Re: [PATCH v2] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call

[Josh Law]

6 Mar 2026 22:57:21 Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>:

> On Fri,  6 Mar 2026 22:32:19 +0000 Josh Law <hlcj1234567@xxxxxxxxx> wrote:
>
>> From: Josh Law <objecting@xxxxxxxxxxxxx>
>>
>> The call to mas_safe_pivot() in mas_wr_extend_null() has the pivot index
>> and maple type arguments swapped. The function signature expects
>> (mas, pivots, piv, type) but the call passes (mas, pivots, type, piv).
>>
>> This causes the pivot index to be interpreted as a maple node type and
>> vice versa, leading to incorrect pivot lookups. In practice, this means
>> a null-extending store into a maple tree node can read the wrong pivot
>> value, potentially corrupting the range tracked by the maple state. For
>> a VMA maple tree, this could cause an incorrect vm_area_struct range to
>> be returned during operations like mmap or munmap, leading to silent
>> memory mapping corruption.
>>
>> Every other mas_safe_pivot() call site in the file passes the arguments
>> in the correct (piv, type) order; this is the only one with them
>> reversed.
>
> This all appears to be identical to v1?
>
>> Link: https://lkml.kernel.org/r/20260306200820.2819999-1-objecting@xxxxxxxxxxxxx
>> Fixes: 54a611b60590 ("Maple Tree: add new data structure")
>> Signed-off-by: Josh Law <objecting@xxxxxxxxxxxxx>
>> Cc: stable@xxxxxxxxxxxxxxx
>> Cc: Alice Ryhl <aliceryhl@xxxxxxxxxx>
>> Cc: Andrew Ballance <andrewjballance@xxxxxxxxx>
>> Cc: Liam Howlett <liam.howlett@xxxxxxxxxx>
>> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
>> ---
>
> Right here after the --- is where people add their
> what-i-changed-since-last time notes.
>
>> lib/maple_tree.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)

Fixed on V3

Only the cc stable was changed so you don't have to do much haha

V/R


Josh law