11 files changed, 111 insertions, 56 deletions

diff --git a/mm/Kconfig b/mm/Kconfig
index c2b57d81e153..71830ba7b986 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -226,6 +226,25 @@ config HAVE_MLOCKED_PAGE_BIT
 config MMU_NOTIFIER
         bool
 
+config DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"
+        default 4096
+        help
+          This is the portion of low virtual memory which should be protected
+          from userspace allocation.  Keeping a user from writing to low pages
+          can help reduce the impact of kernel NULL pointer bugs.
+
+          For most ia64, ppc64 and x86 users with lots of address space
+          a value of 65536 is reasonable and should cause no problems.
+          On arm and other archs it should not be higher than 32768.
+          Programs which use vm86 functionality would either need additional
+          permissions from either the LSM or the capabilities module or have
+          this protection disabled.
+
+          This value can be changed after boot using the
+          /proc/sys/vm/mmap_min_addr tunable.
+
+
 config NOMMU_INITIAL_TRIM_EXCESS
         int "Turn on mmap() excess space trimming before booting"
         depends on !MMU
diff --git a/mm/bootmem.c b/mm/bootmem.c
index daf92713f7de..282df0a09e6f 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -532,6 +532,9 @@ static void * __init alloc_arch_preferred_bootmem(bootmem_data_t *bdata,
                                         unsigned long size, unsigned long align,
                                         unsigned long goal, unsigned long limit)
 {
+        if (WARN_ON_ONCE(slab_is_available()))
+                return kzalloc(size, GFP_NOWAIT);
+
 #ifdef CONFIG_HAVE_ARCH_BOOTMEM
         bootmem_data_t *p_bdata;
 
@@ -662,6 +665,9 @@ static void * __init ___alloc_bootmem_node(bootmem_data_t *bdata,
 void * __init __alloc_bootmem_node(pg_data_t *pgdat, unsigned long size,
                                    unsigned long align, unsigned long goal)
 {
+        if (WARN_ON_ONCE(slab_is_available()))
+                return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
+
         return ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0);
 }
 
@@ -693,6 +699,9 @@ void * __init __alloc_bootmem_node_nopanic(pg_data_t *pgdat, unsigned long size,
 {
         void *ptr;
 
+        if (WARN_ON_ONCE(slab_is_available()))
+                return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
+
         ptr = alloc_arch_preferred_bootmem(pgdat->bdata, size, align, goal, 0);
         if (ptr)
                 return ptr;
@@ -745,6 +754,9 @@ void * __init __alloc_bootmem_low(unsigned long size, unsigned long align,
 void * __init __alloc_bootmem_low_node(pg_data_t *pgdat, unsigned long size,
                                        unsigned long align, unsigned long goal)
 {
+        if (WARN_ON_ONCE(slab_is_available()))
+                return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
+
         return ___alloc_bootmem_node(pgdat->bdata, size, align,
                                 goal, ARCH_LOW_ADDRESS_LIMIT);
 }
diff --git a/mm/bounce.c b/mm/bounce.c
index 65f5e17e411a..4ebe3ea83795 100644
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -191,7 +191,7 @@ static void __blk_queue_bounce(struct request_queue *q, struct bio **bio_orig,
                 /*
                  * is destination page below bounce pfn?
                  */
-                if (page_to_pfn(page) <= q->bounce_pfn)
+                if (page_to_pfn(page) <= queue_bounce_pfn(q))
                         continue;
 
                 /*
@@ -283,7 +283,7 @@ void blk_queue_bounce(struct request_queue *q, struct bio **bio_orig)
          * don't waste time iterating over bio segments
          */
         if (!(q->bounce_gfp & GFP_DMA)) {
-                if (q->bounce_pfn >= blk_max_pfn)
+                if (queue_bounce_pfn(q) >= blk_max_pfn)
                         return;
                 pool = page_pool;
         } else {
diff --git a/mm/mmap.c b/mm/mmap.c
index 6b7b1a95944b..34579b23ebd5 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -28,6 +28,7 @@
 #include <linux/mempolicy.h>
 #include <linux/rmap.h>
 #include <linux/mmu_notifier.h>
+#include <linux/perf_counter.h>
 
