boundary condition bug in do_mmap()

[Tania Oka <tania@centurysys.co.jp>]

Hello

There seems to be a boundary condition bug in do_mmap()
(include/linux/mm.h).  It is in kernels as late as 2.4.4 (not sure about
later).   I saw it reported on a mailing list a year ago but I guess it
didn't make it to the right place.

In the inline function do_mmap(), there is a check for overflow of the
topmost address (line 449 of include/linux/mm.h in the 2.4.4 kernel I
have):

    if ((offset + PAGE_ALIGN(len)) < offset)

This test causes the function to return -EINVAL if offset is 0xfffff000
and len is 0x1000, although these should be valid values to map the last
4K according to the mmap() man page.

Please forward this to the right place.  I couldn't find anyone specific
in the MAINTAINERS file.

Thank you,
Tania