1 files changed, 6 insertions, 0 deletions

diff --git a/mm/ksm.c b/mm/ksm.c
index d708b3ef2260..9a68b0cf0a1c 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1302,6 +1302,12 @@ static struct rmap_item *scan_get_next_rmap_item(struct page **page)
                 slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
                 ksm_scan.mm_slot = slot;
                 spin_unlock(&ksm_mmlist_lock);
+                /*
+                 * Although we tested list_empty() above, a racing __ksm_exit
+                 * of the last mm on the list may have removed it since then.
+                 */
+                if (slot == &ksm_mm_head)
+                        return NULL;
 next_mm:
                 ksm_scan.address = 0;
                 ksm_scan.rmap_list = &slot->rmap_list;