Files
linux/include/linux
Konstantin Khlebnikov 55e0d9869f radix-tree: fix oops after radix_tree_iter_retry
commit 732042821cfa106b3c20b9780e4c60fee9d68900 upstream.

Helper radix_tree_iter_retry() resets next_index to the current index.
In following radix_tree_next_slot current chunk size becomes zero.  This
isn't checked and it tries to dereference null pointer in slot.

Tagged iterator is fine because retry happens only at slot 0 where tag
bitmask in iter->tags is filled with single bit.

Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup")
Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Matthew Wilcox <willy@linux.intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ohad Ben-Cohen <ohad@wizery.com>
Cc: Jeremiah Mahler <jmmahler@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-02-25 12:01:23 -08:00
..
2015-10-01 12:48:11 -07:00
2015-10-17 21:22:08 -07:00
2015-10-07 18:08:15 +01:00
2015-11-07 10:40:47 -07:00
2015-12-28 13:07:07 -07:00
2015-10-07 16:02:49 -07:00
2015-09-08 15:35:28 -07:00
2015-10-18 10:14:39 -07:00
2015-10-31 19:05:59 -04:00
2015-10-30 01:47:27 -04:00
2015-09-08 15:35:28 -07:00
2015-10-23 05:44:28 -07:00
2015-10-01 15:06:43 +02:00
2015-10-13 19:01:25 +02:00
2015-11-09 15:11:24 -08:00
2015-11-23 09:44:58 +01:00
2015-10-27 18:55:31 -07:00
2015-11-06 17:50:42 -08:00
2015-10-20 22:10:45 +08:00
2015-09-10 13:29:01 -07:00
2015-09-10 13:29:01 -07:00
2015-11-06 17:50:42 -08:00
2015-10-09 17:00:32 -04:00
2015-10-06 17:08:19 +02:00
2015-10-22 08:59:18 -07:00
2015-09-10 15:36:59 -04:00
2015-11-05 14:36:09 -05:00
2015-10-01 09:57:59 -07:00
2015-10-19 01:01:21 +02:00
2015-11-23 09:44:58 +01:00
2015-12-04 08:38:42 -07:00
2015-12-13 14:30:59 -08:00
2015-11-13 20:34:33 -05:00
2015-09-08 15:35:28 -07:00