15 files changed, 182 insertions, 120 deletions

diff --git a/mm/filemap.c b/mm/filemap.c
index dafb06f70a09..65d44fd88c78 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -241,18 +241,6 @@ void delete_from_page_cache(struct page *page)
 }
 EXPORT_SYMBOL(delete_from_page_cache);
 
-static int sleep_on_page(void *word)
-{
-        io_schedule();
-        return 0;
-}
-
-static int sleep_on_page_killable(void *word)
-{
-        sleep_on_page(word);
-        return fatal_signal_pending(current) ? -EINTR : 0;
-}
-
 static int filemap_check_errors(struct address_space *mapping)
 {
         int ret = 0;
@@ -692,7 +680,7 @@ void wait_on_page_bit(struct page *page, int bit_nr)
         DEFINE_WAIT_BIT(wait, &page->flags, bit_nr);
 
         if (test_bit(bit_nr, &page->flags))
-                __wait_on_bit(page_waitqueue(page), &wait, sleep_on_page,
+                __wait_on_bit(page_waitqueue(page), &wait, bit_wait_io,
                                                         TASK_UNINTERRUPTIBLE);
 }
 EXPORT_SYMBOL(wait_on_page_bit);
@@ -705,7 +693,7 @@ int wait_on_page_bit_killable(struct page *page, int bit_nr)
                 return 0;
 
         return __wait_on_bit(page_waitqueue(page), &wait,
-                             sleep_on_page_killable, TASK_KILLABLE);
+                             bit_wait_io, TASK_KILLABLE);
 }
 
 /**
@@ -806,7 +794,7 @@ void __lock_page(struct page *page)
 {
         DEFINE_WAIT_BIT(wait, &page->flags, PG_locked);
 
-        __wait_on_bit_lock(page_waitqueue(page), &wait, sleep_on_page,
+        __wait_on_bit_lock(page_waitqueue(page), &wait, bit_wait_io,
                                                         TASK_UNINTERRUPTIBLE);
 }
 EXPORT_SYMBOL(__lock_page);
@@ -816,7 +804,7 @@ int __lock_page_killable(struct page *page)
         DEFINE_WAIT_BIT(wait, &page->flags, PG_locked);
 
         return __wait_on_bit_lock(page_waitqueue(page), &wait,
-                                        sleep_on_page_killable, TASK_KILLABLE);
+                                        bit_wait_io, TASK_KILLABLE);
 }
 EXPORT_SYMBOL_GPL(__lock_page_killable);
 
@@ -1031,18 +1019,21 @@ EXPORT_SYMBOL(find_lock_entry);
  * @mapping: the address_space to search
  * @offset: the page index
  * @fgp_flags: PCG flags
- * @gfp_mask: gfp mask to use if a page is to be allocated
+ * @cache_gfp_mask: gfp mask to use for the page cache data page allocation
+ * @radix_gfp_mask: gfp mask to use for radix tree node allocation
  *
  * Looks up the page cache slot at @mapping & @offset.
  *
- * PCG flags modify how the page is returned
+ * PCG flags modify how the page is returned.
  *
  * FGP_ACCESSED: the page will be marked accessed
  * FGP_LOCK: Page is return locked
  * FGP_CREAT: If page is not present then a new page is allocated using
- *              @gfp_mask and added to the page cache and the VM's LRU
- *              list. The page is returned locked and with an increased
- *              refcount. Otherwise, %NULL is returned.
+ *              @cache_gfp_mask and added to the page cache and the VM's LRU
+ *              list. If radix tree nodes are allocated during page cache
+ *              insertion then @radix_gfp_mask is used. The page is returned
+ *              locked and with an increased refcount. Otherwise, %NULL is
+ *              returned.
  *
  * If FGP_LOCK or FGP_CREAT are specified then the function may sleep even
  * if the GFP flags specified for FGP_CREAT are atomic.
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 2024bbd573d2..7a0a73d2fcff 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -856,7 +856,7 @@ struct hstate *size_to_hstate(unsigned long size)
         return NULL;
 }
 
