diff --git a/drivers/video/tegra/nvmap/nvmap_alloc.c b/drivers/video/tegra/nvmap/nvmap_alloc.c
index c2e22879..daf38d6b 100644
--- a/drivers/video/tegra/nvmap/nvmap_alloc.c
+++ b/drivers/video/tegra/nvmap/nvmap_alloc.c
@@ -1037,7 +1037,7 @@ void _nvmap_handle_free(struct nvmap_handle *h)
 		h->pgalloc.pages[i] = nvmap_to_page(h->pgalloc.pages[i]);
 
 #ifdef NVMAP_CONFIG_PAGE_POOLS
-	if (!h->from_va)
+	if (!h->from_va && !h->is_subhandle)
 		page_index = nvmap_page_pool_fill_lots(&nvmap_dev->pool,
 					h->pgalloc.pages, nr_page);
 #endif
diff --git a/drivers/video/tegra/nvmap/nvmap_fault.c b/drivers/video/tegra/nvmap/nvmap_fault.c
index 9692846c..dacf46db 100644
--- a/drivers/video/tegra/nvmap/nvmap_fault.c
+++ b/drivers/video/tegra/nvmap/nvmap_fault.c
@@ -130,7 +130,7 @@ unlock:
 static void nvmap_vma_close(struct vm_area_struct *vma)
 {
 	struct nvmap_vma_priv *priv = vma->vm_private_data;
-	struct nvmap_vma_list *vma_list;
+	struct nvmap_vma_list *vma_list, *tmp_list;
 	struct nvmap_handle *h;
 	bool vma_found = false;
 	size_t nr_page, i;
@@ -144,7 +144,7 @@ static void nvmap_vma_close(struct vm_area_struct *vma)
 	nr_page = h->size >> PAGE_SHIFT;
 
 	mutex_lock(&h->lock);
-	list_for_each_entry(vma_list, &h->vmas, list) {
+	list_for_each_entry_safe(vma_list, tmp_list, &h->vmas, list) {
 		if (vma_list->vma != vma)
 			continue;
 		if (atomic_dec_return(&vma_list->ref) == 0) {
diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c
index 17289c90..b64d46a5 100644
--- a/drivers/video/tegra/nvmap/nvmap_ioctl.c
+++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c
@@ -1580,11 +1580,14 @@ int nvmap_ioctl_get_fd_from_list(struct file *filp, void __user *arg)
 	}
 	/* Create new handle for the size */
 	ref = nvmap_create_handle(client, hrange.sz, false);
-	if (IS_ERR_OR_NULL(ref))
+	if (IS_ERR_OR_NULL(ref)) {
+		err = -EINVAL;
 		goto free_hs;
+	}
 
 	ref->handle->orig_size = hrange.sz;
 	h = ref->handle;
+	mutex_init(&h->pg_ref_h_lock);
 
 	/* Assign pages from the handles to newly created nvmap handle */
 	err =  nvmap_assign_pages_to_handle(client, hs, h, &hrange);