1 files changed, 4 insertions, 1 deletions

diff --git a/mm/memory.c b/mm/memory.c
index 706c4c4a2b8e..47fe250307c7 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3536,10 +3536,13 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf)
  * but allow concurrent faults).
  * The mmap_sem may have been released depending on flags and our
  * return value.  See filemap_fault() and __lock_page_or_retry().
+ * If mmap_sem is released, vma may become invalid (for example
+ * by other thread calling munmap()).
  */
 static vm_fault_t do_fault(struct vm_fault *vmf)
 {
         struct vm_area_struct *vma = vmf->vma;
+        struct mm_struct *vm_mm = vma->vm_mm;
         vm_fault_t ret;
 
         /*
@@ -3580,7 +3583,7 @@ static vm_fault_t do_fault(struct vm_fault *vmf)
 
         /* preallocated pagetable is unused: free it */
         if (vmf->prealloc_pte) {
-                pte_free(vma->vm_mm, vmf->prealloc_pte);
+                pte_free(vm_mm, vmf->prealloc_pte);
                 vmf->prealloc_pte = NULL;
         }
         return ret;