Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: Ioremap: fix wrong physical address handling in PAT code
  x86, tlb: Clean up and correct used type
  x86, iomap: Fix wrong page aligned size calculation in ioremapping code
  x86, mm: Create symbolic index into address_markers array
  x86, ioremap: Fix normal ram range check
  x86, ioremap: Fix incorrect physical address handling in PAE mode
  x86-64, mm: Initialize VDSO earlier on 64 bits
  x86, kmmio/mmiotrace: Fix double free of kmmio_fault_pages

1 files changed, 13 insertions, 3 deletions

diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
index 5d0e67fff1a6..e5d5e2ce9f77 100644
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -45,6 +45,8 @@ struct kmmio_fault_page {
          * Protected by kmmio_lock, when linked into kmmio_page_table.
          */
         int count;
+
+        bool scheduled_for_release;
 };
 
 struct kmmio_delayed_release {
@@ -398,8 +400,11 @@ static void release_kmmio_fault_page(unsigned long page,
         BUG_ON(f->count < 0);
         if (!f->count) {
                 disarm_kmmio_fault_page(f);
-                f->release_next = *release_list;
-                *release_list = f;
+                if (!f->scheduled_for_release) {
+                        f->release_next = *release_list;
+                        *release_list = f;
+                        f->scheduled_for_release = true;
+                }
         }
 }
 
@@ -471,8 +476,10 @@ static void remove_kmmio_fault_pages(struct rcu_head *head)
                         prevp = &f->release_next;
                 } else {
                         *prevp = f->release_next;
+                        f->release_next = NULL;
+                        f->scheduled_for_release = false;
                 }
-                f = f->release_next;
+                f = *prevp;
         }
         spin_unlock_irqrestore(&kmmio_lock, flags);
 
@@ -510,6 +517,9 @@ void unregister_kmmio_probe(struct kmmio_probe *p)
         kmmio_count--;
         spin_unlock_irqrestore(&kmmio_lock, flags);
 
+        if (!release_list)
+                return;
+
         drelease = kmalloc(sizeof(*drelease), GFP_ATOMIC);
         if (!drelease) {
                 pr_crit("leaking kmmio_fault_page objects.\n");