6 files changed, 56 insertions, 27 deletions

diff --git a/mm/filemap.c b/mm/filemap.c
index a82fbe4c9e8e..5020b280a771 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2581,7 +2581,6 @@ EXPORT_SYMBOL(generic_perform_write);
  * @iocb:       IO state structure (file, offset, etc.)
  * @iov:        vector with data to write
  * @nr_segs:    number of segments in the vector
- * @ppos:       position where to write
  *
  * This function does all the work needed for actually writing data to a
  * file. It does all basic checks, removes SUID from the file, updates
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 64635f5278ff..b4b1feba6472 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1536,16 +1536,23 @@ pmd_t *page_check_address_pmd(struct page *page,
                               enum page_check_address_pmd_flag flag,
                               spinlock_t **ptl)
 {
+        pgd_t *pgd;
+        pud_t *pud;
         pmd_t *pmd;
 
         if (address & ~HPAGE_PMD_MASK)
                 return NULL;
 
-        pmd = mm_find_pmd(mm, address);
-        if (!pmd)
+        pgd = pgd_offset(mm, address);
+        if (!pgd_present(*pgd))
                 return NULL;
+        pud = pud_offset(pgd, address);
+        if (!pud_present(*pud))
+                return NULL;
+        pmd = pmd_offset(pud, address);
+
         *ptl = pmd_lock(mm, pmd);
-        if (pmd_none(*pmd))
+        if (!pmd_present(*pmd))
                 goto unlock;
         if (pmd_page(*pmd) != page)
                 goto unlock;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index dd30f22b35e0..246192929a2d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1172,6 +1172,7 @@ static void return_unused_surplus_pages(struct hstate *h,
         while (nr_pages--) {
                 if (!free_pool_huge_page(h, &node_states[N_MEMORY], 1))
                         break;
+                cond_resched_lock(&hugetlb_lock);
         }
 }
 
diff --git a/mm/memory.c b/mm/memory.c
index d0f0bef3be48..037b812a9531 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -232,17 +232,18 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long
 #endif
 }
 
-void tlb_flush_mmu(struct mmu_gather *tlb)
+static void tlb_flush_mmu_tlbonly(struct mmu_gather *tlb)
 {
-        struct mmu_gather_batch *batch;
-
-        if (!tlb->need_flush)
-                return;
         tlb->need_flush = 0;
         tlb_flush(tlb);
 #ifdef CONFIG_HAVE_RCU_TABLE_FREE
         tlb_table_flush(tlb);
 #endif
+}
+
+static void tlb_flush_mmu_free(struct mmu_gather *tlb)
+{
+        struct mmu_gather_batch *batch;
 
         for (batch = &tlb->local; batch; batch = batch->next) {
                 free_pages_and_swap_cache(batch->pages, batch->nr);
@@ -251,6 +252,14 @@ void tlb_flush_mmu(struct mmu_gather *tlb)
         tlb->active = &tlb->local;
 }
 
+void tlb_flush_mmu(struct mmu_gather *tlb)
+{
+        if (!tlb->need_flush)
+                return;
+        tlb_flush_mmu_tlbonly(tlb);
+        tlb_flush_mmu_free(tlb);
+}
+
 /* tlb_finish_mmu
  *      Called at the end of the shootdown operation to free up any resources
  *      that were required.
@@ -1127,8 +1136,10 @@ again:
                         if (PageAnon(page))
                                 rss[MM_ANONPAGES]--;
                         else {
-                                if (pte_dirty(ptent))
+                                if (pte_dirty(ptent)) {
+                                        force_flush = 1;
                                         set_page_dirty(page);
+                                }
                                 if (pte_young(ptent) &&
                                     likely(!(vma->vm_flags & VM_SEQ_READ)))
                                         mark_page_accessed(page);
@@ -1137,9 +1148,10 @@ again:
                         page_remove_rmap(page);
                         if (unlikely(page_mapcount(page) < 0))
                                 print_bad_pte(vma, addr, ptent, page);
-                        force_flush = !__tlb_remove_page(tlb, page);
-                        if (force_flush)
+                        if (unlikely(!__tlb_remove_page(tlb, page))) {
+                                force_flush = 1;
                                 break;
+                        }
                         continue;
                 }
                 /*
@@ -1174,18 +1186,11 @@ again:
 
         add_mm_rss_vec(mm, rss);
         arch_leave_lazy_mmu_mode();
-        pte_unmap_unlock(start_pte, ptl);
 
-        /*
-         * mmu_gather ran out of room to batch pages, we break out of
-         * the PTE lock to avoid doing the potential expensive TLB invalidate
-         * and page-free while holding it.
-         */
+        /* Do the actual TLB flush before dropping ptl */
         if (force_flush) {
                 unsigned long old_end;
 
-                force_flush = 0;
-
                 /*
                  * Flush the TLB just for the previous segment,
                  * then update the range to be the remaining
@@ -1193,11 +1198,21 @@ again:
                  */
                 old_end = tlb->end;
                 tlb->end = addr;
-
-                tlb_flush_mmu(tlb);
-
+                tlb_flush_mmu_tlbonly(tlb);
                 tlb->start = addr;
                 tlb->end = old_end;
+        }
+        pte_unmap_unlock(start_pte, ptl);
+
+        /*
+         * If we forced a TLB flush (either due to running out of
+         * batch buffers or because we needed to flush dirty TLB
+         * entries before releasing the ptl), free the batched
+         * memory too. Restart if we didn't do everything.
+         */
+        if (force_flush) {
+                force_flush = 0;
+                tlb_flush_mmu_free(tlb);
 
                 if (addr != end)
                         goto again;
@@ -1955,12 +1970,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
                      unsigned long address, unsigned int fault_flags)
 {
         struct vm_area_struct *vma;
+        vm_flags_t vm_flags;
         int ret;
 
         vma = find_extend_vma(mm, address);
         if (!vma || address < vma->vm_start)
                 return -EFAULT;
 
+        vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
+        if (!(vm_flags & vma->vm_flags))
+                return -EFAULT;
+
         ret = handle_mm_fault(mm, vma, address, fault_flags);
         if (ret & VM_FAULT_ERROR) {
                 if (ret & VM_FAULT_OOM)
diff --git a/mm/vmacache.c b/mm/vmacache.c
index d4224b397c0e..1037a3bab505 100644
--- a/mm/vmacache.c
+++ b/mm/vmacache.c
@@ -81,10 +81,12 @@ struct vm_area_struct *vmacache_find(struct mm_struct *mm, unsigned long addr)
         for (i = 0; i < VMACACHE_SIZE; i++) {
                 struct vm_area_struct *vma = current->vmacache[i];
 
-                if (vma && vma->vm_start <= addr && vma->vm_end > addr) {
-                        BUG_ON(vma->vm_mm != mm);
+                if (!vma)
+                        continue;
+                if (WARN_ON_ONCE(vma->vm_mm != mm))
+                        break;
+                if (vma->vm_start <= addr && vma->vm_end > addr)
                         return vma;
-                }
         }
 
         return NULL;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 9b6497eda806..3f56c8deb3c0 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1158,7 +1158,7 @@ unsigned long reclaim_clean_pages_from_list(struct zone *zone,
                         TTU_UNMAP|TTU_IGNORE_ACCESS,
                         &dummy1, &dummy2, &dummy3, &dummy4, &dummy5, true);
         list_splice(&clean_pages, page_list);
-        __mod_zone_page_state(zone, NR_ISOLATED_FILE, -ret);
+        mod_zone_page_state(zone, NR_ISOLATED_FILE, -ret);
         return ret;
 }