Index: /trunk/src/VBox/Runtime/r0drv/linux/memobj-r0drv-linux.c
===================================================================
--- /trunk/src/VBox/Runtime/r0drv/linux/memobj-r0drv-linux.c	(revision 22679)
+++ /trunk/src/VBox/Runtime/r0drv/linux/memobj-r0drv-linux.c	(revision 22680)
@@ -1207,4 +1207,8 @@
     int                 rc           = VERR_NO_MEMORY;
     PRTR0MEMOBJLNX      pMemLnx;
+#ifdef VBOX_USE_PAE_HACK
+    struct page        *pDummyPage;
+    RTHCPHYS            DummyPhys;
+#endif
 
     /*
@@ -1215,4 +1219,15 @@
     if (uAlignment > PAGE_SIZE)
         return VERR_NOT_SUPPORTED;
+
+#ifdef VBOX_USE_PAE_HACK
+    /*
+     * Allocate a dummy page for use when mapping the memory.
+     */
+    pDummyPage = alloc_page(GFP_USER);
+    if (!pDummyPage)
+        return VERR_NO_MEMORY;
+    SetPageReserved(pDummyPage);
+    DummyPhys = page_to_phys(pDummyPage);
+#endif
 
     /*
@@ -1238,13 +1253,4 @@
             const size_t    cPages = pMemLnxToMap->Core.cb >> PAGE_SHIFT;
             size_t          iPage;
-#ifdef VBOX_USE_PAE_HACK
-            struct page    *pDummyPage = alloc_page(GFP_USER);
-            RTHCPHYS        DummyPhys;
-
-            if (!pDummyPage)
-                goto l_error;
-            SetPageReserved(pDummyPage);
-            DummyPhys = page_to_phys(pDummyPage);
-#endif
 
             rc = 0;
@@ -1330,10 +1336,10 @@
                 }
             }
+            if (!rc)
+            {
+                up_write(&pTask->mm->mmap_sem);
 #ifdef VBOX_USE_PAE_HACK
-            __free_page(pDummyPage);
-#endif
-            if (!rc)
-            {
-                up_write(&pTask->mm->mmap_sem);
+                __free_page(pDummyPage);
+#endif
 
                 pMemLnx->Core.pv = pv;
@@ -1348,12 +1354,10 @@
             MY_DO_MUNMAP(pTask->mm, (unsigned long)pv, pMemLnxToMap->Core.cb);
         }
-
+        up_write(&pTask->mm->mmap_sem);
+        rtR0MemObjDelete(&pMemLnx->Core);
+    }
 #ifdef VBOX_USE_PAE_HACK
-l_error:
-#endif
-        up_write(&pTask->mm->mmap_sem);
-
-        rtR0MemObjDelete(&pMemLnx->Core);
-    }
+    __free_page(pDummyPage);
+#endif
 
     return rc;