From: <gregkh@linuxfoundation.org>
To: Liam.Howlett@Oracle.com,Liam.Howlett@oracle.com,gregkh@linuxfoundation.org,linux-mm@kvack.org,maple-tree@lists.infradead.org
Cc: <stable-commits@vger.kernel.org>
Subject: Patch "maple_tree: fix freeing of nodes in rcu mode" has been added to the 6.1-stable tree
Date: Wed, 12 Apr 2023 10:13:21 +0200 [thread overview]
Message-ID: <2023041221-spendable-barbed-69a4@gregkh> (raw)
In-Reply-To: <20230411151055.2910579-11-Liam.Howlett@oracle.com>
This is a note to let you know that I've just added the patch titled
maple_tree: fix freeing of nodes in rcu mode
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From stable-owner@vger.kernel.org Tue Apr 11 17:13:39 2023
From: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Date: Tue, 11 Apr 2023 11:10:51 -0400
Subject: maple_tree: fix freeing of nodes in rcu mode
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org
Cc: maple-tree@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, "Liam R. Howlett" <Liam.Howlett@Oracle.com>, Stable@vger.kernel.org, Liam Howlett <Liam.Howlett@oracle.com>
Message-ID: <20230411151055.2910579-11-Liam.Howlett@oracle.com>
From: "Liam R. Howlett" <Liam.Howlett@Oracle.com>
commit 2e5b4921f8efc9e845f4f04741797d16f36847eb upstream.
The walk to destroy the nodes was not always setting the node type and
would result in a destroy method potentially using the values as nodes.
Avoid this by setting the correct node types. This is necessary for the
RCU mode of the maple tree.
Link: https://lkml.kernel.org/r/20230227173632.3292573-4-surenb@google.com
Cc: <Stable@vger.kernel.org>
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Liam Howlett <Liam.Howlett@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/maple_tree.c | 73 ++++++++++++++++++++++++++++++++++++++++++++++---------
1 file changed, 62 insertions(+), 11 deletions(-)
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -893,6 +893,44 @@ static inline void ma_set_meta(struct ma
}
/*
+ * mas_clear_meta() - clear the metadata information of a node, if it exists
+ * @mas: The maple state
+ * @mn: The maple node
+ * @mt: The maple node type
+ * @offset: The offset of the highest sub-gap in this node.
+ * @end: The end of the data in this node.
+ */
+static inline void mas_clear_meta(struct ma_state *mas, struct maple_node *mn,
+ enum maple_type mt)
+{
+ struct maple_metadata *meta;
+ unsigned long *pivots;
+ void __rcu **slots;
+ void *next;
+
+ switch (mt) {
+ case maple_range_64:
+ pivots = mn->mr64.pivot;
+ if (unlikely(pivots[MAPLE_RANGE64_SLOTS - 2])) {
+ slots = mn->mr64.slot;
+ next = mas_slot_locked(mas, slots,
+ MAPLE_RANGE64_SLOTS - 1);
+ if (unlikely((mte_to_node(next) && mte_node_type(next))))
+ return; /* The last slot is a node, no metadata */
+ }
+ fallthrough;
+ case maple_arange_64:
+ meta = ma_meta(mn, mt);
+ break;
+ default:
+ return;
+ }
+
+ meta->gap = 0;
+ meta->end = 0;
+}
+
+/*
* ma_meta_end() - Get the data end of a node from the metadata
* @mn: The maple node
* @mt: The maple node type
@@ -5433,20 +5471,22 @@ no_gap:
* mas_dead_leaves() - Mark all leaves of a node as dead.
* @mas: The maple state
* @slots: Pointer to the slot array
+ * @type: The maple node type
*
* Must hold the write lock.
*
* Return: The number of leaves marked as dead.