-static void free_huge_page(struct page *page)
+void free_huge_page(struct page *page)
 {
         /*
          * Can't pass hstate in here because it is called from the
@@ -2604,6 +2604,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                 } else {
                         if (cow)
                                 huge_ptep_set_wrprotect(src, addr, src_pte);
+                        entry = huge_ptep_get(src_pte);
                         ptepage = pte_page(entry);
                         get_page(ptepage);
                         page_dup_rmap(ptepage);
diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index 493f758445e7..9aae6f47433f 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -358,9 +358,8 @@ static void __init __hugetlb_cgroup_file_init(int idx)
         cft = &h->cgroup_files[4];
         memset(cft, 0, sizeof(*cft));
 
-        WARN_ON(cgroup_add_cftypes(&hugetlb_cgrp_subsys, h->cgroup_files));
-
-        return;
+        WARN_ON(cgroup_add_legacy_cftypes(&hugetlb_cgrp_subsys,
+                                          h->cgroup_files));
 }
 
 void __init hugetlb_cgroup_file_init(void)
diff --git a/mm/ksm.c b/mm/ksm.c
index 346ddc9e4c0d..fb7590222706 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1978,18 +1978,12 @@ void ksm_migrate_page(struct page *newpage, struct page *oldpage)
 #endif /* CONFIG_MIGRATION */
 
 #ifdef CONFIG_MEMORY_HOTREMOVE
-static int just_wait(void *word)
-{
-        schedule();
-        return 0;
-}
-
 static void wait_while_offlining(void)
 {
         while (ksm_run & KSM_RUN_OFFLINE) {
                 mutex_unlock(&ksm_thread_mutex);
                 wait_on_bit(&ksm_run, ilog2(KSM_RUN_OFFLINE),
-                                just_wait, TASK_UNINTERRUPTIBLE);
+                            TASK_UNINTERRUPTIBLE);
                 mutex_lock(&ksm_thread_mutex);
         }
 }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index a2c7bcb0e6eb..f009a14918d2 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5415,8 +5415,12 @@ static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
 {
         struct mem_cgroup_eventfd_list *ev;
 
+        spin_lock(&memcg_oom_lock);
+
         list_for_each_entry(ev, &memcg->oom_notify, list)
                 eventfd_signal(ev->eventfd, 1);
+
+        spin_unlock(&memcg_oom_lock);
         return 0;
 }
 
@@ -6003,7 +6007,6 @@ static struct cftype mem_cgroup_files[] = {
         },
         {
                 .name = "use_hierarchy",
-                .flags = CFTYPE_INSANE,
                 .write_u64 = mem_cgroup_hierarchy_write,
                 .read_u64 = mem_cgroup_hierarchy_read,
         },
@@ -6407,6 +6410,29 @@ static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
         __mem_cgroup_free(memcg);
 }
 
+/**
+ * mem_cgroup_css_reset - reset the states of a mem_cgroup
+ * @css: the target css
+ *
+ * Reset the states of the mem_cgroup associated with @css.  This is
+ * invoked when the userland requests disabling on the default hierarchy
+ * but the memcg is pinned through dependency.  The memcg should stop
+ * applying policies and should revert to the vanilla state as it may be
+ * made visible again.
+ *
+ * The current implementation only resets the essential configurations.
+ * This needs to be expanded to cover all the visible parts.
+ */
+static void mem_cgroup_css_reset(struct cgroup_subsys_state *css)
+{
+        struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+
+        mem_cgroup_resize_limit(memcg, ULLONG_MAX);
+        mem_cgroup_resize_memsw_limit(memcg, ULLONG_MAX);
+        memcg_update_kmem_limit(memcg, ULLONG_MAX);
+        res_counter_set_soft_limit(&memcg->res, ULLONG_MAX);
+}
+
 #ifdef CONFIG_MMU
 /* Handlers for move charge at task migration. */
 #define PRECHARGE_COUNT_AT_ONCE 256
@@ -7001,16 +7027,17 @@ static void mem_cgroup_move_task(struct cgroup_subsys_state *css,
 
