diff --git a/components/lwp/lwp_user_mm.c b/components/lwp/lwp_user_mm.c
index 1bdd5537cfab3ffe1a59cce2c747067a08ba9350..57dfb5338ba9833f9c206a21887c3eae86547e3c 100644
--- a/components/lwp/lwp_user_mm.c
+++ b/components/lwp/lwp_user_mm.c
@@ -362,8 +362,12 @@ void *lwp_map_user_phy(struct rt_lwp *lwp, void *map_va, void *map_pa,
         va = RT_NULL;
         LOG_W("%s", __func__);
     }
+    else
+    {
+        va += offset;
+    }
 
-    return va + offset;
+    return va;
 }
 
 rt_base_t lwp_brk(void *addr)
diff --git a/components/mm/mm_aspace.c b/components/mm/mm_aspace.c
index b42cdfb5a4a60edbea0cd3330243ce960766f2e5..e171af15d53fe1a31b59bc267f44a887311ba2fb 100644
--- a/components/mm/mm_aspace.c
+++ b/components/mm/mm_aspace.c
@@ -75,12 +75,12 @@ static inline void _varea_uninstall(rt_varea_t varea)
 
     rt_varea_free_pages(varea);
 
+    rt_hw_mmu_unmap(aspace, varea->start, varea->size);
+    rt_hw_tlb_invalidate_range(aspace, varea->start, varea->size, ARCH_PAGE_SIZE);
+
     WR_LOCK(aspace);
     _aspace_bst_remove(aspace, varea);
     WR_UNLOCK(aspace);
-
-    rt_hw_mmu_unmap(aspace, varea->start, varea->size);
-    rt_hw_tlb_invalidate_range(aspace, varea->start, varea->size, ARCH_PAGE_SIZE);
 }
 
 int _init_lock(rt_aspace_t aspace)