if ((regs->cs & 3) != 0 && regs->rip >= TASK_SIZE) 
if ((regs->cs & 3) != 0 && instr >= (unsigned char *)TASK_SIZE) 
static noinline int is_prefetch(struct pt_regs *regs, unsigned long addr,				unsigned long error_code){ 	unsigned char *instr = (unsigned char *)(regs->rip);	int scan_more = 1;	int prefetch = 0; 	unsigned char *max_instr = instr + 15;	/* If it was a exec fault ignore */	if (error_code & (1<<4))		return 0;		/* Code segments in LDT could have a non zero base. Don't check	   when that's possible */	if (regs->cs & (1<<2))		return 0;	if ((regs->cs & 3) != 0 && regs->rip >= TASK_SIZE)		return 0;	while (scan_more && instr < max_instr) { 		unsigned char opcode;		unsigned char instr_hi;		unsigned char instr_lo;		if (__get_user(opcode, instr))			break; 		instr_hi = opcode & 0xf0; 		instr_lo = opcode & 0x0f; 		instr++;		switch (instr_hi) { 		case 0x20:		case 0x30:			/* Values 0x26,0x2E,0x36,0x3E are valid x86			   prefixes.  In long mode, the CPU will signal			   invalid opcode if some of these prefixes are			   present so we will never get here anyway */			scan_more = ((instr_lo & 7) == 0x6);			break;					case 0x40:			/* In AMD64 long mode, 0x40 to 0x4F are valid REX prefixes			   Need to figure out under what instruction mode the			   instruction was issued ... */			/* Could check the LDT for lm, but for now it's good			   enough to assume that long mode only uses well known			   segments or kernel. */			scan_more = ((regs->cs & 3) == 0) || (regs->cs == __USER_CS);			break;					case 0x60:			/* 0x64 thru 0x67 are valid prefixes in all modes. */			scan_more = (instr_lo & 0xC) == 0x4;			break;				case 0xF0:			/* 0xF0, 0xF2, and 0xF3 are valid prefixes in all modes. */			scan_more = !instr_lo || (instr_lo>>1) == 1;			break;					case 0x00:			/* Prefetch instruction is 0x0F0D or 0x0F18 */			scan_more = 0;			if (__get_user(opcode, instr)) 				break;			prefetch = (instr_lo == 0xF) &&				(opcode == 0x0D || opcode == 0x18);			break;					default:			scan_more = 0;			break;		} 	}	return prefetch;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/f1290ec93e5da4a748ca4758a00b580283e06596/fault.c/buggy/arch/x86_64/mm/fault.c