3 files changed, 12 insertions, 2 deletions

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index b2e803e14ea9..6bd22902d289 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1352,6 +1352,13 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         }
 
         /*
+         * The page_table_lock above provides a memory barrier
+         * with change_protection_range.
+         */
+        if (mm_tlb_flush_pending(mm))
+                flush_tlb_range(vma, haddr, haddr + HPAGE_PMD_SIZE);
+
+        /*
          * Migrate the THP to the requested node, returns with page unlocked
          * and pmd_numa cleared.
          */
diff --git a/mm/mprotect.c b/mm/mprotect.c
index d4d5399c7aba..e9f65aaa3182 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -206,6 +206,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
         BUG_ON(addr >= end);
         pgd = pgd_offset(mm, addr);
         flush_cache_range(vma, addr, end);
+        set_tlb_flush_pending(mm);
         do {
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
@@ -217,6 +218,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
         /* Only flush the TLB if we actually modified any entries: */
         if (pages)
                 flush_tlb_range(vma, start, end);
+        clear_tlb_flush_pending(mm);
 
         return pages;
 }
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index eb900bbaa713..4b62a16fc3c1 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -86,9 +86,10 @@ int pmdp_clear_flush_young(struct vm_area_struct *vma,
 pte_t ptep_clear_flush(struct vm_area_struct *vma, unsigned long address,
                        pte_t *ptep)
 {
+        struct mm_struct *mm = (vma)->vm_mm;
         pte_t pte;
-        pte = ptep_get_and_clear((vma)->vm_mm, address, ptep);
-        if (pte_accessible(pte))
+        pte = ptep_get_and_clear(mm, address, ptep);
+        if (pte_accessible(mm, pte))
                 flush_tlb_page(vma, address);
         return pte;
 }