linux-kernel - Re: [PATCH] maple_tree: should get pivots boundary by type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 23 Jan 2023 17:35:21 -0500
From:   "Liam R. Howlett" <Liam.Howlett@...cle.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     Wei Yang <richard.weiyang@...il.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] maple_tree: should get pivots boundary by type

* Andrew Morton <akpm@...ux-foundation.org> [230123 16:43]:
> On Sat, 12 Nov 2022 23:43:08 +0000 Wei Yang <richard.weiyang@...il.com> wrote:
> 
> > We should get pivots boundary by type.
> > 
> 
> When fixing a bug, please always fully describe the runtime effects of
> that bug.
> 
> I see from earlier review that the bug could result in overindexing
> mt_pivots[], but Liam says this code isn't presently used, but
> mas_alloc() calls mte_pivot(), so I'm all confused.

Correct.  The function mas_alloc() is... very much not well named.  It
is called from mtree_alloc_range() which will put a temporary value into
the tree so that you may store over that value later without allocating
memory later.  It's about allocating a range, not memory. Perhaps
mas_reserve() would have been better, in retrospect.

Anyways, it's not used by the mm code right now, but it's certainly a
bug.

> 
> 
> > --- a/lib/maple_tree.c
> > +++ b/lib/maple_tree.c
> > @@ -669,12 +669,13 @@ static inline unsigned long mte_pivot(const struct maple_enode *mn,
> >  				 unsigned char piv)
> >  {
> >  	struct maple_node *node = mte_to_node(mn);
> > +	enum maple_type type = mte_node_type(mn);
> >  
> > -	if (piv >= mt_pivots[piv]) {
> > +	if (piv >= mt_pivots[type]) {
> >  		WARN_ON(1);
> >  		return 0;
> >  	}
> > -	switch (mte_node_type(mn)) {
> > +	switch (type) {
> >  	case maple_arange_64:
> >  		return node->ma64.pivot[piv];
> >  	case maple_range_64:
> > -- 
> > 2.33.1
> >