*/
static inline
-unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots)
+unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots,
+ enum maple_type mt)
{
struct maple_node *node;
enum maple_type type;
void *entry;
int offset;
- for (offset = 0; offset < mt_slot_count(mas->node); offset++) {
+ for (offset = 0; offset < mt_slots[mt]; offset++) {
entry = mas_slot_locked(mas, slots, offset);
type = mte_node_type(entry);
node = mte_to_node(entry);
@@ -5465,14 +5505,13 @@ unsigned char mas_dead_leaves(struct ma_
static void __rcu **mas_dead_walk(struct ma_state *mas, unsigned char offset)
{
- struct maple_node *node, *next;
+ struct maple_node *next;
void __rcu **slots = NULL;
next = mas_mn(mas);
do {
- mas->node = ma_enode_ptr(next);
- node = mas_mn(mas);
- slots = ma_slots(node, node->type);
+ mas->node = mt_mk_node(next, next->type);
+ slots = ma_slots(next, next->type);
next = mas_slot_locked(mas, slots, offset);
offset = 0;
} while (!ma_is_leaf(next->type));
@@ -5536,11 +5575,14 @@ static inline void __rcu **mas_destroy_d
node = mas_mn(mas);
slots = ma_slots(node, mte_node_type(mas->node));
next = mas_slot_locked(mas, slots, 0);
- if ((mte_dead_node(next)))
+ if ((mte_dead_node(next))) {
+ mte_to_node(next)->type = mte_node_type(next);
next = mas_slot_locked(mas, slots, 1);
+ }
mte_set_node_dead(mas->node);
node->type = mte_node_type(mas->node);
+ mas_clear_meta(mas, node, node->type);
node->piv_parent = prev;
node->parent_slot = offset;
offset = 0;
@@ -5560,13 +5602,18 @@ static void mt_destroy_walk(struct maple
MA_STATE(mas, &mt, 0, 0);
- if (mte_is_leaf(enode))
+ mas.node = enode;
+ if (mte_is_leaf(enode)) {
+ node->type = mte_node_type(enode);
goto free_leaf;
+ }
+ ma_flags &= ~MT_FLAGS_LOCK_MASK;
mt_init_flags(&mt, ma_flags);
mas_lock(&mas);
- mas.node = start = enode;
+ mte_to_node(enode)->ma_flags = ma_flags;
+ start = enode;
slots = mas_destroy_descend(&mas, start, 0);
node = mas_mn(&mas);
do {
@@ -5574,7 +5621,8 @@ static void mt_destroy_walk(struct maple
unsigned char offset;
struct maple_enode *parent, *tmp;
- node->slot_len = mas_dead_leaves(&mas, slots);
+ node->type = mte_node_type(mas.node);
+ node->slot_len = mas_dead_leaves(&mas, slots, node->type);
if (free)
mt_free_bulk(node->slot_len, slots);
offset = node->parent_slot + 1;
@@ -5598,7 +5646,8 @@ next:
} while (start != mas.node);
node = mas_mn(&mas);
- node->slot_len = mas_dead_leaves(&mas, slots);
+ node->type = mte_node_type(mas.node);
+ node->slot_len = mas_dead_leaves(&mas, slots, node->type);
if (free)
mt_free_bulk(node->slot_len, slots);
@@ -5608,6 +5657,8 @@ start_slots_free:
free_leaf:
if (free)
mt_free_rcu(&node->rcu);
+ else
+ mas_clear_meta(&mas, node, node->type);
}
/*
Patches currently in stable-queue which might be from stable-owner@vger.kernel.org are
queue-6.1/maple_tree-fix-potential-rcu-issue.patch
queue-6.1/maple_tree-add-smp_rmb-to-dead-node-detection.patch
queue-6.1/maple_tree-add-rcu-lock-checking-to-rcu-callback-functions.patch
queue-6.1/maple_tree-fix-handle-of-invalidated-state-in-mas_wr_store_setup.patch
queue-6.1/maple_tree-reduce-user-error-potential.patch
queue-6.1/maple_tree-fix-mas_prev-and-mas_find-state-handling.patch
queue-6.1/maple_tree-remove-gfp_zero-from-kmem_cache_alloc-and-kmem_cache_alloc_bulk.patch
queue-6.1/maple_tree-be-more-cautious-about-dead-nodes.patch
queue-6.1/mm-enable-maple-tree-rcu-mode-by-default.patch
queue-6.1/maple_tree-detect-dead-nodes-in-mas_start.patch
queue-6.1/maple_tree-fix-freeing-of-nodes-in-rcu-mode.patch
queue-6.1/maple_tree-remove-extra-smp_wmb-from-mas_dead_leaves.patch
queue-6.1/maple_tree-refine-ma_state-init-from-mas_start.patch
next prev parent reply other threads:[~2023-04-12 8:13 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-11 15:10 [PATCH 6.1 00/14] Backport of maple tree fixes for 6.1/6.2 Liam R. Howlett
