8 files changed, 47 insertions, 29 deletions

diff --git a/mm/frontswap.c b/mm/frontswap.c
index 538367ef1372..1b24bdcb3197 100644
--- a/mm/frontswap.c
+++ b/mm/frontswap.c
@@ -319,7 +319,7 @@ void __frontswap_invalidate_area(unsigned type)
                         return;
                 frontswap_ops->invalidate_area(type);
                 atomic_set(&sis->frontswap_pages, 0);
-                memset(sis->frontswap_map, 0, sis->max / sizeof(long));
+                bitmap_zero(sis->frontswap_map, sis->max);
         }
         clear_bit(type, need_init);
 }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index f8feeeca6686..e2bfbf73a551 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2839,7 +2839,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         if (ptep) {
                 entry = huge_ptep_get(ptep);
                 if (unlikely(is_hugetlb_entry_migration(entry))) {
-                        migration_entry_wait(mm, (pmd_t *)ptep, address);
+                        migration_entry_wait_huge(mm, ptep);
                         return 0;
                 } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
                         return VM_FAULT_HWPOISON_LARGE |
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 010d6c14129a..194721839cf5 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1199,7 +1199,6 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
 
                         mz = mem_cgroup_zoneinfo(root, nid, zid);
                         iter = &mz->reclaim_iter[reclaim->priority];
-                        last_visited = iter->last_visited;
                         if (prev && reclaim->generation != iter->generation) {
                                 iter->last_visited = NULL;
                                 goto out_unlock;
@@ -1218,13 +1217,12 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
                          * is alive.
                          */
                         dead_count = atomic_read(&root->dead_count);
-                        smp_rmb();
-                        last_visited = iter->last_visited;
-                        if (last_visited) {
-                                if ((dead_count != iter->last_dead_count) ||
-                                        !css_tryget(&last_visited->css)) {
+                        if (dead_count == iter->last_dead_count) {
+                                smp_rmb();
+                                last_visited = iter->last_visited;
+                                if (last_visited &&
+                                    !css_tryget(&last_visited->css))
                                         last_visited = NULL;
-                                }
                         }
                 }
 
@@ -3141,8 +3139,6 @@ int memcg_update_cache_size(struct kmem_cache *s, int num_groups)
                         return -ENOMEM;
                 }
 
-                INIT_WORK(&s->memcg_params->destroy,
-                                kmem_cache_destroy_work_func);
                 s->memcg_params->is_root_cache = true;
 
                 /*
diff --git a/mm/memory.c b/mm/memory.c
index 6dc1882fbd72..61a262b08e53 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -220,7 +220,6 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, bool fullmm)
         tlb->start      = -1UL;
         tlb->end        = 0;
         tlb->need_flush = 0;
-        tlb->fast_mode  = (num_possible_cpus() == 1);
         tlb->local.next = NULL;
         tlb->local.nr   = 0;
         tlb->local.max  = ARRAY_SIZE(tlb->__pages);
@@ -244,9 +243,6 @@ void tlb_flush_mmu(struct mmu_gather *tlb)
         tlb_table_flush(tlb);
 #endif
 
-        if (tlb_fast_mode(tlb))
-                return;
-
         for (batch = &tlb->local; batch; batch = batch->next) {
                 free_pages_and_swap_cache(batch->pages, batch->nr);
                 batch->nr = 0;
@@ -288,11 +284,6 @@ int __tlb_remove_page(struct mmu_gather *tlb, struct page *page)
 
         VM_BUG_ON(!tlb->need_flush);
 
