1 files changed, 6 insertions, 0 deletions

diff --git a/mm/memory.c b/mm/memory.c
index 6efe36a998ba..d8aebc52265f 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2996,6 +2996,12 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 
         if (set_page_dirty(fault_page))
                 dirtied = 1;
+        /*
+         * Take a local copy of the address_space - page.mapping may be zeroed
+         * by truncate after unlock_page().   The address_space itself remains
+         * pinned by vma->vm_file's reference.  We rely on unlock_page()'s
+         * release semantics to prevent the compiler from undoing this copying.
+         */
         mapping = fault_page->mapping;
         unlock_page(fault_page);
         if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) {