 /*
  * Cgroup retains root cgroups across [un]mount cycles making it necessary
- * to verify sane_behavior flag on each mount attempt.
+ * to verify whether we're attached to the default hierarchy on each mount
+ * attempt.
  */
 static void mem_cgroup_bind(struct cgroup_subsys_state *root_css)
 {
         /*
-         * use_hierarchy is forced with sane_behavior.  cgroup core
+         * use_hierarchy is forced on the default hierarchy.  cgroup core
          * guarantees that @root doesn't have any children, so turning it
          * on for the root memcg is enough.
          */
-        if (cgroup_sane_behavior(root_css->cgroup))
+        if (cgroup_on_dfl(root_css->cgroup))
                 mem_cgroup_from_css(root_css)->use_hierarchy = true;
 }
 
@@ -7019,11 +7046,12 @@ struct cgroup_subsys memory_cgrp_subsys = {
         .css_online = mem_cgroup_css_online,
         .css_offline = mem_cgroup_css_offline,
         .css_free = mem_cgroup_css_free,
+        .css_reset = mem_cgroup_css_reset,
         .can_attach = mem_cgroup_can_attach,
         .cancel_attach = mem_cgroup_cancel_attach,
         .attach = mem_cgroup_move_task,
         .bind = mem_cgroup_bind,
-        .base_cftypes = mem_cgroup_files,
+        .legacy_cftypes = mem_cgroup_files,
         .early_init = 0,
 };
 
@@ -7040,7 +7068,8 @@ __setup("swapaccount=", enable_swap_account);
 
 static void __init memsw_file_init(void)
 {
-        WARN_ON(cgroup_add_cftypes(&memory_cgrp_subsys, memsw_cgroup_files));
+        WARN_ON(cgroup_add_legacy_cftypes(&memory_cgrp_subsys,
+                                          memsw_cgroup_files));
 }
 
 static void __init enable_swap_cgroup(void)
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index c6399e328931..a013bc94ebbe 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -435,7 +435,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill,
         if (av == NULL) /* Not actually mapped anymore */
                 return;
 
-        pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+        pgoff = page_to_pgoff(page);
         read_lock(&tasklist_lock);
         for_each_process (tsk) {
                 struct anon_vma_chain *vmac;
@@ -469,7 +469,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill,
         mutex_lock(&mapping->i_mmap_mutex);
         read_lock(&tasklist_lock);
         for_each_process(tsk) {
-                pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+                pgoff_t pgoff = page_to_pgoff(page);
                 struct task_struct *t = task_early_kill(tsk, force_early);
 
                 if (!t)
@@ -895,7 +895,13 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
         struct page *hpage = *hpagep;
         struct page *ppage;
 
-        if (PageReserved(p) || PageSlab(p) || !PageLRU(p))
+        /*
+         * Here we are interested only in user-mapped pages, so skip any
+         * other types of pages.
+         */
+        if (PageReserved(p) || PageSlab(p))
+                return SWAP_SUCCESS;
+        if (!(PageLRU(hpage) || PageHuge(p)))
                 return SWAP_SUCCESS;
 
         /*
@@ -905,8 +911,10 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
         if (!page_mapped(hpage))
                 return SWAP_SUCCESS;
 
-        if (PageKsm(p))
+        if (PageKsm(p)) {
+                pr_err("MCE %#lx: can't handle KSM pages.\n", pfn);
                 return SWAP_FAIL;
+        }
 
         if (PageSwapCache(p)) {
                 printk(KERN_ERR
@@ -1229,7 +1237,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
          */
         if (hwpoison_user_mappings(p, pfn, trapno, flags, &hpage)
             != SWAP_SUCCESS) {
-                printk(KERN_ERR "MCE %#lx: cannot unmap page, give up\n", pfn);
+                action_result(pfn, "unmapping failed", IGNORED);
                 res = -EBUSY;
                 goto out;
         }
diff --git a/mm/memory.c b/mm/memory.c
index d67fd9fcf1f2..8b44f765b645 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2758,23 +2758,18 @@ void do_set_pte(struct vm_area_struct *vma, unsigned long address,
         update_mmu_cache(vma, address, pte);
 }
 
