From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E87F426690 for ; Mon, 29 Jun 2026 14:42:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.137.202.133 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782744173; cv=none; b=XELEwTr3NJu/53il3V+lk/Hn23N+SgR9fxwAFG0x5T8R3RuKQ2e7xtaRykLZsQge4bQQtAe1iqNqQNDpxhbmZlN8FBoWHCAc0xmO6Zpb/Vwh0gzOhYnx/NUCgvw3dRy9OucfTfmtYDuifIcu+2WH0IyQIyGhHEhZIq177tEEMqc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782744173; c=relaxed/simple; bh=oydQdBSjOYTnqfkH28Po7IRGE5ZqYXQkZj2zwDABUeg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gf4IfZ2VcACFoy3drXrjJEtXSjxYA7X4pMAkZH21syXPRaxHmEC3NoDqXGb01WbA4mz/fdpyOdIGXKcj/6ImJNu/jNt7rpdz5g+vLOtngFyEvsV1RQlRpg1EJFzPSOYZ22QwFTSXdTTOF4lJBEAWG+RqNW6CPXn5N5P1XfSQmFk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=pass smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=pBdoLaed; arc=none smtp.client-ip=198.137.202.133 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="pBdoLaed" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20210309; h=Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender :Reply-To:Content-Type:Content-ID:Content-Description; bh=H6dWsdmUf7ylZMz9/kx/ayCZU5UJ+5FE1mY/hNHUuYY=; b=pBdoLaedvvzM2zY1IGOrfYPJnW rc4cMTP3BQzZNpHO3f4TwD8ViN2LU1m2G7bIssNdCmaaRfQOKY88AmuKd4INkaVi4RhGj1AdWHhhi BH5uXYb311I31dPzQCiJwqI8j0ovyq4Xd6rr5wlob7mq2xhg6AtNEvLtI03pHAoBq5rwVWKwkGL36 fbnkVNd53FGIMZFFBQN7NUd85hqk8xGrYcAgl05BMD0G+v2MMDhF5cl0fLdgTGUSBKs5ILFiTg11B wEqqJJJZ+Pr5eKVMh7uNKx/Hv+hGEopYvPhTudqlo8fQWGDbxWBpqxZw9cwVAOzz3DmFA/aMuBaNL N7DDL6Mg==; Received: from [38.23.173.23] (helo=localhost) by bombadil.infradead.org with esmtpsa (Exim 4.99.1 #2 (Red Hat Linux)) id 1weDCF-0000000Eudm-1h8Y; Mon, 29 Jun 2026 14:42:51 +0000 From: "Liam R. Howlett (Oracle)" To: Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, maple-tree@lists.infradead.org, "Liam R. Howlett (Oracle)" , Chris Mason , Chuck Lever Subject: [PATCH 12/18] maple_tree: Catch race in mas_alloc_cyclic() Date: Mon, 29 Jun 2026 10:41:39 -0400 Message-ID: <20260629144145.1572283-13-liam@infradead.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260629144145.1572283-1-liam@infradead.org> References: <20260629144145.1572283-1-liam@infradead.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit If mas_alloc_cyclic() is called during a low memory situation, it is possible the lock may be dropped so reclaim can occur. There is a window where some other task may allocate the same id and cause the mas_insert() to fail with -EEXIST. In this scenario the function will return -EEXIST, which is not expected. Modifying the retry on mas_nomem() to re-search for a slot means that any race with other writes will not matter as the lock will be held between finding the index and writing the index. No existing users are exposed to this issue. Fixes: 9b6713cc75229 ("maple_tree: Add mtree_alloc_cyclic()") Reported-by: Chris Mason Cc: Chuck Lever Signed-off-by: Liam R. Howlett (Oracle) --- lib/maple_tree.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/lib/maple_tree.c b/lib/maple_tree.c index 6531a2af338cd..67cc480534e96 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -3900,27 +3900,29 @@ int mas_alloc_cyclic(struct ma_state *mas, unsigned long *startp, void *entry, unsigned long range_lo, unsigned long range_hi, unsigned long *next, gfp_t gfp) { - unsigned long min = range_lo; - int ret = 0; + int ret; + unsigned long min; - range_lo = max(min, *next); - ret = mas_empty_area(mas, range_lo, range_hi, 1); - if ((mas->tree->ma_flags & MT_FLAGS_ALLOC_WRAPPED) && ret == 0) { - mas->tree->ma_flags &= ~MT_FLAGS_ALLOC_WRAPPED; - ret = 1; - } - if (ret < 0 && range_lo > min) { - mas_reset(mas); - ret = mas_empty_area(mas, min, range_hi, 1); - if (ret == 0) + min = range_lo; + do { + range_lo = max(min, *next); + ret = mas_empty_area(mas, range_lo, range_hi, 1); + if ((mas->tree->ma_flags & MT_FLAGS_ALLOC_WRAPPED) && ret == 0) { + mas->tree->ma_flags &= ~MT_FLAGS_ALLOC_WRAPPED; ret = 1; - } - if (ret < 0) - return ret; + } + if (ret < 0 && range_lo > min) { + mas_reset(mas); + ret = mas_empty_area(mas, min, range_hi, 1); + if (ret == 0) + ret = 1; + } + if (ret < 0) + return ret; - do { mas_insert(mas, entry); } while (mas_nomem(mas, gfp)); + if (mas_is_err(mas)) return xa_err(mas->node); -- 2.47.3