From: Mike Rapoport <redacted>

The check in gup_pte_range() whether a page belongs to a secretmem mapping
is performed before grabbing the page reference.

To avoid potential race move the check after try_grab_compound_head().

Signed-off-by: Mike Rapoport <redacted>
---
  mm/gup.c | 8 +++++---
  1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/mm/gup.c b/mm/gup.c
index c3a17b189064..6515f82b0f32 100644
--- a/mm/gup.c
+++ b/mm/gup.c

@@ -2080,13 +2080,15 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
  		VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
  		page = pte_page(pte);
  
-		if (page_is_secretmem(page))
-			goto pte_unmap;
-
  		head = try_grab_compound_head(page, 1, flags);
  		if (!head)
  			goto pte_unmap;
  
+		if (unlikely(page_is_secretmem(page))) {
+			put_compound_head(head, 1, flags);
+			goto pte_unmap;
+		}
+
  		if (unlikely(pte_val(pte) != pte_val(*ptep))) {
  			put_compound_head(head, 1, flags);
  			goto pte_unmap;