--- x/kernel/futex/core.c
+++ y/kernel/futex/core.c
@@ -1735,8 +1735,7 @@ void futex_hash_free(struct mm_struct *m
 	free_percpu(mm->futex_ref);
 	kvfree(mm->futex_phash_new);
 	fph = rcu_dereference_raw(mm->futex_phash);
-	if (fph)
-		kvfree(fph);
+	kvfree_rcu(fph, rcu);
 }
 
 static bool futex_pivot_pending(struct mm_struct *mm)
--- x/kernel/fork.c
+++ y/kernel/fork.c
@@ -1192,6 +1192,7 @@ static inline void __mmput(struct mm_str
 void mmput(struct mm_struct *mm)
 {
 	might_sleep();
+	VM_BUG_ON(!atomic_read(&mm->mm_users));
 
 	if (atomic_dec_and_test(&mm->mm_users))
 		__mmput(mm);