2.6.25-git16

 mm

diff --git a/mm/mmap.c b/mm/mmap.c
index a32d28c..fac6633 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -230,9 +230,12 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
    might_sleep();
    if (vma->vm_ops && vma->vm_ops->close)
       vma->vm_ops->close(vma);
-   if (vma->vm_file)
+   if (vma->vm_file) {
       fput(vma->vm_file);
-   mpol_free(vma_policy(vma));
+      if (vma->vm_flags & VM_EXECUTABLE)
+         removed_exe_file_vma(vma->vm_mm);
+   }
+   mpol_put(vma_policy(vma));
    kmem_cache_free(vm_area_cachep, vma);
    return next;
 }
@@ -623,10 +626,13 @@ again:         remove_next = 1 + (end > next->vm_end);
       spin_unlock(&mapping->i_mmap_lock);
 
    if (remove_next) {
-      if (file)
+      if (file) {
          fput(file);
+         if (next->vm_flags & VM_EXECUTABLE)
+            removed_exe_file_vma(mm);
+      }
       mm->map_count--;
-      mpol_free(vma_policy(next));
+      mpol_put(vma_policy(next));
       kmem_cache_free(vm_area_cachep, next);
       /*
        * In mprotect's case 6 (see comments on vma_merge),
@@ -1068,7 +1074,6 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
       mapping_cap_account_dirty(vma->vm_file->f_mapping);
 }
 
-
 unsigned long mmap_region(struct file *file, unsigned long addr,
            unsigned long len, unsigned long flags,
            unsigned int vm_flags, unsigned long pgoff,
@@ -1155,6 +1160,8 @@ munmap_back:
       error = file->f_op->mmap(file, vma);
       if (error)
          goto unmap_and_free_vma;
+      if (vm_flags & VM_EXECUTABLE)
+         added_exe_file_vma(mm);
    } else if (vm_flags & VM_SHARED) {
       error = shmem_zero_setup(vma);
       if (error)
@@ -1181,22 +1188,22 @@ munmap_back:
    if (vma_wants_writenotify(vma))
       vma->vm_page_prot = vm_get_page_prot(vm_flags & ~VM_SHARED);
 
-   if (!file || !vma_merge(mm, prev, addr, vma->vm_end,
+   if (file && vma_merge(mm, prev, addr, vma->vm_end,
          vma->vm_flags, NULL, file, pgoff, vma_policy(vma))) {
-      file = vma->vm_file;
-      vma_link(mm, vma, prev, rb_link, rb_parent);
-      if (correct_wcount)
-         atomic_inc(&inode->i_writecount);
-   } else {
-      if (file) {
-         if (correct_wcount)
-            atomic_inc(&inode->i_writecount);
-         fput(file);
-      }
-      mpol_free(vma_policy(vma));
+      mpol_put(vma_policy(vma));
       kmem_cache_free(vm_area_cachep, vma);
+      fput(file);
+      if (vm_flags & VM_EXECUTABLE)
+         removed_exe_file_vma(mm);
+   } else {
+      vma_link(mm, vma, prev, rb_link, rb_parent);
+      file = vma->vm_file;
    }
-out:   
+
+   /* Once vma denies write, undo our temporary denial count */
+   if (correct_wcount)
+      atomic_inc(&inode->i_writecount);
+out:
    mm->total_vm += len >> PAGE_SHIFT;
    vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
    if (vm_flags & VM_LOCKED) {
@@ -1813,15 +1820,18 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
       new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
    }
 
-   pol = mpol_copy(vma_policy(vma));
+   pol = mpol_dup(vma_policy(vma));
    if (IS_ERR(pol)) {
       kmem_cache_free(vm_area_cachep, new);
       return PTR_ERR(pol);
    }
    vma_set_policy(new, pol);
 
-   if (new->vm_file)
+   if (new->vm_file) {
       get_file(new->vm_file);
+      if (vma->vm_flags & VM_EXECUTABLE)
+         added_exe_file_vma(mm);
+   }
 
    if (new->vm_ops && new->vm_ops->open)
       new->vm_ops->open(new);
@@ -2129,7 +2139,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
       new_vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
       if (new_vma) {
          *new_vma = *vma;
-         pol = mpol_copy(vma_policy(vma));
+         pol = mpol_dup(vma_policy(vma));
          if (IS_ERR(pol)) {
             kmem_cache_free(vm_area_cachep, new_vma);
             return NULL;
@@ -2138,8 +2148,11 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
          new_vma->vm_start = addr;
          new_vma->vm_end = addr + len;
          new_vma->vm_pgoff = pgoff;
-         if (new_vma->vm_file)
+         if (new_vma->vm_file) {
             get_file(new_vma->vm_file);
+            if (vma->vm_flags & VM_EXECUTABLE)
+               added_exe_file_vma(mm);
+         }
          if (new_vma->vm_ops && new_vma->vm_ops->open)
             new_vma->vm_ops->open(new_vma);
          vma_link(mm, new_vma, prev, rb_link, rb_parent);