10 files changed, 86 insertions, 28 deletions

diff --git a/mm/Kconfig b/mm/Kconfig
index 446c6588c753..0bd9c2dbb2a0 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -77,9 +77,6 @@ config FLAT_NODE_MEM_MAP
         def_bool y
         depends on !SPARSEMEM
 
-config HAVE_GET_USER_PAGES_FAST
-        bool
-
 #
 # Both the NUMA code and DISCONTIGMEM use arrays of pg_data_t's
 # to represent different areas of memory.  This variable allows
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 4af15d0340ad..e023c68b0255 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -473,7 +473,7 @@ find_block:
                                 goto find_block;
                         }
 
-                if (bdata->last_end_off &&
+                if (bdata->last_end_off & (PAGE_SIZE - 1) &&
                                 PFN_DOWN(bdata->last_end_off) + 1 == sidx)
                         start_off = ALIGN(bdata->last_end_off, align);
                 else
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 757ca983fd99..67a71191136e 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -565,7 +565,7 @@ static struct page *alloc_fresh_huge_page_node(struct hstate *h, int nid)
                 huge_page_order(h));
         if (page) {
                 if (arch_prepare_hugepage(page)) {
-                        __free_pages(page, HUGETLB_PAGE_ORDER);
+                        __free_pages(page, huge_page_order(h));
                         return NULL;
                 }
                 prep_new_huge_page(h, page, nid);
@@ -665,6 +665,11 @@ static struct page *alloc_buddy_huge_page(struct hstate *h,
                                         __GFP_REPEAT|__GFP_NOWARN,
                                         huge_page_order(h));
 
+        if (page && arch_prepare_hugepage(page)) {
+                __free_pages(page, huge_page_order(h));
+                return NULL;
+        }
+
         spin_lock(&hugetlb_lock);
         if (page) {
                 /*
@@ -1937,6 +1942,18 @@ retry:
                         lock_page(page);
         }
 
+        /*
+         * If we are going to COW a private mapping later, we examine the
+         * pending reservations for this page now. This will ensure that
+         * any allocations necessary to record that reservation occur outside
+         * the spinlock.
+         */
+        if (write_access && !(vma->vm_flags & VM_SHARED))
+                if (vma_needs_reservation(h, vma, address) < 0) {
+                        ret = VM_FAULT_OOM;
+                        goto backout_unlocked;
+                }
+
         spin_lock(&mm->page_table_lock);
         size = i_size_read(mapping->host) >> huge_page_shift(h);
         if (idx >= size)
@@ -1962,6 +1979,7 @@ out:
 
 backout:
         spin_unlock(&mm->page_table_lock);
+backout_unlocked:
         unlock_page(page);
         put_page(page);
         goto out;
@@ -1973,6 +1991,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         pte_t *ptep;
         pte_t entry;
         int ret;
+        struct page *pagecache_page = NULL;
         static DEFINE_MUTEX(hugetlb_instantiation_mutex);
         struct hstate *h = hstate_vma(vma);
 
@@ -1989,25 +2008,44 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         entry = huge_ptep_get(ptep);
         if (huge_pte_none(entry)) {
                 ret = hugetlb_no_page(mm, vma, address, ptep, write_access);
-                mutex_unlock(&hugetlb_instantiation_mutex);
-                return ret;
+                goto out_unlock;
         }
 
         ret = 0;
 
+        /*
+         * If we are going to COW the mapping later, we examine the pending
+         * reservations for this page now. This will ensure that any
+         * allocations necessary to record that reservation occur outside the
+         * spinlock. For private mappings, we also lookup the pagecache
+         * page now as it is used to determine if a reservation has been
+         * consumed.
+         */
+        if (write_access && !pte_write(entry)) {
+                if (vma_needs_reservation(h, vma, address) < 0) {
+                        ret = VM_FAULT_OOM;
+                        goto out_unlock;
+                }
+
+                if (!(vma->vm_flags & VM_SHARED))
+                        pagecache_page = hugetlbfs_pagecache_page(h,
+                                                                vma, address);
+        }
+
         spin_lock(&mm->page_table_lock);
         /* Check for a racing update before calling hugetlb_cow */
         if (likely(pte_same(entry, huge_ptep_get(ptep))))
-                if (write_access && !pte_write(entry)) {
-                        struct page *page;
-                        page = hugetlbfs_pagecache_page(h, vma, address);
-                        ret = hugetlb_cow(mm, vma, address, ptep, entry, page);
-                        if (page) {
-                                unlock_page(page);
-                                put_page(page);
-                        }
-                }
+                if (write_access && !pte_write(entry))
+                        ret = hugetlb_cow(mm, vma, address, ptep, entry,
+                                                        pagecache_page);
         spin_unlock(&mm->page_table_lock);
+
+        if (pagecache_page) {
+                unlock_page(pagecache_page);
+                put_page(pagecache_page);
+        }
+
+out_unlock:
         mutex_unlock(&hugetlb_instantiation_mutex);
 
         return ret;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7056c3bdb478..0f1f7a7374ba 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -796,6 +796,8 @@ int mem_cgroup_shrink_usage(struct mm_struct *mm, gfp_t gfp_mask)
 
         if (mem_cgroup_subsys.disabled)
                 return 0;
+        if (!mm)
+                return 0;
 
         rcu_read_lock();
         mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index e550bec20582..83369058ec13 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -803,7 +803,6 @@ static int migrate_to_node(struct mm_struct *mm, int source, int dest,
 int do_migrate_pages(struct mm_struct *mm,
         const nodemask_t *from_nodes, const nodemask_t *to_nodes, int flags)
 {
-        LIST_HEAD(pagelist);
         int busy = 0;
         int err = 0;
         nodemask_t tmp;
diff --git a/mm/mmap.c b/mm/mmap.c
index 971d0eda754a..339cf5c4d5d8 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2273,14 +2273,14 @@ int install_special_mapping(struct mm_struct *mm,
 
 static DEFINE_MUTEX(mm_all_locks_mutex);
 
