diff options
| author | Chris Metcalf <cmetcalf@tilera.com> | 2011-12-01 12:51:05 -0500 |
|---|---|---|
| committer | Chris Metcalf <cmetcalf@tilera.com> | 2011-12-03 15:31:47 -0500 |
| commit | c2851a9b1caa420c2cdbd517617166990e3723c0 (patch) | |
| tree | bd888b6b0451f96b58c41dd9d8b1b25f4d362587 /arch/tile | |
| parent | 3989efb77046ad334518b6cddcf817184affe7c9 (diff) | |
| download | op-kernel-dev-c2851a9b1caa420c2cdbd517617166990e3723c0.zip op-kernel-dev-c2851a9b1caa420c2cdbd517617166990e3723c0.tar.gz | |
arch/tile: fix double-free bug in homecache_free_pages()
When freeing the page with this API, the page was "put" twice.
This was only discovered bringing up an MPT fusion controller, which
actually used the API; it hadn't been invoked previously, so the bug
had gone unnoticed.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
Diffstat (limited to 'arch/tile')
| -rw-r--r-- | arch/tile/mm/homecache.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/arch/tile/mm/homecache.c b/arch/tile/mm/homecache.c index cbe6f4f..1cc6ae4 100644 --- a/arch/tile/mm/homecache.c +++ b/arch/tile/mm/homecache.c @@ -449,9 +449,12 @@ void homecache_free_pages(unsigned long addr, unsigned int order) VM_BUG_ON(!virt_addr_valid((void *)addr)); page = virt_to_page((void *)addr); if (put_page_testzero(page)) { - int pages = (1 << order); homecache_change_page_home(page, order, initial_page_home()); - while (pages--) - __free_page(page++); + if (order == 0) { + free_hot_cold_page(page, 0); + } else { + init_page_count(page); + __free_pages(page, order); + } } } |
