linux-kernel - [PATCH] radix-tree: Fix private list warnings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 12 Jan 2017 17:28:23 -0800
From:   Matthew Wilcox <mawilcox@...uxonhyperv.com>
To:     Johannes Weiner <hannes@...xchg.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Matthew Wilcox <mawilcox@...rosoft.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-kernel@...r.kernel.org
Subject: [PATCH] radix-tree: Fix private list warnings

From: Matthew Wilcox <mawilcox@...rosoft.com>

The newly introduced warning in radix_tree_free_nodes() was testing the
wrong variable; it should have been 'old' instead of 'node'.  Rather
than replace that one instance, I noticed that we can simply put the
WARN_ON_ONCE in radix_tree_node_free() and it will be just as effective.

Fixes: ea07b862ac8e ("mm: workingset: fix use-after-free in shadow node shrinker")
Signed-off-by: Matthew Wilcox <mawilcox@...rosoft.com>
---
 lib/radix-tree.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 4a4ed3ee4222..3c4577cabc57 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -449,6 +449,7 @@ static void radix_tree_node_rcu_free(struct rcu_head *head)
 static inline void
 radix_tree_node_free(struct radix_tree_node *node)
 {
+	WARN_ON_ONCE(!list_empty(&node->private_list));
 	call_rcu(&node->rcu_head, radix_tree_node_rcu_free);
 }
 
@@ -734,7 +735,6 @@ static inline void radix_tree_shrink(struct radix_tree_root *root,
 				update_node(node, private);
 		}
 
-		WARN_ON_ONCE(!list_empty(&node->private_list));
 		radix_tree_node_free(node);
 	}
 }
@@ -766,7 +766,6 @@ static void delete_node(struct radix_tree_root *root,
 			root->rnode = NULL;
 		}
 
-		WARN_ON_ONCE(!list_empty(&node->private_list));
 		radix_tree_node_free(node);
 
 		node = parent;
@@ -868,7 +867,6 @@ static void radix_tree_free_nodes(struct radix_tree_node *node)
 			struct radix_tree_node *old = child;
 			offset = child->offset + 1;
 			child = child->parent;
-			WARN_ON_ONCE(!list_empty(&node->private_list));
 			radix_tree_node_free(old);
 			if (old == entry_to_node(node))
 				return;
-- 
2.11.0.296.g5800ad326.dirty