diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index bed9f05ecaf19c17c79e79b4f951836e0a43e9b6..32b7ee895315cf25880cd9e30d6c4babc4d9f924 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6001,6 +6001,13 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma,
 		return 0;
 
 	pud_clear(pud);
+	/*
+	 * Once our caller drops the rmap lock, some other process might be
+	 * using this page table as a normal, non-hugetlb page table.
+	 * Wait for pending gup_fast() in other threads to finish before letting
+	 * that happen.
+	 */
+	tlb_remove_table_sync_one();
 	put_page(virt_to_page(ptep));
 	mm_dec_nr_pmds(mm);
 	/*