From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1C01A2E1EE0 for ; Tue, 6 Jan 2026 01:33:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767663232; cv=none; b=UrxHJeZuT5BIztLudIXRKm2v5UtXYUjATOZAztkDbn447IfAgVxINFoBZKflad006P/esNbiqnWqJZFgTJxZ92si7iS80EiIB1qd6S+CEYrWt9ywdCGYalGwfFmnpViUyZbIXnT+9NX4fZunLmiSKqMQg5ADOU2eHBESUDkc5xI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767663232; c=relaxed/simple; bh=xiYjh6ohs22w6pJx8rkfnuaEn5oxOp5Q7Pkvbyedzfs=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=QwDPJ3/ewxFGPlOICYtgy2m3FCcJ31zxo25USREMHFRLFgK3OM0vKCXJ4rH47Ro8dJiijTuvXfRW5xIEE4JPxQYYAR93yGioYuAQUrFmbV2wSARV+pkyS+fz8B9/GZZnrlN2xSvjmF0oYcX5udkdG5QWViVDRi9QqgswkNK5zGY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=QVX+WWXE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="QVX+WWXE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0131C116D0; Tue, 6 Jan 2026 01:33:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1767663231; bh=xiYjh6ohs22w6pJx8rkfnuaEn5oxOp5Q7Pkvbyedzfs=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=QVX+WWXE6zEqxs0zz1N0PBYW+A5xucJYleKHMzCi6AU0/y/0Kn5ZXQ/FTpLI8xXJ7 MRxujhIdYu7eyfCd5tYvSnON7rQsVACAvmJDld1hAfseH5g+IepJrf4VVs96PnumHE Dlk9kdPsNhdAnJjotpdw46uMfBM+IyRpVSGLcf/A= Date: Mon, 5 Jan 2026 17:33:50 -0800 From: Andrew Morton To: Boudewijn van der Heide Cc: Liam.Howlett@oracle.com, aliceryhl@google.com, andrewjballance@gmail.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, maple-tree@lists.infradead.org Subject: Re: [PATCH] maple_tree: Add dead node check in mas_dup_alloc() Message-Id: <20260105173350.d8ad7d630be1f0a581dfd565@linux-foundation.org> In-Reply-To: <20260103200633.246006-1-boudewijn@delta-utec.com> References: <20260103103247.9140cb2556280927b09f59d3@linux-foundation.org> <20260103200633.246006-1-boudewijn@delta-utec.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Sat, 3 Jan 2026 21:06:31 +0100 Boudewijn van der Heide wrote: > On Sat, 3 Jan 2026, Andrew Morton wrote: > > What are the worst-case userspace-visible runtime effects when this > > happens? > > Worst case: if __mt_dup() is invoked without the required external > locking and the source tree is concurrently modified, a node can > transition to the “dead” RCU layout while mas_dup_alloc() is still > traversing it. In that case the code may interpret the rcu_head contents > as slot pointers. > > Practically, this could lead to invalid pointer dereferences (kernel > oops) or corruption of the duplicated tree. Depending on how that > duplicated tree is later used (e.g. in mm/VMA paths), the effects could > be userspace-visible, such as fork() failures, process crashes, or > broader system instability. > > My understanding is that current in-tree users hold the appropriate > locks and should not hit this, as triggering it requires violating the > __mt_dup() synchronization contract. The risk primarily comes from the > fact that __mt_dup() is exported (EXPORT_SYMBOL), making it reachable by > out-of-tree modules or future callers which may not follow the locking > rules. > > > If they're bad then presumably we'll want to backport this fix into > > earlier kernels with a Cc: and, very > > preferably a Fixes: line. > > The function was introduced without the check here: > > Fixes: fd32e4e9b764 ("maple_tree: introduce interfaces __mt_dup() and mtree_dup()") > Great, thanks, I added all that to the changelog and queued this in mm.git as a hotfix, for runtime testing and pending reviewer input.