diff --git a/[refs] b/[refs]
index 6c802487a39a..1fe4cfbf51bb 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5170836679185357dc1b7660bad13287b39e1e33
+refs/heads/master: 7766970cc13e9071b356b1f2a48a9eb8675bfcce
diff --git a/trunk/mm/vmalloc.c b/trunk/mm/vmalloc.c
index 903cad46e796..ed3705e4b83f 100644
--- a/trunk/mm/vmalloc.c
+++ b/trunk/mm/vmalloc.c
@@ -323,6 +323,7 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
 	unsigned long addr;
 	int purged = 0;
 
+	BUG_ON(!size);
 	BUG_ON(size & ~PAGE_MASK);
 
 	va = kmalloc_node(sizeof(struct vmap_area),
@@ -334,6 +335,9 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
 	addr = ALIGN(vstart, align);
 
 	spin_lock(&vmap_area_lock);
+	if (addr + size - 1 < addr)
+		goto overflow;
+
 	/* XXX: could have a last_hole cache */
 	n = vmap_area_root.rb_node;
 	if (n) {
@@ -365,6 +369,8 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
 
 		while (addr + size > first->va_start && addr + size <= vend) {
 			addr = ALIGN(first->va_end + PAGE_SIZE, align);
+			if (addr + size - 1 < addr)
+				goto overflow;
 
 			n = rb_next(&first->rb_node);
 			if (n)
@@ -375,6 +381,7 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
 	}
 found:
 	if (addr + size > vend) {
+overflow:
 		spin_unlock(&vmap_area_lock);
 		if (!purged) {
 			purge_vmap_area_lazy();