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
@@ -87,6 +88,9 @@ int sysctl_overcommit_ratio = 50;	/* default is 50% */
 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
 struct percpu_counter vm_committed_as;
 
+/* amount of vm to protect from userspace access */
+unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
+
 /*
  * Check that a process has enough memory to allocate a new virtual
  * mapping. 0 means there is enough memory for the allocation to
@@ -1219,6 +1223,8 @@ munmap_back:
         if (correct_wcount)
                 atomic_inc(&inode->i_writecount);
 out:
+        perf_counter_mmap(vma);
+
         mm->total_vm += len >> PAGE_SHIFT;
         vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
         if (vm_flags & VM_LOCKED) {
@@ -2305,6 +2311,8 @@ int install_special_mapping(struct mm_struct *mm,
 
         mm->total_vm += len >> PAGE_SHIFT;
 
+        perf_counter_mmap(vma);
+
         return 0;
 }
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 258197b76fb4..d80311baeb2d 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -23,6 +23,7 @@
 #include <linux/swapops.h>
 #include <linux/mmu_notifier.h>
 #include <linux/migrate.h>
+#include <linux/perf_counter.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/cacheflush.h>
@@ -299,6 +300,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
                 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
                 if (error)
                         goto out;
+                perf_counter_mmap(vma);
                 nstart = tmp;
 
                 if (nstart < prev->vm_end)
diff --git a/mm/nommu.c b/mm/nommu.c
index b571ef707428..2fd2ad5da98e 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -69,6 +69,9 @@ int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
 int heap_stack_gap = 0;
 
+/* amount of vm to protect from userspace access */
+unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
+
 atomic_long_t mmap_pages_allocated;
 
 EXPORT_SYMBOL(mem_map);
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index 791905c991df..3dd4a909a1de 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -47,6 +47,8 @@ static int __init alloc_node_page_cgroup(int nid)
         struct page_cgroup *base, *pc;
         unsigned long table_size;
         unsigned long start_pfn, nr_pages, index;
+        struct page *page;
+        unsigned int order;
 
         start_pfn = NODE_DATA(nid)->node_start_pfn;
         nr_pages = NODE_DATA(nid)->node_spanned_pages;
@@ -55,11 +57,13 @@ static int __init alloc_node_page_cgroup(int nid)
                 return 0;
 
         table_size = sizeof(struct page_cgroup) * nr_pages;
-
-        base = __alloc_bootmem_node_nopanic(NODE_DATA(nid),
-                        table_size, PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
-        if (!base)
+        order = get_order(table_size);
+        page = alloc_pages_node(nid, GFP_NOWAIT | __GFP_ZERO, order);
+        if (!page)
+                page = alloc_pages_node(-1, GFP_NOWAIT | __GFP_ZERO, order);
+        if (!page)
                 return -ENOMEM;
+        base = page_address(page);
         for (index = 0; index < nr_pages; index++) {
                 pc = base + index;
                 __init_page_cgroup(pc, start_pfn + index);
diff --git a/mm/shmem.c b/mm/shmem.c
index b25f95ce3db7..0132fbd45a23 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2659,6 +2659,7 @@ struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags)
         if (error)
                 goto close_file;
 #endif
+        ima_counts_get(file);
         return file;
 
 close_file:
@@ -2684,7 +2685,6 @@ int shmem_zero_setup(struct vm_area_struct *vma)
         if (IS_ERR(file))
                 return PTR_ERR(file);
 
-        ima_shm_check(file);
         if (vma->vm_file)
                 fput(vma->vm_file);
         vma->vm_file = file;
diff --git a/mm/slab.c b/mm/slab.c
index 859067f8e4fd..f46b65d124e5 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -316,7 +316,7 @@ static int drain_freelist(struct kmem_cache *cache,
                         struct kmem_list3 *l3, int tofree);
 static void free_block(struct kmem_cache *cachep, void **objpp, int len,
                         int node);
-static int enable_cpucache(struct kmem_cache *cachep);
+static int enable_cpucache(struct kmem_cache *cachep, gfp_t gfp);
 static void cache_reap(struct work_struct *unused);
 
