On Wed, 21 Aug 2013 07:39:35 +0800 Wanpeng Li <liwanp@xxxxxxxxxxxxxxxxxx> wrote: > >Nope. If the error path is taken, free_pmds() will free uninitialised > >items from pmds[], which is a local in pgd_alloc() and contains random > >stack junk. The kernel will crash. > > > >You could pass an nr_pmds argument to free_pmds(), or zero out the > >remaining items on the error path. However, although the current code > >is a bit kooky, I don't see that it is harmful in any way. > > > > There is a check in free_pmds(): > > if (pmds[i]) > free_page((unsigned long)pmds[i]); > > which will avoid the issue you mentioned. pmds[i] is uninitialized. It gets allocated on the stack in pgd_alloc() and does not get zeroed. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>