* Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> [230123 16:43]:
> On Sat, 12 Nov 2022 23:43:08 +0000 Wei Yang <richard.weiyang@xxxxxxxxx> wrote:
>
> > We should get pivots boundary by type.
> >
>
> When fixing a bug, please always fully describe the runtime effects of
> that bug.
>
> I see from earlier review that the bug could result in overindexing
> mt_pivots[], but Liam says this code isn't presently used, but
> mas_alloc() calls mte_pivot(), so I'm all confused.
Correct. The function mas_alloc() is... very much not well named. It
is called from mtree_alloc_range() which will put a temporary value into
the tree so that you may store over that value later without allocating
memory later. It's about allocating a range, not memory. Perhaps
mas_reserve() would have been better, in retrospect.
Anyways, it's not used by the mm code right now, but it's certainly a
bug.
>
>
> > --- a/lib/maple_tree.c
> > +++ b/lib/maple_tree.c
> > @@ -669,12 +669,13 @@ static inline unsigned long mte_pivot(const struct maple_enode *mn,
> > unsigned char piv)
> > {
> > struct maple_node *node = mte_to_node(mn);
> > + enum maple_type type = mte_node_type(mn);
> >
> > - if (piv >= mt_pivots[piv]) {
> > + if (piv >= mt_pivots[type]) {
> > WARN_ON(1);
> > return 0;
> > }
> > - switch (mte_node_type(mn)) {
> > + switch (type) {
> > case maple_arange_64:
> > return node->ma64.pivot[piv];
> > case maple_range_64:
> > --
> > 2.33.1
> >
