2 files changed, 23 insertions, 5 deletions

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index c1592a94582f..83c69f8a64c2 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -722,12 +722,29 @@ out:
 
 }
 
+/*
+ * Allocate a new page for page migration based on vma policy.
+ * Start assuming that page is mapped by vma pointed to by @private.
+ * Search forward from there, if not.  N.B., this assumes that the
+ * list of pages handed to migrate_pages()--which is how we get here--
+ * is in virtual address order.
+ */
 static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
 {
         struct vm_area_struct *vma = (struct vm_area_struct *)private;
+        unsigned long uninitialized_var(address);
 
-        return alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma,
-                                        page_address_in_vma(page, vma));
+        while (vma) {
+                address = page_address_in_vma(page, vma);
+                if (address != -EFAULT)
+                        break;
+                vma = vma->vm_next;
+        }
+
+        /*
+         * if !vma, alloc_page_vma() will use task or system default policy
+         */
+        return alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
 }
 #else
 
diff --git a/mm/rmap.c b/mm/rmap.c
index 8990f909492f..dc3be5f5b0da 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -183,7 +183,9 @@ static void page_unlock_anon_vma(struct anon_vma *anon_vma)
 }
 
 /*
- * At what user virtual address is page expected in vma?
+ * At what user virtual address is page expected in @vma?
+ * Returns virtual address or -EFAULT if page's index/offset is not
+ * within the range mapped the @vma.
  */
 static inline unsigned long
 vma_address(struct page *page, struct vm_area_struct *vma)
@@ -193,8 +195,7 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 
         address = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
         if (unlikely(address < vma->vm_start || address >= vma->vm_end)) {
-                /* page should be within any vma from prio_tree_next */
-                BUG_ON(!PageAnon(page));
+                /* page should be within @vma mapping range */
                 return -EFAULT;
         }
         return address;