+ lib-xarray-free-unused-spare-node-in-xas_create_range.patch added to mm-new branch

+ lib-xarray-free-unused-spare-node-in-xas_create_range.patch added to mm-new branch

[Andrew Morton]

The patch titled
     Subject: lib: xarray: free unused spare node in xas_create_range()
has been added to the -mm mm-new branch.  Its filename is
     lib-xarray-free-unused-spare-node-in-xas_create_range.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/lib-xarray-free-unused-spare-node-in-xas_create_range.patch

This patch will later appear in the mm-new branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Note, mm-new is a provisional staging ground for work-in-progress
patches, and acceptance into mm-new is a notification for others take
notice and to finish up reviews.  Please do not hesitate to respond to
review feedback and post updated versions to replace or incrementally
fixup patches in mm-new.

The mm-new branch of mm.git is not included in linux-next

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Shardul Bankar <shardul.b@mpiricsoftware.com>
Subject: lib: xarray: free unused spare node in xas_create_range()
Date: Thu, 4 Dec 2025 19:56:25 +0530

xas_create_range() is typically called in a retry loop that uses
xas_nomem() to handle -ENOMEM errors.  xas_nomem() may allocate a spare
xa_node and store it in xas->xa_alloc for use in the retry.

When the lock is dropped after xas_create_range() another thread can
expand the xarray tree in the meantime.  On the next retry,
xas_create_range() can then succeed without consuming the spare node
stored in xas->xa_alloc.  If the function returns without freeing this
spare node, it leaks.

xas_create_range() calls xas_create() multiple times in a loop for
different index ranges.  A spare node that isn't needed for one range
iteration might be needed for the next, so we cannot free it after each
xas_create() call.  We can only safely free it after xas_create_range()
completes.

Fix this by calling xas_destroy() at the end of xas_create_range() to free
any unused spare node.  This makes the API safer by default and prevents
callers from needing to remember cleanup.

This fixes a memory leak in mm/khugepaged.c and potentially other callers
that use xas_nomem() with xas_create_range().

Link: https://syzkaller.appspot.com/bug?id=a274d65fc733448ed518ad15481ed575669dd98c
Link: https://lore.kernel.org/all/20251201074540.3576327-1-shardul.b@mpiricsoftware.com/ ("v3")
Link: https://lkml.kernel.org/r/20251204142625.1763372-1-shardul.b@mpiricsoftware.com
Fixes: cae106dd67b9 ("mm/khugepaged: refactor collapse_file control flow")
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
Reviewed-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Jinjiang Tu <tujinjiang@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 lib/xarray.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/lib/xarray.c~lib-xarray-free-unused-spare-node-in-xas_create_range
+++ a/lib/xarray.c
@@ -744,11 +744,16 @@ restore:
 	xas->xa_shift = shift;
 	xas->xa_sibs = sibs;
 	xas->xa_index = index;
-	return;
+	goto cleanup;
+
 success:
 	xas->xa_index = index;
 	if (xas->xa_node)
 		xas_set_offset(xas);
+
+cleanup:
+	/* Free any unused spare node from xas_nomem() */
+	xas_destroy(xas);
 }
 EXPORT_SYMBOL_GPL(xas_create_range);
 
_

Patches currently in -mm which might be from shardul.b@mpiricsoftware.com are

lib-xarray-free-unused-spare-node-in-xas_create_range.patch

Re: + lib-xarray-free-unused-spare-node-in-xas_create_range.patch added to mm-new branch

[Matthew Wilcox]

On Mon, Jan 26, 2026 at 12:07:31PM -0800, Andrew Morton wrote:
> 
> The patch titled
>      Subject: lib: xarray: free unused spare node in xas_create_range()
> has been added to the -mm mm-new branch.  Its filename is
>      lib-xarray-free-unused-spare-node-in-xas_create_range.patch

This has been superseded by my patch to call xa_destroy() in
clear_inode().

