2 files changed, 9 insertions, 3 deletions

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index d9a21d06b862..f8ffd9412ec5 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1795,14 +1795,17 @@ static int __split_huge_page_map(struct page *page,
                 for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
                         pte_t *pte, entry;
                         BUG_ON(PageCompound(page+i));
+                        /*
+                         * Note that pmd_numa is not transferred deliberately
+                         * to avoid any possibility that pte_numa leaks to
+                         * a PROT_NONE VMA by accident.
+                         */
                         entry = mk_pte(page + i, vma->vm_page_prot);
                         entry = maybe_mkwrite(pte_mkdirty(entry), vma);
                         if (!pmd_write(*pmd))
                                 entry = pte_wrprotect(entry);
                         if (!pmd_young(*pmd))
                                 entry = pte_mkold(entry);
-                        if (pmd_numa(*pmd))
-                                entry = pte_mknuma(entry);
                         pte = pte_offset_map(&_pmd, haddr);
                         BUG_ON(!pte_none(*pte));
                         set_pte_at(mm, haddr, pte, entry);
diff --git a/mm/migrate.c b/mm/migrate.c
index f78ec9bd454d..2740360cd216 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -146,8 +146,11 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
         pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
         if (pte_swp_soft_dirty(*ptep))
                 pte = pte_mksoft_dirty(pte);
+
+        /* Recheck VMA as permissions can change since migration started  */
         if (is_write_migration_entry(entry))
-                pte = pte_mkwrite(pte);
+                pte = maybe_mkwrite(pte, vma);
+
 #ifdef CONFIG_HUGETLB_PAGE
         if (PageHuge(new)) {
                 pte = pte_mkhuge(pte);