-static unsigned long fault_around_bytes = 65536;
+static unsigned long fault_around_bytes = rounddown_pow_of_two(65536);
 
-/*
- * fault_around_pages() and fault_around_mask() round down fault_around_bytes
- * to nearest page order. It's what do_fault_around() expects to see.
- */
 static inline unsigned long fault_around_pages(void)
 {
-        return rounddown_pow_of_two(fault_around_bytes) / PAGE_SIZE;
+        return fault_around_bytes >> PAGE_SHIFT;
 }
 
 static inline unsigned long fault_around_mask(void)
 {
-        return ~(rounddown_pow_of_two(fault_around_bytes) - 1) & PAGE_MASK;
+        return ~(fault_around_bytes - 1) & PAGE_MASK;
 }
 
-
 #ifdef CONFIG_DEBUG_FS
 static int fault_around_bytes_get(void *data, u64 *val)
 {
@@ -2782,11 +2777,19 @@ static int fault_around_bytes_get(void *data, u64 *val)
         return 0;
 }
 
+/*
+ * fault_around_pages() and fault_around_mask() expects fault_around_bytes
+ * rounded down to nearest page order. It's what do_fault_around() expects to
+ * see.
+ */
 static int fault_around_bytes_set(void *data, u64 val)
 {
         if (val / PAGE_SIZE > PTRS_PER_PTE)
                 return -EINVAL;
-        fault_around_bytes = val;
+        if (val > PAGE_SIZE)
+                fault_around_bytes = rounddown_pow_of_two(val);
+        else
+                fault_around_bytes = PAGE_SIZE; /* rounddown_pow_of_two(0) is undefined */
         return 0;
 }
 DEFINE_SIMPLE_ATTRIBUTE(fault_around_bytes_fops,
@@ -2882,7 +2885,8 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
          * if page by the offset is not ready to be mapped (cold cache or
          * something).
          */
-        if (vma->vm_ops->map_pages && fault_around_pages() > 1) {
+        if (vma->vm_ops->map_pages && !(flags & FAULT_FLAG_NONLINEAR) &&
+            fault_around_pages() > 1) {
                 pte = pte_offset_map_lock(mm, pmd, address, &ptl);
                 do_fault_around(vma, address, pte, pgoff, flags);
                 if (!pte_same(*pte, orig_pte))
diff --git a/mm/migrate.c b/mm/migrate.c
index 9e0beaa91845..be6dbf995c0c 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -988,9 +988,10 @@ out:
          * it.  Otherwise, putback_lru_page() will drop the reference grabbed
          * during isolation.
          */
-        if (rc != MIGRATEPAGE_SUCCESS && put_new_page)
+        if (rc != MIGRATEPAGE_SUCCESS && put_new_page) {
+                ClearPageSwapBacked(newpage);
                 put_new_page(newpage, private);
-        else
+        } else
                 putback_lru_page(newpage);
 
         if (result) {
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 518e2c3f4c75..e0c943014eb7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1306,9 +1306,9 @@ static inline void bdi_dirty_limits(struct backing_dev_info *bdi,
         *bdi_thresh = bdi_dirty_limit(bdi, dirty_thresh);
 
         if (bdi_bg_thresh)
-                *bdi_bg_thresh = div_u64((u64)*bdi_thresh *
-                                         background_thresh,
-                                         dirty_thresh);
+                *bdi_bg_thresh = dirty_thresh ? div_u64((u64)*bdi_thresh *
+                                                        background_thresh,
+                                                        dirty_thresh) : 0;
 
