diff --git a/[refs] b/[refs]
index 2139be3447d9..ec73a3a10172 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: e4fcd69c9e4e273352e0f87cabd9648606da0c3e
+refs/heads/master: 486cf46f3f9be5f2a966016c1a8fe01e32cde09e
diff --git a/trunk/mm/migrate.c b/trunk/mm/migrate.c
index 666e4e677414..14d0a6a632f6 100644
--- a/trunk/mm/migrate.c
+++ b/trunk/mm/migrate.c
@@ -120,10 +120,10 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
 
 		ptep = pte_offset_map(pmd, addr);
 
-		if (!is_swap_pte(*ptep)) {
-			pte_unmap(ptep);
-			goto out;
-		}
+		/*
+		 * Peek to check is_swap_pte() before taking ptlock?  No, we
+		 * can race mremap's move_ptes(), which skips anon_vma lock.
+		 */
 
 		ptl = pte_lockptr(mm, pmd);
 	}