Skip to content

Commit f996c41

Browse files
committed
lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
jira LE-3201 cve CVE-2024-47668 Rebuild_History Non-Buildable kernel-rt-4.18.0-553.27.1.rt7.368.el8_10 commit-author Kent Overstreet <[email protected]> commit b2f11c6 If we need to increase the tree depth, allocate a new node, and then race with another thread that increased the tree depth before us, we'll still have a preallocated node that might be used later. If we then use that node for a new non-root node, it'll still have a pointer to the old root instead of being zeroed - fix this by zeroing it in the cmpxchg failure path. Signed-off-by: Kent Overstreet <[email protected]> (cherry picked from commit b2f11c6) Signed-off-by: Jonathan Maple <[email protected]>
1 parent fc1a319 commit f996c41

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

lib/generic-radix-tree.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,8 @@ void *__genradix_ptr_alloc(struct __genradix *radix, size_t offset,
131131
if ((v = cmpxchg_release(&radix->root, r, new_root)) == r) {
132132
v = new_root;
133133
new_node = NULL;
134+
} else {
135+
new_node->children[0] = NULL;
134136
}
135137
}
136138

0 commit comments

Comments
 (0)