imamnurby/smpl_train_seed8 huggingface dataset:
--- initial
+++ final
@@ -1,50 +1,50 @@
 asmlinkage void secondary_start_kernel(void) {
   struct mm_struct *mm = &init_mm;
   unsigned int cpu;
   cpu = task_cpu(current);
   set_my_cpu_offset(per_cpu_offset(cpu));
   /*
    * All kernel threads share the same mm context; grab a
    * reference and switch to it.
    */
-  atomic_inc(&mm->mm_count);
+  mmgrab(mm);
   current->active_mm = mm;
   /*
    * TTBR0 is only used for the identity mapping at this stage. Make it
    * point to zero page to avoid speculatively fetching new entries.
    */
   cpu_uninstall_idmap();
   preempt_disable();
   trace_hardirqs_off();
   /*
    * If the system has established the capabilities, make sure
    * this CPU ticks all of those. If it doesn't, the CPU will
    * fail to come online.
    */
   check_local_cpu_capabilities();
   if (cpu_ops[cpu]->cpu_postboot) cpu_ops[cpu]->cpu_postboot();
   /*
    * Log the CPU info before it is marked online and might get read.
    */
   cpuinfo_store_cpu();
   /*
    * Enable GIC and timers.
    */
   notify_cpu_starting(cpu);
   store_cpu_topology(cpu);
   /*
    * OK, now it's safe to let the boot CPU continue.  Wait for
    * the CPU migration code to notice that the CPU is online
    * before we continue.
    */
   pr_info("CPU%u: Booted secondary processor [%08x]\n", cpu, read_cpuid_id());
   update_cpu_boot_status(CPU_BOOT_SUCCESS);
   set_cpu_online(cpu, true);
   complete(&cpu_running);
   local_irq_enable();
   local_async_enable();
   /*
    * OK, it's off to the idle thread for us
    */
   cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,45 +1,45 @@
 asmlinkage void secondary_start_kernel(void) {
   struct mm_struct *mm = &init_mm;
   unsigned int cpu;
   /*
    * The identity mapping is uncached (strongly ordered), so
    * switch away from it before attempting any exclusive accesses.
    */
   cpu_switch_mm(mm->pgd, mm);
   local_flush_bp_all();
   enter_lazy_tlb(mm, current);
   local_flush_tlb_all();
   /*
    * All kernel threads share the same mm context; grab a
    * reference and switch to it.
    */
   cpu = smp_processor_id();
-  atomic_inc(&mm->mm_count);
+  mmgrab(mm);
   current->active_mm = mm;
   cpumask_set_cpu(cpu, mm_cpumask(mm));
   cpu_init();
   pr_debug("CPU%u: Booted secondary processor\n", cpu);
   preempt_disable();
   trace_hardirqs_off();
   /*
    * Give the platform a chance to do its own initialisation.
    */
   if (smp_ops.smp_secondary_init) smp_ops.smp_secondary_init(cpu);
   notify_cpu_starting(cpu);
   calibrate_delay();
   smp_store_cpu_info(cpu);
   /*
    * OK, now it's safe to let the boot CPU continue.  Wait for
    * the CPU migration code to notice that the CPU is online
    * before we continue - which happens after __cpu_up returns.
    */
   set_cpu_online(cpu, true);
   complete(&cpu_running);
   local_irq_enable();
   local_fiq_enable();
   local_abt_enable();
   /*
    * OK, it's off to the idle thread for us
    */
   cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,65 +1,65 @@
 static int __set_oom_adj(struct file *file, int oom_adj, bool legacy) {
   static DEFINE_MUTEX(oom_adj_mutex);
   struct mm_struct *mm = NULL;
   struct task_struct *task;
   int err = 0;
   task = get_proc_task(file_inode(file));
   if (!task) return -ESRCH;
   mutex_lock(&oom_adj_mutex);
   if (legacy) {
     if (oom_adj < task->signal->oom_score_adj && !capable(CAP_SYS_RESOURCE)) {
       err = -EACCES;
       goto err_unlock;
     }
     /*
      * /proc/pid/oom_adj is provided for legacy purposes, ask users to use
      * /proc/pid/oom_score_adj instead.
