From dc3a17997b479f91f36b2421e9c41c11a025de47 Mon Sep 17 00:00:00 2001 From: D Scott Phillips Date: Fri, 17 Apr 2020 10:28:06 -0700 Subject: [PATCH] util/sparse_array: don't stomp head's counter on pop operations By temporarily storing the new_head by a uint32_t, we wipe out the counter section of the head pointer. Fixes: e4f01eca ("util: Add a free list structure for use with util_sparse_array") Reviewed-by: Lionel Landwerlin Reviewed-by: Rafael Antognolli Reviewed-by: Jason Ekstrand Part-of: --- src/util/sparse_array.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/sparse_array.c b/src/util/sparse_array.c index 61dbd2acdff..0c04fd0d6dc 100644 --- a/src/util/sparse_array.c +++ b/src/util/sparse_array.c @@ -270,7 +270,7 @@ util_sparse_array_free_list_pop_idx(struct util_sparse_array_free_list *fl) uint32_t head_idx = current_head; /* Index is the bottom 32 bits */ void *head_elem = util_sparse_array_get(fl->arr, head_idx); uint32_t *head_next = (uint32_t *)((char *)head_elem + fl->next_offset); - uint32_t new_head = free_list_head(current_head, *head_next); + uint64_t new_head = free_list_head(current_head, *head_next); uint64_t old_head = p_atomic_cmpxchg(&fl->head, current_head, new_head); if (old_head == current_head) return head_idx; @@ -291,7 +291,7 @@ util_sparse_array_free_list_pop_elem(struct util_sparse_array_free_list *fl) uint32_t head_idx = current_head; /* Index is the bottom 32 bits */ void *head_elem = util_sparse_array_get(fl->arr, head_idx); uint32_t *head_next = (uint32_t *)((char *)head_elem + fl->next_offset); - uint32_t new_head = free_list_head(current_head, *head_next); + uint64_t new_head = free_list_head(current_head, *head_next); uint64_t old_head = p_atomic_cmpxchg(&fl->head, current_head, new_head); if (old_head == current_head) return head_elem; -- 2.30.2