9 files changed, 72 insertions, 35 deletions

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index c4a3558589ab..85855240933d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2738,7 +2738,8 @@ out_page_table_lock:
                 unlock_page(pagecache_page);
                 put_page(pagecache_page);
         }
-        unlock_page(page);
+        if (page != pagecache_page)
+                unlock_page(page);
 
 out_mutex:
         mutex_unlock(&hugetlb_instantiation_mutex);
diff --git a/mm/ksm.c b/mm/ksm.c
index 65ab5c7067d9..43bc893470b4 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1724,8 +1724,13 @@ static int ksm_memory_callback(struct notifier_block *self,
                 /*
                  * Keep it very simple for now: just lock out ksmd and
                  * MADV_UNMERGEABLE while any memory is going offline.
+                 * mutex_lock_nested() is necessary because lockdep was alarmed
+                 * that here we take ksm_thread_mutex inside notifier chain
+                 * mutex, and later take notifier chain mutex inside
+                 * ksm_thread_mutex to unlock it.   But that's safe because both
+                 * are inside mem_hotplug_mutex.
                  */
-                mutex_lock(&ksm_thread_mutex);
+                mutex_lock_nested(&ksm_thread_mutex, SINGLE_DEPTH_NESTING);
                 break;
 
         case MEM_OFFLINE:
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 124324134ff6..46ab2c044b0e 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -51,6 +51,7 @@
 #include <linux/slab.h>
 #include <linux/swapops.h>
 #include <linux/hugetlb.h>
+#include <linux/memory_hotplug.h>
 #include "internal.h"
 
 int sysctl_memory_failure_early_kill __read_mostly = 0;
@@ -1230,11 +1231,10 @@ static int get_any_page(struct page *p, unsigned long pfn, int flags)
                 return 1;
 
         /*
-         * The lock_system_sleep prevents a race with memory hotplug,
-         * because the isolation assumes there's only a single user.
+         * The lock_memory_hotplug prevents a race with memory hotplug.
          * This is a big hammer, a better would be nicer.
          */
-        lock_system_sleep();
+        lock_memory_hotplug();
 
         /*
          * Isolate the page, so that it doesn't get reallocated if it
@@ -1264,7 +1264,7 @@ static int get_any_page(struct page *p, unsigned long pfn, int flags)
                 ret = 1;
         }
         unset_migratetype_isolate(p);
-        unlock_system_sleep();
+        unlock_memory_hotplug();
         return ret;
 }
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9260314a221e..2c6523af5473 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -34,6 +34,23 @@
 
 #include "internal.h"
 
+DEFINE_MUTEX(mem_hotplug_mutex);
+
+void lock_memory_hotplug(void)
+{
+        mutex_lock(&mem_hotplug_mutex);
+
+        /* for exclusive hibernation if CONFIG_HIBERNATION=y */
+        lock_system_sleep();
+}
+
+void unlock_memory_hotplug(void)
+{
+        unlock_system_sleep();
+        mutex_unlock(&mem_hotplug_mutex);
+}
+
+
 /* add this memory to iomem resource */
 static struct resource *register_memory_resource(u64 start, u64 size)
 {
@@ -493,7 +510,7 @@ int mem_online_node(int nid)
         pg_data_t       *pgdat;
         int     ret;
 
-        lock_system_sleep();
+        lock_memory_hotplug();
         pgdat = hotadd_new_pgdat(nid, 0);
         if (pgdat) {
                 ret = -ENOMEM;
@@ -504,7 +521,7 @@ int mem_online_node(int nid)
         BUG_ON(ret);
 
 out:
-        unlock_system_sleep();
+        unlock_memory_hotplug();
         return ret;
 }
 
@@ -516,7 +533,7 @@ int __ref add_memory(int nid, u64 start, u64 size)
         struct resource *res;
         int ret;
 
