linux-kernel - Re: [PATCH 1/2] maple_tree: Fix mas_skip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 Mar 2023 00:16:45 +0800
From:   Peng Zhang <zhangpeng.00@...edance.com>
To:     Snild Dolkow <snild@...y.com>,
        Peng Zhang <zhangpeng.00@...edance.com>,
        "Liam R. Howlett" <Liam.Howlett@...cle.com>
Cc:     Stable@...r.kernel.org, maple-tree@...ts.infradead.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH 1/2] maple_tree: Fix mas_skip_node() end slot detection

Hi, Snild,

在 2023/3/7 22:30, Snild Dolkow 写道:
> On 2023-03-07 14:05, Peng Zhang wrote:
>> Hi, Liam,
>>> -    } while (slot > slot_count);
>>> +    } while (mas->offset >= mas_data_end(mas));
>>> -    mas->offset = ++slot;
>>> +    mt = mte_node_type(mas->node);
>>>       pivots = ma_pivots(mas_mn(mas), mt);
>>> -    if (slot > 0)
>>> -        mas->min = pivots[slot - 1] + 1;
>>> -
>>> -    if (slot <= slot_count)
>>> -        mas->max = pivots[slot];
>>> +    mas->min = pivots[mas->offset] + 1;
>>> +    mas->offset++;
>>> +    if (mas->offset < mt_slots[mt])
>>> +        mas->max = pivots[mas->offset];
>> There is a bug here, the assignment of mas->min and mas->max is wrong.
>> The assignment will make them represent the range of a child node, 
>> but it should represent the range of the current node. After 
>> mas_ascend() returns, mas-min and mas->max already represent the 
>> range of the current node, so we should delete these assignments of 
>> mas->min and mas->max.
>
>
> Thanks for your suggestion, Peng. Applying it literally by removing 
> only the min/max assignments:
>
> diff --git a/lib/maple_tree.c b/lib/maple_tree.c
> index 6fc1ad42b409..9b6e581cf83f 100644
> --- a/lib/maple_tree.c
> +++ b/lib/maple_tree.c
> @@ -5118,10 +5118,7 @@ static inline bool mas_skip_node
>
>         mt = mte_node_type(mas->node);
>         pivots = ma_pivots(mas_mn(mas), mt);
> -       mas->min = pivots[mas->offset] + 1;
>         mas->offset++;
> -       if (mas->offset < mt_slots[mt])
> -               mas->max = pivots[mas->offset];
>
>         return true;
>  }
>
>
> This allowed my test to pass 100/100 runs. Still in qemu with the test 
> as init, so not really stressed in any way except that specific usecase.
>
> //Snild

Thanks for the test, I'm happy if it happens to fix your problem. So a 
patch was made.
This patch needs to be applied after Liam's patch.

Sincerely yours,
Peng.