--- /dev/null
+From a70dcb969f64e2fa98c24f47854f20bf02ff0092 Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Date: Thu, 6 Nov 2008 12:53:36 -0800
+Subject: memory hotplug: fix page_zone() calculation in test_pages_isolated()
+
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+
+commit a70dcb969f64e2fa98c24f47854f20bf02ff0092 upstream.
+
+My last bugfix here (adding zone->lock) introduced a new problem: Using
+page_zone(pfn_to_page(pfn)) to get the zone after the for() loop is wrong.
+ pfn will then be >= end_pfn, which may be in a different zone or not
+present at all. This may lead to an addressing exception in page_zone()
+or spin_lock_irqsave().
+
+Now I use __first_valid_page() again after the loop to find a valid page
+for page_zone().
+
+Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Acked-by: Nathan Fontenot <nfont@austin.ibm.com>
+Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_isolation.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/mm/page_isolation.c
++++ b/mm/page_isolation.c
+@@ -130,10 +130,11 @@ int test_pages_isolated(unsigned long st
+ if (page && get_pageblock_migratetype(page) != MIGRATE_ISOLATE)
+ break;
+ }
+- if (pfn < end_pfn)
++ page = __first_valid_page(start_pfn, end_pfn - start_pfn);
++ if ((pfn < end_pfn) || !page)
+ return -EBUSY;
+ /* Check all pages are free or Marked as ISOLATED */
+- zone = page_zone(pfn_to_page(pfn));
++ zone = page_zone(page);
+ spin_lock_irqsave(&zone->lock, flags);
+ ret = __test_page_isolated_in_pageblock(start_pfn, end_pfn);
+ spin_unlock_irqrestore(&zone->lock, flags);