-        lock_system_sleep();
+        lock_memory_hotplug();
 
         res = register_memory_resource(start, size);
         ret = -EEXIST;
@@ -563,7 +580,7 @@ error:
                 release_memory_resource(res);
 
 out:
-        unlock_system_sleep();
+        unlock_memory_hotplug();
         return ret;
 }
 EXPORT_SYMBOL_GPL(add_memory);
@@ -791,7 +808,7 @@ static int offline_pages(unsigned long start_pfn,
         if (!test_pages_in_a_zone(start_pfn, end_pfn))
                 return -EINVAL;
 
-        lock_system_sleep();
+        lock_memory_hotplug();
 
         zone = page_zone(pfn_to_page(start_pfn));
         node = zone_to_nid(zone);
@@ -880,7 +897,7 @@ repeat:
         writeback_set_ratelimit();
 
         memory_notify(MEM_OFFLINE, &arg);
-        unlock_system_sleep();
+        unlock_memory_hotplug();
         return 0;
 
 failed_removal:
@@ -891,7 +908,7 @@ failed_removal:
         undo_isolate_page_range(start_pfn, end_pfn);
 
 out:
-        unlock_system_sleep();
+        unlock_memory_hotplug();
         return ret;
 }
 
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 4a57f135b76e..11ff260fb282 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1307,15 +1307,18 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
                 goto out;
 
         /* Find the mm_struct */
+        rcu_read_lock();
         read_lock(&tasklist_lock);
         task = pid ? find_task_by_vpid(pid) : current;
         if (!task) {
                 read_unlock(&tasklist_lock);
+                rcu_read_unlock();
                 err = -ESRCH;
                 goto out;
         }
         mm = get_task_mm(task);
         read_unlock(&tasklist_lock);
+        rcu_read_unlock();
 
         err = -EINVAL;
         if (!mm)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e4092704c1a9..ff7e15872398 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -104,19 +104,24 @@ gfp_t gfp_allowed_mask __read_mostly = GFP_BOOT_MASK;
  * only be modified with pm_mutex held, unless the suspend/hibernate code is
  * guaranteed not to run in parallel with that modification).
  */
-void set_gfp_allowed_mask(gfp_t mask)
+
+static gfp_t saved_gfp_mask;
+
+void pm_restore_gfp_mask(void)
 {
         WARN_ON(!mutex_is_locked(&pm_mutex));
-        gfp_allowed_mask = mask;
+        if (saved_gfp_mask) {
+                gfp_allowed_mask = saved_gfp_mask;
+                saved_gfp_mask = 0;
+        }
 }
 
-gfp_t clear_gfp_allowed_mask(gfp_t mask)
+void pm_restrict_gfp_mask(void)
 {
-        gfp_t ret = gfp_allowed_mask;
-
         WARN_ON(!mutex_is_locked(&pm_mutex));
-        gfp_allowed_mask &= ~mask;
-        return ret;
+        WARN_ON(saved_gfp_mask);
+        saved_gfp_mask = gfp_allowed_mask;
+        gfp_allowed_mask &= ~GFP_IOFS;
 }
 #endif /* CONFIG_PM_SLEEP */
 
diff --git a/mm/slub.c b/mm/slub.c
index 981fb730aa04..bec0e355fbad 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3401,13 +3401,13 @@ static int validate_slab(struct kmem_cache *s, struct page *page,
 
         for_each_free_object(p, s, page->freelist) {
                 set_bit(slab_index(p, s, addr), map);
-                if (!check_object(s, page, p, 0))
+                if (!check_object(s, page, p, SLUB_RED_INACTIVE))
                         return 0;
         }
 
         for_each_object(p, s, addr, page->objects)
                 if (!test_bit(slab_index(p, s, addr), map))
-                        if (!check_object(s, page, p, 1))
+                        if (!check_object(s, page, p, SLUB_RED_ACTIVE))
                                 return 0;
         return 1;
 }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index a3d66b3dc5cb..eb5cc7d00c5a 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -31,8 +31,6 @@
 #include <asm/tlbflush.h>
 #include <asm/shmparam.h>
 
