Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <4912002a-4fa8-c1c0-a8c4-690b6dd76449@gmail.com>
Date:   Fri, 5 May 2023 11:23:20 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.10.1
Subject: Re: [PATCH] maple_tree: Make maple state reusable after
 mas_empty_area()
To:     "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc:     linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        maple-tree@lists.infradead.org,
        "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>,
        Tad <support@spotco.us>,
        Michael Keyes <mgkeyes@vigovproductions.net>,
        Stable@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org>
References: <20230504175509.2195838-1-Liam.Howlett@oracle.com>
From:   Peng Zhang <perlyzhang@gmail.com>
In-Reply-To: <20230504175509.2195838-1-Liam.Howlett@oracle.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk


在 2023/5/5 01:55, Liam R. Howlett 写道:
> Do not update the min and max of the maple state to the slot of the leaf
> node.  Leaving the min and max to the node entry allows for the maple
> state to be used in other operations.
> 
> Users would get unexpected results from other operations on the maple
> state after calling the affected function.
> 
> Reported-by: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
> Reported-by: Tad <support@spotco.us>
> Reported-by: Michael Keyes <mgkeyes@vigovproductions.net>
> Link: https://lore.kernel.org/linux-mm/32f156ba80010fd97dbaf0a0cdfc84366608624d.camel@intel.com/
> Link: https://lore.kernel.org/linux-mm/e6108286ac025c268964a7ead3aab9899f9bc6e9.camel@spotco.us/
> Fixes: Fixes: 54a611b60590 ("Maple Tree: add new data structure")
> Cc: <Stable@vger.kernel.org>
> Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
> ---
>   lib/maple_tree.c | 15 +--------------
>   1 file changed, 1 insertion(+), 14 deletions(-)
> 
> diff --git a/lib/maple_tree.c b/lib/maple_tree.c
> index 110a36479dced..1c4bc7a988ed3 100644
> --- a/lib/maple_tree.c
> +++ b/lib/maple_tree.c
> @@ -5285,10 +5285,6 @@ static inline int mas_sparse_area(struct ma_state *mas, unsigned long min,
>   int mas_empty_area(struct ma_state *mas, unsigned long min,
>   		unsigned long max, unsigned long size)
>   {
> -	unsigned char offset;
> -	unsigned long *pivots;
> -	enum maple_type mt;
> -
>   	if (min >= max)
>   		return -EINVAL;
>   
> @@ -5311,18 +5307,9 @@ int mas_empty_area(struct ma_state *mas, unsigned long min,
>   	if (unlikely(mas_is_err(mas)))
>   		return xa_err(mas->node);
>   
> -	offset = mas->offset;
> -	if (unlikely(offset == MAPLE_NODE_SLOTS))
> +	if (unlikely(mas->offset == MAPLE_NODE_SLOTS))
>   		return -EBUSY;
>   
> -	mt = mte_node_type(mas->node);
> -	pivots = ma_pivots(mas_mn(mas), mt);
> -	if (offset)
> -		mas->min = pivots[offset - 1] + 1;
> -
> -	if (offset < mt_pivots[mt])
> -		mas->max = pivots[offset];
> -
>   	if (mas->index < mas->min)
>   		mas->index = mas->min;
This will bring new bugs, mas->index should take the maximum
value with mas->index and mas_safe_min(mas, pivots, offset),
otherwise there will be overwriting allocation.

Maybe you have forgotten, I have posted a patch[1] with the same
function last week. I didn't know of a place where mas was used
after mas_empty_area() before. That patch does not introduce new
bugs, but the code style has not been updated yet. If using this
patch will bring more conflicts with my patch set, so what should
I do? ????

[1] 
https://lore.kernel.org/lkml/20230425110511.11680-3-zhangpeng.00@bytedance.com/
>