linux-kernel - Re: [PATCH 1/2] maple_tree: Fix mas_skip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 7 Mar 2023 11:10:23 -0500
From:   "Liam R. Howlett" <Liam.Howlett@...cle.com>
To:     Snild Dolkow <snild@...y.com>
Cc:     Peng Zhang <zhangpeng.00@...edance.com>, Stable@...r.kernel.org,
        maple-tree@...ts.infradead.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH 1/2] maple_tree: Fix mas_skip_node() end slot detection

* Snild Dolkow <snild@...y.com> [230307 09:31]:
> On 2023-03-07 14:05, Peng Zhang wrote:
> > Hi, Liam,
> > > -    } while (slot > slot_count);
> > > +    } while (mas->offset >= mas_data_end(mas));
> > > -    mas->offset = ++slot;
> > > +    mt = mte_node_type(mas->node);
> > >       pivots = ma_pivots(mas_mn(mas), mt);
> > > -    if (slot > 0)
> > > -        mas->min = pivots[slot - 1] + 1;
> > > -
> > > -    if (slot <= slot_count)
> > > -        mas->max = pivots[slot];
> > > +    mas->min = pivots[mas->offset] + 1;
> > > +    mas->offset++;
> > > +    if (mas->offset < mt_slots[mt])
> > > +        mas->max = pivots[mas->offset];
> > There is a bug here, the assignment of mas->min and mas->max is wrong.
> > The assignment will make them represent the range of a child node, but
> > it should represent the range of the current node. After mas_ascend()
> > returns, mas-min and mas->max already represent the range of the current
> > node, so we should delete these assignments of mas->min and mas->max.
> 
> 
> Thanks for your suggestion, Peng. Applying it literally by removing only the
> min/max assignments:
> 
> diff --git a/lib/maple_tree.c b/lib/maple_tree.c
> index 6fc1ad42b409..9b6e581cf83f 100644
> --- a/lib/maple_tree.c
> +++ b/lib/maple_tree.c
> @@ -5118,10 +5118,7 @@ static inline bool mas_skip_node
> 
>         mt = mte_node_type(mas->node);
>         pivots = ma_pivots(mas_mn(mas), mt);
> -       mas->min = pivots[mas->offset] + 1;
>         mas->offset++;
> -       if (mas->offset < mt_slots[mt])
> -               mas->max = pivots[mas->offset];
> 
>         return true;
>  }
> 
> 
> This allowed my test to pass 100/100 runs. Still in qemu with the test as
> init, so not really stressed in any way except that specific usecase.
> 


Yes, I have a v2 that removes these lines and some extra unused lines.
I've been working on a recreation to add to the testing before I send v2
out.  I had 100% success running my testing over the weekend, but I
wanted to have a testcase before sending the change.

Thanks,
Liam