[PATCH 0/2] xarray: free unused spare node after range creation

[PATCH 0/2] xarray: free unused spare node after range creation

[Andrew Morton]

xas_nomem() can leave a spare xa_node in an XA state when another user
populates the tree before xas_create_range() retries.  Free an unused
spare at the end of range creation, and add a deterministic lib/test_xarray
check for that path.  The fix is first and the test is second.

The test patch was held on both sides of a kernel A/B run while only the
fix was removed and restored.  Without the fix, its spare-node assertion
failed (158825705 of 158825706 checks passed).  With the fix, all
158825706 checks passed.  Both runs used the same verified guest test
script.

Shardul Bankar (1):
  lib: xarray: free unused spare node in xas_create_range()

Andrew Morton (1):
  lib/test_xarray: check unused spare node after range creation

 lib/test_xarray.c | 31 +++++++++++++++++++++++++++++++
 lib/xarray.c      |  7 ++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)

[PATCH 1/2] lib: xarray: free unused spare node in xas_create_range()

[Andrew Morton]

From: Shardul Bankar <shardul.b@mpiricsoftware.com>

xas_create_range() is typically called in a retry loop that uses
xas_nomem() to handle -ENOMEM errors.  xas_nomem() may allocate a spare
xa_node and store it in xas->xa_alloc for use in the retry.

If the lock is dropped after xas_nomem(), another thread can expand the
xarray tree in the meantime.  On the next retry, xas_create_range() can
then succeed without consuming the spare node stored in xas->xa_alloc.  If
the function returns without freeing this spare node, it leaks.

xas_create_range() calls xas_create() multiple times in a loop for
different index ranges.  A spare node that isn't needed for one range
iteration might be needed for the next, so we cannot free it after each
xas_create() call.  We can only safely free it after xas_create_range()
completes.

Fix this by calling xas_destroy() at the end of xas_create_range() to free
any unused spare node.  This makes the API safer by default and prevents
callers from needing to remember cleanup.

This fixes a memory leak in mm/khugepaged.c and potentially other callers
that use xas_nomem() with xas_create_range().

Link: https://lore.kernel.org/20251204142625.1763372-1-shardul.b@mpiricsoftware.com
Link: https://syzkaller.appspot.com/bug?id=a274d65fc733448ed518ad15481ed575669dd98c
Link: https://lore.kernel.org/all/20251201074540.3576327-1-shardul.b@mpiricsoftware.com/ ("v3")
Fixes: cae106dd67b9 ("mm/khugepaged: refactor collapse_file control flow")
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: David Hildenbrand (ARM) <david@kernel.org>
Tested-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: <janak@mpiricsoftware.com>
Cc: Jinjiang Tu <tujinjiang@huawei.com>

 lib/xarray.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/lib/xarray.c~lib-xarray-free-unused-spare-node-in-xas_create_range
+++ a/lib/xarray.c
@@ -745,11 +745,16 @@ restore:
 	xas->xa_shift = shift;
 	xas->xa_sibs = sibs;
 	xas->xa_index = index;
-	return;
+	goto cleanup;
+
 success:
 	xas->xa_index = index;
 	if (xas->xa_node)
 		xas_set_offset(xas);
+
+cleanup:
+	/* Free any unused spare node from xas_nomem() */
+	xas_destroy(xas);
 }
 EXPORT_SYMBOL_GPL(xas_create_range);
 
_

[PATCH 2/2] lib/test_xarray: check unused spare node after range creation

[Andrew Morton]

Shardul Bankar's "[PATCH v4] lib: xarray: free unused spare node in
xas_create_range()" [1] releases a spare node left over after range
creation.  Exercise the case without depending on allocator failures or
timing: let xas_nomem() reserve a node, then populate the relevant XArray
node through a separate operation before xas_create_range() retries.

Check that the retry succeeds and releases the unused spare node.

Link: https://lore.kernel.org/r/20251204142625.1763372-1-shardul.b@mpiricsoftware.com [1]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Shardul Bankar <shardul.b@mpiricsoftware.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: David Hildenbrand (ARM) <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: <janak@mpiricsoftware.com>
Cc: Jinjiang Tu <tujinjiang@huawei.com>

 lib/test_xarray.c |   31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

--- a/lib/test_xarray.c~lib-test_xarray-check-unused-spare-node-after-range-creation
+++ a/lib/test_xarray.c
@@ -1834,6 +1834,34 @@ static noinline void check_create_range_
 	xa_destroy(xa);
 }
 
+#ifdef CONFIG_XARRAY_MULTI
+static noinline void check_create_range_spare(struct xarray *xa)
+{
+	XA_STATE_ORDER(xas, xa, 0, XA_CHUNK_SHIFT);
+	bool spare_left;
+
+	XA_BUG_ON(xa, !xa_empty(xa));
+
+	/* Model a failed allocation followed by a successful xas_nomem(). */
+	xas_set_err(&xas, -ENOMEM);
+	XA_BUG_ON(xa, !xas_nomem(&xas, GFP_KERNEL));
+
+	/* Model another user populating the tree before the retry. */
+	xa_insert_index(xa, 0);
+	xa_insert_index(xa, 1);
+
+	xas_lock(&xas);
+	xas_create_range(&xas);
+	xas_unlock(&xas);
+
+	XA_BUG_ON(xa, xas_error(&xas));
+	spare_left = xas.xa_alloc != NULL;
+	xas_destroy(&xas);
+	XA_BUG_ON(xa, spare_left);
+	xa_destroy(xa);
+}
+#endif
+
 static noinline void check_create_range(struct xarray *xa)
 {
 	unsigned int order;
@@ -1867,6 +1895,9 @@ static noinline void check_create_range(
 	}
 
 	check_create_range_3();
+#ifdef CONFIG_XARRAY_MULTI
+	check_create_range_spare(xa);
+#endif
 }
 
 static noinline void __check_store_range(struct xarray *xa, unsigned long first,
_