From nobody Fri Sep 25 05:30:16 2026 Received: from danaos.cslab.ece.ntua.gr (danaos.cslab.ece.ntua.gr [147.102.3.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD5E04EBAEB for ; Wed, 16 Sep 2026 11:39:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=147.102.3.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789558771; cv=none; b=B7cy7/kqRTYDWzdfTIPyX+MOZgyij9hgpaHFhYMxkfcA/zLqD9HSSRSP+zqFahDnz4sXE//LcOvLdXpvfavzOlTbus+KR8UGhqBDgnXBxGifzqv+nJpgFP2ACbTFQW2Fmbk09nVEiC+tXSn+OrZv2hv2QnzTQcC58IhuYVAZ/JM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789558771; c=relaxed/simple; bh=Y1SFoLhBIFd6pX1RkY73sxEGVjFfj6zsBKMG2Gysrbc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=t+L16o/28m11eLDwIITAaYAT3RN76lbxsIUguwqPBZkXBKWKmIqgwu2OFAGiN2f1VXd9KP+7nXyije60P4pdjXsj8g92H0BKXxH03z0IEY9vh8xpRBoJqkirwGmQ+qIA+25thzZ1xp7KbQC4rsuHnq8YcI0HtBu/A/CifiXAExo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cslab.ece.ntua.gr; spf=pass smtp.mailfrom=cslab.ece.ntua.gr; dkim=pass (1024-bit key) header.d=cslab.ece.ntua.gr header.i=@cslab.ece.ntua.gr header.b=am3FPyaP; arc=none smtp.client-ip=147.102.3.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cslab.ece.ntua.gr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cslab.ece.ntua.gr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=cslab.ece.ntua.gr header.i=@cslab.ece.ntua.gr header.b="am3FPyaP" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cslab.ece.ntua.gr; s=smtp-cslab; t=1789558743; bh=Y1SFoLhBIFd6pX1RkY73sxEGVjFfj6zsBKMG2Gysrbc=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=am3FPyaPipHW4yX/qhIBiB5rBHVCCgYrVvR5SqtJPa9iSeMr8VPph3LDHi6EOXYpB s0Wa3dIj0xBT7vXVWvPd1UKqgpMqJiLry8OmcvSeYEum6F4N0INbzu3xaR/3el0fIC fSSSRo1RyjZYPYtqc9Y3TdQM4w5A3kisb/jPoHWs= Received: from [127.0.0.1] (armor.cslab.ece.ntua.gr [147.102.4.33]) by danaos.cslab.ece.ntua.gr (Postfix) with ESMTPSA id CA559120B7D; Wed, 16 Sep 2026 14:39:03 +0300 (EEST) From: Dimitris Charisis Date: Wed, 16 Sep 2026 11:38:42 +0000 Subject: [PATCH v2 1/4] maple_tree: remove mt_clear_meta() to fix a pointer corruption Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260916-fix-maple-tree-range64-rcu-v2-1-0b09de37eb69@cslab.ece.ntua.gr> References: <20260916-fix-maple-tree-range64-rcu-v2-0-0b09de37eb69@cslab.ece.ntua.gr> In-Reply-To: <20260916-fix-maple-tree-range64-rcu-v2-0-0b09de37eb69@cslab.ece.ntua.gr> To: Andrew Morton , "Liam R. Howlett" , Alice Ryhl , Andrew Ballance , Suren Baghdasaryan , "Matthew Wilcox (Oracle)" Cc: maple-tree@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Dimitris Charisis X-Mailer: b4 0.14.2 mt_clear_meta() decides whether the last slot of a maple_range_64 node holds a child pointer or a struct maple_metadata with the check if (unlikely((mte_to_node(next) && mte_node_type(next)))) return; /* no metadata, could be node */ The check expects the pointer to be encoded. But the only callsite of mt_clear_meta() is mt_destroy_walk() on the RCU destroy path, and by the time it runs, mte_dead_leaves() has overwritten every slot on a full node with a raw pointer, stripping the type information. Thus, the check above never returns early for a full node as it should. It falls through and then: meta->gap =3D 0; meta->end =3D 0; zeroes two bytes of a valid child pointer. Later, mt_free_walk() dereferences the corrupted pointer. Fix this by removing mt_clear_meta() along with its only callsite. mt_clear_meta() is only called for the root of each sub-tree destroyed