 /*
@@ -959,12 +959,12 @@ static void __cpuinit start_cpu_timer(int cpu)
 }
 
 static struct array_cache *alloc_arraycache(int node, int entries,
-                                            int batchcount)
+                                            int batchcount, gfp_t gfp)
 {
         int memsize = sizeof(void *) * entries + sizeof(struct array_cache);
         struct array_cache *nc = NULL;
 
-        nc = kmalloc_node(memsize, GFP_KERNEL, node);
+        nc = kmalloc_node(memsize, gfp, node);
         /*
          * The array_cache structures contain pointers to free object.
          * However, when such objects are allocated or transfered to another
@@ -1012,7 +1012,7 @@ static int transfer_objects(struct array_cache *to,
 #define drain_alien_cache(cachep, alien) do { } while (0)
 #define reap_alien(cachep, l3) do { } while (0)
 
-static inline struct array_cache **alloc_alien_cache(int node, int limit)
+static inline struct array_cache **alloc_alien_cache(int node, int limit, gfp_t gfp)
 {
         return (struct array_cache **)BAD_ALIEN_MAGIC;
 }
@@ -1043,7 +1043,7 @@ static inline void *____cache_alloc_node(struct kmem_cache *cachep,
 static void *____cache_alloc_node(struct kmem_cache *, gfp_t, int);
 static void *alternate_node_alloc(struct kmem_cache *, gfp_t);
 
-static struct array_cache **alloc_alien_cache(int node, int limit)
+static struct array_cache **alloc_alien_cache(int node, int limit, gfp_t gfp)
 {
         struct array_cache **ac_ptr;
         int memsize = sizeof(void *) * nr_node_ids;
@@ -1051,14 +1051,14 @@ static struct array_cache **alloc_alien_cache(int node, int limit)
 
         if (limit > 1)
                 limit = 12;
-        ac_ptr = kmalloc_node(memsize, GFP_KERNEL, node);
+        ac_ptr = kmalloc_node(memsize, gfp, node);
         if (ac_ptr) {
                 for_each_node(i) {
                         if (i == node || !node_online(i)) {
                                 ac_ptr[i] = NULL;
                                 continue;
                         }
-                        ac_ptr[i] = alloc_arraycache(node, limit, 0xbaadf00d);
+                        ac_ptr[i] = alloc_arraycache(node, limit, 0xbaadf00d, gfp);
                         if (!ac_ptr[i]) {
                                 for (i--; i >= 0; i--)
                                         kfree(ac_ptr[i]);
@@ -1291,20 +1291,20 @@ static int __cpuinit cpuup_prepare(long cpu)
                 struct array_cache **alien = NULL;
 
                 nc = alloc_arraycache(node, cachep->limit,
-                                        cachep->batchcount);
+                                        cachep->batchcount, GFP_KERNEL);
                 if (!nc)
                         goto bad;
                 if (cachep->shared) {
                         shared = alloc_arraycache(node,
                                 cachep->shared * cachep->batchcount,
-                                0xbaadf00d);
+                                0xbaadf00d, GFP_KERNEL);
                         if (!shared) {
                                 kfree(nc);
                                 goto bad;
                         }
                 }
                 if (use_alien_caches) {
-                        alien = alloc_alien_cache(node, cachep->limit);
+                        alien = alloc_alien_cache(node, cachep->limit, GFP_KERNEL);
                         if (!alien) {
                                 kfree(shared);
                                 kfree(nc);
@@ -1408,10 +1408,9 @@ static void init_list(struct kmem_cache *cachep, struct kmem_list3 *list,
 {
         struct kmem_list3 *ptr;
 
-        ptr = kmalloc_node(sizeof(struct kmem_list3), GFP_KERNEL, nodeid);
+        ptr = kmalloc_node(sizeof(struct kmem_list3), GFP_NOWAIT, nodeid);
         BUG_ON(!ptr);
 
-        local_irq_disable();
         memcpy(ptr, list, sizeof(struct kmem_list3));
         /*
          * Do not assume that spinlocks can be initialized via memcpy:
@@ -1420,7 +1419,6 @@ static void init_list(struct kmem_cache *cachep, struct kmem_list3 *list,
 
