5-new.git/tree/patches/maple_tree-add-dead-node-check-in-mas_dup_alloc.patch

This patch will later appear in the mm-hotfixes-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Boudewijn van der Heide <boudewijn@delta-utec.com>
Subject: maple_tree: add dead node check in mas_dup_alloc()
Date: Sat, 3 Jan 2026 17:57:58 +0100

__mt_dup() is exported and can be called without internal locking, relying
on the caller to provide appropriate synchronization.  If a caller fails
to hold proper locks, the source tree may be modified concurrently,
potentially resulting in dead nodes during traversal.

The call stack is:
  __mt_dup()
    → mas_dup_build()
      → mas_dup_alloc()  [accesses node->slot[]]

mas_dup_alloc() may access node slots without first verifying that the
node is still alive.  If a dead node is encountered, its memory layout may
have been switched to the RCU union member, making slot array access
undefined behavior as we would be reading from the rcu_head structure
instead.

If __mt_dup() is invoked without the required external locking and the
source tree is concurrently modified, a node can transition to the dead
RCU layout while mas_dup_alloc() is still traversing it.  In that case the
code may interpret the rcu_head contents as slot pointers.

Practically, this could lead to invalid pointer dereferences (kernel oops)
or corruption of the duplicated tree.  Depending on how that duplicated
tree is later used (e.g.  in mm/VMA paths), the effects could be
userspace-visible, such as fork() failures, process crashes, or broader
system instability.

My understanding is that current in-tree users hold the appropriate locks
and should not hit this, as triggering it requires violating the
__mt_dup() synchronization contract.  The risk primarily comes from the
fact that __mt_dup() is exported (EXPORT_SYMBOL), making it reachable by
out-of-tree modules or future callers which may not follow the locking
rules.

Add an explicit dead node check to detect concurrent modification during
duplication.  When a dead node is detected, return -EBUSY to indicate that
the tree is undergoing concurrent modification.

Link: https://lkml.kernel.org/r/20260103165758.74094-1-boudewijn@delta-utec.com
Fixes: fd32e4e9b764 ("maple_tree: introduce interfaces __mt_dup() and mtree_dup()")
Signed-off-by: Boudewijn van der Heide <boudewijn@delta-utec.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andrew Ballance <andrewjballance@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 lib/maple_tree.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/lib/maple_tree.c~maple_tree-add-dead-node-check-in-mas_dup_alloc
+++ a/lib/maple_tree.c
@@ -6251,6 +6251,11 @@ static inline void mas_dup_alloc(struct
 	/* Allocate memory for child nodes. */
 	type = mte_node_type(mas->node);
 	new_slots = ma_slots(new_node, type);
+	if (unlikely(ma_dead_node(node))) {
+		mas_set_err(mas, -EBUSY);
+		return;
+	}
+
 	count = mas->node_request = mas_data_end(mas) + 1;
 	mas_alloc_nodes(mas, gfp);
 	if (unlikely(mas_is_err(mas)))
_

