From: "Liam R. Howlett (Google)" <liam@infradead.org>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
maple-tree@lists.infradead.org, Lorenzo Stoakes <ljs@kernel.org>,
Chris Mason <mason@kernel.org>, Alice Ryhl <aliceryhl@google.com>,
Andrew Ballance <andrewjballance@gmail.com>,
"Liam R. Howlett (Google)" <liam@infradead.org>
Subject: [PATCH v2 0/3] maple_tree fixes for 7.3
Date: Mon, 2 Nov 2026 21:07:21 -0500 [thread overview]
Message-ID: <20261103020724.2614498-1-liam@infradead.org> (raw)
Two bugs found by an LLM review, and one problem Lorenzo Stoakes
reported off list.
An RCU reader that restarts after its node dies can dereference NULL if
the tree was emptied, or holds a single entry in the root pointer.
Patch 1 fixes it and patch 2 adds a test.
With CONFIG_DEBUG_MAPLE_TREE, MT_WARN_ON() and the other WARN macros
print the tree and call dump_stack() rather than WARN(), so syzbot never
sees them. Patch 3 makes them WARN once per call site, after the dump,
and makes the BUG macros BUG() after theirs. The userspace tests make
WARN() fatal to keep failing as they did on dump_stack().
Changes since v1:
- Drop rhashtable patch. It is still undecided and will go to linux-crypto
- A reverse walk from index 0 returned the new root entry a second time;
fixed and tested (Andrew's review bot)
- Fixes tags point at the commits that introduced the problems
- The WARN macros' once state is reset by clear_warn_once
- WARN() is fatal in maple-shared.h (Lorenzo); the maple test exits
non-zero on a failure
Liam R. Howlett (Google) (3):
maple_tree: Fix rcu reader NULL dereference after the tree is emptied
maple_tree: Test emptying tree while RCU reading
maple_tree: Update internal warning and bug_on code
include/linux/maple_tree.h | 48 ++++----
lib/maple_tree.c | 112 ++++++++++++++-----
lib/test_maple_tree.c | 165 ++++++++++++++++++++++++++++
tools/testing/radix-tree/maple.c | 13 ++-
tools/testing/shared/maple-shared.h | 33 ++++++
5 files changed, 316 insertions(+), 55 deletions(-)
--
2.47.3
next reply other threads:[~2026-11-03 2:07 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-03 2:07 Liam R. Howlett (Google) [this message]
2026-11-03 2:07 ` [PATCH v2 1/3] maple_tree: Fix rcu reader NULL dereference after the tree is emptied Liam R. Howlett (Google)
2026-11-03 2:07 ` [PATCH v2 2/3] maple_tree: Test emptying tree while RCU reading Liam R. Howlett (Google)
2026-11-03 2:07 ` [PATCH v2 3/3] maple_tree: Update internal warning and bug_on code Liam R. Howlett (Google)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261103020724.2614498-1-liam@infradead.org \
--to=liam@infradead.org \
--cc=akpm@linux-foundation.org \
--cc=aliceryhl@google.com \
--cc=andrewjballance@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=maple-tree@lists.infradead.org \
--cc=mason@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®