There is a possibility that get_page_bootmem() is called to the same page many times. So when get_page_bootmem is called to the same page, the function only increments page->_count. CC: Len Brown <len.brown@xxxxxxxxx> CC: Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> CC: Paul Mackerras <paulus@xxxxxxxxx> CC: Christoph Lameter <cl@xxxxxxxxx> Cc: Minchan Kim <minchan.kim@xxxxxxxxx> CC: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> CC: KOSAKI Motohiro <kosaki.motohiro@xxxxxxxxxxxxxx> CC: Wen Congyang <wency@xxxxxxxxxxxxxx> Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@xxxxxxxxxxxxxx> Index: linux-3.5-rc4/mm/memory_hotplug.c =================================================================== --- linux-3.5-rc4.orig/mm/memory_hotplug.c 2012-06-26 13:56:34.371988312 +0900 +++ linux-3.5-rc4/mm/memory_hotplug.c 2012-06-26 14:03:37.564697621 +0900 @@ -95,10 +95,17 @@ static void release_memory_resource(stru static void get_page_bootmem(unsigned long info, struct page *page, unsigned long type) { - page->lru.next = (struct list_head *) type; - SetPagePrivate(page); - set_page_private(page, info); - atomic_inc(&page->_count); + unsigned long page_type; + + page_type = (unsigned long) page->lru.next; + if (type < MEMORY_HOTPLUG_MIN_BOOTMEM_TYPE || + type > MEMORY_HOTPLUG_MAX_BOOTMEM_TYPE){ + page->lru.next = (struct list_head *) type; + SetPagePrivate(page); + set_page_private(page, info); + atomic_inc(&page->_count); + } else + atomic_inc(&page->_count); } /* reference to __meminit __free_pages_bootmem is valid -- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html