Commit d9f868c4 authored by Dave Kleikamp's avatar Dave Kleikamp Committed by Linus Torvalds

[PATCH] radix_tree_delete() fix

I was looking through the radix tree code and came across what I think
is a bug in radix_tree_delete.

	for (idx = 0; idx < RADIX_TREE_TAG_LONGS; idx++) {
		if (pathp[0].node->tags[tag][idx]) {
			tags[tag] = 1;
			nr_cleared_tags--;
			break;
		}
	}

The above loop should only be executed if tags[tag] is zero.  Otherwise,
when walking up the tree, we can decrement nr_cleared_tags twice or more
for the same value of tag, thus potentially exiting the outer loop too
early.

Ensure that nr_cleared_tags is only decremented once for each tag.
Signed-off-by: default avatarDave Kleikamp <shaggy@austin.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 4062e12b
...@@ -701,8 +701,10 @@ void *radix_tree_delete(struct radix_tree_root *root, unsigned long index) ...@@ -701,8 +701,10 @@ void *radix_tree_delete(struct radix_tree_root *root, unsigned long index)
for (tag = 0; tag < RADIX_TREE_TAGS; tag++) { for (tag = 0; tag < RADIX_TREE_TAGS; tag++) {
int idx; int idx;
if (!tags[tag]) if (tags[tag])
tag_clear(pathp[0].node, tag, pathp[0].offset); continue;
tag_clear(pathp[0].node, tag, pathp[0].offset);
for (idx = 0; idx < RADIX_TREE_TAG_LONGS; idx++) { for (idx = 0; idx < RADIX_TREE_TAG_LONGS; idx++) {
if (pathp[0].node->tags[tag][idx]) { if (pathp[0].node->tags[tag][idx]) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment