1 files changed, 30 insertions, 2 deletions

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 7f686251f711..85ab7db0d366 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -104,8 +104,36 @@ static pfn_t fault_pfn;
 inline int kvm_is_mmio_pfn(pfn_t pfn)
 {
         if (pfn_valid(pfn)) {
-                struct page *page = compound_head(pfn_to_page(pfn));
-                return PageReserved(page);
+                struct page *head;
+                struct page *tail = pfn_to_page(pfn);
+                head = compound_head(tail);
+                if (head != tail) {
+                        smp_rmb();
+                        /*
+                         * head may be a dangling pointer.
+                         * __split_huge_page_refcount clears PageTail
+                         * before overwriting first_page, so if
+                         * PageTail is still there it means the head
+                         * pointer isn't dangling.
+                         */
+                        if (PageTail(tail)) {
+                                /*
+                                 * the "head" is not a dangling
+                                 * pointer but the hugepage may have
+                                 * been splitted from under us (and we
+                                 * may not hold a reference count on
+                                 * the head page so it can be reused
+                                 * before we run PageReferenced), so
+                                 * we've to recheck PageTail before
+                                 * returning what we just read.
+                                 */
+                                int reserved = PageReserved(head);
+                                smp_rmb();
+                                if (PageTail(tail))
+                                        return reserved;
+                        }
+                }
+                return PageReserved(tail);
         }
 
         return true;