Bootmem isn't popular any more, but some architectures still use
it, and freeing to bootmem after calling free_all_bootmem_core()
can end up scribbling over random memory. Instead, make sure the
kernel panics by ensuring the node_bootmem_map field is non-NULL
when are freeing or marking bootmem.
An instance of this bug was just fixed in the tile architecture
("tile: use free_bootmem_late() for initrd") and catching this case
more widely seems like a good thing.
Signed-off-by: Chris Metcalf <cmetc...@ezchip.com>
---
mm/bootmem.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/mm/bootmem.c b/mm/bootmem.c
index a23dd1934654..178748259736 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -236,6 +236,7 @@ static unsigned long __init
free_all_bootmem_core(bootmem_data_t *bdata)
count += pages;
while (pages--)
__free_pages_bootmem(page++, cur++, 0);
+ bdata->node_bootmem_map = NULL;
bdebug("nid=%td released=%lx\n", bdata - bootmem_node_data, count);
@@ -294,6 +295,8 @@ static void __init __free(bootmem_data_t *bdata,
sidx + bdata->node_min_pfn,
eidx + bdata->node_min_pfn);
+ BUG_ON(bdata->node_bootmem_map == NULL);
+
if (bdata->hint_idx > sidx)
bdata->hint_idx = sidx;
@@ -314,6 +317,8 @@ static int __init __reserve(bootmem_data_t *bdata, unsigned
long sidx,
eidx + bdata->node_min_pfn,
flags);
+ BUG_ON(bdata->node_bootmem_map == NULL);
+
for (idx = sidx; idx < eidx; idx++)
if (test_and_set_bit(idx, bdata->node_bootmem_map)) {
if (exclusive) {
--
2.1.2
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
