merging ppref could cause negative back reference, fix from niklas@

1 files changed, 5 insertions, 3 deletions

diff --git a/sys/uvm/uvm_amap.c b/sys/uvm/uvm_amap.c
index de6bea7db3e..6bb844233e9 100644
--- a/sys/uvm/uvm_amap.c
+++ b/sys/uvm/uvm_amap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_amap.c,v 1.23 2002/02/19 17:57:34 provos Exp $	*/
+/*	$OpenBSD: uvm_amap.c,v 1.24 2002/02/20 20:16:23 provos Exp $	*/
 /*	$NetBSD: uvm_amap.c,v 1.27 2000/11/25 06:27:59 chs Exp $	*/
 
 /*
@@ -954,7 +954,8 @@ amap_pp_adjref(amap, curslot, slotlen, adjval)
 		}
 		prevlcv = lcv;
 	}
-	pp_getreflen(ppref, prevlcv, &prevref, &prevlen);
+	if (prevlcv >= 0)
+		pp_getreflen(ppref, prevlcv, &prevref, &prevlen);
 
 	/*
 	 * now adjust reference counts in range.  merge the first
@@ -975,7 +976,8 @@ amap_pp_adjref(amap, curslot, slotlen, adjval)
 		ref += adjval;
 		if (ref < 0)
 			panic("amap_pp_adjref: negative reference count");
-		if (lcv == prevlcv + prevlen && ref == prevref) {
+		if (prevlcv >= 0 && lcv == prevlcv + prevlen &&
+		    ref == prevref) {
 			pp_setreflen(ppref, prevlcv, ref, prevlen + len);
 		} else {
 			pp_setreflen(ppref, lcv, ref, len);