[PATCH v2 0/3] maple_tree fixes for 7.3
Liam R. Howlett (Google)
liam at infradead.org
Mon Nov 2 18:07:21 PST 2026
Two bugs found by an LLM review, and one problem Lorenzo Stoakes
reported off list.
An RCU reader that restarts after its node dies can dereference NULL if
the tree was emptied, or holds a single entry in the root pointer.
Patch 1 fixes it and patch 2 adds a test.
With CONFIG_DEBUG_MAPLE_TREE, MT_WARN_ON() and the other WARN macros
print the tree and call dump_stack() rather than WARN(), so syzbot never
sees them. Patch 3 makes them WARN once per call site, after the dump,
and makes the BUG macros BUG() after theirs. The userspace tests make
WARN() fatal to keep failing as they did on dump_stack().
Changes since v1:
- Drop rhashtable patch. It is still undecided and will go to linux-crypto
- A reverse walk from index 0 returned the new root entry a second time;
fixed and tested (Andrew's review bot)
- Fixes tags point at the commits that introduced the problems
- The WARN macros' once state is reset by clear_warn_once
- WARN() is fatal in maple-shared.h (Lorenzo); the maple test exits
non-zero on a failure
Liam R. Howlett (Google) (3):
maple_tree: Fix rcu reader NULL dereference after the tree is emptied
maple_tree: Test emptying tree while RCU reading
maple_tree: Update internal warning and bug_on code
include/linux/maple_tree.h | 48 ++++----
lib/maple_tree.c | 112 ++++++++++++++-----
lib/test_maple_tree.c | 165 ++++++++++++++++++++++++++++
tools/testing/radix-tree/maple.c | 13 ++-
tools/testing/shared/maple-shared.h | 33 ++++++
5 files changed, 316 insertions(+), 55 deletions(-)
--
2.47.3
More information about the maple-tree
mailing list