From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9328329C74 for ; Fri, 6 Mar 2026 23:38:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772840312; cv=none; b=lkGp2P54N7s0dusbfY8hJVR3ealA/W4z5rBBKuh+CjxtZaE/keBDMqvmZ4GfP+BhbfBAijooMyFhFrL7UvLI+GWfogFynlwFIYwmE2dD7ElXwiSooRsllWY+yDGltCtt0T8u2f01xVIXfPgI4Q6Atd1JCx5/S36QmPqZ61bqlM4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772840312; c=relaxed/simple; bh=mZv+THovHzTJCVSKXNcQIUaFk+fkGXYm1zK+N5Bh8ho=; h=Date:From:To:Cc:Message-ID:In-Reply-To:References:Subject: MIME-Version:Content-Type; b=FeBBqMWU+m7N1o77WWYljY0FZnlz9BBWOGzD4DEu2Bp5GVMDu1WK7A2rdN/e0H3GzCN1sF5a2TF/YhwyIe/zef0FfKmH066epfEWQFVfNLCEgg17BFubvfM3Iz+pcfxtWqg+62oV/y6RzYAy9nsnMM03X2NXtNZWTn2vh8AUG0k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dgptXyrf; arc=none smtp.client-ip=209.85.221.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dgptXyrf" Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-439ac15f35fso6324663f8f.0 for ; Fri, 06 Mar 2026 15:38:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772840309; x=1773445109; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:subject:references :in-reply-to:message-id:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=mZv+THovHzTJCVSKXNcQIUaFk+fkGXYm1zK+N5Bh8ho=; b=dgptXyrfUr3G1A0dUjbwVN/Kjb+8h6Gzky0lylSjJDxSaXm+tw8d628/ce0LeHDKqA EOVIMl1DWebHqm9qdsZCxWqCX6tkOqNy3l3q3RWsDfb2ICWycGq6WKy9Ip2dLtwzht1C lnI3GU1BfaVNvTgWcS6Y/n2mQDBcx457EXIOvPRcRZB9nnztKZiZ59Dxw20YGADTfttO mnVyzDAa6G4eiQAT+/9QvnTkwftVmu/MR13aZh85/yJAlF5UBKWurAIkOmB1TOPtvTrz T7UgLDOFgpKstT7syiU1/PS43NKxDqOJjvCcmXAkTG0AxhatK1Yat+s9cdu9E0G2uBM4 vowA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772840309; x=1773445109; h=content-transfer-encoding:mime-version:subject:references :in-reply-to:message-id:cc:to:from:date:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=mZv+THovHzTJCVSKXNcQIUaFk+fkGXYm1zK+N5Bh8ho=; b=Qdvb3eIE2KqYWsF1fXkvjIiQPjuGYxVhW8hIF2MF6UAKvUZufozueY3WMUa4NdYyJn TxaVzyGoZ4oDHZKLR6zGVe/Ig8N1l9MdHVVeOjyq0xa6dP52wVWF7IF8uVcFXHq10OaE ivou1Jxs1+DFy7TizOpifkO3l9h8pZqNRvdZvgpiP8F7uySPLoU+m5aYl1DaEh7aHBwF bClMln1OD0t368WuA/ULyy2FIyf+CS/yhw8/hUZoXZD6ZTc4qFgDuAhuOiqGcW+6tR9F 19aiB2zK/Vt8O+IsG7gjaUe9FOko0oZouwyn9pW1992GG/dIVccoj6oJL0NF6VFcpU6K AIfQ== X-Forwarded-Encrypted: i=1; AJvYcCWq71nAkH/6bmNml2ZZeK0ADyfLoMiZaONB3wq9jMp0PkLH/tQN/jdeW1sh9dA3WbRyCR+jZHKKUbG8zp0=@vger.kernel.org X-Gm-Message-State: AOJu0YyCk5m9x96QB1dk4eOjAZtaH/xXplZjnQKMNs0X28IAHyiR57Q/ hHFJMl4VKLhs2eVbZtMZbliPJjQX07V3a3GcZl+dqqSJ+yo/SHVtdkpP X-Gm-Gg: ATEYQzxQNToiKWjg4fPnjNxvkZVKqYkcbHvoYj70AqeNGn44DWGZSDdYi3TsMqXPOOk t2m/8kbGjvb0p5GpwjKCWa5NXz/kbUOo39n35u/x9QxN8hEkHKj7AoA/OC9i6OrMt+x6hKRAYm/ Q7eR+dWw8ylik5J12mEX7UfNWza3Kqt7WDNaH5p01WYiRxh6ltolWp1K4VL8Qi347EpRFXq4YSL Vz18c3H2TlVz+VslOFZ8sDz/XS6Hy4C9X3JvrpeilIkdkb8negVF5cnhPHRE08WWnjlN4lkLQEB tqDcgp73fAv+aeGUSr00yuCo+TvC3eh3q7Yl0stW1aoTmMs9mYvaGa4hFTtgpp6l4CPuJazyT4C bknQNfH8wfbmCDGn7w+BWTlI2Qu8kudXK4zAPrrDrbYNp2e7BV4ux1K9Y1pP5W+/P0GVZDOfj5M 1Rie1dABqsm7ZGVf2F X-Received: by 2002:a05:6000:1843:b0:439:c9b2:6571 