         /*
          * In order to avoid the stacked BDI deadlock we need
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 0ea758b898fd..ef44ad736ca1 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2447,7 +2447,7 @@ static inline int
 gfp_to_alloc_flags(gfp_t gfp_mask)
 {
         int alloc_flags = ALLOC_WMARK_MIN | ALLOC_CPUSET;
-        const gfp_t wait = gfp_mask & __GFP_WAIT;
+        const bool atomic = !(gfp_mask & (__GFP_WAIT | __GFP_NO_KSWAPD));
 
         /* __GFP_HIGH is assumed to be the same as ALLOC_HIGH to save a branch. */
         BUILD_BUG_ON(__GFP_HIGH != (__force gfp_t) ALLOC_HIGH);
@@ -2456,20 +2456,20 @@ gfp_to_alloc_flags(gfp_t gfp_mask)
          * The caller may dip into page reserves a bit more if the caller
          * cannot run direct reclaim, or if the caller has realtime scheduling
          * policy or is asking for __GFP_HIGH memory.  GFP_ATOMIC requests will
-         * set both ALLOC_HARDER (!wait) and ALLOC_HIGH (__GFP_HIGH).
+         * set both ALLOC_HARDER (atomic == true) and ALLOC_HIGH (__GFP_HIGH).
          */
         alloc_flags |= (__force int) (gfp_mask & __GFP_HIGH);
 
-        if (!wait) {
+        if (atomic) {
                 /*
-                 * Not worth trying to allocate harder for
-                 * __GFP_NOMEMALLOC even if it can't schedule.
+                 * Not worth trying to allocate harder for __GFP_NOMEMALLOC even
+                 * if it can't schedule.
                  */
-                if  (!(gfp_mask & __GFP_NOMEMALLOC))
+                if (!(gfp_mask & __GFP_NOMEMALLOC))
                         alloc_flags |= ALLOC_HARDER;
                 /*
-                 * Ignore cpuset if GFP_ATOMIC (!wait) rather than fail alloc.
-                 * See also cpuset_zone_allowed() comment in kernel/cpuset.c.
+                 * Ignore cpuset mems for GFP_ATOMIC rather than fail, see the
+                 * comment for __cpuset_node_allowed_softwall().
                  */
                 alloc_flags &= ~ALLOC_CPUSET;
         } else if (unlikely(rt_task(current)) && !in_interrupt())
@@ -6062,11 +6062,13 @@ static inline int pfn_to_bitidx(struct zone *zone, unsigned long pfn)
 }
 
 /**
- * get_pageblock_flags_group - Return the requested group of flags for the pageblock_nr_pages block of pages
+ * get_pfnblock_flags_mask - Return the requested group of flags for the pageblock_nr_pages block of pages
  * @page: The page within the block of interest
- * @start_bitidx: The first bit of interest to retrieve
- * @end_bitidx: The last bit of interest
- * returns pageblock_bits flags
+ * @pfn: The target page frame number
+ * @end_bitidx: The last bit of interest to retrieve
+ * @mask: mask of bits that the caller is interested in
+ *
+ * Return: pageblock_bits flags
  */
 unsigned long get_pfnblock_flags_mask(struct page *page, unsigned long pfn,
                                         unsigned long end_bitidx,
@@ -6091,9 +6093,10 @@ unsigned long get_pfnblock_flags_mask(struct page *page, unsigned long pfn,
 /**
  * set_pfnblock_flags_mask - Set the requested group of flags for a pageblock_nr_pages block of pages
  * @page: The page within the block of interest
- * @start_bitidx: The first bit of interest
- * @end_bitidx: The last bit of interest
  * @flags: The flags to set
+ * @pfn: The target page frame number
+ * @end_bitidx: The last bit of interest
+ * @mask: mask of bits that the caller is interested in
  */
 void set_pfnblock_flags_mask(struct page *page, unsigned long flags,
                                         unsigned long pfn,
diff --git a/mm/percpu.c b/mm/percpu.c
index 2ddf9a990dbd..2139e30a4b44 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -720,8 +720,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved)
         if (unlikely(align < 2))
                 align = 2;
 