      */
     pr_warn_once("%s (%d): /proc/%d/oom_adj is deprecated, please use /proc/%d/oom_score_adj instead.\n", current->comm, task_pid_nr(current), task_pid_nr(task), task_pid_nr(task));
   } else {
     if ((short)oom_adj < task->signal->oom_score_adj_min && !capable(CAP_SYS_RESOURCE)) {
       err = -EACCES;
       goto err_unlock;
     }
   }
   /*
    * Make sure we will check other processes sharing the mm if this is
    * not vfrok which wants its own oom_score_adj.
    * pin the mm so it doesn't go away and get reused after task_unlock
    */
   if (!task->vfork_done) {
     struct task_struct *p = find_lock_task_mm(task);
     if (p) {
       if (atomic_read(&p->mm->mm_users) > 1) {
         mm = p->mm;
-        atomic_inc(&mm->mm_count);
+        mmgrab(mm);
       }
       task_unlock(p);
     }
   }
   task->signal->oom_score_adj = oom_adj;
   if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE)) task->signal->oom_score_adj_min = (short)oom_adj;
   trace_oom_score_adj_update(task);
   if (mm) {
     struct task_struct *p;
     rcu_read_lock();
     for_each_process(p) {
       if (same_thread_group(task, p)) continue;
       /* do not touch kernel threads or the global init */
       if (p->flags & PF_KTHREAD || is_global_init(p)) continue;
       task_lock(p);
       if (!p->vfork_done && process_shares_mm(p, mm)) {
         pr_info("updating oom_score_adj for %d (%s) from %d to %d because it shares mm with %d (%s). Report if this is unexpected.\n", task_pid_nr(p), p->comm, p->signal->oom_score_adj, oom_adj, task_pid_nr(task), task->comm);
         p->signal->oom_score_adj = oom_adj;
         if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE)) p->signal->oom_score_adj_min = (short)oom_adj;
       }
       task_unlock(p);
     }
     rcu_read_unlock();
     mmdrop(mm);
   }
 err_unlock:
   mutex_unlock(&oom_adj_mutex);
   put_task_struct(task);
   return err;
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,15 +1,15 @@
 struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) {
   struct task_struct *task = get_proc_task(inode);
   struct mm_struct *mm = ERR_PTR(-ESRCH);
   if (task) {
     mm = mm_access(task, mode | PTRACE_MODE_FSCREDS);
     put_task_struct(task);
     if (!IS_ERR_OR_NULL(mm)) {
       /* ensure this mm_struct can't be freed */
-      atomic_inc(&mm->mm_count);
+      mmgrab(mm);
       /* but do not pin its memory */
       mmput(mm);
     }
   }
   return mm;
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,47 +1,47 @@
 static void exit_mm(void) {
   struct mm_struct *mm = current->mm;
   struct core_state *core_state;
   mm_release(current, mm);
   if (!mm) return;
   sync_mm_rss(mm);
   /*
    * Serialize with any possible pending coredump.
    * We must hold mmap_sem around checking core_state
    * and clearing tsk->mm.  The core-inducing thread
    * will increment ->nr_threads for each thread in the
    * group with ->mm != NULL.
    */
   down_read(&mm->mmap_sem);
   core_state = mm->core_state;
   if (core_state) {
     struct core_thread self;
     up_read(&mm->mmap_sem);
     self.task = current;
     self.next = xchg(&core_state->dumper.next, &self);
     /*
      * Implies mb(), the result of xchg() must be visible
      * to core_state->dumper.
      */
     if (atomic_dec_and_test(&core_state->nr_threads)) complete(&core_state->startup);
     for (;;) {
       set_current_state(TASK_UNINTERRUPTIBLE);
       if (!self.task) /* see coredump_finish() */
         break;
       freezable_schedule();
     }
     __set_current_state(TASK_RUNNING);
     down_read(&mm->mmap_sem);
   }
-  atomic_inc(&mm->mm_count);
+  mmgrab(mm);
   BUG_ON(mm != current->active_mm);
   /* more a memory barrier than a real lock */
   task_lock(current);
   current->mm = NULL;
   up_read(&mm->mmap_sem);
   enter_lazy_tlb(mm, current);
   task_unlock(current);
   mm_update_next_owner(mm);
   userfaultfd_exit(mm);
   mmput(mm);
   if (test_thread_flag(TIF_MEMDIE)) exit_oom_victim();
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,20 +1,20 @@
 static int hfi1_file_open(struct inode *inode, struct file *fp) {
   struct hfi1_filedata *fd;
   struct hfi1_devdata *dd = container_of(inode->i_cdev, struct hfi1_devdata, user_cdev);
   if (!atomic_inc_not_zero(&dd->user_refcount)) return -ENXIO;
   /* Just take a ref now. Not all opens result in a context assign */
   kobject_get(&dd->kobj);
   /* The real work is performed later in assign_ctxt() */
   fd = kzalloc(sizeof(*fd), GFP_KERNEL);
   if (fd) {
     fd->rec_cpu_num = -1; /* no cpu affinity by default */
     fd->mm = current->mm;
-    atomic_inc(&fd->mm->mm_count);
+    mmgrab(fd->mm);
     fp->private_data = fd;
   } else {
     fp->private_data = NULL;
     if (atomic_dec_and_test(&dd->user_refcount)) complete(&dd->user_comp);
     return -ENOMEM;
   }
   return 0;
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,9 +1,9 @@
 static inline void futex_get_mm(union futex_key *key) {
-  atomic_inc(&key->private.mm->mm_count);
+  mmgrab(key->private.mm);
   /*
    * Ensure futex_get_mm() implies a full barrier such that
    * get_futex_key() implies a full barrier. This is relied upon
    * as smp_mb(); (B), see the ordering comment above.
