From: Hugh Dickins <hugh@veritas.com>

The problem is in the flexible mmap patch: arch_get_unmapped_area_topdown
is liable to give your mmap vm_start above TASK_SIZE with vm_end wrapped;
which is confusing, and ends up as that BUG_ON(mm->map_count).

The patch below stops that behaviour, but it's not the full solution:
wilson_mmap_test -s 1000 then simply cannot allocate memory for the
large mmap, whereas it works fine non-top-down.

I think it's wrong to interpret a large or rlim_infinite stack rlimit
as an inviolable request to reserve that much for the stack: it makes
much less VM available than bottom up, not what was intended.  Perhaps
top down should go bottom up (instead of belly up) when it fails -
but I'd probably better leave that to Ingo.

Or perhaps the default should place stack below text (as WLI suggested
and ELF intended, with its text defaulting to 0x08048000, small progs
sharing page table between stack and text and data); with a further
personality for those needing bigger stack.

Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 25-akpm/mm/mmap.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

diff -puN mm/mmap.c~flexible-mmap-bug-fix mm/mmap.c
--- 25/mm/mmap.c~flexible-mmap-bug-fix	2004-07-26 23:22:36.399107864 -0700
+++ 25-akpm/mm/mmap.c	2004-07-26 23:22:36.409106344 -0700
@@ -1107,12 +1107,12 @@ arch_get_unmapped_area_topdown(struct fi
 			return addr;
 	}
 
+try_again:
 	/* make sure it can fit in the remaining address space */
 	if (mm->free_area_cache < len)
 		goto fail;
 
 	/* either no address requested or cant fit in requested address hole */
-try_again:
 	addr = (mm->free_area_cache - len) & PAGE_MASK;
 	do {
 		/*
_