From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933659AbdJJUxO (ORCPT ); Tue, 10 Oct 2017 16:53:14 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:57118 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933026AbdJJUxM (ORCPT ); Tue, 10 Oct 2017 16:53:12 -0400 Date: Tue, 10 Oct 2017 13:53:11 -0700 From: Andrew Morton To: Wei Yang Cc: mawilcox@microsoft.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH] radix-tree: get_slot_offset() returns invalid offset when parent is NULL Message-Id: <20171010135311.008c61a83c75f06b840815c2@linux-foundation.org> In-Reply-To: <20171010025201.5895-1-richard.weiyang@gmail.com> References: <20171010025201.5895-1-richard.weiyang@gmail.com> X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 10 Oct 2017 10:52:01 +0800 Wei Yang wrote: > When parent is NULL, get_slot_offset() returns almost the address of slot. > This is an invalid value for offset. > > One possible scenario happens on deleting #0 index, when it is the only one > in tree. > > Current behavior doesn't harm the system, because the offset will not be > used when parent is NULL in the following procedure or parent is checked > before get_slot_offset() called. While it is still not safe to return an > invalid offset. > > This patch returns 0 when parent is NULL in get_slot_offset(). > I'm confused. If parent=NULL, get_slot_offset() will crash the kernel. So why "Current behavior doesn't harm the system"? > --- a/lib/radix-tree.c > +++ b/lib/radix-tree.c > @@ -119,7 +119,7 @@ bool is_sibling_entry(const struct radix_tree_node *parent, void *node) > static inline unsigned long > get_slot_offset(const struct radix_tree_node *parent, void __rcu **slot) > { > - return slot - parent->slots; > + return parent ? (slot - parent->slots):0; > } > > static unsigned int radix_tree_descend(const struct radix_tree_node *parent,