the page count of buddy seems to be buggy under no MMU

This set_page_refs() function is copied from linux-2.6.10 mm/page_alloc.c

static inline void set_page_refs(struct page *page, int order) {

#ifdef CONFIG_MMU
	set_page_count(page, 1);
#else
	int i;

	/*
	 * We need to reference all the pages for this order, otherwise if
	 * anyone accesses one of the pages with (get/put) it will be freed.
	 */
	for (i = 0; i < (1 << order); i++)
		set_page_count(page+i, 1);

#endif /* CONFIG_MMU */
}

So when we are under no MMU, the __free_pages() function also should de-reference all the pages for this order (order > 0), too. However, the current __free_pages() only decrements the first page's refcount, which will cause __free_pages_ok() to dump stack!

---------------------------------------------------------

@@ -786,6 +786,8 @@
 		free_hot_cold_page(pvec->pages[i], pvec->cold);
 }
 
+#ifdef CONFIG_MMU
+
 fastcall void __free_pages(struct page *page, unsigned int order)
 {
 	if (!PageReserved(page) && put_page_testzero(page)) {

@@ -796,6 +798,35 @@
 	}
 }
 
+#else
+
+fastcall void __free_pages(struct page *page, unsigned int order)
+{
+	if (PageReserved(page))
+		return;
+	
+	if (order == 0) {
+		if (put_page_testzero(page))
+			free_hot_page(page);
+	} else {
+		int i, result = 0;
+		
+		/*
+		 * We need to de-reference all the pages for this order -- see

set_page_refs()
+ */
+ for (i = 0; i < (1 << order); i++)
+ result += put_page_testzero(page + i);
+
+ if (result) {
+ if (result != (1 << order))
+ BUG();
+ __free_pages_ok(page, order);
+ }
+ }
+}
+
+#endif /* CONFIG_MMU */
+
EXPORT_SYMBOL(__free_pages);

fastcall void free_pages(unsigned long addr, unsigned int order)

Rongkai Zhan