linux-kernel - Re: [PATCH 1/2] maple_tree: Fix mas_skip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 7 Mar 2023 15:30:24 +0100
From:   Snild Dolkow <snild@...y.com>
To:     Peng Zhang <zhangpeng.00@...edance.com>,
        "Liam R. Howlett" <Liam.Howlett@...cle.com>
Cc:     Stable@...r.kernel.org, maple-tree@...ts.infradead.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH 1/2] maple_tree: Fix mas_skip_node() end slot detection

On 2023-03-07 14:05, Peng Zhang wrote:
> Hi, Liam,
>> -    } while (slot > slot_count);
>> +    } while (mas->offset >= mas_data_end(mas));
>> -    mas->offset = ++slot;
>> +    mt = mte_node_type(mas->node);
>>       pivots = ma_pivots(mas_mn(mas), mt);
>> -    if (slot > 0)
>> -        mas->min = pivots[slot - 1] + 1;
>> -
>> -    if (slot <= slot_count)
>> -        mas->max = pivots[slot];
>> +    mas->min = pivots[mas->offset] + 1;
>> +    mas->offset++;
>> +    if (mas->offset < mt_slots[mt])
>> +        mas->max = pivots[mas->offset];
> There is a bug here, the assignment of mas->min and mas->max is wrong.
> The assignment will make them represent the range of a child node, but 
> it should represent the range of the current node. After mas_ascend() 
> returns, mas-min and mas->max already represent the range of the current 
> node, so we should delete these assignments of mas->min and mas->max.


Thanks for your suggestion, Peng. Applying it literally by removing only 
the min/max assignments:

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index 6fc1ad42b409..9b6e581cf83f 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -5118,10 +5118,7 @@ static inline bool mas_skip_node

         mt = mte_node_type(mas->node);
         pivots = ma_pivots(mas_mn(mas), mt);
-       mas->min = pivots[mas->offset] + 1;
         mas->offset++;
-       if (mas->offset < mt_slots[mt])
-               mas->max = pivots[mas->offset];

         return true;
  }


This allowed my test to pass 100/100 runs. Still in qemu with the test 
as init, so not really stressed in any way except that specific usecase.

//Snild