1 files changed, 18 insertions, 2 deletions

diff --git a/mm/migrate.c b/mm/migrate.c
index d8c65a65c61d..3ca6392e82cc 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -285,7 +285,15 @@ void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
 
         page = migration_entry_to_page(entry);
 
-        get_page(page);
+        /*
+         * Once radix-tree replacement of page migration started, page_count
+         * *must* be zero. And, we don't want to call wait_on_page_locked()
+         * against a page without get_page().
+         * So, we use get_page_unless_zero(), here. Even failed, page fault
+         * will occur again.
+         */
+        if (!get_page_unless_zero(page))
+                goto out;
         pte_unmap_unlock(ptep, ptl);
         wait_on_page_locked(page);
         put_page(page);
@@ -305,6 +313,7 @@ out:
 static int migrate_page_move_mapping(struct address_space *mapping,
                 struct page *newpage, struct page *page)
 {
+        int expected_count;
         void **pslot;
 
         if (!mapping) {
@@ -319,12 +328,18 @@ static int migrate_page_move_mapping(struct address_space *mapping,
         pslot = radix_tree_lookup_slot(&mapping->page_tree,
                                         page_index(page));
 
-        if (page_count(page) != 2 + !!PagePrivate(page) ||
+        expected_count = 2 + !!PagePrivate(page);
+        if (page_count(page) != expected_count ||
                         (struct page *)radix_tree_deref_slot(pslot) != page) {
                 write_unlock_irq(&mapping->tree_lock);
                 return -EAGAIN;
         }
 
+        if (!page_freeze_refs(page, expected_count)) {
+                write_unlock_irq(&mapping->tree_lock);
+                return -EAGAIN;
+        }
+
         /*
          * Now we know that no one else is looking at the page.
          */
@@ -338,6 +353,7 @@ static int migrate_page_move_mapping(struct address_space *mapping,
 
         radix_tree_replace_slot(pslot, newpage);
 
+        page_unfreeze_refs(page, expected_count);
         /*
          * Drop cache reference from old page.
          * We know this isn't the last reference.