From: Hugh Dickins <hugh@veritas.com>

The mem_cgroup_cache_charge in shmem_unuse_inode has been moved after the
radix_tree_preload, so generating a BUG: sleeping function called from
invalid context.  Move it back, uncharging where necessary.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Acked-by: Balbir Singh <balbir@linux.vnet.ibm.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Li Zefan <lizf@cn.fujitsu.com>
Cc: YAMAMOTO Takashi <yamamoto@valinux.co.jp>
Cc: Paul Menage <menage@google.com>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/shmem.c |   28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff -puN mm/shmem.c~memcg-remove-refcnt-from-page_cgroup-memcg-fix-shmem_unuse_inode-charging mm/shmem.c
--- a/mm/shmem.c~memcg-remove-refcnt-from-page_cgroup-memcg-fix-shmem_unuse_inode-charging
+++ a/mm/shmem.c
@@ -922,27 +922,24 @@ found:
 	error = 1;
 	if (!inode)
 		goto out;
-	error = radix_tree_preload(GFP_KERNEL);
-	if (error)
-		goto out;
-	/*
-	 * Because we use GFP_NOWAIT in add_to_page_cache(), we can see -ENOMEM
-	 * failure because of memory pressure in memory resource controller.
-	 * Then, precharge page while we can wait, uncharge at failure will be
-	 * automatically done in add_to_page_cache()
-	 */
+	/* Precharge page using GFP_KERNEL while we can wait */
 	error = mem_cgroup_cache_charge(page, current->mm, GFP_KERNEL);
 	if (error)
-		goto preload_out;
-
+		goto out;
+	error = radix_tree_preload(GFP_KERNEL);
+	if (error) {
+		mem_cgroup_uncharge_cache_page(page);
+		goto out;
+	}
 	error = 1;
 
 	spin_lock(&info->lock);
 	ptr = shmem_swp_entry(info, idx, NULL);
-	if (ptr && ptr->val == entry.val)
-		error = add_to_page_cache(page, inode->i_mapping, idx,
-					GFP_NOWAIT);
-	else /* we don't have to account this page. */
+	if (ptr && ptr->val == entry.val) {
+		error = add_to_page_cache(page, inode->i_mapping,
+						idx, GFP_NOWAIT);
+		/* does mem_cgroup_uncharge_cache_page on error */
+	} else	/* we must compensate for our precharge above */
 		mem_cgroup_uncharge_cache_page(page);
 
 	if (error == -EEXIST) {
@@ -969,7 +966,6 @@ found:
 	if (ptr)
 		shmem_swp_unmap(ptr);
 	spin_unlock(&info->lock);
-preload_out:
 	radix_tree_preload_end();
 out:
 	unlock_page(page);
_