From 5bb8293cb9ba80ca4f83980fb5e63a12b347e109 Mon Sep 17 00:00:00 2001 From: Fan Yong Date: Fri, 21 Feb 2025 15:05:23 +0800 Subject: [PATCH] DAOS-17148 common: btree delete may move target out of boundary - b26 During btr_node_del_rec(), if the record to be deleted from current node is the last one, the logic will try to migrate one record from its sibling node. If current node is at the tail position in parent node, original logic may migrate an invalid record from a non-exist sibling node on the right. That may cause kinds of corruption since the content in such invalid record is undefined. Signed-off-by: Fan Yong --- src/common/btree.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/common/btree.c b/src/common/btree.c index 6bf1bdb2b15..1257c2736b9 100644 --- a/src/common/btree.c +++ b/src/common/btree.c @@ -1,5 +1,6 @@ /** * (C) Copyright 2016-2024 Intel Corporation. + * (C) Copyright 2025 Hewlett Packard Enterprise Development LP * * SPDX-License-Identifier: BSD-2-Clause-Patent */ @@ -3152,12 +3153,13 @@ btr_node_del_rec(struct btr_context *tcx, struct btr_trace *par_tr, D_DEBUG(DB_TRACE, "Parent trace at=%d, key_nr=%d\n", par_tr->tr_at, par_nd->tn_keyn); + D_ASSERT(par_tr->tr_at < par_nd->tn_keyn); + if (par_tr->tr_at == 0) { /* only has sibling on the right side */ sib_off = btr_node_child_at(tcx, par_tr->tr_node, 1); sib_on_right = true; - - } else if (par_tr->tr_at == par_nd->tn_keyn) { + } else if (par_tr->tr_at == par_nd->tn_keyn - 1) { /* only has sibling on the left side */ sib_off = btr_node_child_at(tcx, par_tr->tr_node, par_tr->tr_at - 1);