From: Nick Piggin Couple more silly bugs caught by the rtth. Signed-off-by: Andrew Morton --- lib/radix-tree.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff -puN lib/radix-tree.c~adix-tree-rcu-lockless-readside-fix-2 lib/radix-tree.c --- a/lib/radix-tree.c~adix-tree-rcu-lockless-readside-fix-2 +++ a/lib/radix-tree.c @@ -624,6 +624,8 @@ __lookup(struct radix_tree_node *slot, v shift -= RADIX_TREE_MAP_SHIFT; slot = rcu_dereference(slot->slots[i]); + if (slot == NULL) + goto out; } /* Bottom level: grab some items */ @@ -925,10 +927,14 @@ void *radix_tree_delete(struct radix_tre to_free = NULL; /* Now free the nodes we do not need anymore */ while (pathp->node) { - if (to_free) - radix_tree_node_free(to_free); pathp->node->slots[pathp->offset] = NULL; pathp->node->count--; + /* + * Queue the node for deferred freeing after the + * last reference to it disappears (set NULL, above). + */ + if (to_free) + radix_tree_node_free(to_free); if (pathp->node->count) { if (pathp->node == root->rnode) _