6 files changed, 49 insertions, 44 deletions

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 470dcda10add..83326ad66d9b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1408,6 +1408,9 @@ out:
         return ret;
 }
 
+#define VM_NO_THP (VM_SPECIAL|VM_INSERTPAGE|VM_MIXEDMAP|VM_SAO| \
+                   VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
+
 int hugepage_madvise(struct vm_area_struct *vma,
                      unsigned long *vm_flags, int advice)
 {
@@ -1416,11 +1419,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_HUGEPAGE |
-                                 VM_SHARED   | VM_MAYSHARE   |
-                                 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_MIXEDMAP | VM_SAO))
+                if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
                         return -EINVAL;
                 *vm_flags &= ~VM_NOHUGEPAGE;
                 *vm_flags |= VM_HUGEPAGE;
@@ -1436,11 +1435,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_NOHUGEPAGE |
-                                 VM_SHARED   | VM_MAYSHARE   |
-                                 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_MIXEDMAP | VM_SAO))
+                if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
                         return -EINVAL;
                 *vm_flags &= ~VM_HUGEPAGE;
                 *vm_flags |= VM_NOHUGEPAGE;
@@ -1574,10 +1569,14 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
                  * page fault if needed.
                  */
                 return 0;
-        if (vma->vm_file || vma->vm_ops)
+        if (vma->vm_ops)
                 /* khugepaged not yet working on file or special mappings */
                 return 0;
-        VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+        /*
+         * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+         * true too, verify it here.
+         */
+        VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
         hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
         hend = vma->vm_end & HPAGE_PMD_MASK;
         if (hstart < hend)
@@ -1828,12 +1827,15 @@ static void collapse_huge_page(struct mm_struct *mm,
             (vma->vm_flags & VM_NOHUGEPAGE))
                 goto out;
 
-        /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
-        if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+        if (!vma->anon_vma || vma->vm_ops)
                 goto out;
         if (is_vma_temporary_stack(vma))
                 goto out;
-        VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+        /*
+         * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+         * true too, verify it here.
+         */
+        VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
 
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
@@ -2066,13 +2068,16 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
                         progress++;
                         continue;
                 }
-                /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
-                if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+                if (!vma->anon_vma || vma->vm_ops)
                         goto skip;
                 if (is_vma_temporary_stack(vma))
                         goto skip;
-
-                VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+                /*
+                 * If is_pfn_mapping() is true is_learn_pfn_mapping()
+                 * must be true too, verify it here.
+                 */
+                VM_BUG_ON(is_linear_pfn_mapping(vma) ||
+                          vma->vm_flags & VM_NO_THP);
 
                 hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
                 hend = vma->vm_end & HPAGE_PMD_MASK;
diff --git a/mm/memory.c b/mm/memory.c
index ce22a250926f..61e66f026563 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1359,7 +1359,7 @@ split_fallthrough:
                  */
                 mark_page_accessed(page);
         }
-        if (flags & FOLL_MLOCK) {
+        if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
                 /*
                  * The preliminary mapping check is mainly to avoid the
                  * pointless overhead of lock_page on the ZERO_PAGE
@@ -1412,9 +1412,8 @@ no_page_table:
 
 static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
 {
-        return (vma->vm_flags & VM_GROWSDOWN) &&
-                (vma->vm_start == addr) &&
-                !vma_stack_continue(vma->vm_prev, addr);
+        return stack_guard_page_start(vma, addr) ||
+               stack_guard_page_end(vma, addr+PAGE_SIZE);
 }
 
 /**
@@ -1551,13 +1550,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                         continue;
                 }
 
-                /*
-                 * If we don't actually want the page itself,
-                 * and it's the stack guard page, just skip it.
-                 */
-                if (!pages && stack_guard_page(vma, start))
-                        goto next_page;
-
                 do {
                         struct page *page;
                         unsigned int foll_flags = gup_flags;
@@ -1574,6 +1566,11 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 int ret;
                                 unsigned int fault_flags = 0;
 