    */
   smp_mb__after_atomic();
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,20 +1,20 @@
 void start_secondary(void) {
   unsigned int cpu;
   unsigned long thread_ptr;
   /*  Calculate thread_info pointer from stack pointer  */
   __asm__ __volatile__("%0 = SP;\n" : "=r"(thread_ptr));
   thread_ptr = thread_ptr & ~(THREAD_SIZE - 1);
   __asm__ __volatile__(QUOTED_THREADINFO_REG " = %0;\n" : : "r"(thread_ptr));
   /*  Set the memory struct  */
-  atomic_inc(&init_mm.mm_count);
+  mmgrab(&init_mm);
   current->active_mm = &init_mm;
   cpu = smp_processor_id();
   setup_irq(BASE_IPI_IRQ + cpu, &ipi_intdesc);
   /*  Register the clock_event dummy  */
   setup_percpu_clockdev();
   printk(KERN_INFO "%s cpu %d\n", __func__, current_thread_info()->cpu);
   notify_cpu_starting(cpu);
   set_cpu_online(cpu, true);
   local_irq_enable();
   cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm.mm_count);
+       mmgrab(&init_mm);
--- initial
+++ final
@@ -1,36 +1,36 @@
 static int i915_gem_userptr_init__mm_struct(struct drm_i915_gem_object *obj) {
   struct drm_i915_private *dev_priv = to_i915(obj->base.dev);
   struct i915_mm_struct *mm;
   int ret = 0;
   /* During release of the GEM object we hold the struct_mutex. This
    * precludes us from calling mmput() at that time as that may be
    * the last reference and so call exit_mmap(). exit_mmap() will
    * attempt to reap the vma, and if we were holding a GTT mmap
    * would then call drm_gem_vm_close() and attempt to reacquire
    * the struct mutex. So in order to avoid that recursion, we have
    * to defer releasing the mm reference until after we drop the
    * struct_mutex, i.e. we need to schedule a worker to do the clean
    * up.
    */
   mutex_lock(&dev_priv->mm_lock);
   mm = __i915_mm_struct_find(dev_priv, current->mm);
   if (mm == NULL) {
     mm = kmalloc(sizeof(*mm), GFP_KERNEL);
     if (mm == NULL) {
       ret = -ENOMEM;
       goto out;
     }
     kref_init(&mm->kref);
     mm->i915 = to_i915(obj->base.dev);
     mm->mm = current->mm;
-    atomic_inc(&current->mm->mm_count);
+    mmgrab(current->mm);
     mm->mn = NULL;
     /* Protected by dev_priv->mm_lock */
     hash_add(dev_priv->mm_structs, &mm->node, (unsigned long)mm->mm);
   } else
     kref_get(&mm->kref);
   obj->userptr.mm = mm;
 out:
   mutex_unlock(&dev_priv->mm_lock);
   return ret;
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,21 +1,21 @@
 asmlinkage void start_secondary(void) {
   unsigned int cpu = smp_processor_id();
   struct mm_struct *mm = &init_mm;
   enable_mmu();
-  atomic_inc(&mm->mm_count);
+  mmgrab(mm);
   atomic_inc(&mm->mm_users);
   current->active_mm = mm;
 #ifdef CONFIG_MMU
   enter_lazy_tlb(mm, current);
   local_flush_tlb_all();
 #endif
   per_cpu_trap_init();
   preempt_disable();
   notify_cpu_starting(cpu);
   local_irq_enable();
   calibrate_delay();
   smp_store_cpu_info(cpu);
   set_cpu_online(cpu, true);
   per_cpu(cpu_state, cpu) = CPU_ONLINE;
   cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,49 +1,49 @@
 void per_cpu_trap_init(bool is_boot_cpu) {
   unsigned int cpu = smp_processor_id();
   configure_status();
   configure_hwrena();
   configure_exception_vector();
   /*
    * Before R2 both interrupt numbers were fixed to 7, so on R2 only:
    *
    *  o read IntCtl.IPTI to determine the timer interrupt
    *  o read IntCtl.IPPCI to determine the performance counter interrupt
    *  o read IntCtl.IPFDC to determine the fast debug channel interrupt
    */
   if (cpu_has_mips_r2_r6) {
     /*
      * We shouldn't trust a secondary core has a sane EBASE register
      * so use the one calculated by the boot CPU.
