Messages in this thread Patch in this message | | | From | Roland Dreier <> | Subject | [PATCH 1/2] btree: Fix tree corruption in btree_get_prev() | Date | Wed, 6 Jun 2012 10:17:26 -0700 |
| |
From: Roland Dreier <roland@purestorage.com>
The memory the parameter __key points to is used as an iterator in btree_get_prev(), so if we save off a bkey() pointer in retry_key and then assign that to __key, we'll end up corrupting the btree internals when we do eg
longcpy(__key, bkey(geo, node, i), geo->keylen);
to return the key value. What we should do instead is use longcpy() to copy the key value that retry_key points to __key.
This can cause a btree to get corrupted by seemingly read-only operations such as btree_for_each_safe.
Acked-by: Joern Engel <joern@logfs.org> Cc: <stable@vger.kernel.org> Signed-off-by: Roland Dreier <roland@purestorage.com> --- lib/btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/btree.c b/lib/btree.c index e5ec1e9..b6e889b 100644 --- a/lib/btree.c +++ b/lib/btree.c @@ -351,7 +351,7 @@ retry: } miss: if (retry_key) { - __key = retry_key; + longcpy(__key, retry_key, geo->keylen); retry_key = NULL; goto retry; } -- 1.7.9.5
| |