under RCU. Descendant nodes retain their metadata until they are freed. RCU readers may use the metadata while traversing a node, but do not use cleared metadata to detect that a node has been removed. They detect a dead node via ma_dead_node(). Fixes: 2e5b4921f8ef ("maple_tree: fix freeing of nodes in rcu mode") Signed-off-by: Dimitris Charisis --- lib/maple_tree.c | 39 --------------------------------------- 1 file changed, 39 deletions(-) diff --git a/lib/maple_tree.c b/lib/maple_tree.c index 1aba6cced71307245cbbca26986e14e74b35a14f..e86eee43aa0ada6963995cd7449= 5d9344f6ccd06 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -763,43 +763,6 @@ static inline void ma_set_meta(struct maple_node *mn, = enum maple_type mt, meta->end =3D end; } =20 -/* - * mt_clear_meta() - clear the metadata information of a node, if it exists - * @mt: The maple tree - * @mn: The maple node - * @type: The maple node type - */ -static inline void mt_clear_meta(struct maple_tree *mt, struct maple_node = *mn, - enum maple_type type) -{ - struct maple_metadata *meta; - unsigned long *pivots; - void __rcu **slots; - void *next; - - switch (type) { - case maple_range_64: - pivots =3D mn->mr64.pivot; - if (unlikely(pivots[MAPLE_RANGE64_SLOTS - 2])) { - slots =3D mn->mr64.slot; - next =3D mt_slot_locked(mt, slots, - MAPLE_RANGE64_SLOTS - 1); - if (unlikely((mte_to_node(next) && - mte_node_type(next)))) - return; /* no metadata, could be node */ - } - fallthrough; - case maple_arange_64: - meta =3D ma_meta(mn, type); - break; - default: - return; - } - - meta->gap =3D 0; - meta->end =3D 0; -} - /* * ma_meta_end() - Get the data end of a node from the metadata * @mn: The maple node @@ -4885,8 +4848,6 @@ static void mt_destroy_walk(struct maple_enode *enode= , struct maple_tree *mt, free_leaf: if (free) kfree(node); - else - mt_clear_meta(mt, node, node->type); } =20 /* --=20 2.47.3 From nobody Fri Sep 25 05:30:16 2026 Received: from danaos.cslab.ece.ntua.gr (danaos.cslab.ece.ntua.gr [147.102.3.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B39334E8E05 for ; Wed, 16 Sep 2026 11:39:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=147.102.3.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789558771; cv=none; b=ORtM1DSf6D9aM0KBnGTYKFaGslNjgbHR4klEZrTxJX/9TueglXrQvp19B19KHvo2oFdee+YKxz805YCWcC7DxEA6mSuuj52rKTgh+FxJ81MRnsSvX13b3pfoBfVF7D+CQfMxBR9Tak7E6+1oIBGxHfyaFYwHy/1aBT6WVUDzAv0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789558771; c=relaxed/simple; bh=UTqsWoNgi0JoUBsTSlLajU9tY0b5om7/Kl+EO4gTmk8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=fcPIKUlPsDHGyMlPgvnfKhV28zFbaujQT8vVVy2RF9jynoJ0S6F937wZy+fUicpG+tnFsVldzVyJ/C6dlWT3pTZLwZ2Tp4uLnu9blcbAeI70bE6EDya+0nYcY59dh2Wr2jwpV0DMqOaJZvNNNLaIFy09UrwvoZX66Zd6nkj/L6Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cslab.ece.ntua.gr; spf=pass smtp.mailfrom=cslab.ece.ntua.gr; dkim=pass (1024-bit key) header.d=cslab.ece.ntua.gr header.i=@cslab.ece.ntua.gr header.b=q6YLEGd5; arc=none smtp.client-ip=147.102.3.