2.6.26-rc1-git9

 mm

diff --git a/mm/memory.c b/mm/memory.c
index bbab1e3..48c122d 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -969,7 +969,7 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address,
       goto no_page_table;
    
    pmd = pmd_offset(pud, address);
-   if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd)))
+   if (pmd_none(*pmd))
       goto no_page_table;
 
    if (pmd_huge(*pmd)) {
@@ -978,6 +978,9 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address,
       goto out;
    }
 
+   if (unlikely(pmd_bad(*pmd)))
+      goto no_page_table;
+
    ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
    if (!ptep)
       goto out;