-bool vmap_lazy_unmap __read_mostly = true;
-
 /*** Page table manipulation functions ***/
 
 static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
@@ -503,9 +501,6 @@ static unsigned long lazy_max_pages(void)
 {
         unsigned int log;
 
-        if (!vmap_lazy_unmap)
-                return 0;
-
         log = fls(num_online_cpus());
 
         return log * (32UL * 1024 * 1024 / PAGE_SIZE);
@@ -566,7 +561,6 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
                         if (va->va_end > *end)
                                 *end = va->va_end;
                         nr += (va->va_end - va->va_start) >> PAGE_SHIFT;
-                        unmap_vmap_area(va);
                         list_add_tail(&va->purge_list, &valist);
                         va->flags |= VM_LAZY_FREEING;
                         va->flags &= ~VM_LAZY_FREE;
@@ -611,10 +605,11 @@ static void purge_vmap_area_lazy(void)
 }
 
 /*
- * Free and unmap a vmap area, caller ensuring flush_cache_vunmap had been
- * called for the correct range previously.
+ * Free a vmap area, caller ensuring that the area has been unmapped
+ * and flush_cache_vunmap had been called for the correct range
+ * previously.
  */
-static void free_unmap_vmap_area_noflush(struct vmap_area *va)
+static void free_vmap_area_noflush(struct vmap_area *va)
 {
         va->flags |= VM_LAZY_FREE;
         atomic_add((va->va_end - va->va_start) >> PAGE_SHIFT, &vmap_lazy_nr);
@@ -623,6 +618,16 @@ static void free_unmap_vmap_area_noflush(struct vmap_area *va)
 }
 
 /*
+ * Free and unmap a vmap area, caller ensuring flush_cache_vunmap had been
+ * called for the correct range previously.
+ */
+static void free_unmap_vmap_area_noflush(struct vmap_area *va)
+{
+        unmap_vmap_area(va);
+        free_vmap_area_noflush(va);
+}
+
+/*
  * Free and unmap a vmap area
  */
 static void free_unmap_vmap_area(struct vmap_area *va)
@@ -798,7 +803,7 @@ static void free_vmap_block(struct vmap_block *vb)
         spin_unlock(&vmap_block_tree_lock);
         BUG_ON(tmp != vb);
 
-        free_unmap_vmap_area_noflush(vb->va);
+        free_vmap_area_noflush(vb->va);
         call_rcu(&vb->rcu_head, rcu_free_vb);
 }
 
@@ -936,6 +941,8 @@ static void vb_free(const void *addr, unsigned long size)
         rcu_read_unlock();
         BUG_ON(!vb);
 
+        vunmap_page_range((unsigned long)addr, (unsigned long)addr + size);
+
         spin_lock(&vb->lock);
         BUG_ON(bitmap_allocate_region(vb->dirty_map, offset >> PAGE_SHIFT, order));
 
@@ -988,7 +995,6 @@ void vm_unmap_aliases(void)
 
                                 s = vb->va->va_start + (i << PAGE_SHIFT);
                                 e = vb->va->va_start + (j << PAGE_SHIFT);
-                                vunmap_page_range(s, e);
                                 flush = 1;
 
                                 if (s < start)
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 42eac4d33216..8f62f17ee1c7 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -750,8 +750,6 @@ static const char * const vmstat_text[] = {
         "nr_shmem",
         "nr_dirtied",
         "nr_written",
-        "nr_dirty_threshold",
-        "nr_dirty_background_threshold",
 
 #ifdef CONFIG_NUMA
         "numa_hit",
@@ -761,6 +759,8 @@ static const char * const vmstat_text[] = {
         "numa_local",
         "numa_other",
 #endif
+        "nr_dirty_threshold",
+        "nr_dirty_background_threshold",
 
 #ifdef CONFIG_VM_EVENT_COUNTERS
         "pgpgin",