Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Liam R. Howlett" <Liam.Howlett@oracle.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        maple-tree@lists.infradead.org, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, Matthew Wilcox <willy@infradead.org>,
        Suren Baghdasaryan <surenb@google.com>
Cc:     "Liam R. Howlett" <Liam.Howlett@Oracle.com>,
        Stable@vger.kernel.org,
        "Liam R . Howlett" <Liam.Howlett@oracle.com>
Subject: [PATCH 3/8] maple_tree: fix freeing of nodes in rcu mode
Date:   Mon, 27 Mar 2023 14:55:27 -0400
Message-Id: <20230327185532.2354250-4-Liam.Howlett@oracle.com>
In-Reply-To: <20230327185532.2354250-1-Liam.Howlett@oracle.com>
References: <20230327185532.2354250-1-Liam.Howlett@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?2jc1Yn+tEOEOT9QilGmI4y6qFkEXfrQ+JfHHyHEbDpWIjsW1uRUCS39Ibe3w?=
 =?us-ascii?Q?SgPElwgougkmj1IE+JMuBa1HxUmbIjZ6kxkqRVLnLdzadjTHfuk8zMC4v7u0?=
 =?us-ascii?Q?PP/VkgimtQVIv1uw72OCFygPmPEj5PcAPHypcfBgJcM0aH1R+WPRgLEboszV?=
 =?us-ascii?Q?0ulwgvLQaSm+xS1JYXxjd7y5d7WfUEPPgpYiEcRV7+uUmEGDN30xZ/Dnw9I7?=
 =?us-ascii?Q?oepYlPP4H/IhgnpgBJfIPCH5yZbgYR0grsIVxUAlSsnhzU4tixruq/YSR9XL?=
 =?us-ascii?Q?KDxLkD7nd0Ku9nl0u5kkyUqv6LlEzp/h5klBjE/Avx+/fSbN/Ux8BPFXoWci?=
 =?us-ascii?Q?iPDAwYeeIHYd6apQqNTt7CWWMkX/TLTy7cROa/DtyzyR7cvx/fkBIPhi8Eis?=
 =?us-ascii?Q?QnkeeAQRaQV4QbAA2/aDgcl05DXOSWtTKm9/vSeZNEjmbOwFDCshfz9jmGDz?=
 =?us-ascii?Q?9gPRCXzZoh1RncIITif32WpJa6hXZr4yz4FUVnBHY/4baOiHOXhgAkwCJiyJ?=
 =?us-ascii?Q?RMZb2pXBnLESlqwwLj5jk/g5EdtXY1K61FDYOGtzjYf/bG5/goHoHSAVHkZ+?=
 =?us-ascii?Q?eaLPs/w+/usTLtql0mI4YXUj63icLWaSLisWzjv5i0BNeXhY3MaAc8enMWUC?=
 =?us-ascii?Q?CDXr/m9wOaDP9dzz0wAgjCn7O5j6Z/16dHCTayceFB/f71TyTRxs5rHV8YYx?=
 =?us-ascii?Q?zk9XHKWISqGcdPYenYTjfPEt+/JX2ahJmEe4uu8QwhFbL4vg8hBSkHifJgVo?=
 =?us-ascii?Q?1eNVFLA+3D7gpDJQldfno1ww16cEMpwlUPzElhiKzzm0wdZZBl7VTURPudKI?=
 =?us-ascii?Q?wGfyVin4kF/0OsdiY7vJHth4xTshJXkv00K0SVmhnOc+aF7vVKIM70xTij7a?=
 =?us-ascii?Q?ku9U5Wf+yADpfpIaulYuDvj3lGzRcadzrCe551Bcj6OvakUe3UrfuY1mBUH6?=
 =?us-ascii?Q?Qbf/GxrbtOkTuuwqQL4j+KZIX3dmhvebmmVkB5Bf4ryOZaRI/uaOqSPx0poD?=
 =?us-ascii?Q?0HzGm9BcaHrAThI8s7w7P5czxDuscZsO4pm4pnhlP4+TY90eCYDh1Y7QR/TA?=
 =?us-ascii?Q?y98V4WEmzWuZIABgS5LCp6SCNHHgddsooJhM7cMIMd7B3Mq/eL8PDe39UI2s?=
 =?us-ascii?Q?Wy6toAW0pMyXawilP7PKniy73nLpz5AYvPCM9Zsw+Ur/M2QfHSxDREHmC108?=
 =?us-ascii?Q?x9AnQ93eJLMEmERST7RR+FnQ9r3M2xssByx4e9ZJB9vnTXHVvDW82ottntHH?=
 =?us-ascii?Q?lBvyVm5AShogKS6IsHw/RxjgBAA9Mv7/7ko0svIwr5dNPyAluuX8/D0eLA0R?=
 =?us-ascii?Q?atviCKOmDi6Ou07DjlGa262umJO7pw2Gjwj6ISRnB6bp0pISOB0UlQzFZX1W?=
 =?us-ascii?Q?b28VZX/JEbkGiIvL1xcaaHc+yHJ8FFq0tl8smCD+rcxlKuHKr5nHzjknxPwO?=
