From eece2b71e012f3a4d0c4952fe87452998121bd7a Mon Sep 17 00:00:00 2001 From: Gavin Shan Date: Tue, 29 May 2012 15:06:32 -0700 Subject: [PATCH] mm: bootmem: fix checking the bitmap when finally freeing bootmem When bootmem releases an unaligned chunk of memory at the beginning of a node to the page allocator, it iterates from that unaligned PFN but checks an aligned word of the page bitmap. The checked bits do not correspond to the PFNs and, as a result, reserved pages can be freed. Properly shift the bitmap word so that the lowest bit corresponds to the starting PFN before entering the freeing loop. This bug has been around since commit f7bae92d0af0 ("bootmem: clean up free_all_bootmem_core") (2.6.27) without known reports. Signed-off-by: Gavin Shan Signed-off-by: Johannes Weiner Acked-by: Tejun Heo Acked-by: David S. Miller Cc: Yinghai Lu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- mm/bootmem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/bootmem.c b/mm/bootmem.c index 0131170c9d540..67872fca97d96 100644 --- a/mm/bootmem.c +++ b/mm/bootmem.c @@ -203,6 +203,7 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata) } else { unsigned long off = 0; + vec >>= start & (BITS_PER_LONG - 1); while (vec && off < BITS_PER_LONG) { if (vec & 1) { page = pfn_to_page(start + off); -- 2.39.5