b/mm/slob.c
index 08a9bd91a1aa..ee2ef8af0d43 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -495,6 +495,7 @@ size_t ksize(const void *block)
         else
                 return sp->page.private;
 }
+EXPORT_SYMBOL(ksize);
 
 struct kmem_cache {
         unsigned int size, align;
diff --git a/mm/slub.c b/mm/slub.c
index 9acb413858ac..b9f37cb0f2e6 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2558,8 +2558,12 @@ size_t ksize(const void *object)
         if (unlikely(object == ZERO_SIZE_PTR))
                 return 0;
 
-        page = get_object_page(object);
+        page = virt_to_head_page(object);
         BUG_ON(!page);
+
+        if (unlikely(!PageSlab(page)))
+                return PAGE_SIZE << compound_order(page);
+
         s = page->slab;
         BUG_ON(!s);