--- x/fs/9p/v9fs.c
+++ y/fs/9p/v9fs.c
@@ -408,6 +408,7 @@ struct p9_fid *v9fs_session_init(struct
 	v9ses->clnt = p9_client_create(dev_name, data);
 	if (IS_ERR(v9ses->clnt)) {
 		rc = PTR_ERR(v9ses->clnt);
+		v9ses->clnt = NULL;
 		p9_debug(P9_DEBUG_ERROR, "problem initializing 9p client\n");
 		goto err_names;
 	}
@@ -486,6 +487,7 @@ err_clnt:
 	kfree(v9ses->cachetag);
 #endif
 	p9_client_destroy(v9ses->clnt);
+	v9ses->clnt = NULL;
 err_names:
 	kfree(v9ses->uname);
 	kfree(v9ses->aname);
@@ -527,6 +529,8 @@ void v9fs_session_close(struct v9fs_sess
 void v9fs_session_cancel(struct v9fs_session_info *v9ses)
 {
 	p9_debug(P9_DEBUG_ERROR, "cancel session %p\n", v9ses);
+	if (!v9ses->clnt)
+		return;
 	p9_client_disconnect(v9ses->clnt);
 }
 
--- x/fs/9p/vfs_super.c
+++ y/fs/9p/vfs_super.c
@@ -197,6 +197,7 @@ free_session:
 	return ERR_PTR(retval);
 
 release_sb:
+	goto clunk_fid;
 	/*
 	 * we will do the session_close and root dentry release
 	 * in the below call. But we need to clunk fid, because we haven't
--- x/mm/mmap.c
+++ y/mm/mmap.c
@@ -3078,6 +3078,7 @@ void exit_mmap(struct mm_struct *mm)
 		mmap_read_unlock(mm);
 		return;
 	}
+	count++;
 
 	lru_add_drain();
 	flush_cache_mm(mm);
@@ -3102,13 +3103,13 @@ void exit_mmap(struct mm_struct *mm)
 	 * enabled, without holding any MM locks besides the unreachable
 	 * mmap_write_lock.
 	 */
-	do {
+	while ((vma = mas_find(&mas, ULONG_MAX)) != NULL) {
 		if (vma->vm_flags & VM_ACCOUNT)
 			nr_accounted += vma_pages(vma);
 		remove_vma(vma);
 		count++;
 		cond_resched();
-	} while ((vma = mas_find(&mas, ULONG_MAX)) != NULL);
+	}
 
 	BUG_ON(count != mm->map_count);