Konstantin, Andrew, On Fri, Feb 05, 2016 at 02:19:40PM -0800, Andrew Morton wrote: > On Fri, 5 Feb 2016 10:05:02 -0800 Jeremiah Mahler <[email protected]> wrote: > [...] > > This should fix it up. > > From: Konstantin Khlebnikov <[email protected]> > Subject: radix-tree: fix oops after radix_tree_iter_retry > > Helper radix_tree_iter_retry() resets next_index to the current index. In > following radix_tree_next_slot current chunk size becomes zero. This > isn't checked and it tries to dereference null pointer in slot. > > Tagged iterator is fine because retry happens only at slot 0 where tag > bitmask in iter->tags is filled with single bit. > > Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") > Signed-off-by: Konstantin Khlebnikov <[email protected]> > Cc: Matthew Wilcox <[email protected]> > Cc: Hugh Dickins <[email protected]> > Cc: Ohad Ben-Cohen <[email protected]> > Cc: Jeremiah Mahler <[email protected]> > Cc: <[email protected]> > Signed-off-by: Andrew Morton <[email protected]> > --- > > include/linux/radix-tree.h | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff -puN > include/linux/radix-tree.h~radix-tree-fix-oops-after-radix_tree_iter_retry > include/linux/radix-tree.h > --- > a/include/linux/radix-tree.h~radix-tree-fix-oops-after-radix_tree_iter_retry > +++ a/include/linux/radix-tree.h > @@ -400,7 +400,7 @@ void **radix_tree_iter_retry(struct radi > * @iter: pointer to radix tree iterator > * Returns: current chunk size > */ > -static __always_inline unsigned > +static __always_inline long > radix_tree_chunk_size(struct radix_tree_iter *iter) > { > return iter->next_index - iter->index; > @@ -434,9 +434,9 @@ radix_tree_next_slot(void **slot, struct > return slot + offset + 1; > } > } else { > - unsigned size = radix_tree_chunk_size(iter) - 1; > + long size = radix_tree_chunk_size(iter); > > - while (size--) { > + while (--size > 0) { > slot++; > iter->index++; > if (likely(*slot)) > _ >
Fix is still working great after a couple days. Tested-by: Jeremiah Mahler <[email protected]> -- - Jeremiah Mahler
