Messages in this thread |  | | Date | Fri, 6 Mar 2026 22:59:33 +0000 | | From | Josh Law <> | | Subject | Re: [PATCH v2] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call |
| |
6 Mar 2026 22:57:21 Andrew Morton <akpm@linux-foundation.org>:
> On Fri, 6 Mar 2026 22:32:19 +0000 Josh Law <hlcj1234567@gmail.com> wrote: > >> From: Josh Law <objecting@objecting.org> >> >> The call to mas_safe_pivot() in mas_wr_extend_null() has the pivot index >> and maple type arguments swapped. The function signature expects >> (mas, pivots, piv, type) but the call passes (mas, pivots, type, piv). >> >> This causes the pivot index to be interpreted as a maple node type and >> vice versa, leading to incorrect pivot lookups. In practice, this means >> a null-extending store into a maple tree node can read the wrong pivot >> value, potentially corrupting the range tracked by the maple state. For >> a VMA maple tree, this could cause an incorrect vm_area_struct range to >> be returned during operations like mmap or munmap, leading to silent >> memory mapping corruption. >> >> Every other mas_safe_pivot() call site in the file passes the arguments >> in the correct (piv, type) order; this is the only one with them >> reversed. > > This all appears to be identical to v1? > >> Link: https://lkml.kernel.org/r/20260306200820.2819999-1-objecting@objecting.org >> Fixes: 54a611b60590 ("Maple Tree: add new data structure") >> Signed-off-by: Josh Law <objecting@objecting.org> >> Cc: stable@vger.kernel.org >> Cc: Alice Ryhl <aliceryhl@google.com> >> Cc: Andrew Ballance <andrewjballance@gmail.com> >> Cc: Liam Howlett <liam.howlett@oracle.com> >> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> >> --- > > Right here after the --- is where people add their > what-i-changed-since-last time notes. > >> lib/maple_tree.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-)
Fixed on V3
Only the cc stable was changed so you don't have to do much haha
V/R
Josh law
|  |