Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2d6f45b8 authored by Konstantin Khlebnikov's avatar Konstantin Khlebnikov Committed by Linus Torvalds
Browse files

radix-tree tests: add regression3 test 



After calling radix_tree_iter_retry(), 'slot' will be set to NULL.  This
can cause radix_tree_next_slot() to dereference the NULL pointer.  Add
Konstantin Khlebnikov's test to the regression framework.

Signed-off-by: default avatarMatthew Wilcox <matthew.r.wilcox@intel.com>
Reported-by: default avatarKonstantin Khlebnikov <koct9i@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 7165092f

tools/testing/radix-tree/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -3,7 +3,7 @@ CFLAGS += -I. -g -Wall -D_LGPL_SOURCE 
LDFLAGS += -lpthread -lurcu

TARGETS = main

OFILES = main.o radix-tree.o linux.o test.o tag_check.o find_next_bit.o \

	 regression1.o regression2.o

	 regression1.o regression2.o regression3.o



targets: $(TARGETS)

tools/testing/radix-tree/linux/kernel.h

+1 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 


#define BUG_ON(expr)	assert(!(expr))

#define __init

#define __must_check

#define panic(expr)

#define printk printf

#define __force

tools/testing/radix-tree/main.c

+1 −0
Original line number Diff line number Diff line
@@ -261,6 +261,7 @@ int main(void) 


	regression1_test();

	regression2_test();

	regression3_test();

	single_thread_tests();



	sleep(1);

tools/testing/radix-tree/regression.h

+1 −0
Original line number Diff line number Diff line
@@ -3,5 +3,6 @@ 


void regression1_test(void);

void regression2_test(void);

void regression3_test(void);



#endif

tools/testing/radix-tree/regression3.c

0 → 100644
+86 −0
Original line number Diff line number Diff line 
/*

 * Regression3

 * Description:

 * Helper radix_tree_iter_retry resets next_index to the current index.

 * In following radix_tree_next_slot current chunk size becomes zero.

 * This isn't checked and it tries to dereference null pointer in slot.

 *

 * Running:

 * This test should run to completion immediately. The above bug would

 * cause it to segfault.

 *

 * Upstream commit:

 * Not yet

 */

#include <linux/kernel.h>

#include <linux/gfp.h>

#include <linux/slab.h>

#include <linux/radix-tree.h>

#include <stdlib.h>

#include <stdio.h>



#include "regression.h"



void regression3_test(void)

{

	RADIX_TREE(root, GFP_KERNEL);

	void *ptr = (void *)4ul;

	struct radix_tree_iter iter;

	void **slot;

	bool first;



	printf("running regression test 3 (should take milliseconds)\n");



	radix_tree_insert(&root, 0, ptr);

	radix_tree_tag_set(&root, 0, 0);



	first = true;

	radix_tree_for_each_tagged(slot, &root, &iter, 0, 0) {

//		printk("tagged %ld %p\n", iter.index, *slot);

		if (first) {

			radix_tree_insert(&root, 1, ptr);

			radix_tree_tag_set(&root, 1, 0);

			first = false;

		}

		if (radix_tree_deref_retry(*slot)) {

//			printk("retry %ld\n", iter.index);

			slot = radix_tree_iter_retry(&iter);

			continue;

		}

	}

	radix_tree_delete(&root, 1);



	first = true;

	radix_tree_for_each_slot(slot, &root, &iter, 0) {

//		printk("slot %ld %p\n", iter.index, *slot);

		if (first) {

			radix_tree_insert(&root, 1, ptr);

			first = false;

		}

		if (radix_tree_deref_retry(*slot)) {

//			printk("retry %ld\n", iter.index);

			slot = radix_tree_iter_retry(&iter);

			continue;

		}

	}

	radix_tree_delete(&root, 1);



	first = true;

	radix_tree_for_each_contig(slot, &root, &iter, 0) {

//		printk("contig %ld %p\n", iter.index, *slot);

		if (first) {

			radix_tree_insert(&root, 1, ptr);

			first = false;

		}

		if (radix_tree_deref_retry(*slot)) {

//			printk("retry %ld\n", iter.index);

			slot = radix_tree_iter_retry(&iter);

			continue;

		}

	}



	radix_tree_delete(&root, 0);

	radix_tree_delete(&root, 1);



	printf("regression test 3 passed\n");

}