/* * Regression3 * Description: * Helper radix_tree_iter_retry resets next_index to the current index. * In following radix_tree_next_slot current chunk size becomes zero. * This isn't checked and it tries to dereference null pointer in slot. * * Helper radix_tree_iter_resume reset slot to NULL and next_index to index + 1, * for tagger iteraction it also must reset cached tags in iterator to abort * next radix_tree_next_slot and go to slow-path into radix_tree_next_chunk. * * Running: * This test should run to completion immediately. The above bug would * cause it to segfault. * * Upstream commit: * Not yet */ #include <linux/kernel.h> #include <linux/gfp.h> #include <linux/slab.h> #include <linux/radix-tree.h> #include <stdlib.h> #include <stdio.h> #include "regression.h" void regression3_test(void) { RADIX_TREE(root, GFP_KERNEL); void *ptr0 = (void *)4ul; void *ptr = (void *)8ul; struct radix_tree_iter iter; void **slot; bool first; printf("running regression test 3 (should take milliseconds)\n"); radix_tree_insert(&root, 0, ptr0); radix_tree_tag_set(&root, 0, 0); first = true; radix_tree_for_each_tagged(slot, &root, &iter, 0, 0) { printf("tagged %ld %p\n", iter.index, *slot); if (first) { radix_tree_insert(&root, 1, ptr); radix_tree_tag_set(&root, 1, 0); first = false; } if (radix_tree_deref_retry(*slot)) { printf("retry at %ld\n", iter.index); slot = radix_tree_iter_retry(&iter); continue; } } radix_tree_delete(&root, 1); first = true; radix_tree_for_each_slot(slot, &root, &iter, 0) { printf("slot %ld %p\n", iter.index, *slot); if (first) { radix_tree_insert(&root, 1, ptr); first = false; } if (radix_tree_deref_retry(*slot)) { printk("retry at %ld\n", iter.index); slot = radix_tree_iter_retry(&iter); continue; } } radix_tree_delete(&root, 1); first = true; radix_tree_for_each_contig(slot, &root, &iter, 0) { printk("contig %ld %p\n", iter.index, *slot); if (first) { radix_tree_insert(&root, 1, ptr); first = false; } if (radix_tree_deref_retry(*slot)) { printk("retry at %ld\n", iter.index); slot = radix_tree_iter_retry(&iter); continue; } } radix_tree_for_each_slot(slot, &root, &iter, 0) { printf("slot %ld %p\n", iter.index, *slot); if (!iter.index) { printf("next at %ld\n", iter.index); slot = radix_tree_iter_resume(slot, &iter); } } radix_tree_for_each_contig(slot, &root, &iter, 0) { printf("contig %ld %p\n", iter.index, *slot); if (!iter.index) { printf("next at %ld\n", iter.index); slot = radix_tree_iter_resume(slot, &iter); } } radix_tree_tag_set(&root, 0, 0); radix_tree_tag_set(&root, 1, 0); radix_tree_for_each_tagged(slot, &root, &iter, 0, 0) { printf("tagged %ld %p\n", iter.index, *slot); if (!iter.index) { printf("next at %ld\n", iter.index); slot = radix_tree_iter_resume(slot, &iter); } } radix_tree_delete(&root, 0); radix_tree_delete(&root, 1); printf("regression test 3 passed\n"); } 393be56d2be237e81610'>transport.c</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='id' value='52f5631a4c056ad01682393be56d2be237e81610'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'> <tr><th>author</th><td>Jurij Smakov <jurij@wooyd.org></td><td class='right'>2017-01-30 15:41:36 -0600</td></tr> <tr><th>committer</th><td>Kalle Valo <kvalo@codeaurora.org></td><td class='right'>2017-01-31 09:05:25 +0200</td></tr> <tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/net/rds/transport.c?id=52f5631a4c056ad01682393be56d2be237e81610'>52f5631a4c056ad01682393be56d2be237e81610</a> (<a href='/cgit.cgi/linux/net-next.git/patch/net/rds/transport.c?id=52f5631a4c056ad01682393be56d2be237e81610'>patch</a>)</td></tr> <tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?id=52f5631a4c056ad01682393be56d2be237e81610'>53d1ddd2c1b179c808df10b6ce731ad26aa9f31b</a> /<a href='/cgit.cgi/linux/net-next.git/tree/net/rds/transport.c?id=52f5631a4c056ad01682393be56d2be237e81610'>net/rds/transport.c</a></td></tr> <tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/net/rds/transport.c?id=2b1d530cb3157f828fcaadd259613f59db3c6d1c'>2b1d530cb3157f828fcaadd259613f59db3c6d1c</a> (<a href='/cgit.cgi/linux/net-next.git/diff/net/rds/transport.c?id=52f5631a4c056ad01682393be56d2be237e81610&id2=2b1d530cb3157f828fcaadd259613f59db3c6d1c'>diff</a>)</td></tr></table> <div class='commit-subject'>rtlwifi: rtl8192ce: Fix loading of incorrect firmware</div><div class='commit-msg'>In commit cf4747d7535a ("rtlwifi: Fix regression caused by commit d86e64768859, an error in the edit results in the wrong firmware being loaded for some models of the RTL8188/8192CE. In this condition, the connection suffered from high ping latency, slow transfer rates, and required higher signal strengths to work at all See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=853073, https://bugzilla.opensuse.org/show_bug.cgi?id=1017471, and https://github.com/lwfinger/rtlwifi_new/issues/203 for descriptions of the problems. This patch fixes all of those problems. Fixes: cf4747d7535a ("rtlwifi: Fix regression caused by commit d86e64768859") Signed-off-by: Jurij Smakov <jurij@wooyd.org> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.kernel.org> # 4.9+ Signed-off-by: Kalle Valo <kvalo@codeaurora.org> </div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?id=52f5631a4c056ad01682393be56d2be237e81610'>Diffstat</a> (limited to 'net/rds/transport.c')</div><table summary='diffstat' class='diffstat'>