I have invented a new software development methodology! You send an
email to Hugh saying "I don't have the foggiest idea why this guy's
kernel is oopsing" and next morning, you get a patch! I shall patent
this.

Since 2.5.3, move_vma() has been passing a freed vma into
move_page_tables().  Fix it to move back to the previous vma in the
list if we're about to delete this one.

Thanks to Morten Helgesen for patient reporting, diagnosis and testing.