+                                /* For mlock, just skip the stack guard page. */
+                                if (foll_flags & FOLL_MLOCK) {
+                                        if (stack_guard_page(vma, start))
+                                                goto next_page;
+                                }
                                 if (foll_flags & FOLL_WRITE)
                                         fault_flags |= FAULT_FLAG_WRITE;
                                 if (nonblocking)
@@ -3396,7 +3393,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
          * run pte_offset_map on the pmd, if an huge pmd could
          * materialize from under us from a different thread.
          */
-        if (unlikely(__pte_alloc(mm, vma, pmd, address)))
+        if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
                 return VM_FAULT_OOM;
         /* if an huge pmd materialized from under us just retry later */
         if (unlikely(pmd_trans_huge(*pmd)))
diff --git a/mm/mlock.c b/mm/mlock.c
index 6b55e3efe0df..516b2c2ddd5a 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -162,7 +162,7 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         VM_BUG_ON(end   > vma->vm_end);
         VM_BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
 
-        gup_flags = FOLL_TOUCH;
+        gup_flags = FOLL_TOUCH | FOLL_MLOCK;
         /*
          * We want to touch writable mappings with a write fault in order
          * to break COW, except for shared mappings because these don't COW
@@ -178,9 +178,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC))
                 gup_flags |= FOLL_FORCE;
 
-        if (vma->vm_flags & VM_LOCKED)
-                gup_flags |= FOLL_MLOCK;
-
         return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
                                 NULL, NULL, nonblocking);
 }
diff --git a/mm/mmap.c b/mm/mmap.c
index e27e0cf0de03..772140c53ab1 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1767,10 +1767,13 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
                 size = address - vma->vm_start;
                 grow = (address - vma->vm_end) >> PAGE_SHIFT;
 
-                error = acct_stack_growth(vma, size, grow);
-                if (!error) {
-                        vma->vm_end = address;
-                        perf_event_mmap(vma);
+                error = -ENOMEM;
+                if (vma->vm_pgoff + (size >> PAGE_SHIFT) >= vma->vm_pgoff) {
+                        error = acct_stack_growth(vma, size, grow);
+                        if (!error) {
+                                vma->vm_end = address;
+                                perf_event_mmap(vma);
+                        }
                 }
         }
         vma_unlock_anon_vma(vma);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 83fb72c108b7..f52e85c80e8d 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -172,10 +172,13 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
 
         /*
          * The baseline for the badness score is the proportion of RAM that each
-         * task's rss and swap space use.
+         * task's rss, pagetable and swap space use.
          */
-        points = (get_mm_rss(p->mm) + get_mm_counter(p->mm, MM_SWAPENTS)) * 1000 /
-                        totalpages;
+        points = get_mm_rss(p->mm) + p->mm->nr_ptes;
+        points += get_mm_counter(p->mm, MM_SWAPENTS);
+
+        points *= 1000;
+        points /= totalpages;
         task_unlock(p);
 
         /*
diff --git a/mm/slub.c b/mm/slub.c
index 94d2a33a866e..9d2e5e46bf09 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1940,7 +1940,7 @@ redo:
                  * Since this is without lock semantics the protection is only against
                  * code executing on this cpu *not* from access by other cpus.
                  */
-                if (unlikely(!this_cpu_cmpxchg_double(
+                if (unlikely(!irqsafe_cpu_cmpxchg_double(
                                 s->cpu_slab->freelist, s->cpu_slab->tid,
                                 object, tid,
                                 get_freepointer(s, object), next_tid(tid)))) {
@@ -2145,7 +2145,7 @@ redo:
                 set_freepointer(s, object, c->freelist);
 
 #ifdef CONFIG_CMPXCHG_LOCAL
-                if (unlikely(!this_cpu_cmpxchg_double(
+                if (unlikely(!irqsafe_cpu_cmpxchg_double(
                                 s->cpu_slab->freelist, s->cpu_slab->tid,
                                 c->freelist, tid,
                                 object, next_tid(tid)))) {