4 files changed, 20 insertions, 13 deletions

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index bade35ef563b..33514d88fef9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2423,8 +2423,6 @@ static void collapse_huge_page(struct mm_struct *mm,
         pmd = mm_find_pmd(mm, address);
         if (!pmd)
                 goto out;
-        if (pmd_trans_huge(*pmd))
-                goto out;
 
         anon_vma_lock_write(vma->anon_vma);
 
@@ -2523,8 +2521,6 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
         pmd = mm_find_pmd(mm, address);
         if (!pmd)
                 goto out;
-        if (pmd_trans_huge(*pmd))
-                goto out;
 
         memset(khugepaged_node_load, 0, sizeof(khugepaged_node_load));
         pte = pte_offset_map_lock(mm, pmd, address, &ptl);
@@ -2877,12 +2873,22 @@ void split_huge_page_pmd_mm(struct mm_struct *mm, unsigned long address,
 static void split_huge_page_address(struct mm_struct *mm,
                                     unsigned long address)
 {
+        pgd_t *pgd;
+        pud_t *pud;
         pmd_t *pmd;
 
         VM_BUG_ON(!(address & ~HPAGE_PMD_MASK));
 
-        pmd = mm_find_pmd(mm, address);
-        if (!pmd)
+        pgd = pgd_offset(mm, address);
+        if (!pgd_present(*pgd))
+                return;
+
+        pud = pud_offset(pgd, address);
+        if (!pud_present(*pud))
+                return;
+
+        pmd = pmd_offset(pud, address);
+        if (!pmd_present(*pmd))
                 return;
         /*
          * Caller holds the mmap_sem write mode, so a huge pmd cannot
diff --git a/mm/ksm.c b/mm/ksm.c
index 68710e80994a..346ddc9e4c0d 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -945,7 +945,6 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
         pmd = mm_find_pmd(mm, addr);
         if (!pmd)
                 goto out;
-        BUG_ON(pmd_trans_huge(*pmd));
 
         mmun_start = addr;
         mmun_end   = addr + PAGE_SIZE;
diff --git a/mm/migrate.c b/mm/migrate.c
index 63f0cd559999..9e0beaa91845 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -120,8 +120,6 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
                 pmd = mm_find_pmd(mm, addr);
                 if (!pmd)
                         goto out;
-                if (pmd_trans_huge(*pmd))
-                        goto out;
 
                 ptep = pte_offset_map(pmd, addr);
 
diff --git a/mm/rmap.c b/mm/rmap.c
index bf05fc872ae8..b7e94ebbd09e 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -569,6 +569,7 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd = NULL;
+        pmd_t pmde;
 
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
@@ -579,7 +580,13 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
                 goto out;
 
         pmd = pmd_offset(pud, address);
-        if (!pmd_present(*pmd))
+        /*
+         * Some THP functions use the sequence pmdp_clear_flush(), set_pmd_at()
+         * without holding anon_vma lock for write.  So when looking for a
+         * genuine pmde (in which to find pte), test present and !THP together.
+         */
+        pmde = ACCESS_ONCE(*pmd);
+        if (!pmd_present(pmde) || pmd_trans_huge(pmde))
                 pmd = NULL;
 out:
         return pmd;
@@ -615,9 +622,6 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm,
         if (!pmd)
                 return NULL;
 
-        if (pmd_trans_huge(*pmd))
-                return NULL;
-
         pte = pte_offset_map(pmd, address);
         /* Make a quick check before getting the lock */
         if (!sync && !pte_present(*pte)) {