[lkml]   [2012]   [Jun]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[ 04/42] btree: fix tree corruption in btree_get_prev()
    3.4-stable review patch.  If anyone has any objections, please let me know.


    From: Roland Dreier <>

    commit cbf8ae32f66a9ceb8907ad9e16663c2a29e48990 upstream.

    The memory the parameter __key points to is used as an iterator in
    btree_get_prev(), so if we save off a bkey() pointer in retry_key and
    then assign that to __key, we'll end up corrupting the btree internals
    when we do eg

    longcpy(__key, bkey(geo, node, i), geo->keylen);

    to return the key value. What we should do instead is use longcpy() to
    copy the key value that retry_key points to __key.

    This can cause a btree to get corrupted by seemingly read-only
    operations such as btree_for_each_safe.

    [ avoid the double longcpy()]
    Signed-off-by: Roland Dreier <>
    Acked-by: Joern Engel <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>

    lib/btree.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/lib/btree.c
    +++ b/lib/btree.c
    @@ -319,8 +319,8 @@ void *btree_get_prev(struct btree_head *

    if (head->height == 0)
    return NULL;
    longcpy(key, __key, geo->keylen);
    dec_key(geo, key);

    node = head->node;
    @@ -351,7 +351,7 @@ retry:
    if (retry_key) {
    - __key = retry_key;
    + longcpy(key, retry_key, geo->keylen);
    retry_key = NULL;
    goto retry;

     \ /
      Last update: 2012-06-15 03:01    [W:0.022 / U:5.420 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site