Re: [PATCH] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call

[Josh Law]

6 Mar 2026 21:33:22 Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>:

> On Fri,  6 Mar 2026 20:08:20 +0000 Josh Law <hlcj1234567@xxxxxxxxx> wrote:
>
>> From: Josh Law <objecting@xxxxxxxxxxxxx>
>>
>> The call to mas_safe_pivot() in mas_wr_extend_null() has the pivot index
>> and maple type arguments swapped. The function signature expects
>> (mas, pivots, piv, type) but the call passes (mas, pivots, type, piv).
>>
>> This causes the pivot index to be interpreted as a maple node type and
>> vice versa, leading to incorrect pivot lookups. In practice, this means
>> a null-extending store into a maple tree node can read the wrong pivot
>> value, potentially corrupting the range tracked by the maple state. For
>> a VMA maple tree, this could cause an incorrect vm_area_struct range to
>> be returned during operations like mmap or munmap, leading to silent
>> memory mapping corruption.
>>
>> Every other mas_safe_pivot() call site in the file passes the arguments
>> in the correct (piv, type) order; this is the only one with them
>> reversed.
>>
>> ...
>>
>> --- a/lib/maple_tree.c
>> +++ b/lib/maple_tree.c
>> @@ -3279,7 +3279,7 @@ static inline void mas_extend_spanning_null(struct ma_wr_state *l_wr_mas,
>>         (r_mas->last < r_mas->max) &&
>>         !mas_slot_locked(r_mas, r_wr_mas->slots, r_mas->offset + 1)) {
>>         r_mas->last = mas_safe_pivot(r_mas, r_wr_mas->pivots,
>> -                        r_wr_mas->type, r_mas->offset + 1);
>> +                        r_mas->offset + 1, r_wr_mas->type);
>>         r_mas->offset++;
>>     }
>
> Whoops.  How come nobody has noticed after 4+ years?
>
> I'll add
>
>     Fixes: 54a611b60590 ("Maple Tree: add new data structure")
>
> and maybe cc:stable if we have a reason to do so.

Hi Andrew, on thought, I'd like to add Cc: stable@xxxxxxxxxxxxxxx to this.
Even though it's been 4 years, a swapped argument in a core data structure like Maple Tree is a silent bug that could cause rare corruption. Better to defuse it in the LTS kernels.