From: Hugh Dickins objrmap must check lest address wrapped below vma->vm_start. 25-akpm/mm/rmap.c | 6 +----- 1 files changed, 1 insertion(+), 5 deletions(-) diff -puN mm/rmap.c~hugh-06-wrap-below-vm_start mm/rmap.c --- 25/mm/rmap.c~hugh-06-wrap-below-vm_start Tue Mar 25 18:34:51 2003 +++ 25-akpm/mm/rmap.c Tue Mar 25 18:34:51 2003 @@ -101,12 +101,8 @@ find_pte(struct vm_area_struct *vma, str unsigned long address; loffset = (page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT)); - if (loffset < vma->vm_pgoff) - goto out; - address = vma->vm_start + ((loffset - vma->vm_pgoff) << PAGE_SHIFT); - - if (address >= vma->vm_end) + if (address < vma->vm_start || address >= vma->vm_end) goto out; pgd = pgd_offset(mm, address); _