Patches currently in -mm which might be from boudewijn@delta-utec.com are

maple_tree-add-dead-node-check-in-mas_dup_alloc.patch




From - Tue Jan 06 15:32:35 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
>From stable+bounces-204998-hi=josie.lol@vger.kernel.org Tue Jan 06 01:54:56 2026
Return-path: <stable+bounces-204998-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Tue, 06 Jan 2026 01:54:56 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-204998-hi=josie.lol@vger.kernel.org>)
	id 1vcwHg-00000004mLm-0jQy
	for hi@josie.lol;
	Tue, 06 Jan 2026 01:54:56 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id 990053104A8B
	for <hi@josie.lol>; Tue,  6 Jan 2026 01:48:31 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 4459021C16A;
	Tue,  6 Jan 2026 01:48:30 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="aF1jiQcL"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D0E654723;
	Tue,  6 Jan 2026 01:48:30 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1767664110; cv=none; b=ZtgLFHoZoPoedkWdVHo4arFEuv0qM0ccklV7pEzSwirHpAbjeQbBPD1eQi/L5PQiw58nlsrQq9+9WdAoYlYvWc7wdAKsyCDVBPQ/1hSlBkcfDlQ+8j4Xq9qIMuIsgyk6JiHHmQpRdmVfrYQkR+fW2lBTgaWG5n5STIXbmhBu7RQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1767664110; c=relaxed/simple;
	bh=l53VTd+SUEtW2mClevWwfpcJcMJZXRxVtzOKWmw3DQA=;
	h=Date:To:From:Subject:Message-Id; b=Htah2Ouf+j9p5+5oddGZSqTxZyFy7TnMLmTSBNmLLuMLjzJ85ewkvJtFZFOaeqKbuFHOEo8/AMh4BQeLypxGVGdv70VCb0Cetuak5MTJsoiK7QbFro88o1x6uBZCcNGrwY3RZQgiRFhnAvw+VcFeEIWSmFIQMOPrMC54xx9FCw0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=aF1jiQcL; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id CFC96C116D0;
	Tue,  6 Jan 2026 01:48:29 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org;
	s=korg; t=1767664109;
	bh=l53VTd+SUEtW2mClevWwfpcJcMJZXRxVtzOKWmw3DQA=;
	h=Date:To:From:Subject:From;
	b=aF1jiQcLg95m0D63pwyUHyG9dQSBBK3wPbhrq0Wnci+zPq6aFAEq4QO5ao/0Yyak7
	 wmeP9iHpvx+pwtWI3sVIo5iMuZYB6lQdpCJVBUSgB0TZR34Sd48pggsgMz853WWQiN
	 n3LVusCvcIX3zAdb8GIMZULb7pq6bvSx9KrOzEfM=
Date: Mon, 05 Jan 2026 17:48:29 -0800
To: mm-commits@vger.kernel.org,willy@infradead.org,viro@zeniv.linux.org.uk,vbabka@suse.cz,surenb@google.com,stable@vger.kernel.org,rppt@kernel.org,miklos@szeredi.hu,mhocko@suse.com,lorenzo.stoakes@oracle.com,Liam.Howlett@oracle.com,j.neuschaefer@gmx.net,jack@suse.cz,david@kernel.org,carnil@debian.org,bschubert@ddn.com,brauner@kernel.org,athul.krishna.kr@protonmail.com,joannelkoong@gmail.com,akpm@linux-foundation.org
From: Andrew Morton <akpm@linux-foundation.org>
Message-Id: <20260106014829.CFC96C116D0@smtp.kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
X-DKIM: signer='linux-foundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 25.4 (+++++++++++++++++++++++++)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (25.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linux-foundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.234.253.10 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
   25 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII
                              but isn't
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
X-Old-Subject:+ fs-writeback-skip-as_no_data_integrity-mappings-in-wait_sb_inodes.patch added to mm-hotfixes-unstable branch
Subject:*****SPAM***** + fs-writeback-skip-as_no_data_integrity-mappings-in-wait_sb_inodes.patch added to mm-hotfixes-unstable branch
X-Spam-Status: Yes, score=25.4, +20 total spam score
SpamTally: Final spam score: 274


The patch titled
     Subject: fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
     fs-writeback-skip-as_no_data_integrity-mappings-in-wait_sb_inodes.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/fs-writeback-skip-as_no_data_integrity-mappings-in-wait_sb_inodes.patch

This patch will later appear in the mm-hotfixes-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Joanne Koong <joannelkoong@gmail.com>
Subject: fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
Date: Mon, 5 Jan 2026 13:17:27 -0800

Above the while() loop in wait_sb_inodes(), we document that we must wait
for all pages under writeback for data integrity.  Consequently, if a
mapping, like fuse, traditionally does not have data integrity semantics,
there is no need to wait at all; we can simply skip these inodes.

This restores fuse back to prior behavior where syncs are no-ops.  This
fixes a user regression where if a system is running a faulty fuse server
that does not reply to issued write requests, this causes wait_sb_inodes()
to wait forever.

Link: https://lkml.kernel.org/r/20260105211737.4105620-2-joannelkoong@gmail.com
Fixes: 0c58a97f919c ("fuse: remove tmp folio for writebacks and internal rb tree")
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Reported-by: Athul Krishna <athul.krishna.kr@protonmail.com>
Reported-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Reviewed-by: Bernd Schubert <bschubert@ddn.com>
Tested-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Bernd Schubert <bschubert@ddn.com>
Cc: Bonaccorso Salvatore <carnil@debian.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/fs-writeback.c       |    7 ++++++-
 fs/fuse/file.c          |    4 +++-
 include/linux/pagemap.h |   11 +++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

--- a/fs/fs-writeback.c~fs-writeback-skip-as_no_data_integrity-mappings-in-wait_sb_inodes
+++ a/fs/fs-writeback.c
@@ -2750,8 +2750,13 @@ static void wait_sb_inodes(struct super_
 		 * The mapping can appear untagged while still on-list since we
 		 * do not have the mapping lock. Skip it here, wb completion
 		 * will remove it.
+		 *
+		 * If the mapping does not have data integrity semantics,
+		 * there's no need to wait for the writeout to complete, as the
+		 * mapping cannot guarantee that data is persistently stored.
 		 */
-		if (!mapping_tagged(mapping, PAGECACHE_TAG_WRITEBACK))
+		if (!mapping_tagged(mapping, PAGECACHE_TAG_WRITEBACK) ||
+		    mapping_no_data_integrity(mapping))
 			continue;
 
 		spin_unlock_irq(&sb->s_inode_wblist_lock);
--- a/fs/fuse/file.c~fs-writeback-skip-as_no_data_integrity-mappings-in-wait_sb_inodes
+++ a/fs/fuse/file.c
@@ -3200,8 +3200,10 @@ void fuse_init_file_inode(struct inode *
 
 	inode->i_fop = &fuse_file_operations;
 	inode->i_data.a_ops = &fuse_file_aops;
-	if (fc->writeback_cache)
+	if (fc->writeback_cache) {
 		mapping_set_writeback_may_deadlock_on_reclaim(&inode->i_data);
+		mapping_set_no_data_integrity(&inode->i_data);
+	}
 