         MAKE_ALL_LISTS(cachep, ptr, nodeid);
         cachep->nodelists[nodeid] = ptr;
-        local_irq_enable();
 }
 
 /*
@@ -1584,9 +1582,8 @@ void __init kmem_cache_init(void)
         {
                 struct array_cache *ptr;
 
-                ptr = kmalloc(sizeof(struct arraycache_init), GFP_KERNEL);
+                ptr = kmalloc(sizeof(struct arraycache_init), GFP_NOWAIT);
 
-                local_irq_disable();
                 BUG_ON(cpu_cache_get(&cache_cache) != &initarray_cache.cache);
                 memcpy(ptr, cpu_cache_get(&cache_cache),
                        sizeof(struct arraycache_init));
@@ -1596,11 +1593,9 @@ void __init kmem_cache_init(void)
                 spin_lock_init(&ptr->lock);
 
                 cache_cache.array[smp_processor_id()] = ptr;
-                local_irq_enable();
 
-                ptr = kmalloc(sizeof(struct arraycache_init), GFP_KERNEL);
+                ptr = kmalloc(sizeof(struct arraycache_init), GFP_NOWAIT);
 
-                local_irq_disable();
                 BUG_ON(cpu_cache_get(malloc_sizes[INDEX_AC].cs_cachep)
                        != &initarray_generic.cache);
                 memcpy(ptr, cpu_cache_get(malloc_sizes[INDEX_AC].cs_cachep),
@@ -1612,7 +1607,6 @@ void __init kmem_cache_init(void)
 
                 malloc_sizes[INDEX_AC].cs_cachep->array[smp_processor_id()] =
                     ptr;
-                local_irq_enable();
         }
         /* 5) Replace the bootstrap kmem_list3's */
         {
@@ -1636,7 +1630,7 @@ void __init kmem_cache_init(void)
                 struct kmem_cache *cachep;
                 mutex_lock(&cache_chain_mutex);
                 list_for_each_entry(cachep, &cache_chain, next)
-                        if (enable_cpucache(cachep))
+                        if (enable_cpucache(cachep, GFP_NOWAIT))
                                 BUG();
                 mutex_unlock(&cache_chain_mutex);
         }
@@ -2073,10 +2067,10 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
         return left_over;
 }
 
-static int __init_refok setup_cpu_cache(struct kmem_cache *cachep)
+static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
 {
         if (g_cpucache_up == FULL)
-                return enable_cpucache(cachep);
+                return enable_cpucache(cachep, gfp);
 
         if (g_cpucache_up == NONE) {
                 /*
@@ -2098,7 +2092,7 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep)
                         g_cpucache_up = PARTIAL_AC;
         } else {
                 cachep->array[smp_processor_id()] =
-                        kmalloc(sizeof(struct arraycache_init), GFP_KERNEL);
+                        kmalloc(sizeof(struct arraycache_init), gfp);
 
                 if (g_cpucache_up == PARTIAL_AC) {
                         set_up_list3s(cachep, SIZE_L3);
@@ -2162,6 +2156,7 @@ kmem_cache_create (const char *name, size_t size, size_t align,
 {
         size_t left_over, slab_size, ralign;
         struct kmem_cache *cachep = NULL, *pc;
+        gfp_t gfp;
 
         /*
          * Sanity checks... these are all serious usage bugs.
@@ -2177,8 +2172,10 @@ kmem_cache_create (const char *name, size_t size, size_t align,
          * We use cache_chain_mutex to ensure a consistent view of
          * cpu_online_mask as well.  Please see cpuup_callback
          */
-        get_online_cpus();
-        mutex_lock(&cache_chain_mutex);
+        if (slab_is_available()) {
+                get_online_cpus();
+                mutex_lock(&cache_chain_mutex);
+        }
 
         list_for_each_entry(pc, &cache_chain, next) {
                 char tmp;
@@ -2287,8 +2284,13 @@ kmem_cache_create (const char *name, size_t size, size_t align,
          */
         align = ralign;
 
+        if (slab_is_available())
+                gfp = GFP_KERNEL;
+        else
+                gfp = GFP_NOWAIT;
+
         /* Get cache's description obj. */
-        cachep = kmem_cache_zalloc(&cache_cache, GFP_KERNEL);
+        cachep = kmem_cache_zalloc(&cache_cache, gfp);
         if (!cachep)
                 goto oops;
 