 =?us-ascii?Q?V2Un0/1ydK4j4oAxX0uPX4ocOvmAQ6eaaNeNzru8XoFAFHJeKfbyzEZsFxda?=
 =?us-ascii?Q?f5gQO8lBLsUATvdSwDqWFk9FZTic2Xbx7QY3MkMWwcl1t6+NpGfGZYuNA891?=
 =?us-ascii?Q?UZSDctuReVH39HfpevOZKv4bJImkIkCeoTKi7n4ENIE0Se/2XpTO59IrFsgl?=
 =?us-ascii?Q?2g=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?ncntFVIsuvaLBaTgKoJBJXRp3DbxSWstKyEtg9kFBSZ2nchguKeFGiJpmwR0?=
 =?us-ascii?Q?vx2N1LLfTQ5whABFM7JzenHYiCZkULMQvVlqGPN3m5ceLU5CrJ11NEAWK9vv?=
 =?us-ascii?Q?bBQAD7NIYPyatkTHqjQxyezmZwvspKCTe3sztink5ADBKR+TFIUnZ4UIY1Mm?=
 =?us-ascii?Q?u7zxzz/WBL1CGj4piGhC1XHRE1H+jz3NGpfw2oDugYdmf8kxXelAUnEx3+iO?=
 =?us-ascii?Q?aEPq2M5DwWEOpBAHQqNSxIrcBi+4Cn00Lgvd8f+3iXP9CF68IboNhaYIVIj3?=
 =?us-ascii?Q?I90kvuKLaX7lePtwXlBGzRfsdT2XrN6vLKF+gJoJHaxzecj7PsQYmKgkAZrR?=
 =?us-ascii?Q?OI52B5tLO0NHc4+m0rC52tCQN24j9gywilRZoiITW8ffTrzsO271Dt2XslgY?=
 =?us-ascii?Q?i8BZ8P8Grw3SNwR0z7cE+VXhJQgR1gT1HW/NQCzG0sTFG7I0LMYZi6RsYRI1?=
 =?us-ascii?Q?EheFOKULzrYas6HlfuRoYKF+27LhGHBZiBJ6NMtW0tranKiNhDzHOeryNsZy?=
 =?us-ascii?Q?31+uIvOeVOIy1gH3vo5Eq3+/JIP45AHyQwrs4PuIbetjqyJQe8A2wVMVJUTi?=
 =?us-ascii?Q?66MQITbAhoqG4UAB45ksOlYNFaU+aSquO9e21Cbm0XLCkgXeTZXoTMs4yzdF?=
 =?us-ascii?Q?Jli9L6gL8jDOQO8fcFvmpnxq4TuWzMPh29t3nUUoTkqL6N+vuZ3PZZ1ccx4X?=
 =?us-ascii?Q?UO2kMa8LjhkHFJjxw4kRyj8QLv8dkQOESrRlpd9WxXkODL3vW7BeqS06sccj?=
 =?us-ascii?Q?DYuExihCRdSh5ants1unnJjsmo8iqfiRM/lxo5kMT1646VndMai1XSRnn1CN?=
 =?us-ascii?Q?5AND0iwkNQaTXmKXgyFM7HD83y2Naa2CQOWzRWrJvnujMmvLTOmo+ogQOGII?=
 =?us-ascii?Q?YakIo+DVRXSkQYR38pjgSWU9f2XdYY/akdkEg8EADVQIwoI9dIzc/IboplYE?=
 =?us-ascii?Q?4RiUMro/ajqdQIrTWVFXdw=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2539281e-35c3-498a-b524-08db2ef4dde3
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Mar 2023 18:55:43.4030
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Oc5rhuITm+0u++RPSgD8H3z9uj9nbUHeiR5k5QgqZnFxygLKpEEtWlCcqmYs9QSQuHYSeRJmhrOord+M6odFjw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB5722
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-03-24_11,2023-03-27_02,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0
 phishscore=0 suspectscore=0 malwarescore=0 spamscore=0 mlxscore=0
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2303270155
X-Proofpoint-ORIG-GUID: MqwT9VG-NhxC3Y_REuPVz0JyaVsjifX_
X-Proofpoint-GUID: MqwT9VG-NhxC3Y_REuPVz0JyaVsjifX_
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
        DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,
        SPF_HELO_NONE,SPF_NONE autolearn=unavailable autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: "Liam R. Howlett" <Liam.Howlett@Oracle.com>

