[PATCH Fix 1/2] maple_tree: Fix mas_spanning_rebalance() corner case

Liam Howlett liam.howlett at oracle.com
Wed Jun 29 08:23:50 PDT 2022


When a node is insufficient during a spanning rebalance loop and
mast_spanning_rebalance() is called to combine neighbouring nodes, the
loop should not terminate regardless of if neighbours exist or not.
This will allow the data to be stored in the correct node.

Reported-by: Yu Zhao <yuzhao at google.com>
Fixes: 37a4d714b7d9 (maple_tree: fix underflow in mas_spanning_rebalance())
Signed-off-by: Liam R. Howlett <Liam.Howlett at oracle.com>
---
 lib/maple_tree.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index d8457122ca5d..2cccd8f2153f 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -3029,8 +3029,7 @@ static int mas_spanning_rebalance(struct ma_state *mas,
 		if (mas_is_root_limits(mast->orig_l))
 			break;
 
-		if (!mast_spanning_rebalance(mast))
-			break;
+		mast_spanning_rebalance(mast);
 
 		/* rebalancing from other nodes may require another loop. */
 		if (!count)
@@ -6521,6 +6520,7 @@ static inline void *mas_first_entry(struct ma_state *mas, struct maple_node *mn,
 	max = mas->max;
 	mas->offset = 0;
 	while (likely(!ma_is_leaf(mt))) {
+		MT_BUG_ON(mas->tree, mte_dead_node(mas->node));
 		slots = ma_slots(mn, mt);
 		pivots = ma_pivots(mn, mt);
 		max = pivots[0];
@@ -6531,6 +6531,7 @@ static inline void *mas_first_entry(struct ma_state *mas, struct maple_node *mn,
 		mn = mas_mn(mas);
 		mt = mte_node_type(mas->node);
 	}
+	MT_BUG_ON(mas->tree, mte_dead_node(mas->node));
 
 	mas->max = max;
 	slots = ma_slots(mn, mt);
-- 
2.35.1



More information about the maple-tree mailing list