• Dave Kleikamp's avatar
    [PATCH] radix_tree_delete() fix · d9f868c4
    Dave Kleikamp authored
    I was looking through the radix tree code and came across what I think
    is a bug in radix_tree_delete.
    
    	for (idx = 0; idx < RADIX_TREE_TAG_LONGS; idx++) {
    		if (pathp[0].node->tags[tag][idx]) {
    			tags[tag] = 1;
    			nr_cleared_tags--;
    			break;
    		}
    	}
    
    The above loop should only be executed if tags[tag] is zero.  Otherwise,
    when walking up the tree, we can decrement nr_cleared_tags twice or more
    for the same value of tag, thus potentially exiting the outer loop too
    early.
    
    Ensure that nr_cleared_tags is only decremented once for each tag.
    Signed-off-by: default avatarDave Kleikamp <shaggy@austin.ibm.com>
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    d9f868c4
radix-tree.c 19.4 KB