summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTang Chen <tangchen@cn.fujitsu.com>2014-08-29 15:18:31 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2014-08-29 16:28:15 -0700
commit0cfb8f0c3e21e36d4a6e472e4c419d58ba848698 (patch)
treeb1a56e06c5ec06051c4f9b3717e6771bc0dfdd53
parent800df627e2eabaf4a921d342a1d5162c843b7fc2 (diff)
downloadlinux-stable-0cfb8f0c3e21e36d4a6e472e4c419d58ba848698.tar.gz
linux-stable-0cfb8f0c3e21e36d4a6e472e4c419d58ba848698.tar.bz2
linux-stable-0cfb8f0c3e21e36d4a6e472e4c419d58ba848698.zip
memblock, memhotplug: fix wrong type in memblock_find_in_range_node().
In memblock_find_in_range_node(), we defined ret as int. But it should be phys_addr_t because it is used to store the return value from __memblock_find_range_bottom_up(). The bug has not been triggered because when allocating low memory near the kernel end, the "int ret" won't turn out to be negative. When we started to allocate memory on other nodes, and the "int ret" could be minus. Then the kernel will panic. A simple way to reproduce this: comment out the following code in numa_init(), memblock_set_bottom_up(false); and the kernel won't boot. Reported-by: Xishi Qiu <qiuxishi@huawei.com> Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com> Tested-by: Xishi Qiu <qiuxishi@huawei.com> Cc: <stable@vger.kernel.org> [3.13+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--mm/memblock.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/mm/memblock.c b/mm/memblock.c
index 6d2f219a48b0..70fad0c0dafb 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -192,8 +192,7 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size,
phys_addr_t align, phys_addr_t start,
phys_addr_t end, int nid)
{
- int ret;
- phys_addr_t kernel_end;
+ phys_addr_t kernel_end, ret;
/* pump up @end */
if (end == MEMBLOCK_ALLOC_ACCESSIBLE)