While walking up parents looking for the next node we were comparing the child with the wrong parent pointer. This is easily verified by glancing at rb_next() :). Signed-off-by: Zach Brown <zab@versity.com>