@@ -2391,7 +2393,7 @@ kmem_cache_create (const char *name, size_t size, size_t align,
         cachep->ctor = ctor;
         cachep->name = name;
 
-        if (setup_cpu_cache(cachep)) {
+        if (setup_cpu_cache(cachep, gfp)) {
                 __kmem_cache_destroy(cachep);
                 cachep = NULL;
                 goto oops;
@@ -2403,8 +2405,10 @@ oops:
         if (!cachep && (flags & SLAB_PANIC))
                 panic("kmem_cache_create(): failed to create slab `%s'\n",
                       name);
-        mutex_unlock(&cache_chain_mutex);
-        put_online_cpus();
+        if (slab_is_available()) {
+                mutex_unlock(&cache_chain_mutex);
+                put_online_cpus();
+        }
         return cachep;
 }
 EXPORT_SYMBOL(kmem_cache_create);
@@ -3830,7 +3834,7 @@ EXPORT_SYMBOL_GPL(kmem_cache_name);
 /*
  * This initializes kmem_list3 or resizes various caches for all nodes.
  */
-static int alloc_kmemlist(struct kmem_cache *cachep)
+static int alloc_kmemlist(struct kmem_cache *cachep, gfp_t gfp)
 {
         int node;
         struct kmem_list3 *l3;
@@ -3840,7 +3844,7 @@ static int alloc_kmemlist(struct kmem_cache *cachep)
         for_each_online_node(node) {
 
                 if (use_alien_caches) {
-                        new_alien = alloc_alien_cache(node, cachep->limit);
+                        new_alien = alloc_alien_cache(node, cachep->limit, gfp);
                         if (!new_alien)
                                 goto fail;
                 }
@@ -3849,7 +3853,7 @@ static int alloc_kmemlist(struct kmem_cache *cachep)
                 if (cachep->shared) {
                         new_shared = alloc_arraycache(node,
                                 cachep->shared*cachep->batchcount,
-                                        0xbaadf00d);
+                                        0xbaadf00d, gfp);
                         if (!new_shared) {
                                 free_alien_cache(new_alien);
                                 goto fail;
@@ -3878,7 +3882,7 @@ static int alloc_kmemlist(struct kmem_cache *cachep)
                         free_alien_cache(new_alien);
                         continue;
                 }
-                l3 = kmalloc_node(sizeof(struct kmem_list3), GFP_KERNEL, node);
+                l3 = kmalloc_node(sizeof(struct kmem_list3), gfp, node);
                 if (!l3) {
                         free_alien_cache(new_alien);
                         kfree(new_shared);
@@ -3934,18 +3938,18 @@ static void do_ccupdate_local(void *info)
 
 /* Always called with the cache_chain_mutex held */
 static int do_tune_cpucache(struct kmem_cache *cachep, int limit,
-                                int batchcount, int shared)
+                                int batchcount, int shared, gfp_t gfp)
 {
         struct ccupdate_struct *new;
         int i;
 
-        new = kzalloc(sizeof(*new), GFP_KERNEL);
+        new = kzalloc(sizeof(*new), gfp);
         if (!new)
                 return -ENOMEM;
 
         for_each_online_cpu(i) {
                 new->new[i] = alloc_arraycache(cpu_to_node(i), limit,
-                                                batchcount);
+                                                batchcount, gfp);
                 if (!new->new[i]) {
                         for (i--; i >= 0; i--)
                                 kfree(new->new[i]);
@@ -3972,11 +3976,11 @@ static int do_tune_cpucache(struct kmem_cache *cachep, int limit,
                 kfree(ccold);
         }
         kfree(new);
-        return alloc_kmemlist(cachep);
+        return alloc_kmemlist(cachep, gfp);
 }
 
