Revision 732042821cfa106b3c20b9780e4c60fee9d68900 authored by Konstantin Khlebnikov on 05 February 2016, 23:37:01 UTC, committed by Linus Torvalds on 06 February 2016, 02:10:40 UTC
Helper radix_tree_iter_retry() resets next_index to the current index. In following radix_tree_next_slot current chunk size becomes zero. This isn't checked and it tries to dereference null pointer in slot. Tagged iterator is fine because retry happens only at slot 0 where tag bitmask in iter->tags is filled with single bit. Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> Cc: Matthew Wilcox <willy@linux.intel.com> Cc: Hugh Dickins <hughd@google.com> Cc: Ohad Ben-Cohen <ohad@wizery.com> Cc: Jeremiah Mahler <jmmahler@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent b14fd33
File | Mode | Size |
---|---|---|
Documentation | ||
arch | ||
block | ||
certs | ||
crypto | ||
drivers | ||
firmware | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
samples | ||
scripts | ||
security | ||
sound | ||
tools | ||
usr | ||
virt | ||
.get_maintainer.ignore | -rw-r--r-- | 31 bytes |
.gitignore | -rw-r--r-- | 1.2 KB |
.mailmap | -rw-r--r-- | 5.5 KB |
COPYING | -rw-r--r-- | 18.3 KB |
CREDITS | -rw-r--r-- | 95.4 KB |
Kbuild | -rw-r--r-- | 2.6 KB |
Kconfig | -rw-r--r-- | 252 bytes |
MAINTAINERS | -rw-r--r-- | 337.2 KB |
Makefile | -rw-r--r-- | 53.7 KB |
README | -rw-r--r-- | 18.2 KB |
REPORTING-BUGS | -rw-r--r-- | 7.3 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...