1 files changed, 15 insertions, 18 deletions

diff --git a/mm/mmap.c b/mm/mmap.c
index a32d28ce31cd..677d184b0d42 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -232,7 +232,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
                 vma->vm_ops->close(vma);
         if (vma->vm_file)
                 fput(vma->vm_file);
-        mpol_free(vma_policy(vma));
+        mpol_put(vma_policy(vma));
         kmem_cache_free(vm_area_cachep, vma);
         return next;
 }
@@ -626,7 +626,7 @@ again:			remove_next = 1 + (end > next->vm_end);
                 if (file)
                         fput(file);
                 mm->map_count--;
-                mpol_free(vma_policy(next));
+                mpol_put(vma_policy(next));
                 kmem_cache_free(vm_area_cachep, next);
                 /*
                  * In mprotect's case 6 (see comments on vma_merge),
@@ -1068,7 +1068,6 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
                 mapping_cap_account_dirty(vma->vm_file->f_mapping);
 }
 
-
 unsigned long mmap_region(struct file *file, unsigned long addr,
                           unsigned long len, unsigned long flags,
                           unsigned int vm_flags, unsigned long pgoff,
@@ -1181,22 +1180,20 @@ munmap_back:
         if (vma_wants_writenotify(vma))
                 vma->vm_page_prot = vm_get_page_prot(vm_flags & ~VM_SHARED);
 
-        if (!file || !vma_merge(mm, prev, addr, vma->vm_end,
+        if (file && vma_merge(mm, prev, addr, vma->vm_end,
                         vma->vm_flags, NULL, file, pgoff, vma_policy(vma))) {
-                file = vma->vm_file;
-                vma_link(mm, vma, prev, rb_link, rb_parent);
-                if (correct_wcount)
-                        atomic_inc(&inode->i_writecount);
-        } else {
-                if (file) {
-                        if (correct_wcount)
-                                atomic_inc(&inode->i_writecount);
-                        fput(file);
-                }
-                mpol_free(vma_policy(vma));
+                mpol_put(vma_policy(vma));
                 kmem_cache_free(vm_area_cachep, vma);
+                fput(file);
+        } else {
+                vma_link(mm, vma, prev, rb_link, rb_parent);
+                file = vma->vm_file;
         }
-out:    
+
+        /* Once vma denies write, undo our temporary denial count */
+        if (correct_wcount)
+                atomic_inc(&inode->i_writecount);
+out:
         mm->total_vm += len >> PAGE_SHIFT;
         vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
         if (vm_flags & VM_LOCKED) {
@@ -1813,7 +1810,7 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
                 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
         }
 
-        pol = mpol_copy(vma_policy(vma));
+        pol = mpol_dup(vma_policy(vma));
         if (IS_ERR(pol)) {
                 kmem_cache_free(vm_area_cachep, new);
                 return PTR_ERR(pol);
@@ -2129,7 +2126,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
                 new_vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
                 if (new_vma) {
                         *new_vma = *vma;
-                        pol = mpol_copy(vma_policy(vma));
+                        pol = mpol_dup(vma_policy(vma));
                         if (IS_ERR(pol)) {
                                 kmem_cache_free(vm_area_cachep, new_vma);
                                 return NULL;