+ lib-xarray-free-unused-spare-node-in-xas_create_range.patch added to mm-new branch

[Andrew Morton]

The patch titled
     Subject: lib: xarray: free unused spare node in xas_create_range()
has been added to the -mm mm-new branch.  Its filename is
     lib-xarray-free-unused-spare-node-in-xas_create_range.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/lib-xarray-free-unused-spare-node-in-xas_create_range.patch

This patch will later appear in the mm-new branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Note, mm-new is a provisional staging ground for work-in-progress
patches, and acceptance into mm-new is a notification for others take
notice and to finish up reviews.  Please do not hesitate to respond to
review feedback and post updated versions to replace or incrementally
fixup patches in mm-new.

The mm-new branch of mm.git is not included in linux-next

If a few days of testing in mm-new is successful, the patch will me moved
into mm.git's mm-unstable branch, which is included in linux-next

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Shardul Bankar <shardul.b@mpiricsoftware.com>
Subject: lib: xarray: free unused spare node in xas_create_range()
Date: Thu, 04 Dec 2025 19:56:25 +0530

Patch series "xarray: free unused spare node after range creation".

xas_nomem() can leave a spare xa_node in an XA state when another user
populates the tree before xas_create_range() retries.  Free an unused
spare at the end of range creation, and add a deterministic lib/test_xarray
check for that path.  The fix is first and the test is second.

The test patch was held on both sides of a kernel A/B run while only the
fix was removed and restored.  Without the fix, its spare-node assertion
failed (158825705 of 158825706 checks passed).  With the fix, all
158825706 checks passed.  Both runs used the same verified guest test
script.


This patch (of 2):

xas_create_range() is typically called in a retry loop that uses
xas_nomem() to handle -ENOMEM errors.  xas_nomem() may allocate a spare
xa_node and store it in xas->xa_alloc for use in the retry.

If the lock is dropped after xas_nomem(), another thread can expand the
xarray tree in the meantime.  On the next retry, xas_create_range() can
then succeed without consuming the spare node stored in xas->xa_alloc.  If
the function returns without freeing this spare node, it leaks.

xas_create_range() calls xas_create() multiple times in a loop for
different index ranges.  A spare node that isn't needed for one range
iteration might be needed for the next, so we cannot free it after each
xas_create() call.  We can only safely free it after xas_create_range()
completes.

Fix this by calling xas_destroy() at the end of xas_create_range() to free
any unused spare node.  This makes the API safer by default and prevents
callers from needing to remember cleanup.

This fixes a memory leak in mm/khugepaged.c and potentially other callers
that use xas_nomem() with xas_create_range().

Link: https://lore.kernel.org/20251204142625.1763372-1-shardul.b@mpiricsoftware.com
Link: https://syzkaller.appspot.com/bug?id=a274d65fc733448ed518ad15481ed575669dd98c
Link: https://lore.kernel.org/all/20251201074540.3576327-1-shardul.b@mpiricsoftware.com/ ("v3")
Fixes: cae106dd67b9 ("mm/khugepaged: refactor collapse_file control flow")
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: David Hildenbrand (ARM) <david@kernel.org>
Tested-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: <janak@mpiricsoftware.com>
Cc: Jinjiang Tu <tujinjiang@huawei.com>

 lib/xarray.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/lib/xarray.c~lib-xarray-free-unused-spare-node-in-xas_create_range
+++ a/lib/xarray.c
@@ -745,11 +745,16 @@ restore:
 	xas->xa_shift = shift;
 	xas->xa_sibs = sibs;
 	xas->xa_index = index;
-	return;
+	goto cleanup;
+
 success:
 	xas->xa_index = index;
 	if (xas->xa_node)
 		xas_set_offset(xas);
+
+cleanup:
+	/* Free any unused spare node from xas_nomem() */
+	xas_destroy(xas);
 }
 EXPORT_SYMBOL_GPL(xas_create_range);
 
_

Patches currently in -mm which might be from shardul.b@mpiricsoftware.com are

lib-xarray-free-unused-spare-node-in-xas_create_range.patch