-        if (unlikely(size & 1))
-                size++;
+        size = ALIGN(size, 2);
 
         if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE)) {
                 WARN(true, "illegal size (%zu) or align (%zu) for "
diff --git a/mm/rmap.c b/mm/rmap.c
index b7e94ebbd09e..22a4a7699cdb 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -517,11 +517,7 @@ void page_unlock_anon_vma_read(struct anon_vma *anon_vma)
 static inline unsigned long
 __vma_address(struct page *page, struct vm_area_struct *vma)
 {
-        pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
-
-        if (unlikely(is_vm_hugetlb_page(vma)))
-                pgoff = page->index << huge_page_order(page_hstate(page));
-
+        pgoff_t pgoff = page_to_pgoff(page);
         return vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
 }
 
@@ -1639,7 +1635,7 @@ static struct anon_vma *rmap_walk_anon_lock(struct page *page,
 static int rmap_walk_anon(struct page *page, struct rmap_walk_control *rwc)
 {
         struct anon_vma *anon_vma;
-        pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+        pgoff_t pgoff = page_to_pgoff(page);
         struct anon_vma_chain *avc;
         int ret = SWAP_AGAIN;
 
@@ -1680,7 +1676,7 @@ static int rmap_walk_anon(struct page *page, struct rmap_walk_control *rwc)
 static int rmap_walk_file(struct page *page, struct rmap_walk_control *rwc)
 {
         struct address_space *mapping = page->mapping;
-        pgoff_t pgoff = page->index << compound_order(page);
+        pgoff_t pgoff = page_to_pgoff(page);
         struct vm_area_struct *vma;
         int ret = SWAP_AGAIN;
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 1140f49b6ded..af68b15a8fc1 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -85,7 +85,7 @@ static struct vfsmount *shm_mnt;
  * a time): we would prefer not to enlarge the shmem inode just for that.
  */
 struct shmem_falloc {
-        int     mode;           /* FALLOC_FL mode currently operating */
+        wait_queue_head_t *waitq; /* faults into hole wait for punch to end */
         pgoff_t start;          /* start of range currently being fallocated */
         pgoff_t next;           /* the next page offset to be fallocated */
         pgoff_t nr_falloced;    /* how many new pages have been fallocated */
@@ -468,23 +468,20 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend,
                 return;
 
         index = start;
-        for ( ; ; ) {
+        while (index < end) {
                 cond_resched();
 
                 pvec.nr = find_get_entries(mapping, index,
                                 min(end - index, (pgoff_t)PAGEVEC_SIZE),
                                 pvec.pages, indices);
                 if (!pvec.nr) {
-                        if (index == start || unfalloc)
+                        /* If all gone or hole-punch or unfalloc, we're done */
+                        if (index == start || end != -1)
                                 break;
+                        /* But if truncating, restart to make sure all gone */
                         index = start;
                         continue;
                 }
-                if ((index == start || unfalloc) && indices[0] >= end) {
-                        pagevec_remove_exceptionals(&pvec);
-                        pagevec_release(&pvec);
-                        break;
-                }
                 mem_cgroup_uncharge_start();
                 for (i = 0; i < pagevec_count(&pvec); i++) {
                         struct page *page = pvec.pages[i];
@@ -496,8 +493,12 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend,
                         if (radix_tree_exceptional_entry(page)) {
                                 if (unfalloc)
                                         continue;
-                                nr_swaps_freed += !shmem_free_swap(mapping,
-                                                                index, page);
+                                if (shmem_free_swap(mapping, index, page)) {
+                                        /* Swap was replaced by page: retry */
+                                        index--;
+                                        break;
+                                }
+                                nr_swaps_freed++;
                                 continue;
                         }
 
