Patch for orabug 9493665.
[Subject]: free pte page on hugetlb_prefault to avoid the clear_page race.

--- a/arch/i386/mm/hugetlbpage.c	2010-03-30 13:22:46.000000000 +0800
+++ b/arch/i386/mm/hugetlbpage.c	2010-03-30 13:23:51.000000000 +0800
@@ -248,7 +248,7 @@ int hugetlb_prefault(struct address_spac
 			page = pmd_page(*pmd);
 			pmd_clear(pmd);
 			dec_page_state(nr_page_table_pages);
-			page_cache_release(page);
+			pte_free(page);
 		}
 
 		idx = ((addr - vma->vm_start) >> HPAGE_SHIFT)
--- a/arch/x86_64/mm/hugetlbpage.c	2010-03-30 13:22:55.000000000 +0800
+++ b/arch/x86_64/mm/hugetlbpage.c	2010-03-30 13:23:29.000000000 +0800
@@ -255,7 +255,7 @@ int hugetlb_prefault(struct address_spac
 			page = pmd_page(*pmd);
 			pmd_clear(pmd);
 			dec_page_state(nr_page_table_pages);
-			page_cache_release(page);
+			pte_free(page);
 		}
 
 		idx = ((addr - vma->vm_start) >> HPAGE_SHIFT)
--- a/arch/x86_64/mm/pageattr-xen.c	2010-03-30 13:24:15.000000000 +0800
+++ b/arch/x86_64/mm/pageattr-xen.c	2010-03-30 13:24:58.000000000 +0800
@@ -165,7 +165,8 @@ void pte_free(struct page *pte)
 
 	if (!pte_write(*virt_to_ptep(va)))
 		BUG_ON(HYPERVISOR_update_va_mapping(
-			va, pfn_pte(page_to_pfn(pte), PAGE_KERNEL), 0));
+			va, pfn_pte(page_to_pfn(pte), PAGE_KERNEL), 
+			UVMF_INVLPG|UVMF_ALL));
 	__free_page(pte);
 }
 #endif /* CONFIG_XEN */