6 files changed, 14 insertions, 4 deletions

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index b0ceb29da4c7..e8644b1e5527 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -7,7 +7,7 @@
 
 int bdi_init(struct backing_dev_info *bdi)
 {
-        int i, j;
+        int i;
         int err;
 
         for (i = 0; i < NR_BDI_STAT_ITEMS; i++) {
@@ -21,7 +21,7 @@ int bdi_init(struct backing_dev_info *bdi)
 
         if (err) {
 err:
-                for (j = 0; j < i; j++)
+                while (i--)
                         percpu_counter_destroy(&bdi->bdi_stat[i]);
         }
 
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index 32132f3cd641..e233fff61b4b 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -314,7 +314,7 @@ __xip_file_write(struct file *filp, const char __user *buf,
                 fault_in_pages_readable(buf, bytes);
                 kaddr = kmap_atomic(page, KM_USER0);
                 copied = bytes -
-                        __copy_from_user_inatomic_nocache(kaddr, buf, bytes);
+                        __copy_from_user_inatomic_nocache(kaddr + offset, buf, bytes);
                 kunmap_atomic(kaddr, KM_USER0);
                 flush_dcache_page(page);
 
diff --git a/mm/mmap.c b/mm/mmap.c
index facc1a75bd4f..acfc13f23ca0 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1934,6 +1934,10 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
         if (is_hugepage_only_range(mm, addr, len))
                 return -EINVAL;
 
+        error = security_file_mmap(0, 0, 0, 0, addr, 1);
+        if (error)
+                return error;
+
         flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
 
         error = arch_mmap_check(addr, len, flags);
diff --git a/mm/slab.c b/mm/slab.c
index 202465a193c1..2e338a5f7b14 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4475,3 +4475,4 @@ size_t ksize(const void *objp)
 
         return obj_size(virt_to_cache(objp));
 }
+EXPORT_SYMBOL(ksize);
diff --git a/mm/slob.c b/mm/slob.c
index 08a9bd91a1aa..ee2ef8af0d43 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -495,6 +495,7 @@ size_t ksize(const void *block)
         else
                 return sp->page.private;
 }
+EXPORT_SYMBOL(ksize);
 
 struct kmem_cache {
         unsigned int size, align;
diff --git a/mm/slub.c b/mm/slub.c
index 9acb413858ac..b9f37cb0f2e6 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2558,8 +2558,12 @@ size_t ksize(const void *object)
         if (unlikely(object == ZERO_SIZE_PTR))
                 return 0;
 
-        page = get_object_page(object);
+        page = virt_to_head_page(object);
         BUG_ON(!page);
+
+        if (unlikely(!PageSlab(page)))
+                return PAGE_SIZE << compound_order(page);
+
         s = page->slab;
         BUG_ON(!s);