From: Hugh Dickins The problem is that PKMAP_BASE is lower than TASK_SIZE, so pgd_ctor (non-PAE) or kpmd_ctor (PAE) copies init_mm's entry for PKMAP_BASE into the task's pgd/pmd, and so it gets "freed" below clean_page_tables. 25-akpm/include/asm-i386/atomic_kmap.h | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-) diff -puN include/asm-i386/atomic_kmap.h~4g4g-pagetable-accounting-fix include/asm-i386/atomic_kmap.h --- 25/include/asm-i386/atomic_kmap.h~4g4g-pagetable-accounting-fix Mon Sep 8 12:20:16 2003 +++ 25-akpm/include/asm-i386/atomic_kmap.h Mon Sep 8 12:20:16 2003 @@ -21,7 +21,7 @@ extern pte_t *kmap_pte; #define kmap_prot PAGE_KERNEL -#define PKMAP_BASE (0xfe000000UL) +#define PKMAP_BASE (0xff000000UL) #define NR_SHARED_PMDS ((0xffffffff-PKMAP_BASE+1)/PMD_SIZE) static inline unsigned long __kmap_atomic_vaddr(enum km_type type) _