with SMTP id ffacd0b85a97d-439da3697a9mr7081358f8f.41.1772840309039; Fri, 06 Mar 2026 15:38:29 -0800 (PST) Received: from [127.0.0.1] ([86.1.69.5]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-439dae57c05sm6340069f8f.39.2026.03.06.15.38.28 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 06 Mar 2026 15:38:28 -0800 (PST) Date: Fri, 6 Mar 2026 23:38:27 +0000 From: Josh Law To: Andrew Morton Cc: Liam.Howlett@oracle.com, aliceryhl@google.com, andrewjballance@gmail.com, maple-tree@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Josh Law Message-ID: <329e9c6c-81ad-42c0-972d-4f187353dd77@gmail.com> In-Reply-To: <20260306145434.c069313fe809d94e64a07109@linux-foundation.org> References: <20260306200820.2819999-1-objecting@objecting.org> <20260306133321.4fa6c5a73067bd179a5e888e@linux-foundation.org> <20260306145434.c069313fe809d94e64a07109@linux-foundation.org> Subject: Re: [PATCH] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Correlation-ID: <329e9c6c-81ad-42c0-972d-4f187353dd77@gmail.com> 6 Mar 2026 22:54:36 Andrew Morton : > On Fri, 6 Mar 2026 22:11:54 +0000 Josh Law wrote: > >>>> --- a/lib/maple_tree.c >>>> +++ b/lib/maple_tree.c >>>> @@ -3279,7 +3279,7 @@ static inline void mas_extend_spanning_null(stru= ct ma_wr_state *l_wr_mas, >>>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (r_mas->last < r_mas->max) = && >>>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 !mas_slot_locked(r_mas, r_w= r_mas->slots, r_mas->offset + 1)) { >>>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 r_mas->last =3D mas_safe_pi= vot(r_mas, r_wr_mas->pivots, >>>> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 r_wr_= mas->type, r_mas->offset + 1); >>>> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 r_mas= ->offset + 1, r_wr_mas->type); >>>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 r_mas->offset++; >>>> =C2=A0=C2=A0=C2=A0 } >>> >>> Whoops.=C2=A0 How come nobody has noticed after 4+ years? >>> >>> I'll add >>> >>> =C2=A0=C2=A0=C2=A0 Fixes: 54a611b60590 ("Maple Tree: add new data struc= ture") >>> >>> and maybe cc:stable if we have a reason to do so. >> >> Hi Andrew, on thought, I'd like to add Cc: stable@vger.kernel.org to thi= s. >> Even though it's been 4 years, a swapped argument in a core data structu= re like Maple Tree is a silent bug that could cause rare corruption. Better= to defuse it in the LTS kernels. > >> Seems appropriate.=C2=A0 But not as a hotfix, given the 3+ year thing. >> >> I was hoping to hear some thoughts on why this has proven to be so benig= n.=C2=A0 I suspect it has proven benign because, in most common workloads, the maple= _type enum and the offset happen to be small, overlapping integers. mas_saf= e_pivot likely returned a 'plausible' boundary that didn't trigger an immed= iate OOB access, and the tree's walking logic is resilient enough to handle= a slightly miscalculated pivot during a spanning-null extension without cr= ashing. It was a silent logic error rather than a loud memory error. V/R V/R Josh law