Re: [PATCH] maple_tree: should get pivots boundary by type

[Liam R. Howlett]

* Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> [230123 16:43]:
> On Sat, 12 Nov 2022 23:43:08 +0000 Wei Yang <richard.weiyang@xxxxxxxxx> wrote:
> 
> > We should get pivots boundary by type.
> > 
> 
> When fixing a bug, please always fully describe the runtime effects of
> that bug.
> 
> I see from earlier review that the bug could result in overindexing
> mt_pivots[], but Liam says this code isn't presently used, but
> mas_alloc() calls mte_pivot(), so I'm all confused.

Correct.  The function mas_alloc() is... very much not well named.  It
is called from mtree_alloc_range() which will put a temporary value into
the tree so that you may store over that value later without allocating
memory later.  It's about allocating a range, not memory. Perhaps
mas_reserve() would have been better, in retrospect.

Anyways, it's not used by the mm code right now, but it's certainly a
bug.

> 
> 
> > --- a/lib/maple_tree.c
> > +++ b/lib/maple_tree.c
> > @@ -669,12 +669,13 @@ static inline unsigned long mte_pivot(const struct maple_enode *mn,
> >  				 unsigned char piv)
> >  {
> >  	struct maple_node *node = mte_to_node(mn);
> > +	enum maple_type type = mte_node_type(mn);
> >  
> > -	if (piv >= mt_pivots[piv]) {
> > +	if (piv >= mt_pivots[type]) {
> >  		WARN_ON(1);
> >  		return 0;
> >  	}
> > -	switch (mte_node_type(mn)) {
> > +	switch (type) {
> >  	case maple_arange_64:
> >  		return node->ma64.pivot[piv];
> >  	case maple_range_64:
> > -- 
> > 2.33.1
> >