[PATCH 0/3] maple_tree: fix two bugs when freeing RCU-mode trees

[Florian Schmaus]

On 22/10/2026 18.32, Liam R. Howlett wrote:
> On 26/10/15 05:11PM, Florian Schmaus wrote:
>> Destroying a non-allocation maple tree with MT_FLAGS_USE_RCU defers freeing
>> its nodes to mt_free_walk(). There are two independent bugs on that path,
>> both caused by the metadata that a maple_range_64 node may keep in its last
>> slot:
>>
>>   1. mt_free_walk() takes the metadata of a node with 15 children for a
>>      child node and dereferences it.
>>      Reproduced with: 2768 ranges / height 4
>>
>>   2. mt_destroy_walk() takes the last child of a full node for metadata
>>      and corrupts its pointer, so mt_free_walk() frees a bogus address.
>>      Reproduced with: 120 ranges / a full root
[...]
> Thanks, but did you see Dimitris' patch on the 5th for this [1]?

No, I missed it, sorry. As there is no in-tree user, I did not expect 
anyone else to run into this and did not look for existing fixes.


> I believe this should also resolve your issue.

It does. Dimitris' change to mt_free_walk() is identical to my patch 1, 
and removing mt_clear_meta() is probably the better fix for the second 
bug than my patch 2.

One thing that may still be worth having is my test case: the height-3 
case in his tests only hits the bug at the root (the one requiring 
mt_clear_meta() to be gone). The height-4 case from my patch 3 exercises 
the bug at a non-root node and is not yet covered in Dimitri's test case.

Dimitris, I can send the height-4 test case as a follow-up patch on top 
of your series, extending check_range64_in_rcu(). Or would you rather 
fold it into your patch? Both is fine with me.

Thanks,
Florian

1: 
https://lore.kernel.org/all/20261005-fix-maple-tree-range64-rcu-v3-0-ebe7fb278e20@cslab.ece.ntua.gr/