From: Liam R. Howlett <Liam.Howlett@Oracle.com>
Date: Tue, 20 Oct 2020 16:24:51 +0000 (-0400)
Subject: maple_tree: Fix mas_alloc_nodes() off by one in bulk alloc
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=21910dc49464d1cf41a17edaa823275a90c4c8a1;p=users%2Fjedix%2Flinux-maple.git

maple_tree: Fix mas_alloc_nodes() off by one in bulk alloc

Signed-off-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
---

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index 5ac7e7519bf3..cd0d4a84015b 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -18,7 +18,6 @@
 #include <trace/events/maple_tree.h>
 
 #define MA_ROOT_PARENT 1
-#define MAPLE_NODE_MAX MAPLE_NODE_MASK
 
 #define ma_parent_ptr(x) ((struct maple_pnode *)(x))
 #define ma_mnode_ptr(x) ((struct maple_node *)(x))
@@ -906,7 +905,7 @@ static inline void mas_alloc_nodes(struct ma_state *mas, gfp_t gfp)
 
 	mas_set_alloc_req(mas, 0);
 	if (!mas_allocated(mas) ||
-	    mas->alloc->node_count == MAPLE_NODE_SLOTS - 1) {
+	    mas->alloc->node_count == MAPLE_NODE_SLOTS - 2) {
 		node = (struct maple_alloc *)mt_alloc_one(gfp);
 		if (!node)
 			goto nomem;
@@ -924,22 +923,22 @@ static inline void mas_alloc_nodes(struct ma_state *mas, gfp_t gfp)
 	success = allocated = node->total;
 	while(requested) {
 		void **slots = (void**)&node->slot;
-		unsigned int max = MAPLE_NODE_SLOTS - 1;
+		unsigned int max_off = MAPLE_NODE_SLOTS - 1;
 
 		if (node->slot[0]) {
-			slots = (void**)&node->slot[node->node_count + 1];
-			max -= node->node_count;
+			unsigned int offset = node->node_count + 1;
+			slots = (void**)&node->slot[offset];
+			max_off -= offset;
 		}
 
-		count = min(requested, max);
+		count = min(requested, max_off);
 		count = mt_alloc_bulk(gfp, count, slots);
 		if (!count)
 			goto nomem;
 
+		node->node_count += count;
 		if (slots == (void**)&node->slot)
-			node->node_count = count - 1; // zero indexed.
-		else
-			node->node_count += count;
+			node->node_count--; // zero indexed.
 
 		success += count;
 		nodep = &node->slot[0];
@@ -1031,7 +1030,7 @@ int mas_entry_count(struct ma_state *mas, unsigned long nr_entries)
 
 	nr_nodes = DIV_ROUND_UP(nr_entries, MAPLE_RANGE64_SLOTS); // leaves
 	nr_nodes += DIV_ROUND_UP(nr_nodes, nonleaf_cap);
-	mas_node_count(mas, min(nr_nodes, (int)MAPLE_NODE_MAX));
+	mas_node_count(mas, nr_nodes);
 
 	if (!mas_is_err(mas))
 		return 0;