diff --git a/drivers/ub/obmm/obmm_shm_dev.c b/drivers/ub/obmm/obmm_shm_dev.c
index e70792673a80a13b0419746d4ae6a05b36729a13..56b61926242a962048a68f57097498c110965672 100644
--- a/drivers/ub/obmm/obmm_shm_dev.c
+++ b/drivers/ub/obmm/obmm_shm_dev.c
@@ -48,7 +48,17 @@ static void obmm_vma_close(struct vm_area_struct *vma)
 
 	mutex_lock(&reg->state_mutex);
 
-	cache_ops = update_vma_perm_count(reg, region_pgoff, npages, access, OBMM_SHM_MEM_NO_ACCESS);
+	/*
+	 * Only the cacheable mappings take part in the ownership counters:
+	 * an O_SYNC mapping of a cc region was mapped without counting it,
+	 * so it must not decrement the counters on the way out. The mode is
+	 * INIT only while no mapping exists, and a region cannot be mapped
+	 * cacheable and non-cacheable at the same time.
+	 */
+	cache_ops = OBMM_SHM_CACHE_NONE;
+	if (reg->mmap_mode == OBMM_MMAP_NORMAL)
+		cache_ops = update_vma_perm_count(reg, region_pgoff, npages,
+						  access, OBMM_SHM_MEM_NO_ACCESS);
 
 	if (cache_ops != OBMM_SHM_CACHE_NONE && reg->mmap_mode == OBMM_MMAP_NORMAL) {
 		ret = obmm_region_flush_range(reg, region_pgoff << PAGE_SHIFT,