The walk to destroy the nodes was not always setting the node type and
would result in a destroy method potentially using the values as nodes.
Avoid this by setting the correct node types.  This is necessary for the
RCU mode of the maple tree.

Link: https://lkml.kernel.org/r/20230227173632.3292573-4-surenb@google.com
Cc: <Stable@vger.kernel.org>
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
---
 lib/maple_tree.c | 73 ++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 62 insertions(+), 11 deletions(-)

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index 089cd76ec379..44d6ce30b28e 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -902,6 +902,44 @@ static inline void ma_set_meta(struct maple_node *mn, enum maple_type mt,
 	meta->end = end;
 }
 
+/*
+ * mas_clear_meta() - clear the metadata information of a node, if it exists
+ * @mas: The maple state
+ * @mn: The maple node
+ * @mt: The maple node type
+ * @offset: The offset of the highest sub-gap in this node.
+ * @end: The end of the data in this node.
+ */
+static inline void mas_clear_meta(struct ma_state *mas, struct maple_node *mn,
+				  enum maple_type mt)
+{
+	struct maple_metadata *meta;
+	unsigned long *pivots;
+	void __rcu **slots;
+	void *next;
+
+	switch (mt) {
+	case maple_range_64:
+		pivots = mn->mr64.pivot;
+		if (unlikely(pivots[MAPLE_RANGE64_SLOTS - 2])) {
+			slots = mn->mr64.slot;
+			next = mas_slot_locked(mas, slots,
+					       MAPLE_RANGE64_SLOTS - 1);
+			if (unlikely((mte_to_node(next) && mte_node_type(next))))
+				return; /* The last slot is a node, no metadata */
+		}
+		fallthrough;
+	case maple_arange_64:
+		meta = ma_meta(mn, mt);
+		break;
+	default:
+		return;
+	}
+
+	meta->gap = 0;
+	meta->end = 0;
+}
+
 /*
  * ma_meta_end() - Get the data end of a node from the metadata
  * @mn: The maple node
@@ -5455,20 +5493,22 @@ static inline int mas_rev_alloc(struct ma_state *mas, unsigned long min,
  * mas_dead_leaves() - Mark all leaves of a node as dead.
  * @mas: The maple state
  * @slots: Pointer to the slot array
+ * @type: The maple node type
  *
  * Must hold the write lock.
  *
  * Return: The number of leaves marked as dead.
  */
 static inline
-unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots)
+unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots,
+			      enum maple_type mt)
 {
 	struct maple_node *node;
 	enum maple_type type;
 	void *entry;
 	int offset;
 