@@ -506,6 +507,11 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend,
                                 if (page->mapping == mapping) {
                                         VM_BUG_ON_PAGE(PageWriteback(page), page);
                                         truncate_inode_page(mapping, page);
+                                } else {
+                                        /* Page was replaced by swap: retry */
+                                        unlock_page(page);
+                                        index--;
+                                        break;
                                 }
                         }
                         unlock_page(page);
@@ -760,7 +766,7 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
                         spin_lock(&inode->i_lock);
                         shmem_falloc = inode->i_private;
                         if (shmem_falloc &&
-                            !shmem_falloc->mode &&
+                            !shmem_falloc->waitq &&
                             index >= shmem_falloc->start &&
                             index < shmem_falloc->next)
                                 shmem_falloc->nr_unswapped++;
@@ -1248,38 +1254,58 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
          * Trinity finds that probing a hole which tmpfs is punching can
          * prevent the hole-punch from ever completing: which in turn
          * locks writers out with its hold on i_mutex.  So refrain from
-         * faulting pages into the hole while it's being punched, and
-         * wait on i_mutex to be released if vmf->flags permits.
+         * faulting pages into the hole while it's being punched.  Although
+         * shmem_undo_range() does remove the additions, it may be unable to
+         * keep up, as each new page needs its own unmap_mapping_range() call,
+         * and the i_mmap tree grows ever slower to scan if new vmas are added.
+         *
+         * It does not matter if we sometimes reach this check just before the
+         * hole-punch begins, so that one fault then races with the punch:
+         * we just need to make racing faults a rare case.
+         *
+         * The implementation below would be much simpler if we just used a
+         * standard mutex or completion: but we cannot take i_mutex in fault,
+         * and bloating every shmem inode for this unlikely case would be sad.
          */
         if (unlikely(inode->i_private)) {
                 struct shmem_falloc *shmem_falloc;
 
                 spin_lock(&inode->i_lock);
                 shmem_falloc = inode->i_private;
-                if (!shmem_falloc ||
-                    shmem_falloc->mode != FALLOC_FL_PUNCH_HOLE ||
-                    vmf->pgoff < shmem_falloc->start ||
-                    vmf->pgoff >= shmem_falloc->next)
-                        shmem_falloc = NULL;
-                spin_unlock(&inode->i_lock);
-                /*
-                 * i_lock has protected us from taking shmem_falloc seriously
-                 * once return from shmem_fallocate() went back up that stack.
-                 * i_lock does not serialize with i_mutex at all, but it does
-                 * not matter if sometimes we wait unnecessarily, or sometimes
-                 * miss out on waiting: we just need to make those cases rare.
-                 */
-                if (shmem_falloc) {
+                if (shmem_falloc &&
+                    shmem_falloc->waitq &&
+                    vmf->pgoff >= shmem_falloc->start &&
+                    vmf->pgoff < shmem_falloc->next) {
+                        wait_queue_head_t *shmem_falloc_waitq;
+                        DEFINE_WAIT(shmem_fault_wait);
+
+                        ret = VM_FAULT_NOPAGE;
                         if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
                            !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
+                                /* It's polite to up mmap_sem if we can */
                                 up_read(&vma->vm_mm->mmap_sem);
-                                mutex_lock(&inode->i_mutex);
-                                mutex_unlock(&inode->i_mutex);
-                                return VM_FAULT_RETRY;
+                                ret = VM_FAULT_RETRY;
                         }
-                        /* cond_resched? Leave that to GUP or return to user */
-                        return VM_FAULT_NOPAGE;
+
+                        shmem_falloc_waitq = shmem_falloc->waitq;
+                        prepare_to_wait(shmem_falloc_waitq, &shmem_fault_wait,
+                                        TASK_UNINTERRUPTIBLE);
+                        spin_unlock(&inode->i_lock);
+                        schedule();
+
+                        /*
+                         * shmem_falloc_waitq points into the shmem_fallocate()
+                         * stack of the hole-punching task: shmem_falloc_waitq
+                         * is usually invalid by the time we reach here, but
+                         * finish_wait() does not dereference it in that case;
+                         * though i_lock needed lest racing with wake_up_all().
+                         */
+                        spin_lock(&inode->i_lock);
+                        finish_wait(shmem_falloc_waitq, &shmem_fault_wait);
+                        spin_unlock(&inode->i_lock);
+                        return ret;
                 }
+                spin_unlock(&inode->i_lock);
         }
 