      */
     if (!is_boot_cpu) {
       /* If available, use WG to set top bits of EBASE */
       if (cpu_has_ebase_wg) {
 #ifdef CONFIG_64BIT
         write_c0_ebase_64(ebase | MIPS_EBASE_WG);
 #else
         write_c0_ebase(ebase | MIPS_EBASE_WG);
 #endif
       }
       write_c0_ebase(ebase);
     }
     cp0_compare_irq_shift = CAUSEB_TI - CAUSEB_IP;
     cp0_compare_irq = (read_c0_intctl() >> INTCTLB_IPTI) & 7;
     cp0_perfcount_irq = (read_c0_intctl() >> INTCTLB_IPPCI) & 7;
     cp0_fdc_irq = (read_c0_intctl() >> INTCTLB_IPFDC) & 7;
     if (!cp0_fdc_irq) cp0_fdc_irq = -1;
   } else {
     cp0_compare_irq = CP0_LEGACY_COMPARE_IRQ;
     cp0_compare_irq_shift = CP0_LEGACY_PERFCNT_IRQ;
     cp0_perfcount_irq = -1;
     cp0_fdc_irq = -1;
   }
   if (!cpu_data[cpu].asid_cache) cpu_data[cpu].asid_cache = asid_first_version(cpu);
-  atomic_inc(&init_mm.mm_count);
+  mmgrab(&init_mm);
   current->active_mm = &init_mm;
   BUG_ON(current->mm);
   enter_lazy_tlb(&init_mm, current);
   /* Boot CPU's cache setup in setup_arch(). */
   if (!is_boot_cpu) cpu_cache_init();
   tlb_init();
   TLBMISS_HANDLER_SETUP();
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm.mm_count);
+       mmgrab(&init_mm);
--- initial
+++ final
@@ -1,37 +1,37 @@
 static void kfd_process_notifier_release(struct mmu_notifier *mn, struct mm_struct *mm) {
   struct kfd_process *p;
   struct kfd_process_device *pdd = NULL;
   /*
    * The kfd_process structure can not be free because the
    * mmu_notifier srcu is read locked
    */
   p = container_of(mn, struct kfd_process, mmu_notifier);
   BUG_ON(p->mm != mm);
   mutex_lock(&kfd_processes_mutex);
   hash_del_rcu(&p->kfd_processes);
   mutex_unlock(&kfd_processes_mutex);
   synchronize_srcu(&kfd_processes_srcu);
   mutex_lock(&p->mutex);
   /* In case our notifier is called before IOMMU notifier */
   pqm_uninit(&p->pqm);
   /* Iterate over all process device data structure and check
    * if we should delete debug managers and reset all wavefronts
    */
   list_for_each_entry(pdd, &p->per_device_data, per_device_list) {
     if ((pdd->dev->dbgmgr) && (pdd->dev->dbgmgr->pasid == p->pasid)) kfd_dbgmgr_destroy(pdd->dev->dbgmgr);
     if (pdd->reset_wavefronts) {
       pr_warn("amdkfd: Resetting all wave fronts\n");
       dbgdev_wave_reset_wavefronts(pdd->dev, p);
       pdd->reset_wavefronts = false;
     }
   }
   mutex_unlock(&p->mutex);
   /*
    * Because we drop mm_count inside kfd_process_destroy_delayed
    * and because the mmu_notifier_unregister function also drop
    * mm_count we need to take an extra count here.
