Re: [PATCH v2] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call

[Andrew Morton]

On Fri,  6 Mar 2026 22:32:19 +0000 Josh Law <hlcj1234567@xxxxxxxxx> wrote:

> From: Josh Law <objecting@xxxxxxxxxxxxx>
> 
> The call to mas_safe_pivot() in mas_wr_extend_null() has the pivot index
> and maple type arguments swapped. The function signature expects
> (mas, pivots, piv, type) but the call passes (mas, pivots, type, piv).
> 
> This causes the pivot index to be interpreted as a maple node type and
> vice versa, leading to incorrect pivot lookups. In practice, this means
> a null-extending store into a maple tree node can read the wrong pivot
> value, potentially corrupting the range tracked by the maple state. For
> a VMA maple tree, this could cause an incorrect vm_area_struct range to
> be returned during operations like mmap or munmap, leading to silent
> memory mapping corruption.
> 
> Every other mas_safe_pivot() call site in the file passes the arguments
> in the correct (piv, type) order; this is the only one with them
> reversed.

This all appears to be identical to v1?

> Link: https://lkml.kernel.org/r/20260306200820.2819999-1-objecting@xxxxxxxxxxxxx
> Fixes: 54a611b60590 ("Maple Tree: add new data structure")
> Signed-off-by: Josh Law <objecting@xxxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: Alice Ryhl <aliceryhl@xxxxxxxxxx>
> Cc: Andrew Ballance <andrewjballance@xxxxxxxxx>
> Cc: Liam Howlett <liam.howlett@xxxxxxxxxx>
> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> ---

Right here after the --- is where people add their
what-i-changed-since-last time notes.

>  lib/maple_tree.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)