fix Merge LA.UM.9.14.r1-21600-LAHAINA.QSSI14.0

include/linux/mm.h

@@ -1559,7 +1559,7 @@ static inline void vm_write_begin(struct vm_area_struct *vma)
          * speculative page fault handler still needs to know it was changed.
          */
         if (!RB_EMPTY_NODE(&vma->vm_rb))
-		WARN_ON_ONCE(!rwsem_is_locked(&(vma->vm_mm)->mmap_sem));
+			rwsem_is_locked(&(vma->vm_mm)->mmap_sem);
 	/*
 	 * The reads never spins and preemption
 	 * disablement is not required.

mm/khugepaged.c

@@ -1405,14 +1405,16 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr)
 	}
 
 	/* step 4: collapse pmd */
+	ptl = pmd_lock(vma->vm_mm, pmd);
+	_pmd = pmdp_collapse_flush(vma, haddr, pmd);
 	/* we make no change to anon, but protect concurrent anon page lookup */
 	if (vma->anon_vma)
 		anon_vma_lock_write(vma->anon_vma);
 
 	mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm, haddr,
 				haddr + HPAGE_PMD_SIZE);
 	mmu_notifier_invalidate_range_start(&range);
-	_pmd = pmdp_collapse_flush(vma, haddr, pmd);
+	spin_unlock(ptl);
 	vm_write_end(vma);
 	mm_dec_nr_ptes(mm);
 	tlb_remove_table_sync_one();
@@ -1505,15 +1507,17 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
 		if (down_write_trylock(&mm->mmap_sem)) {
 			if (!khugepaged_test_exit(mm)) {
 				vm_write_begin(vma);
+				spinlock_t *ptl = pmd_lock(mm, pmd);
+				/* assume page table is clear */
+				_pmd = pmdp_collapse_flush(vma, addr, pmd);
 				struct mmu_notifier_range range;
 
 				mmu_notifier_range_init(&range,
 							MMU_NOTIFY_CLEAR, 0,
 							NULL, mm, addr,
 							addr + HPAGE_PMD_SIZE);
 				mmu_notifier_invalidate_range_start(&range);
-				/* assume page table is clear */
-				_pmd = pmdp_collapse_flush(vma, addr, pmd);
+				spin_unlock(ptl);
 				vm_write_end(vma);
 				mm_dec_nr_ptes(mm);
 				tlb_remove_table_sync_one();