Index: linux-2.6.20-rc7/mm/memory.c
===================================================================
--- linux-2.6.20-rc7.orig/mm/memory.c	2007-01-31 18:03:43.000000000 -0800
+++ linux-2.6.20-rc7/mm/memory.c	2007-01-31 19:15:40.000000000 -0800
@@ -683,12 +683,13 @@ static unsigned long zap_pte_range(struc
 			}
 			page_remove_rmap(page, vma);
 			if (vma->vm_flags & VM_LOCKED) {
+				printk("Freeing mlocked vma page=%p vma_count=%d mlocked=%d mlocked=%ld\n", page, mlock_vma_count(page), PageMlocked(page), global_page_state(NR_MLOCK));
 				/*
-				 * Now for the expensive part ... Must take
-				 * page lock to hold off new vma references
+				 * Somehow we need to protect against new
+				 * vmas being added while we process this page
 				 */
 				lock_page(page);
-				if (mlock_vma_count(page) > 1 &&
+				if (mlock_vma_count(page) == 0 &&
 						TestClearPageMlocked(page)) {
 					/* The MLOCK state of the page changed */
 					dec_zone_page_state(page, NR_MLOCK);