summaryrefslogtreecommitdiff
path: root/mm/bootmem.c
diff options
context:
space:
mode:
authorGavin Shan <shangw@linux.vnet.ibm.com>2012-05-30 02:06:32 +0400
committerLinus Torvalds <torvalds@linux-foundation.org>2012-05-30 03:22:21 +0400
commit6dccdcbe2c3ebe152847ac8507e7bded4e3f4546 (patch)
tree32d748a8b981e98b64547ab8a7064453b7686334 /mm/bootmem.c
parent955c1cd7401565671b064e499115344ec8067dfd (diff)
downloadlinux-6dccdcbe2c3ebe152847ac8507e7bded4e3f4546.tar.xz
mm: bootmem: fix checking the bitmap when finally freeing bootmem
When bootmem releases an unaligned chunk of memory at the beginning of a node to the page allocator, it iterates from that unaligned PFN but checks an aligned word of the page bitmap. The checked bits do not correspond to the PFNs and, as a result, reserved pages can be freed. Properly shift the bitmap word so that the lowest bit corresponds to the starting PFN before entering the freeing loop. This bug has been around since commit 41546c17418f ("bootmem: clean up free_all_bootmem_core") (2.6.27) without known reports. Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com> Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Acked-by: Tejun Heo <tj@kernel.org> Acked-by: David S. Miller <davem@davemloft.net> Cc: Yinghai Lu <yinghai@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm/bootmem.c')
-rw-r--r--mm/bootmem.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 0131170c9d54..67872fca97d9 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -203,6 +203,7 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
} else {
unsigned long off = 0;
+ vec >>= start & (BITS_PER_LONG - 1);
while (vec && off < BITS_PER_LONG) {
if (vec & 1) {
page = pfn_to_page(start + off);