Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 91abab83 authored by Matthew Wilcox (Oracle)'s avatar Matthew Wilcox (Oracle)
Browse files

XArray: Fix xas_next() with a single entry at 0 



If there is only a single entry at 0, the first time we call xas_next(),
we return the entry.  Unfortunately, all subsequent times we call
xas_next(), we also return the entry at 0 instead of noticing that the
xa_index is now greater than zero.  This broke find_get_pages_contig().

Fixes: 64d3e9a9 ("xarray: Step through an XArray")
Reported-by: default avatarKent Overstreet <kent.overstreet@gmail.com>
Signed-off-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
parent 6fbc7275

lib/test_xarray.c

+24 −0
Original line number Diff line number Diff line
@@ -1110,6 +1110,28 @@ static noinline void check_find_entry(struct xarray *xa) 
	XA_BUG_ON(xa, !xa_empty(xa));

}



static noinline void check_move_tiny(struct xarray *xa)

{

	XA_STATE(xas, xa, 0);



	XA_BUG_ON(xa, !xa_empty(xa));

	rcu_read_lock();

	XA_BUG_ON(xa, xas_next(&xas) != NULL);

	XA_BUG_ON(xa, xas_next(&xas) != NULL);

	rcu_read_unlock();

	xa_store_index(xa, 0, GFP_KERNEL);

	rcu_read_lock();

	xas_set(&xas, 0);

	XA_BUG_ON(xa, xas_next(&xas) != xa_mk_index(0));

	XA_BUG_ON(xa, xas_next(&xas) != NULL);

	xas_set(&xas, 0);

	XA_BUG_ON(xa, xas_prev(&xas) != xa_mk_index(0));

	XA_BUG_ON(xa, xas_prev(&xas) != NULL);

	rcu_read_unlock();

	xa_erase_index(xa, 0);

	XA_BUG_ON(xa, !xa_empty(xa));

}



static noinline void check_move_small(struct xarray *xa, unsigned long idx)

{

	XA_STATE(xas, xa, 0);
@@ -1217,6 +1239,8 @@ static noinline void check_move(struct xarray *xa) 


	xa_destroy(xa);



	check_move_tiny(xa);



	for (i = 0; i < 16; i++)

		check_move_small(xa, 1UL << i);

lib/xarray.c

+4 −0
Original line number Diff line number Diff line
@@ -994,6 +994,8 @@ void *__xas_prev(struct xa_state *xas) 


	if (!xas_frozen(xas->xa_node))

		xas->xa_index--;

	if (!xas->xa_node)

		return set_bounds(xas);

	if (xas_not_node(xas->xa_node))

		return xas_load(xas);
@@ -1031,6 +1033,8 @@ void *__xas_next(struct xa_state *xas) 


	if (!xas_frozen(xas->xa_node))

		xas->xa_index++;

	if (!xas->xa_node)

		return set_bounds(xas);

	if (xas_not_node(xas->xa_node))

		return xas_load(xas);