1 files changed, 11 insertions, 11 deletions

diff --git a/mm/rmap.c b/mm/rmap.c
index bf05fc872ae8..22a4a7699cdb 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -517,11 +517,7 @@ void page_unlock_anon_vma_read(struct anon_vma *anon_vma)
 static inline unsigned long
 __vma_address(struct page *page, struct vm_area_struct *vma)
 {
-        pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
-
-        if (unlikely(is_vm_hugetlb_page(vma)))
-                pgoff = page->index << huge_page_order(page_hstate(page));
-
+        pgoff_t pgoff = page_to_pgoff(page);
         return vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
 }
 
@@ -569,6 +565,7 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd = NULL;
+        pmd_t pmde;
 
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
@@ -579,7 +576,13 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
                 goto out;
 
         pmd = pmd_offset(pud, address);
-        if (!pmd_present(*pmd))
+        /*
+         * Some THP functions use the sequence pmdp_clear_flush(), set_pmd_at()
+         * without holding anon_vma lock for write.  So when looking for a
+         * genuine pmde (in which to find pte), test present and !THP together.
+         */
+        pmde = ACCESS_ONCE(*pmd);
+        if (!pmd_present(pmde) || pmd_trans_huge(pmde))
                 pmd = NULL;
 out:
         return pmd;
@@ -615,9 +618,6 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm,
         if (!pmd)
                 return NULL;
 
-        if (pmd_trans_huge(*pmd))
-                return NULL;
-
         pte = pte_offset_map(pmd, address);
         /* Make a quick check before getting the lock */
         if (!sync && !pte_present(*pte)) {
@@ -1635,7 +1635,7 @@ static struct anon_vma *rmap_walk_anon_lock(struct page *page,
 static int rmap_walk_anon(struct page *page, struct rmap_walk_control *rwc)
 {
         struct anon_vma *anon_vma;
-        pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+        pgoff_t pgoff = page_to_pgoff(page);
         struct anon_vma_chain *avc;
         int ret = SWAP_AGAIN;
 
@@ -1676,7 +1676,7 @@ static int rmap_walk_anon(struct page *page, struct rmap_walk_control *rwc)
 static int rmap_walk_file(struct page *page, struct rmap_walk_control *rwc)
 {
         struct address_space *mapping = page->mapping;
-        pgoff_t pgoff = page->index << compound_order(page);
+        pgoff_t pgoff = page_to_pgoff(page);
         struct vm_area_struct *vma;
         int ret = SWAP_AGAIN;