         error = shmem_getpage(inode, vmf->pgoff, &vmf->page, SGP_CACHE, &ret);
@@ -1774,13 +1800,13 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
 
         mutex_lock(&inode->i_mutex);
 
-        shmem_falloc.mode = mode & ~FALLOC_FL_KEEP_SIZE;
-
         if (mode & FALLOC_FL_PUNCH_HOLE) {
                 struct address_space *mapping = file->f_mapping;
                 loff_t unmap_start = round_up(offset, PAGE_SIZE);
                 loff_t unmap_end = round_down(offset + len, PAGE_SIZE) - 1;
+                DECLARE_WAIT_QUEUE_HEAD_ONSTACK(shmem_falloc_waitq);
 
+                shmem_falloc.waitq = &shmem_falloc_waitq;
                 shmem_falloc.start = unmap_start >> PAGE_SHIFT;
                 shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT;
                 spin_lock(&inode->i_lock);
@@ -1792,8 +1818,13 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
                                             1 + unmap_end - unmap_start, 0);
                 shmem_truncate_range(inode, offset, offset + len - 1);
                 /* No need to unmap again: hole-punching leaves COWed pages */
+
+                spin_lock(&inode->i_lock);
+                inode->i_private = NULL;
+                wake_up_all(&shmem_falloc_waitq);
+                spin_unlock(&inode->i_lock);
                 error = 0;
-                goto undone;
+                goto out;
         }
 
         /* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
@@ -1809,6 +1840,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
                 goto out;
         }
 
+        shmem_falloc.waitq = NULL;
         shmem_falloc.start = start;
         shmem_falloc.next  = start;
         shmem_falloc.nr_falloced = 0;
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 735e01a0db6f..d31c4bacc6a2 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -55,7 +55,7 @@ static int kmem_cache_sanity_check(const char *name, size_t size)
                         continue;
                 }
 
-#if !defined(CONFIG_SLUB) || !defined(CONFIG_SLUB_DEBUG_ON)
+#if !defined(CONFIG_SLUB)
                 if (!strcmp(s->name, name)) {
                         pr_err("%s (%s): Cache name already exists.\n",
                                __func__, name);
diff --git a/mm/truncate.c b/mm/truncate.c
index 6a78c814bebf..eda247307164 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -355,14 +355,16 @@ void truncate_inode_pages_range(struct address_space *mapping,
         for ( ; ; ) {
                 cond_resched();
                 if (!pagevec_lookup_entries(&pvec, mapping, index,
-                        min(end - index, (pgoff_t)PAGEVEC_SIZE),
-                        indices)) {
+                        min(end - index, (pgoff_t)PAGEVEC_SIZE), indices)) {
+                        /* If all gone from start onwards, we're done */
                         if (index == start)
                                 break;
+                        /* Otherwise restart to make sure all gone */
                         index = start;
                         continue;
                 }
                 if (index == start && indices[0] >= end) {
+                        /* All gone out of hole to be punched, we're done */
                         pagevec_remove_exceptionals(&pvec);
                         pagevec_release(&pvec);
                         break;
@@ -373,8 +375,11 @@ void truncate_inode_pages_range(struct address_space *mapping,
 
                         /* We rely upon deletion not changing page->index */
                         index = indices[i];
-                        if (index >= end)
+                        if (index >= end) {
+                                /* Restart punch to make sure all gone */
+                                index = start - 1;
                                 break;
+                        }
 
                         if (radix_tree_exceptional_entry(page)) {
                                 clear_exceptional_entry(mapping, index, page);