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cslab.ece.ntua.gr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cslab.ece.ntua.gr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=cslab.ece.ntua.gr header.i=@cslab.ece.ntua.gr header.b="q6YLEGd5" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cslab.ece.ntua.gr; s=smtp-cslab; t=1789558743; bh=UTqsWoNgi0JoUBsTSlLajU9tY0b5om7/Kl+EO4gTmk8=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=q6YLEGd5JNR6tuPP/xh8EF1H1DVyHK0FubeLeJUEl/f1CZncZkhk59xsfR1i5dpir Nx8nAy9lI/22ss49Pt8aKIzMMwMZSenmNiA0KA5yPJZ5bjet/pxnFX4JSHPPFjaAor dKqDhcd41To2lPMWO22BNMnsU3kreLTlsxXvo7fM= Received: from [127.0.0.1] (armor.cslab.ece.ntua.gr [147.102.4.33]) by danaos.cslab.ece.ntua.gr (Postfix) with ESMTPSA id EA125120BF5; Wed, 16 Sep 2026 14:39:03 +0300 (EEST) From: Dimitris Charisis Date: Wed, 16 Sep 2026 11:38:43 +0000 Subject: [PATCH v2 2/4] test_maple_tree: test a full maple_range_64 node in RCU mode Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260916-fix-maple-tree-range64-rcu-v2-2-0b09de37eb69@cslab.ece.ntua.gr> References: <20260916-fix-maple-tree-range64-rcu-v2-0-0b09de37eb69@cslab.ece.ntua.gr> In-Reply-To: <20260916-fix-maple-tree-range64-rcu-v2-0-0b09de37eb69@cslab.ece.ntua.gr> To: Andrew Morton , "Liam R. Howlett" , Alice Ryhl , Andrew Ballance , Suren Baghdasaryan , "Matthew Wilcox (Oracle)" Cc: maple-tree@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Dimitris Charisis X-Mailer: b4 0.14.2 Add a test that builds a tree whose root is a full maple_range_64 node. Ensure the destruction under RCU does not misinterpret the last slot as metadata. 226 insertions produce such a root on a 64-bit build. Signed-off-by: Dimitris Charisis --- lib/test_maple_tree.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/lib/test_maple_tree.c b/lib/test_maple_tree.c index b9367c61e8b50d107ab972fc5222fb6a531fad87..461bb0e4816ef6e9c670018a13a= 88a0e5d0cf89e 100644 --- a/lib/test_maple_tree.c +++ b/lib/test_maple_tree.c @@ -3710,6 +3710,23 @@ static noinline void __init alloc_cyclic_testing(str= uct maple_tree *mt) MT_BUG_ON(mt, ret !=3D 1); } =20 +static noinline void __init check_range64_in_rcu(struct maple_tree *mt) +{ + unsigned long i; + unsigned long nr_entries =3D 226; /* Build a full maple_range_64 root nod= e */ + + MT_BUG_ON(mt, !mtree_empty(mt)); + mt_init_flags(mt, MT_FLAGS_USE_RCU); + + for (i =3D 0; i < nr_entries; i++) { + MT_BUG_ON(mt, mtree_test_insert_range(mt, i*10, i*10 + 9, + xa_mk_value(i))); + } + + mtree_destroy(mt); + rcu_barrier(); +} + static DEFINE_MTREE(tree); static int __init maple_tree_seed(void) { @@ -3999,6 +4016,8 @@ static int __init maple_tree_seed(void) alloc_cyclic_testing(&tree); mtree_destroy(&tree); =20 + check_range64_in_rcu(&tree); + =20 #if defined(BENCH) skip: --=20 2.47.3 From nobody Fri Sep 25 05:30:16 2026 Received: from danaos.cslab.ece.ntua.gr (danaos.cslab.ece.ntua.gr [147.102.3.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5BEAA3B71DC for ; Wed, 16 Sep 2026 11:39:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=147.102.3.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789558767; cv=none; b=HHfuAlp6dtxe1w5JtM3V3ELYG5bbAFbSOkdDgn3UA0irOnvSMCdLr5SZ4fn0oIKkRaoXqV0W1lldtbg+1TIiyKkpEak6jhPTB3T09LWD0LQ/joCN61lcTddMXJnYACacBu56J+vTycBdEDZEBkeeq3q5HQNkkFmIt4YbPxn5auM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789558767; c=relaxed/simple; bh=iTPbgi6TTWpSnIYUxKADxzx4y1Pw8y2qclg7BMPDqWA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WdVI0HL2bCsNcGMZEz37hiBNyjg+wucLxgat4pJLWDomVV0g5UmewMZQe8/OGiu7kjOTDAxWm62no86S5+2vgbHHSBzqb64GmK+0Ah1iHtB3ZEZexMJY7wIGsukE9svbrJ/MYbusCaWn4fDB618Vpng+7vQEUau8bRgV/6bmrUk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cslab.ece.ntua.gr; spf=pass smtp.mailfrom=cslab.ece.ntua.gr; dkim=pass (1024-bit key) header.d=cslab.ece.ntua.gr header.i=@cslab.ece.ntua.gr header.b=d47+8HVT; arc=none smtp.client-ip=147.102.3.