diff --git a/[refs] b/[refs]
index c76e3a40c444..bbbda26d84e2 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 1668bfd5be9d8a52536c4865000fbbe065a3613b
+refs/heads/master: db0480b3a61bd6ad86ead3b8bbad094ab0996932
diff --git a/trunk/mm/memory-failure.c b/trunk/mm/memory-failure.c
index b62287db87af..dc47415a5511 100644
--- a/trunk/mm/memory-failure.c
+++ b/trunk/mm/memory-failure.c
@@ -687,6 +687,8 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
 	/*
 	 * Propagate the dirty bit from PTEs to struct page first, because we
 	 * need this to decide if we should kill or just drop the page.
+	 * XXX: the dirty test could be racy: set_page_dirty() may not always
+	 * be called inside page lock (it's recommended but not enforced).
 	 */
 	mapping = page_mapping(p);
 	if (!PageDirty(p) && mapping && mapping_cap_writeback_dirty(mapping)) {