-static void vm_lock_anon_vma(struct anon_vma *anon_vma)
+static void vm_lock_anon_vma(struct mm_struct *mm, struct anon_vma *anon_vma)
 {
         if (!test_bit(0, (unsigned long *) &anon_vma->head.next)) {
                 /*
                  * The LSB of head.next can't change from under us
                  * because we hold the mm_all_locks_mutex.
                  */
-                spin_lock(&anon_vma->lock);
+                spin_lock_nest_lock(&anon_vma->lock, &mm->mmap_sem);
                 /*
                  * We can safely modify head.next after taking the
                  * anon_vma->lock. If some other vma in this mm shares
@@ -2296,7 +2296,7 @@ static void vm_lock_anon_vma(struct anon_vma *anon_vma)
         }
 }
 
-static void vm_lock_mapping(struct address_space *mapping)
+static void vm_lock_mapping(struct mm_struct *mm, struct address_space *mapping)
 {
         if (!test_bit(AS_MM_ALL_LOCKS, &mapping->flags)) {
                 /*
@@ -2310,7 +2310,7 @@ static void vm_lock_mapping(struct address_space *mapping)
                  */
                 if (test_and_set_bit(AS_MM_ALL_LOCKS, &mapping->flags))
                         BUG();
-                spin_lock(&mapping->i_mmap_lock);
+                spin_lock_nest_lock(&mapping->i_mmap_lock, &mm->mmap_sem);
         }
 }
 
@@ -2358,11 +2358,17 @@ int mm_take_all_locks(struct mm_struct *mm)
         for (vma = mm->mmap; vma; vma = vma->vm_next) {
                 if (signal_pending(current))
                         goto out_unlock;
-                if (vma->anon_vma)
-                        vm_lock_anon_vma(vma->anon_vma);
                 if (vma->vm_file && vma->vm_file->f_mapping)
-                        vm_lock_mapping(vma->vm_file->f_mapping);
+                        vm_lock_mapping(mm, vma->vm_file->f_mapping);
+        }
+
+        for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                if (signal_pending(current))
+                        goto out_unlock;
+                if (vma->anon_vma)
+                        vm_lock_anon_vma(mm, vma->anon_vma);
         }
+
         ret = 0;
 
 out_unlock:
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 8a5467ee6265..64e5b4bcd964 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -26,6 +26,7 @@
 #include <linux/module.h>
 #include <linux/notifier.h>
 #include <linux/memcontrol.h>
+#include <linux/security.h>
 
 int sysctl_panic_on_oom;
 int sysctl_oom_kill_allocating_task;
@@ -128,7 +129,8 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
          * Superuser processes are usually more important, so we make it
          * less likely that we kill those.
          */
-        if (__capable(p, CAP_SYS_ADMIN) || __capable(p, CAP_SYS_RESOURCE))
+        if (has_capability(p, CAP_SYS_ADMIN) ||
+            has_capability(p, CAP_SYS_RESOURCE))
                 points /= 4;
 
         /*
@@ -137,7 +139,7 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
          * tend to only have this flag set on applications they think
          * of as important.
          */
-        if (__capable(p, CAP_SYS_RAWIO))
+        if (has_capability(p, CAP_SYS_RAWIO))
                 points /= 4;
 
         /*
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 401d104d2bb6..af982f7cdb2a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4437,7 +4437,7 @@ void *__init alloc_large_system_hash(const char *tablename,
         do {
                 size = bucketsize << log2qty;
                 if (flags & HASH_EARLY)
-                        table = alloc_bootmem(size);
+                        table = alloc_bootmem_nopanic(size);
                 else if (hashdist)
                         table = __vmalloc(size, GFP_ATOMIC, PAGE_KERNEL);
                 else {
diff --git a/mm/sparse.c b/mm/sparse.c
index 5d9dbbb9d39e..39db301b920d 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -12,7 +12,6 @@
 #include <asm/dma.h>
 #include <asm/pgalloc.h>
 #include <asm/pgtable.h>
-#include "internal.h"
 
 /*
  * Permanent SPARSEMEM data:
diff --git a/mm/util.c b/mm/util.c
index 9341ca77bd88..cb00b748ce47 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -171,3 +171,18 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
         mm->unmap_area = arch_unmap_area;
 }
 #endif
+
+int __attribute__((weak)) get_user_pages_fast(unsigned long start,
+                                int nr_pages, int write, struct page **pages)
+{
+        struct mm_struct *mm = current->mm;
+        int ret;
+
+        down_read(&mm->mmap_sem);
+        ret = get_user_pages(current, mm, start, nr_pages,
+                                        write, 0, pages, NULL);
+        up_read(&mm->mmap_sem);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(get_user_pages_fast);