fix bug in releasing subpages in free()