    */
-  atomic_inc(&p->mm->mm_count);
+  mmgrab(p->mm);
   mmu_notifier_unregister_no_release(&p->mmu_notifier, p->mm);
   mmu_notifier_call_srcu(&p->rcu, &kfd_process_destroy_delayed);
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,24 +1,24 @@
 int __khugepaged_enter(struct mm_struct *mm) {
   struct mm_slot *mm_slot;
   int wakeup;
   mm_slot = alloc_mm_slot();
   if (!mm_slot) return -ENOMEM;
   /* __khugepaged_exit() must not run from under us */
   VM_BUG_ON_MM(khugepaged_test_exit(mm), mm);
   if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) {
     free_mm_slot(mm_slot);
     return 0;
   }
   spin_lock(&khugepaged_mm_lock);
   insert_to_mm_slots_hash(mm, mm_slot);
   /*
    * Insert just behind the scanning cursor, to let the area settle
    * down a little.
    */
   wakeup = list_empty(&khugepaged_scan.mm_head);
   list_add_tail(&mm_slot->mm_node, &khugepaged_scan.mm_head);
   spin_unlock(&khugepaged_mm_lock);
-  atomic_inc(&mm->mm_count);
+  mmgrab(mm);
   if (wakeup) wake_up_interruptible(&khugepaged_wait);
   return 0;
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,29 +1,29 @@
 int __ksm_enter(struct mm_struct *mm) {
   struct mm_slot *mm_slot;
   int needs_wakeup;
   mm_slot = alloc_mm_slot();
   if (!mm_slot) return -ENOMEM;
   /* Check ksm_run too?  Would need tighter locking */
   needs_wakeup = list_empty(&ksm_mm_head.mm_list);
   spin_lock(&ksm_mmlist_lock);
   insert_to_mm_slots_hash(mm, mm_slot);
   /*
    * When KSM_RUN_MERGE (or KSM_RUN_STOP),
    * insert just behind the scanning cursor, to let the area settle
    * down a little; when fork is followed by immediate exec, we don't
    * want ksmd to waste time setting up and tearing down an rmap_list.
    *
    * But when KSM_RUN_UNMERGE, it's important to insert ahead of its
    * scanning cursor, otherwise KSM pages in newly forked mms will be
    * missed: then we might as well insert at the end of the list.
    */
   if (ksm_run & KSM_RUN_UNMERGE)
     list_add_tail(&mm_slot->mm_list, &ksm_mm_head.mm_list);
   else
     list_add_tail(&mm_slot->mm_list, &ksm_scan.mm_slot->mm_list);
   spin_unlock(&ksm_mmlist_lock);
   set_bit(MMF_VM_MERGEABLE, &mm->flags);
-  atomic_inc(&mm->mm_count);
+  mmgrab(mm);
   if (needs_wakeup) wake_up_interruptible(&ksm_thread_wait);
   return 0;
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,61 +1,61 @@
 static struct kvm *kvm_create_vm(unsigned long type) {
   int r, i;
   struct kvm *kvm = kvm_arch_alloc_vm();
   if (!kvm) return ERR_PTR(-ENOMEM);
   spin_lock_init(&kvm->mmu_lock);
-  atomic_inc(&current->mm->mm_count);
+  mmgrab(current->mm);
   kvm->mm = current->mm;
   kvm_eventfd_init(kvm);
   mutex_init(&kvm->lock);
   mutex_init(&kvm->irq_lock);
   mutex_init(&kvm->slots_lock);
   atomic_set(&kvm->users_count, 1);
   INIT_LIST_HEAD(&kvm->devices);
   r = kvm_arch_init_vm(kvm, type);
   if (r) goto out_err_no_disable;
   r = hardware_enable_all();
   if (r) goto out_err_no_disable;
 #ifdef CONFIG_HAVE_KVM_IRQFD
   INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
 #endif
   BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
   r = -ENOMEM;
   for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
     struct kvm_memslots *slots = kvm_alloc_memslots();
     if (!slots) goto out_err_no_srcu;
     /*
      * Generations must be different for each address space.
      * Init kvm generation close to the maximum to easily test the
      * code of handling generation number wrap-around.
