Unfortunately, p?d_alloc() and p?d_free() are not pair!! If p?d_alloc() succeed, they may be used, so in the next failure, we have to skip them to let exit_mmap() or do_munmap() to process it. According to "Documentation/vm/locking", 'mm->page_table_lock' is for using vma list, so not need it when its related vmas are detached or unmapped from using vma list. The related work flow: exit_mmap() -> unmap_vmas(); /* so not need mm->page_table_lock */ free_pgtables(); do_munmap()-> detach_vmas_to_be_unmapped(); /* so not need mm->page_table_lock */ unmap_region() -> free_pgtables(); free_pgtables() -> free_pgd_range() -> free_pud_range() -> free_pmd_range() -> free_pte_range() -> pmd_clear(); pte_free_tlb(); pud_clear(); pmd_free_tlb(); pgd_clear(); pud_free_tlb(); Signed-off-by: Chen Gang <gang.chen@xxxxxxxxxxx> --- arch/um/kernel/skas/mmu.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/um/kernel/skas/mmu.c b/arch/um/kernel/skas/mmu.c index 007d550..3fd1951 100644 --- a/arch/um/kernel/skas/mmu.c +++ b/arch/um/kernel/skas/mmu.c @@ -40,9 +40,9 @@ static int init_stub_pte(struct mm_struct *mm, unsigned long proc, return 0; out_pte: - pmd_free(mm, pmd); + /* used by mm->pgd->pud, will free in do_munmap() or exit_mmap() */ out_pmd: - pud_free(mm, pud); + /* used by mm->pgd, will free in do_munmap() or exit_mmap() */ out: return -ENOMEM; } -- 1.7.7.6 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx"> email@xxxxxxxxx </a>