[Patch v3 0/3] maple_tree: Fix the replacement of a root leaf node

[Wei Yang]

On Tue, Jun 10, 2025 at 08:55:39PM -0700, Andrew Morton wrote:
>On Wed, 11 Jun 2025 02:54:36 +0000 Wei Yang <richard.weiyang at gmail.com> wrote:
>
>> On Tue, Jun 10, 2025 at 06:37:27PM -0700, Andrew Morton wrote:
>> >On Wed, 11 Jun 2025 01:12:50 +0000 Wei Yang <richard.weiyang at gmail.com> wrote:
>> >
>> >> On destroy we should set each node dead. But current
>> >> code miss this when the maple tree has only the root node.
>> >> 
>> >> The reason is mt_destroy_walk() leverage mte_destroy_descend() to set
>> >> node dead, but this is skipped since the only root node is a leaf.
>> >
>> >Thanks.  You added cc:stable to two of the patches and that's great,
>> >thanks for remembering.  But the changelogs didn't tell us why you made
>> >this choice.
>> >
>> >So, as always, please always describe the userspace-visible impact of a
>> >bug when fixing that bug!
>> 
>> Thanks for reminding.
>> 
>> Do you prefer to have a new version with the description in changelog?
>
>No, that's fine - please just send it in reply to this email.

Below is my understanding about the impact of the bug.

---

Without the fix, maple tree user may see old value after overwriting the whole
range [0, ULONG_MAX] on a tree containing just one leaf node. If it happens,
kernel may access some invalid data and be crashed.

Since we rarely overwrite the whole range of a maple tree, we don't expect it
to have userspace-visible impact in practise.

-- 
Wei Yang
Help you, Help me