-	for (offset = 0; offset < mt_slot_count(mas->node); offset++) {
+	for (offset = 0; offset < mt_slots[mt]; offset++) {
 		entry = mas_slot_locked(mas, slots, offset);
 		type = mte_node_type(entry);
 		node = mte_to_node(entry);
@@ -5487,14 +5527,13 @@ unsigned char mas_dead_leaves(struct ma_state *mas, void __rcu **slots)
 
 static void __rcu **mas_dead_walk(struct ma_state *mas, unsigned char offset)
 {
-	struct maple_node *node, *next;
+	struct maple_node *next;
 	void __rcu **slots = NULL;
 
 	next = mas_mn(mas);
 	do {
-		mas->node = ma_enode_ptr(next);
-		node = mas_mn(mas);
-		slots = ma_slots(node, node->type);
+		mas->node = mt_mk_node(next, next->type);
+		slots = ma_slots(next, next->type);
 		next = mas_slot_locked(mas, slots, offset);
 		offset = 0;
 	} while (!ma_is_leaf(next->type));
@@ -5558,11 +5597,14 @@ static inline void __rcu **mas_destroy_descend(struct ma_state *mas,
 		node = mas_mn(mas);
 		slots = ma_slots(node, mte_node_type(mas->node));
 		next = mas_slot_locked(mas, slots, 0);
-		if ((mte_dead_node(next)))
+		if ((mte_dead_node(next))) {
+			mte_to_node(next)->type = mte_node_type(next);
 			next = mas_slot_locked(mas, slots, 1);
+		}
 
 		mte_set_node_dead(mas->node);
 		node->type = mte_node_type(mas->node);
+		mas_clear_meta(mas, node, node->type);
 		node->piv_parent = prev;
 		node->parent_slot = offset;
 		offset = 0;
@@ -5582,13 +5624,18 @@ static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags,
 
 	MA_STATE(mas, &mt, 0, 0);
 
-	if (mte_is_leaf(enode))
+	mas.node = enode;
+	if (mte_is_leaf(enode)) {
+		node->type = mte_node_type(enode);
 		goto free_leaf;
+	}
 
+	ma_flags &= ~MT_FLAGS_LOCK_MASK;
 	mt_init_flags(&mt, ma_flags);
 	mas_lock(&mas);
 
-	mas.node = start = enode;
+	mte_to_node(enode)->ma_flags = ma_flags;
+	start = enode;
 	slots = mas_destroy_descend(&mas, start, 0);
 	node = mas_mn(&mas);
 	do {
@@ -5596,7 +5643,8 @@ static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags,
 		unsigned char offset;
 		struct maple_enode *parent, *tmp;
 
-		node->slot_len = mas_dead_leaves(&mas, slots);
+		node->type = mte_node_type(mas.node);
+		node->slot_len = mas_dead_leaves(&mas, slots, node->type);
 		if (free)
 			mt_free_bulk(node->slot_len, slots);
 		offset = node->parent_slot + 1;
@@ -5620,7 +5668,8 @@ static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags,
 	} while (start != mas.node);
 
 	node = mas_mn(&mas);
-	node->slot_len = mas_dead_leaves(&mas, slots);
+	node->type = mte_node_type(mas.node);
+	node->slot_len = mas_dead_leaves(&mas, slots, node->type);
 	if (free)
 		mt_free_bulk(node->slot_len, slots);
 
@@ -5630,6 +5679,8 @@ static void mt_destroy_walk(struct maple_enode *enode, unsigned char ma_flags,
 free_leaf:
 	if (free)
 		mt_free_rcu(&node->rcu);
+	else
+		mas_clear_meta(&mas, node, node->type);
 }
 
 /*
-- 
2.39.2