1 files changed, 7 insertions, 2 deletions

diff --git a/mm/mmap.c b/mm/mmap.c
index 68b9ad2ef1d6..906ed402f7ca 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1536,9 +1536,14 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
          * vma->vm_start/vm_end cannot change under us because the caller
          * is required to hold the mmap_sem in read mode.  We need the
          * anon_vma lock to serialize against concurrent expand_stacks.
+         * Also guard against wrapping around to address 0.
          */
-        address += 4 + PAGE_SIZE - 1;
-        address &= PAGE_MASK;
+        if (address < PAGE_ALIGN(address+4))
+                address = PAGE_ALIGN(address+4);
+        else {
+                anon_vma_unlock(vma);
+                return -ENOMEM;
+        }
         error = 0;
 
         /* Somebody else might have raced and expanded it already */