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cslab.ece.ntua.gr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cslab.ece.ntua.gr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=cslab.ece.ntua.gr header.i=@cslab.ece.ntua.gr header.b="d47+8HVT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cslab.ece.ntua.gr; s=smtp-cslab; t=1789558744; bh=iTPbgi6TTWpSnIYUxKADxzx4y1Pw8y2qclg7BMPDqWA=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=d47+8HVTgyT/i/Hi2bUgm9y0um/FjGxgtsCzL2ArQFbb8d+v1ZL9I3nvIgQTAY8CN Wk+ZzIZ7AU8UkFUBUIIYN7y68xKkXeHQItTNLM1EHiV+zwLSjHMbw7Sz8q+XtuEOAJ 2fFMAIeiLC2DlFvC+kDAkn7DzmxSaik5QQ0BRVgQ= Received: from [127.0.0.1] (armor.cslab.ece.ntua.gr [147.102.4.33]) by danaos.cslab.ece.ntua.gr (Postfix) with ESMTPSA id 141F9120BF6; Wed, 16 Sep 2026 14:39:04 +0300 (EEST) From: Dimitris Charisis Date: Wed, 16 Sep 2026 11:38:44 +0000 Subject: [PATCH v2 3/4] maple_tree: fix invalid memory access in mt_free_walk() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260916-fix-maple-tree-range64-rcu-v2-3-0b09de37eb69@cslab.ece.ntua.gr> References: <20260916-fix-maple-tree-range64-rcu-v2-0-0b09de37eb69@cslab.ece.ntua.gr> In-Reply-To: <20260916-fix-maple-tree-range64-rcu-v2-0-0b09de37eb69@cslab.ece.ntua.gr> To: Andrew Morton , "Liam R. Howlett" , Alice Ryhl , Andrew Ballance , Suren Baghdasaryan , "Matthew Wilcox (Oracle)" Cc: maple-tree@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Dimitris Charisis X-Mailer: b4 0.14.2 mt_free_walk() descends to the left-most unvisited "parent-of-a-leaf" node by checking the condition: if ((offset < mt_slots[type]) && rcu_dereference_protected(slots[offset], lock_is_held(&rcu_callback_map))) slots =3D mte_dead_walk(&enode, offset); A maple_range_64 node has MAPLE_RANGE64_SLOTS slots. When it's not full, the last slot carries a struct maple_metadata holding the offset of the last valid slot. So on a node with MAPLE_RANGE64_SLOTS-1 children *all* slots are non-NULL. The first MAPLE_RANGE64_SLOTS-1 hold valid pointers to child nodes, and the last slot contains metadata. The above check therefore passes for all offsets, and mte_dead_walk() dereferences the metadata as if it were a node. To trigger this, a node at least two levels above the leaves has to have exactly MAPLE_RANGE64_SLOTS-1 valid pointers to other nodes. maple_arange_64 nodes cannot hit this since they store the metadata in a separate field. Fix this by bounding the descent with slot_len which holds the number of children of a dead node. Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Dimitris Charisis --- lib/maple_tree.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lib/maple_tree.c b/lib/maple_tree.c index e86eee43aa0ada6963995cd74495d9344f6ccd06..0b0036c9f848929a7c9a26650cc= d935c44aa1376 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -4752,9 +4752,7 @@ static void mt_free_walk(struct rcu_head *head) =20 type =3D mte_node_type(enode); slots =3D ma_slots(mte_to_node(enode), type); - if ((offset < mt_slots[type]) && - rcu_dereference_protected(slots[offset], - lock_is_held(&rcu_callback_map))) + if (offset < mte_to_node(enode)->slot_len) slots =3D mte_dead_walk(&enode, offset); node =3D mte_to_node(enode); } while ((node !=3D start) || (node->slot_len < offset)); --=20 2.47.3 From nobody Fri Sep 25 05:30:16 2026 Received: from danaos.cslab.ece.ntua.gr (danaos.cslab.ece.ntua.gr [147.102.3.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2AEDA48A8A3 for ; Wed, 16 Sep 2026 11:39:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=147.102.3.