Re: [PATCH] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call

[Andrew Morton <akpm@linux-foundation.org>]

On Fri,  6 Mar 2026 20:08:20 +0000 Josh Law <hlcj1234567@gmail.com> wrote:

> From: Josh Law <objecting@objecting.org>
> 
> The call to mas_safe_pivot() in mas_wr_extend_null() has the pivot index
> and maple type arguments swapped. The function signature expects
> (mas, pivots, piv, type) but the call passes (mas, pivots, type, piv).
> 
> This causes the pivot index to be interpreted as a maple node type and
> vice versa, leading to incorrect pivot lookups. In practice, this means
> a null-extending store into a maple tree node can read the wrong pivot
> value, potentially corrupting the range tracked by the maple state. For
> a VMA maple tree, this could cause an incorrect vm_area_struct range to
> be returned during operations like mmap or munmap, leading to silent
> memory mapping corruption.
> 
> Every other mas_safe_pivot() call site in the file passes the arguments
> in the correct (piv, type) order; this is the only one with them
> reversed.
>
> ...
>
> --- a/lib/maple_tree.c
> +++ b/lib/maple_tree.c
> @@ -3279,7 +3279,7 @@ static inline void mas_extend_spanning_null(struct ma_wr_state *l_wr_mas,
>  	    (r_mas->last < r_mas->max) &&
>  	    !mas_slot_locked(r_mas, r_wr_mas->slots, r_mas->offset + 1)) {
>  		r_mas->last = mas_safe_pivot(r_mas, r_wr_mas->pivots,
> -					     r_wr_mas->type, r_mas->offset + 1);
> +					     r_mas->offset + 1, r_wr_mas->type);
>  		r_mas->offset++;
>  	}

Whoops.  How come nobody has noticed after 4+ years?

I'll add

	Fixes: 54a611b60590 ("Maple Tree: add new data structure")

and maybe cc:stable if we have a reason to do so.