2023-04-11 15:10 ` [PATCH 6.1 01/14] maple_tree: remove GFP_ZERO from kmem_cache_alloc() and kmem_cache_alloc_bulk() Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: remove GFP_ZERO from kmem_cache_alloc() and kmem_cache_alloc_bulk()" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: remove GFP_ZERO from kmem_cache_alloc() and kmem_cache_alloc_bulk()" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 02/14] maple_tree: fix potential rcu issue Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: fix potential rcu issue" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: fix potential rcu issue" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 03/14] maple_tree: reduce user error potential Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: reduce user error potential" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: reduce user error potential" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 04/14] maple_tree: fix handle of invalidated state in mas_wr_store_setup() Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: fix handle of invalidated state in mas_wr_store_setup()" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: fix handle of invalidated state in mas_wr_store_setup()" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 05/14] maple_tree: fix mas_prev() and mas_find() state handling Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: fix mas_prev() and mas_find() state handling" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: fix mas_prev() and mas_find() state handling" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 06/14] maple_tree: fix mas_skip_node() end slot detection Liam R. Howlett
2023-04-11 15:10 ` [PATCH 6.1 07/14] maple_tree: be more cautious about dead nodes Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: be more cautious about dead nodes" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: be more cautious about dead nodes" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 08/14] maple_tree: refine ma_state init from mas_start() Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: refine ma_state init from mas_start()" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: refine ma_state init from mas_start()" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 09/14] maple_tree: detect dead nodes in mas_start() Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: detect dead nodes in mas_start()" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: detect dead nodes in mas_start()" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 10/14] maple_tree: fix freeing of nodes in rcu mode Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: fix freeing of nodes in rcu mode" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` gregkh [this message]
2023-04-11 15:10 ` [PATCH 6.1 11/14] maple_tree: remove extra smp_wmb() from mas_dead_leaves() Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: remove extra smp_wmb() from mas_dead_leaves()" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: remove extra smp_wmb() from mas_dead_leaves()" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 12/14] maple_tree: add smp_rmb() to dead node detection Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: add smp_rmb() to dead node detection" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: add smp_rmb() to dead node detection" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 13/14] maple_tree: add RCU lock checking to rcu callback functions Liam R. Howlett
2023-04-12 8:12 ` Patch "maple_tree: add RCU lock checking to rcu callback functions" has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "maple_tree: add RCU lock checking to rcu callback functions" has been added to the 6.1-stable tree gregkh
2023-04-11 15:10 ` [PATCH 6.1 14/14] mm: enable maple tree RCU mode by default Liam R. Howlett
2023-04-12 8:12 ` Patch "mm: enable maple tree RCU mode by default." has been added to the 6.2-stable tree gregkh
2023-04-12 8:13 ` Patch "mm: enable maple tree RCU mode by default." has been added to the 6.1-stable tree gregkh
2023-04-12 8:12 ` [PATCH 6.1 00/14] Backport of maple tree fixes for 6.1/6.2 Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2023041221-spendable-barbed-69a4@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=Liam.Howlett@Oracle.com \
--cc=linux-mm@kvack.org \
--cc=maple-tree@lists.infradead.org \
--cc=stable-commits@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).