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789558765; cv=none; b=WAq5Wpn8pPbFB3Z8SkrBJCIjkfznUyC5cc/9+Ke7knFoPsexluBxd1Cag0W17u5JPduK1110rGYLtJmQJeiP0R2QV9cj+/l08GlmwWiUv3+tX+T7eHVQyNTK5rxGWZNqjIg0xzyJ42+B5OdMWRBReG8+txp8nOWndDR2c0KrW90= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789558765; c=relaxed/simple; bh=taknttCU6rJMJ8zwyv9vXK3jlIjsPKMRnLZRjFDfX5k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=GGe8QAtjMU5wtyDg6ieoyvEfNlKlh1CgjCzwsRRVXQSINxFGISpTkzgJzPW50ImxRA+hjZ1+NBBnpdWFh+1b9z7N65L+8u/FII1MMZQnGZdXHMQ7X6xImlfjOkIOJiOVs0Wx2ESxbGxlGuI/dbihTzp8CBMbRV8CKj+KfwoKF9Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cslab.ece.ntua.gr; spf=pass smtp.mailfrom=cslab.ece.ntua.gr; dkim=pass (1024-bit key) header.d=cslab.ece.ntua.gr header.i=@cslab.ece.ntua.gr header.b=gHofv133; arc=none smtp.client-ip=147.102.3.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cslab.ece.ntua.gr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cslab.ece.ntua.gr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=cslab.ece.ntua.gr header.i=@cslab.ece.ntua.gr header.b="gHofv133" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cslab.ece.ntua.gr; s=smtp-cslab; t=1789558744; bh=taknttCU6rJMJ8zwyv9vXK3jlIjsPKMRnLZRjFDfX5k=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=gHofv133TPvlF28+QEpcaM5JgD7JoZleuStXVi1KHcOLwqKyEa5RdlsZZijH0/hzi vkcqb/cTlti/McA1gqgIZT4VB9hPkgpKuf8VD+/+Gn9Lrt/G0Px87DFavqMyfUDLG0 ieXEKDd1DCFTaVa6Ly9TVv2+QyThQdan3ZewjYso= Received: from [127.0.0.1] (armor.cslab.ece.ntua.gr [147.102.4.33]) by danaos.cslab.ece.ntua.gr (Postfix) with ESMTPSA id 282A9120BFD; Wed, 16 Sep 2026 14:39:04 +0300 (EEST) From: Dimitris Charisis Date: Wed, 16 Sep 2026 11:38:45 +0000 Subject: [PATCH v2 4/4] test_maple_tree: test a maple_range_64 metadata slot in RCU mode Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260916-fix-maple-tree-range64-rcu-v2-4-0b09de37eb69@cslab.ece.ntua.gr> References: <20260916-fix-maple-tree-range64-rcu-v2-0-0b09de37eb69@cslab.ece.ntua.gr> In-Reply-To: <20260916-fix-maple-tree-range64-rcu-v2-0-0b09de37eb69@cslab.ece.ntua.gr> To: Andrew Morton , "Liam R. Howlett" , Alice Ryhl , Andrew Ballance , Suren Baghdasaryan , "Matthew Wilcox (Oracle)" Cc: maple-tree@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Dimitris Charisis X-Mailer: b4 0.14.2 Add a test that builds a height 3 tree whose root holds 15 child pointers and metadata in its last slot, so every slot is non-zero. Ensure the destruction under RCU does not descend into the metadata slot. 3166 insertions produce such a tree on a 64-bit build. Signed-off-by: Dimitris Charisis --- lib/test_maple_tree.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/lib/test_maple_tree.c b/lib/test_maple_tree.c index 461bb0e4816ef6e9c670018a13a88a0e5d0cf89e..fb40e193a3cb76f0eb02af3aa4a= 38630692a4a9b 100644 --- a/lib/test_maple_tree.c +++ b/lib/test_maple_tree.c @@ -3725,6 +3725,19 @@ static noinline void __init check_range64_in_rcu(str= uct maple_tree *mt) =20 mtree_destroy(mt); rcu_barrier(); + + nr_entries =3D 3166; /* Height 3. Root has 15 children + metadata */ + + MT_BUG_ON(mt, !mtree_empty(mt)); + mt_init_flags(mt, MT_FLAGS_USE_RCU); + + for (i =3D 0; i < nr_entries; i++) { + MT_BUG_ON(mt, mtree_test_insert_range(mt, i*10, i*10 + 9, + xa_mk_value(i))); + } + + mtree_destroy(mt); + rcu_barrier(); } =20 static DEFINE_MTREE(tree); --=20 2.47.3