-        if (tlb_fast_mode(tlb)) {
-                free_page_and_swap_cache(page);
-                return 1; /* avoid calling tlb_flush_mmu() */
-        }
-
         batch = tlb->active;
         batch->pages[batch->nr++] = page;
         if (batch->nr == batch->max) {
diff --git a/mm/migrate.c b/mm/migrate.c
index b1f57501de9c..6f0c24438bba 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -200,15 +200,14 @@ static void remove_migration_ptes(struct page *old, struct page *new)
  * get to the page and wait until migration is finished.
  * When we return from this function the fault will be retried.
  */
-void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
-                                unsigned long address)
+static void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
+                                spinlock_t *ptl)
 {
-        pte_t *ptep, pte;
-        spinlock_t *ptl;
+        pte_t pte;
         swp_entry_t entry;
         struct page *page;
 
-        ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
+        spin_lock(ptl);
         pte = *ptep;
         if (!is_swap_pte(pte))
                 goto out;
@@ -236,6 +235,20 @@ out:
         pte_unmap_unlock(ptep, ptl);
 }
 
+void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
+                                unsigned long address)
+{
+        spinlock_t *ptl = pte_lockptr(mm, pmd);
+        pte_t *ptep = pte_offset_map(pmd, address);
+        __migration_entry_wait(mm, ptep, ptl);
+}
+
+void migration_entry_wait_huge(struct mm_struct *mm, pte_t *pte)
+{
+        spinlock_t *ptl = &(mm)->page_table_lock;
+        __migration_entry_wait(mm, pte, ptl);
+}
+
 #ifdef CONFIG_BLOCK
 /* Returns true if all buffers are successfully locked */
 static bool buffer_migrate_lock_buffers(struct buffer_head *head,
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 378a15bcd649..c3edb624fccf 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1628,6 +1628,7 @@ static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark,
         long min = mark;
         long lowmem_reserve = z->lowmem_reserve[classzone_idx];
         int o;
+        long free_cma = 0;
 
         free_pages -= (1 << order) - 1;
         if (alloc_flags & ALLOC_HIGH)
@@ -1637,9 +1638,10 @@ static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark,
 #ifdef CONFIG_CMA
         /* If allocation can't use CMA areas don't use free CMA pages */
         if (!(alloc_flags & ALLOC_CMA))
-                free_pages -= zone_page_state(z, NR_FREE_CMA_PAGES);
+                free_cma = zone_page_state(z, NR_FREE_CMA_PAGES);
 #endif
-        if (free_pages <= min + lowmem_reserve)
+
+        if (free_pages - free_cma <= min + lowmem_reserve)
                 return false;
         for (o = 0; o < order; o++) {
                 /* At the next order, this order's pages become unavailable */
diff --git a/mm/swap_state.c b/mm/swap_state.c
index b3d40dcf3624..f24ab0dff554 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -336,8 +336,24 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                  * Swap entry may have been freed since our caller observed it.
                  */
                 err = swapcache_prepare(entry);
-                if (err == -EEXIST) {   /* seems racy */
+                if (err == -EEXIST) {
                         radix_tree_preload_end();
+                        /*
+                         * We might race against get_swap_page() and stumble
+                         * across a SWAP_HAS_CACHE swap_map entry whose page
+                         * has not been brought into the swapcache yet, while
+                         * the other end is scheduled away waiting on discard
+                         * I/O completion at scan_swap_map().
+                         *
+                         * In order to avoid turning this transitory state
+                         * into a permanent loop around this -EEXIST case
+                         * if !CONFIG_PREEMPT and the I/O completion happens
+                         * to be waiting on the CPU waitqueue where we are now
+                         * busy looping, we just conditionally invoke the
+                         * scheduler here, if there are some more important
+                         * tasks to run.
+                         */
+                        cond_resched();
                         continue;
                 }
                 if (err) {              /* swp entry is obsolete ? */
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 6c340d908b27..746af55b8455 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2116,7 +2116,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
         }
         /* frontswap enabled? set up bit-per-page map for frontswap */
         if (frontswap_enabled)
-                frontswap_map = vzalloc(maxpages / sizeof(long));
+                frontswap_map = vzalloc(BITS_TO_LONGS(maxpages) * sizeof(long));
 
         if (p->bdev) {
                 if (blk_queue_nonrot(bdev_get_queue(p->bdev))) {