summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChris Metcalf <cmetcalf@tilera.com>2011-12-01 12:51:05 -0500
committerChris Metcalf <cmetcalf@tilera.com>2011-12-03 15:31:47 -0500
commitc2851a9b1caa420c2cdbd517617166990e3723c0 (patch)
treebd888b6b0451f96b58c41dd9d8b1b25f4d362587
parent3989efb77046ad334518b6cddcf817184affe7c9 (diff)
downloadop-kernel-dev-c2851a9b1caa420c2cdbd517617166990e3723c0.zip
op-kernel-dev-c2851a9b1caa420c2cdbd517617166990e3723c0.tar.gz
arch/tile: fix double-free bug in homecache_free_pages()
When freeing the page with this API, the page was "put" twice. This was only discovered bringing up an MPT fusion controller, which actually used the API; it hadn't been invoked previously, so the bug had gone unnoticed. Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
-rw-r--r--arch/tile/mm/homecache.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/arch/tile/mm/homecache.c b/arch/tile/mm/homecache.c
index cbe6f4f..1cc6ae4 100644
--- a/arch/tile/mm/homecache.c
+++ b/arch/tile/mm/homecache.c
@@ -449,9 +449,12 @@ void homecache_free_pages(unsigned long addr, unsigned int order)
VM_BUG_ON(!virt_addr_valid((void *)addr));
page = virt_to_page((void *)addr);
if (put_page_testzero(page)) {
- int pages = (1 << order);
homecache_change_page_home(page, order, initial_page_home());
- while (pages--)
- __free_page(page++);
+ if (order == 0) {
+ free_hot_cold_page(page, 0);
+ } else {
+ init_page_count(page);
+ __free_pages(page, order);
+ }
}
}
OpenPOWER on IntegriCloud