1 files changed, 8 insertions, 4 deletions

diff --git a/mm/rmap.c b/mm/rmap.c
index bf05fc872ae8..b7e94ebbd09e 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -569,6 +569,7 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd = NULL;
+        pmd_t pmde;
 
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
@@ -579,7 +580,13 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
                 goto out;
 
         pmd = pmd_offset(pud, address);
-        if (!pmd_present(*pmd))
+        /*
+         * Some THP functions use the sequence pmdp_clear_flush(), set_pmd_at()
+         * without holding anon_vma lock for write.  So when looking for a
+         * genuine pmde (in which to find pte), test present and !THP together.
+         */
+        pmde = ACCESS_ONCE(*pmd);
+        if (!pmd_present(pmde) || pmd_trans_huge(pmde))
                 pmd = NULL;
 out:
         return pmd;
@@ -615,9 +622,6 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm,
         if (!pmd)
                 return NULL;
 
-        if (pmd_trans_huge(*pmd))
-                return NULL;
-
         pte = pte_offset_map(pmd, address);
         /* Make a quick check before getting the lock */
         if (!sync && !pte_present(*pte)) {