BUILD-5.1

*PM / Hibernate: Fix free_unnecessary_pages()  [KANG from android_kernel_samsung_msm7x27]
There is a bug in free_unnecessary_pages() that causes it to
attempt to free too many pages in some cases, which triggers the
BUG_ON() in memory_bm_clear_bit() for copy_bm.  Namely, if
count_data_pages() is initially greater than alloc_normal, we get
to_free_normal equal to 0 and "save" greater from 0.  In that case,
if the sum of "save" and count_highmem_pages() is greater than
alloc_highmem, we subtract a positive number from to_free_normal.
Hence, since to_free_normal was 0 before the subtraction and is
an unsigned int, the result is converted to a huge positive number
that is used as the number of pages to free.
Fix this bug by checking if to_free_normal is actually greater
than or equal to the number we're going to subtract from it.

*mm: ashmem: Make sure vma is valid while flushing [KANG from android_kernel_samsung_msm7x27]
Ensure that the vma that the ashmem region is tied to
is valid before flushing and hold the mm semaphore so
that the vma does not get destroyed from under while
it's being flushed.

*mm: ashmem: fix deadlock when system is low on memory [KANG from android_kernel_samsung_msm7x27]

When system is low on memory, allocating memory while holding the
ashmem_mutex may try to directly reclaim memory. Then ashmem_shrink()
is called in same thread. It will deadlock at acquiring ashmem_mutex.
This change lets ashmem_shrink() return failure if ashmem_mutex is not
available. Memory will be reclaimed from others.

*PM: Free memory bitmaps if opening /dev/snapshot fails  [KANG from android_kernel_samsung_msm7x27]
When opening /dev/snapshot device, snapshot_open() creates memory
bitmaps which are freed in snapshot_release(). But if any of the
callbacks called by pm_notifier_call_chain() returns NOTIFY_BAD, open()
fails, snapshot_release() is never called and bitmaps are not freed.
Next attempt to open /dev/snapshot then triggers BUG_ON() check in
create_basic_memory_bitmaps(). This happens e.g. when vmwatchdog module
is active on s390x.