lkml.org 
[lkml]   [2004]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] bug in radix_tree_delete
From
Date
I was looking through the radix tree code and came across what I think
is a bug in radix_tree_delete.

for (idx = 0; idx < RADIX_TREE_TAG_LONGS; idx++) {
if (pathp[0].node->tags[tag][idx]) {
tags[tag] = 1;
nr_cleared_tags--;
break;
}
}

The above loop should only be executed if tags[tag] is zero. Otherwise,
when walking up the tree, we can decrement nr_cleared_tags twice or more
for the same value of tag, thus potentially exiting the outer loop too
early.

radix-tree: Ensure that nr_cleared_tags is only decremented once for each tag.

Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
diff -Nurp linux-2.6.10-rc1-mm4/lib/radix-tree.c linux/lib/radix-tree.c
--- linux-2.6.10-rc1-mm4/lib/radix-tree.c 2004-11-10 14:45:18.259269000 -0600
+++ linux/lib/radix-tree.c 2004-11-10 14:45:59.292031072 -0600
@@ -725,8 +725,10 @@ void *radix_tree_delete(struct radix_tre
for (tag = 0; tag < RADIX_TREE_TAGS; tag++) {
int idx;

- if (!tags[tag])
- tag_clear(pathp[0].node, tag, pathp[0].offset);
+ if (tags[tag])
+ continue;
+
+ tag_clear(pathp[0].node, tag, pathp[0].offset);

for (idx = 0; idx < RADIX_TREE_TAG_LONGS; idx++) {
if (pathp[0].node->tags[tag][idx]) {

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:07    [W:0.034 / U:4.852 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site