      */
     slots->generation = i * 2 - 150;
     rcu_assign_pointer(kvm->memslots[i], slots);
   }
   if (init_srcu_struct(&kvm->srcu)) goto out_err_no_srcu;
   if (init_srcu_struct(&kvm->irq_srcu)) goto out_err_no_irq_srcu;
   for (i = 0; i < KVM_NR_BUSES; i++) {
     kvm->buses[i] = kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL);
     if (!kvm->buses[i]) goto out_err;
   }
   r = kvm_init_mmu_notifier(kvm);
   if (r) goto out_err;
   spin_lock(&kvm_lock);
   list_add(&kvm->vm_list, &vm_list);
   spin_unlock(&kvm_lock);
   preempt_notifier_inc();
   return kvm;
 out_err:
   cleanup_srcu_struct(&kvm->irq_srcu);
 out_err_no_irq_srcu:
   cleanup_srcu_struct(&kvm->srcu);
 out_err_no_srcu:
   hardware_disable_all();
 out_err_no_disable:
   for (i = 0; i < KVM_NR_BUSES; i++)
     kfree(kvm->buses[i]);
   for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
     kvm_free_memslots(kvm, kvm->memslots[i]);
   kvm_arch_free_vm(kvm);
   mmdrop(current->mm);
   return ERR_PTR(r);
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);
--- initial
+++ final
@@ -1,18 +1,18 @@
 void leon_cpu_pre_online(void *arg) {
   int cpuid = hard_smp_processor_id();
   /* Allow master to continue. The master will then give us the
    * go-ahead by setting the smp_commenced_mask and will wait without
    * timeouts until our setup is completed fully (signified by
    * our bit being set in the cpu_online_mask).
    */
   do_swap(&cpu_callin_map[cpuid], 1);
   local_ops->cache_all();
   local_ops->tlb_all();
   /* Fix idle thread fields. */
   __asm__ __volatile__("ld [%0], %%g6\n\t" : : "r"(&current_set[cpuid]) : "memory" /* paranoid */);
   /* Attach to the address space of init_task. */
-  atomic_inc(&init_mm.mm_count);
+  mmgrab(&init_mm);
   current->active_mm = &init_mm;
   while (!cpumask_test_cpu(cpuid, &smp_commenced_mask))
     mb();
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm.mm_count);
+       mmgrab(&init_mm);
--- initial
+++ final
@@ -1,41 +1,41 @@
 void secondary_start_kernel(void) {
   unsigned int cpu = smp_processor_id();
   struct mm_struct *mm = &init_mm;
   if (_bfin_swrst & SWRST_DBL_FAULT_B) {
     printk(KERN_EMERG "CoreB Recovering from DOUBLE FAULT event\n");
 #ifdef CONFIG_DEBUG_DOUBLEFAULT
     printk(KERN_EMERG " While handling exception (EXCAUSE = %#x) at %pF\n", initial_pda_coreb.seqstat_doublefault & SEQSTAT_EXCAUSE, initial_pda_coreb.retx_doublefault);
     printk(KERN_NOTICE "   DCPLB_FAULT_ADDR: %pF\n", initial_pda_coreb.dcplb_doublefault_addr);
     printk(KERN_NOTICE "   ICPLB_FAULT_ADDR: %pF\n", initial_pda_coreb.icplb_doublefault_addr);
 #endif
     printk(KERN_NOTICE " The instruction at %pF caused a double exception\n", initial_pda_coreb.retx);
   }
   /*
    * We want the D-cache to be enabled early, in case the atomic
    * support code emulates cache coherence (see
    * __ARCH_SYNC_CORE_DCACHE).
    */
   init_exception_vectors();
   local_irq_disable();
   /* Attach the new idle task to the global mm. */
   atomic_inc(&mm->mm_users);
-  atomic_inc(&mm->mm_count);
+  mmgrab(mm);
   current->active_mm = mm;
   preempt_disable();
   setup_secondary(cpu);
   platform_secondary_init(cpu);
   /* setup local core timer */
   bfin_local_timer_setup();
   local_irq_enable();
   bfin_setup_caches(cpu);
   notify_cpu_starting(cpu);
   /*
    * Calibrate loops per jiffy value.
    * IRQs need to be enabled here - D-cache can be invalidated
    * in timer irq handler, so core B can read correct jiffies.
    */
   calibrate_delay();
   /* We are done with local CPU inits, unblock the boot CPU. */
   set_cpu_online(cpu, true);
   cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
 }<sep>@@
expression init_mm;
@@
-       atomic_inc(&init_mm->mm_count);
+       mmgrab(init_mm);