 /* Called with cache_chain_mutex held always */
-static int enable_cpucache(struct kmem_cache *cachep)
+static int enable_cpucache(struct kmem_cache *cachep, gfp_t gfp)
 {
         int err;
         int limit, shared;
@@ -4022,7 +4026,7 @@ static int enable_cpucache(struct kmem_cache *cachep)
         if (limit > 32)
                 limit = 32;
 #endif
-        err = do_tune_cpucache(cachep, limit, (limit + 1) / 2, shared);
+        err = do_tune_cpucache(cachep, limit, (limit + 1) / 2, shared, gfp);
         if (err)
                 printk(KERN_ERR "enable_cpucache failed for %s, error %d.\n",
                        cachep->name, -err);
@@ -4328,7 +4332,8 @@ ssize_t slabinfo_write(struct file *file, const char __user * buffer,
                                 res = 0;
                         } else {
                                 res = do_tune_cpucache(cachep, limit,
-                                                       batchcount, shared);
+                                                       batchcount, shared,
+                                                       GFP_KERNEL);
                         }
                         break;
                 }
diff --git a/mm/slub.c b/mm/slub.c
index 6674a7907b0c..3964d3ce4c15 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2560,13 +2560,16 @@ static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
         if (gfp_flags & SLUB_DMA)
                 flags = SLAB_CACHE_DMA;
 
-        down_write(&slub_lock);
+        /*
+         * This function is called with IRQs disabled during early-boot on
+         * single CPU so there's no need to take slub_lock here.
+         */
         if (!kmem_cache_open(s, gfp_flags, name, size, ARCH_KMALLOC_MINALIGN,
                                                                 flags, NULL))
                 goto panic;
 
         list_add(&s->list, &slab_caches);
-        up_write(&slub_lock);
+
         if (sysfs_slab_add(s))
                 goto panic;
         return s;
@@ -3024,7 +3027,7 @@ void __init kmem_cache_init(void)
          * kmem_cache_open for slab_state == DOWN.
          */
         create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
-                sizeof(struct kmem_cache_node), GFP_KERNEL);
+                sizeof(struct kmem_cache_node), GFP_NOWAIT);
         kmalloc_caches[0].refcount = -1;
         caches++;
 
@@ -3037,16 +3040,16 @@ void __init kmem_cache_init(void)
         /* Caches that are not of the two-to-the-power-of size */
         if (KMALLOC_MIN_SIZE <= 64) {
                 create_kmalloc_cache(&kmalloc_caches[1],
-                                "kmalloc-96", 96, GFP_KERNEL);
+                                "kmalloc-96", 96, GFP_NOWAIT);
                 caches++;
                 create_kmalloc_cache(&kmalloc_caches[2],
-                                "kmalloc-192", 192, GFP_KERNEL);
+                                "kmalloc-192", 192, GFP_NOWAIT);
                 caches++;
         }
 
         for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
                 create_kmalloc_cache(&kmalloc_caches[i],
-                        "kmalloc", 1 << i, GFP_KERNEL);
+                        "kmalloc", 1 << i, GFP_NOWAIT);
                 caches++;
         }
 
@@ -3083,7 +3086,7 @@ void __init kmem_cache_init(void)
         /* Provide the correct kmalloc names now that the caches are up */
         for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++)
                 kmalloc_caches[i]. name =
-                        kasprintf(GFP_KERNEL, "kmalloc-%d", 1 << i);
+                        kasprintf(GFP_NOWAIT, "kmalloc-%d", 1 << i);
 
 #ifdef CONFIG_SMP
         register_cpu_notifier(&slab_notifier);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index b7db93572797..f8189a4b3e13 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -23,7 +23,6 @@
 #include <linux/rbtree.h>
 #include <linux/radix-tree.h>
 #include <linux/rcupdate.h>
-#include <linux/bootmem.h>
 #include <linux/pfn.h>
 #include <linux/kmemleak.h>
 
@@ -1033,7 +1032,7 @@ void __init vmalloc_init(void)
 
         /* Import existing vmlist entries. */
         for (tmp = vmlist; tmp; tmp = tmp->next) {
-                va = alloc_bootmem(sizeof(struct vmap_area));
+                va = kzalloc(sizeof(struct vmap_area), GFP_NOWAIT);
                 va->flags = tmp->flags | VM_VM_AREA;
                 va->va_start = (unsigned long)tmp->addr;
                 va->va_end = va->va_start + tmp->size;