From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 590CB33B6F4 for ; Fri, 6 Mar 2026 21:33:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772832802; cv=none; b=N2xYioEv0eSvzN1+SaSWyqvhGp5+6++I8pVLdjZWsO87ksJsCaT/Qywij1KyEqtBNM8ytdFgdtLh2fhr2Gh446i0xpWp9qU31xFtdh+8ODX2jLgp4Uj0qW2NwOrAn63Yd3o77RIXjzxv6x3efmfRzh4ZG0AohiXjYIgwTQ59bkc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772832802; c=relaxed/simple; bh=8jaSIcRSx+9WU8w9NefmaqaqpI5tNzDSPWXQW3xYA5s=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=tgjKx8Rw5rgmTYrRNOBMJDK0KEvmp4SQJeFUItQBImIy7qqMJehLjrH+D0R7/htuU7rxcH62ae2SulbvHPFUdjd+6cP4nN8v/7Skelo0HdXXP7ucrCOXV2qHKIoOrhZM0vkTP/0R1hdoGB26Nev1zYqTe0ucf98tY6xfqMc9gDk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=YZ/xBNKk; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="YZ/xBNKk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9E34C4CEF7; Fri, 6 Mar 2026 21:33:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1772832802; bh=8jaSIcRSx+9WU8w9NefmaqaqpI5tNzDSPWXQW3xYA5s=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=YZ/xBNKksGtAYPckNFaiDTD5J5+3zMZkaM45Kfz+l4PN0ZnBiWvY473N8oaX93Rzy B8uX2yQVWtsrXq5dG4jI6WNVnz3Py73QkdcvRTk7nZdKNWo+jvQ5exAu+zLWR9ebDQ NdagGLA99dbNlkReEVhkdcWkuh5cMYTcbUwMOrJ0= Date: Fri, 6 Mar 2026 13:33:21 -0800 From: Andrew Morton To: Josh Law Cc: Liam.Howlett@oracle.com, aliceryhl@google.com, andrewjballance@gmail.com, maple-tree@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Josh Law Subject: Re: [PATCH] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call Message-Id: <20260306133321.4fa6c5a73067bd179a5e888e@linux-foundation.org> In-Reply-To: <20260306200820.2819999-1-objecting@objecting.org> References: <20260306200820.2819999-1-objecting@objecting.org> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Fri, 6 Mar 2026 20:08:20 +0000 Josh Law wrote: > From: Josh Law > > The call to mas_safe_pivot() in mas_wr_extend_null() has the pivot index > and maple type arguments swapped. The function signature expects > (mas, pivots, piv, type) but the call passes (mas, pivots, type, piv). > > This causes the pivot index to be interpreted as a maple node type and > vice versa, leading to incorrect pivot lookups. In practice, this means > a null-extending store into a maple tree node can read the wrong pivot > value, potentially corrupting the range tracked by the maple state. For > a VMA maple tree, this could cause an incorrect vm_area_struct range to > be returned during operations like mmap or munmap, leading to silent > memory mapping corruption. > > Every other mas_safe_pivot() call site in the file passes the arguments > in the correct (piv, type) order; this is the only one with them > reversed. > > ... > > --- a/lib/maple_tree.c > +++ b/lib/maple_tree.c > @@ -3279,7 +3279,7 @@ static inline void mas_extend_spanning_null(struct ma_wr_state *l_wr_mas, > (r_mas->last < r_mas->max) && > !mas_slot_locked(r_mas, r_wr_mas->slots, r_mas->offset + 1)) { > r_mas->last = mas_safe_pivot(r_mas, r_wr_mas->pivots, > - r_wr_mas->type, r_mas->offset + 1); > + r_mas->offset + 1, r_wr_mas->type); > r_mas->offset++; > } Whoops. How come nobody has noticed after 4+ years? I'll add Fixes: 54a611b60590 ("Maple Tree: add new data structure") and maybe cc:stable if we have a reason to do so.