/* * Regression3 * Description: * Helper radix_tree_iter_retry resets next_index to the current index. * In following radix_tree_next_slot current chunk size becomes zero. * This isn't checked and it tries to dereference null pointer in slot. * * Helper radix_tree_iter_resume reset slot to NULL and next_index to index + 1, * for tagger iteraction it also must reset cached tags in iterator to abort * next radix_tree_next_slot and go to slow-path into radix_tree_next_chunk. * * Running: * This test should run to completion immediately. The above bug would * cause it to segfault. * * Upstream commit: * Not yet */ #include #include #include #include #include #include #include "regression.h" void regression3_test(void) { RADIX_TREE(root, GFP_KERNEL); void *ptr0 = (void *)4ul; void *ptr = (void *)8ul; struct radix_tree_iter iter; void **slot; bool first; printf("running regression test 3 (should take milliseconds)\n"); radix_tree_insert(&root, 0, ptr0); radix_tree_tag_set(&root, 0, 0); first = true; radix_tree_for_each_tagged(slot, &root, &iter, 0, 0) { printf("tagged %ld %p\n", iter.index, *slot); if (first) { radix_tree_insert(&root, 1, ptr); radix_tree_tag_set(&root, 1, 0); first = false; } if (radix_tree_deref_retry(*slot)) { printf("retry at %ld\n", iter.index); slot = radix_tree_iter_retry(&iter); continue; } } radix_tree_delete(&root, 1); first = true; radix_tree_for_each_slot(slot, &root, &iter, 0) { printf("slot %ld %p\n", iter.index, *slot); if (first) { radix_tree_insert(&root, 1, ptr); first = false; } if (radix_tree_deref_retry(*slot)) { printk("retry at %ld\n", iter.index); slot = radix_tree_iter_retry(&iter); continue; } } radix_tree_delete(&root, 1); first = true; radix_tree_for_each_contig(slot, &root, &iter, 0) { printk("contig %ld %p\n", iter.index, *slot); if (first) { radix_tree_insert(&root, 1, ptr); first = false; } if (radix_tree_deref_retry(*slot)) { printk("retry at %ld\n", iter.index); slot = radix_tree_iter_retry(&iter); continue; } } radix_tree_for_each_slot(slot, &root, &iter, 0) { printf("slot %ld %p\n", iter.index, *slot); if (!iter.index) { printf("next at %ld\n", iter.index); slot = radix_tree_iter_resume(slot, &iter); } } radix_tree_for_each_contig(slot, &root, &iter, 0) { printf("contig %ld %p\n", iter.index, *slot); if (!iter.index) { printf("next at %ld\n", iter.index); slot = radix_tree_iter_resume(slot, &iter); } } radix_tree_tag_set(&root, 0, 0); radix_tree_tag_set(&root, 1, 0); radix_tree_for_each_tagged(slot, &root, &iter, 0, 0) { printf("tagged %ld %p\n", iter.index, *slot); if (!iter.index) { printf("next at %ld\n", iter.index); slot = radix_tree_iter_resume(slot, &iter); } } radix_tree_delete(&root, 0); radix_tree_delete(&root, 1); printf("regression test 3 passed\n"); } 13:07:46 -0500'>2017-02-07net: add dst_pending_confirm flag to skbuffJulian Anastasov2-1/+5 2017-02-07sock: add sk_dst_pending_confirm flagJulian Anastasov1-0/+2 2017-02-07ipv6: sr: fix non static symbol warningsWei Yongjun1-4/+4 2017-02-07net/sched: act_mirred: remove duplicated include from act_mirred.cWei Yongjun1-2/+0 2017-02-07net: dsa: Add support for platform dataFlorian Fainelli1-18/+84 2017-02-07net: dsa: Rename and export dev_to_net_device()Florian Fainelli1-2/+3 2017-02-06bridge: fdb: write to used and updated at most once per jiffyNikolay Aleksandrov2-2/+4 2017-02-06bridge: move write-heavy fdb members in their own cache lineNikolay Aleksandrov1-4/+6 2017-02-06bridge: move to workqueue gcNikolay Aleksandrov10-23/+29 2017-02-06bridge: modify bridge and port to have often accessed fields in one cache lineNikolay Aleksandrov1-23/+20 2017-02-06net: dsa: introduce bridge notifierVivien Didelot2-11/+61 2017-02-06net: dsa: add switch notifierVivien Didelot5-0/+70 2017-02-06net: dsa: change state setter scopeVivien Didelot1-6/+9 2017-02-06net: dsa: rollback bridging on errorVivien Didelot1-1/+13 2017-02-06net: dsa: simplify netdevice events handlingVivien Didelot1-28/+16 2017-02-06net: dsa: move netdevice notifier registrationVivien Didelot3-10/+26 2017-02-06net-next: treewide use is_vlan_dev() helper function.Parav Pandit1-1/+2 2017-02-06sctp: process fwd tsn chunk only when prsctp is enabledXin Long1-0/+6 2017-02-06net: remove ndo_neigh_{construct, destroy} from stacked devicesIdo Schimmel3-48/+0 2017-02-05net: remove __napi_complete()Eric Dumazet1-21/+3 2017-02-04net: ipv6: Use compressed IPv6 addresses showing route replace errorDavid Ahern1-1/+1 2017-02-04net: ipv6: Change notifications for multipath delete to RTA_MULTIPATHDavid Ahern2-1/+28 2017-02-04net: ipv6: Change notifications for multipath add to RTA_MULTIPATHDavid Ahern2-3/+53 2017-02-04net: ipv6: Add support to dump multipath routes via RTA_MULTIPATH attributeDavid Ahern2-17/+105 2017-02-04net: ipv6: Allow shorthand delete of all nexthops in multipath routeDavid Ahern1-2/+36 2017-02-03net: skb_needs_check() accepts CHECKSUM_NONE for txEric Dumazet1-3/+4 2017-02-03net: remove support for per driver ndo_busy_poll()Eric Dumazet2-16/+0 2017-02-03Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-nextDavid S. Miller53-640/+576 2017-02-03sched: cls_flower: expose priority to offloading netdeviceJiri Pirko1-0/+3 2017-02-03tcp: clear pfmemalloc on outgoing skbEric Dumazet