next = pmd_addr_end(addr, end);
                if (pmd_trans_huge(*src_pmd)) {
                        int err;
+                       VM_BUG_ON(next-addr != HPAGE_PMD_SIZE);
                        err = copy_huge_pmd(dst_mm, src_mm,
                                            dst_pmd, src_pmd, addr, vma);
                        if (err == -ENOMEM)
        do {
                next = pmd_addr_end(addr, end);
                if (pmd_trans_huge(*pmd)) {
-                       if (next-addr != HPAGE_PMD_SIZE)
+                       if (next-addr != HPAGE_PMD_SIZE) {
+                               VM_BUG_ON(!rwsem_is_locked(&tlb->mm->mmap_sem));
                                split_huge_page_pmd(vma->vm_mm, pmd);
-                       else if (zap_huge_pmd(tlb, vma, pmd)) {
+                       } else if (zap_huge_pmd(tlb, vma, pmd)) {
                                (*zap_work)--;
                                continue;
                        }