On Mon, 27 Mar 2023 14:55:32 -0400 "Liam R. Howlett" <Liam.Howlett@xxxxxxxxxx> wrote: > Use the maple tree in RCU mode for VMA tracking. > > The maple tree tracks the stack and is able to update the pivot > (lower/upper boundary) in-place to allow the page fault handler to write > to the tree while holding just the mmap read lock. This is safe as the > writes to the stack have a guard VMA which ensures there will always be > a NULL in the direction of the growth and thus will only update a pivot. > > It is possible, but not recommended, to have VMAs that grow up/down > without guard VMAs. syzbot has constructed a testcase which sets up a > VMA to grow and consume the empty space. Overwriting the entire NULL > entry causes the tree to be altered in a way that is not safe for > concurrent readers; the readers may see a node being rewritten or one > that does not match the maple state they are using. > > Enabling RCU mode allows the concurrent readers to see a stable node and This differs from what had. Intended? --- a/mm/mmap.c~mm-enable-maple-tree-rcu-mode-by-default-v8 +++ a/mm/mmap.c @@ -2277,8 +2277,7 @@ do_vmi_align_munmap(struct vma_iterator int count = 0; int error = -ENOMEM; MA_STATE(mas_detach, &mt_detach, 0, 0); - mt_init_flags(&mt_detach, vmi->mas.tree->ma_flags & - (MT_FLAGS_LOCK_MASK | MT_FLAGS_USE_RCU)); + mt_init_flags(&mt_detach, vmi->mas.tree->ma_flags & MT_FLAGS_LOCK_MASK); mt_set_external_lock(&mt_detach, &mm->mmap_lock); /* _
