From a07f0bf0608aeda53f489cf51fc7a58843361133 Mon Sep 17 00:00:00 2001
From: Hugh Dickins <hugh@veritas.com>
Date: Tue, 11 Oct 2005 19:16:26 +0100
Subject: [PATCH] --- yaml --- r: 9811 b: refs/heads/master c:
 f5154a98a1931641f0448f6512294a15279110d7 h: refs/heads/master i:   9809:
 4058bcf67dd8364e715f1489cfe662c4b64b5858   9807:
 79675e9c5a9d45b28013a992fc1d79862c7bb1e2 v: v3

---
 [refs]            | 2 +-
 trunk/mm/fremap.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 0032606e47a3..88bdf0247853 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 9149ccfa3571eaa4a4b444777d67fc4ed3ebcf27
+refs/heads/master: f5154a98a1931641f0448f6512294a15279110d7
diff --git a/trunk/mm/fremap.c b/trunk/mm/fremap.c
index 3235fb77c133..ab23a0673c35 100644
--- a/trunk/mm/fremap.c
+++ b/trunk/mm/fremap.c
@@ -89,6 +89,9 @@ int install_page(struct mm_struct *mm, struct vm_area_struct *vma,
 	size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 	if (!page->mapping || page->index >= size)
 		goto err_unlock;
+	err = -ENOMEM;
+	if (page_mapcount(page) > INT_MAX/2)
+		goto err_unlock;
 
 	zap_pte(mm, vma, addr, pte);