mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: "Liam R. Howlett (Google)" <liam@infradead.org>
To: Andrew Morton <akpm@linux-foundation.org>,
	Thomas Graf <tgraf@suug.ch>,
	Herbert Xu <herbert@gondor.apana.org.au>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
	maple-tree@lists.infradead.org, Lorenzo Stoakes <ljs@kernel.org>,
	Chris Mason <mason@kernel.org>, Alice Ryhl <aliceryhl@google.com>,
	Andrew Ballance <andrewjballance@gmail.com>,
	"Liam R. Howlett (Google)" <liam@infradead.org>
Subject: [PATCH 0/4] Lib fixes for 7.3
Date: Wed, 28 Oct 2026 11:42:14 -0400	[thread overview]
Message-ID: <20261028154218.1668182-1-liam@infradead.org> (raw)

Two bugs found by an LLM review, and one problem Lorenzo Stoakes
reported off list.

An RCU reader that restarts after its node dies can dereference NULL if
the tree was emptied, or holds a single entry in the root pointer.
Patch 1 fixes it and patch 2 adds a test.

rhashtable can deadlock when an insert in atomic context grows the
table: the rehash may call vmalloc(), which takes locks that are not
safe against interrupts.  Patch 3 keeps non-blocking callers on
kmalloc() or a nested table.

With CONFIG_DEBUG_MAPLE_TREE, MT_WARN_ON() and the other WARN macros
print the tree and call dump_stack() rather than WARN(), so syzbot never
sees them.  Patch 4 makes them WARN once per call site, after the dump,
and makes the BUG macros BUG() after theirs.

Chris Mason (1):
  rhashtable: fix vmalloc() deadlock in atomic rehash

Liam R. Howlett (Google) (3):
  maple_tree: Fix rcu reader NULL dereference after the tree is emptied
  maple_tree: Test emptying tree while RCU reading
  maple_tree: Update internal warning and bug_on code

 include/linux/maple_tree.h |  54 +++++++++-------
 lib/maple_tree.c           | 110 +++++++++++++++++++++++--------
 lib/rhashtable.c           |  18 +++++-
 lib/test_maple_tree.c      | 129 +++++++++++++++++++++++++++++++++++++
 4 files changed, 257 insertions(+), 54 deletions(-)

-- 
2.47.3


             reply	other threads:[~2026-10-28 15:42 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-28 15:42 Liam R. Howlett (Google) [this message]
2026-10-28 15:42 ` [PATCH 1/4] maple_tree: Fix rcu reader NULL dereference after the tree is emptied Liam R. Howlett (Google)
2026-10-28 15:42 ` [PATCH 2/4] maple_tree: Test emptying tree while RCU reading Liam R. Howlett (Google)
2026-10-28 15:42 ` [PATCH 3/4] maple_tree: Update internal warning and bug_on code Liam R. Howlett (Google)
2026-10-28 17:54   ` Lorenzo Stoakes (ARM)
2026-10-28 18:37     ` Liam R. Howlett (Google)
2026-10-28 15:42 ` [PATCH 4/4] rhashtable: fix vmalloc() deadlock in atomic rehash Liam R. Howlett (Google)
2026-10-29  2:16   ` Herbert Xu
2026-10-29 10:08     ` Uladzislau Rezki
2026-10-29 14:53       ` Liam R. Howlett (Google)
2026-10-29 16:23         ` Michal Hocko
2026-10-29 20:02   ` Matthew Wilcox

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261028154218.1668182-1-liam@infradead.org \
    --to=liam@infradead.org \
    --cc=akpm@linux-foundation.org \
    --cc=aliceryhl@google.com \
    --cc=andrewjballance@gmail.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=ljs@kernel.org \
    --cc=maple-tree@lists.infradead.org \
    --cc=mason@kernel.org \
    --cc=tgraf@suug.ch \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®