* Vasily Gorbik <gor@xxxxxxxxxxxxx> [220301 17:51]: > On Tue, Mar 01, 2022 at 08:39:44PM +0000, Liam Howlett wrote: > > * Vasily Gorbik <gor@xxxxxxxxxxxxx> [220228 21:01]: > > > This condition is not present in mas_dead_leaves() where we potentially > > > iterate over all 16 slots, simply checking that we have a "valid" node pointer > > > with: > > > > > > entry & ~MAPLE_NODE_MASK != 0 > > > > I have fixed this and another issue that Hugh pointed out [1]. I have > > been working on an s390 VM since you reported your issue and have been > > getting strange behaviour and have been able to detect the bug reported > > by Hugh with the config KASAN option. With the fix I described above > > and fixing the do_mas_align_munmap() splitting order I broken in my > > linked list removal, I am now able to boot my s390 VM and log in with > > KASAN, VM debug, maple tree debug, rbtree debug, debug page flags, and > > Poison pages after freeing all set in the config I use. I've pushed the > > fix to a tag on my branch [2] and I'd appreciate it if you could test it > > on your side. > > Great, I gave it a spin and it looks much better now! I'll go run some stress > tests. > > BTW, since you've made efforts to isolate mapple tests in userspace I > wonder how much sense it would make to use libfuzzer to give API some good > coverage-guided exercise. > > I've written a minimal libfuzzer test (just a hack) for the "Normal API" and got > couple of flavours of crashes. Just rebased onto your latest branch state > and still get them. Please have a look if those are valid findings. Thanks! Yes, the first one is certainly a valid bug. I was able to reproduce it and fix the issue in my tree. I'll have a look and see what else it throws out. Cheers, Liam
