linux-kernel - Re: [BUG] rbtree bug with mmotm 2009-04-14-17-24

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 22 Apr 2009 15:34:02 -0500
From:	Steve Wise <swise@...ngridcomputing.com>
To:	Jens Axboe <jens.axboe@...cle.com>
CC:	balbir@...ux.vnet.ibm.com,
	Andrew Morton <akpm@...ux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Wolfram Strepp <wstrepp@....de>
Subject: Re: [BUG] rbtree bug with mmotm 2009-04-14-17-24

Steve Wise wrote:
> Jens Axboe wrote:
>
>  
>
>>> Still crashes with this variant:
>>>     
>>
>> OK, so please try and revert a36e71f996e25d6213f57951f7ae1874086ec57e
>> and see if that works?
>>
>> Or, better yet, please try and revert
>> 55a63998b8967615a15e2211ba0ff3a84a565824 first. If that doesn't work,
>> try the above revert.
>>
>>   
>
> Reverting 55a63998b8967615a15e2211ba0ff3a84a565824 did the trick.
>
>
> Steve.
>
>

<snipit from 55a63998b8967615a15e2211ba0ff3a84a565824>

@@ -200,17 +197,14 @@ static void __rb_erase_color(struct rb_node *node, 
struct rb_node *parent,
                        {
                                if (!other->rb_left || 
rb_is_black(other->rb_left))
                                {
-                                       register struct rb_node *o_right;
-                                       if ((o_right = other->rb_right))
-                                               rb_set_black(o_right);
+                                       rb_set_black(other->rb_right);
                                        rb_set_red(other);
                                        __rb_rotate_left(other, root);
                                        other = parent->rb_left;
                                }
                                rb_set_color(other, rb_color(parent));
                                rb_set_black(parent);
-                               if (other->rb_left)
-                                       rb_set_black(other->rb_left);
+                               rb_set_black(other->rb_left);
                                __rb_rotate_right(parent, root);
                                node = root->rb_node;
                                break;


I don't know this code, but isn't the 'if (other->rb_left)' really 
needed?  Or is it always true that if '!other->rb_left' is true entering 
this snipit, then after executing the first 'if' block, then 
'other->rb_left' must be a valid ptr? (how's that for confusing english? :)

Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/