 	INIT_LIST_HEAD(&fi->write_files);
 	INIT_LIST_HEAD(&fi->queued_writes);
--- a/include/linux/pagemap.h~fs-writeback-skip-as_no_data_integrity-mappings-in-wait_sb_inodes
+++ a/include/linux/pagemap.h
@@ -210,6 +210,7 @@ enum mapping_flags {
 	AS_WRITEBACK_MAY_DEADLOCK_ON_RECLAIM = 9,
 	AS_KERNEL_FILE = 10,	/* mapping for a fake kernel file that shouldn't
 				   account usage to user cgroups */
+	AS_NO_DATA_INTEGRITY = 11, /* no data integrity guarantees */
 	/* Bits 16-25 are used for FOLIO_ORDER */
 	AS_FOLIO_ORDER_BITS = 5,
 	AS_FOLIO_ORDER_MIN = 16,
@@ -345,6 +346,16 @@ static inline bool mapping_writeback_may
 	return test_bit(AS_WRITEBACK_MAY_DEADLOCK_ON_RECLAIM, &mapping->flags);
 }
 
+static inline void mapping_set_no_data_integrity(struct address_space *mapping)
+{
+	set_bit(AS_NO_DATA_INTEGRITY, &mapping->flags);
+}
+
+static inline bool mapping_no_data_integrity(const struct address_space *mapping)
+{
+	return test_bit(AS_NO_DATA_INTEGRITY, &mapping->flags);
+}
+
 static inline gfp_t mapping_gfp_mask(const struct address_space *mapping)
 {
 	return mapping->gfp_mask;
_

Patches currently in -mm which might be from joannelkoong@gmail.com are

fs-writeback-skip-as_no_data_integrity-mappings-in-wait_sb_inodes.patch




From - Tue Jan 06 15:32:35 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
>From stable+bounces-205033-hi=josie.lol@vger.kernel.org Tue Jan 06 03:41:18 2026
Return-path: <stable+bounces-205033-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Tue, 06 Jan 2026 03:41:18 +0000
Received: from tor.lore.kernel.org ([172.105.105.114])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-205033-hi=josie.lol@vger.kernel.org>)
	id 1vcxwc-00000009GyI-0XHi
	for hi@josie.lol;
	Tue, 06 Jan 2026 03:41:18 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by tor.lore.kernel.org (Postfix) with ESMTP id E42D5302350F
	for <hi@josie.lol>; Tue,  6 Jan 2026 03:40:55 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 7185A254B18;
	Tue,  6 Jan 2026 03:40:52 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="rTUwvQR7"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46F1624E4A8;
	Tue,  6 Jan 2026 03:40:52 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1767670852; cv=none; b=q4gawnaptx5Z9s9jC/Hgs0iDTh94kGqNLTCp4x20HvZcLCfeeg40fRoLLL70B85GJ6hr7HP1mtVUeWW4GWs7y1aM0o4S7dgagAQR/X9aN0yCBsJXa/wm9Y0HjsjwqqiEdwEB9rnyIqlBipG6iIi+3C8/37J7RRtbjjbvf91HqIU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1767670852; c=relaxed/simple;
	bh=1CuxBdl5njbHYYq62NVazGyyPuBrBX9k3Tg7xgE5b6A=;
	h=Date:To:From:Subject:Message-Id; b=W+cfhKhl3a+8fgAU4jgr9VvbCmUVvksxKgx7SQ4ouZaseuXQ5IM16o2vlVa+xpu5yneFkcpOOOMY9qVkfKnysRT3gdoZSXp0jv7gtz3EZDM6GXoqmtw8pU+TPT2jcQ94vUhV/elvb0Lqp3pbOKwSn8Ek2sOwS7bn0oUYbWeyHCw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=rTUwvQR7; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A53BC116D0;
	Tue,  6 Jan 2026 03:40:52 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org;
	s=korg; t=1767670852;
	bh=1CuxBdl5njbHYYq62NVazGyyPuBrBX9k3Tg7xgE5b6A=;
	h=Date:To:From:Subject:From;
	b=rTUwvQR75EkVrnCI9g8E1L6GHE3aQcexeAyB8npFGBi0ACro6LXnJeZgFv716Vb8l
	 BiZGv8W0s66yQPkU8u7LnqD/wi+AfbZ4M6qKDoyaT59PwIjrri0IkmTj0YYjLCvbsl
	 LPbs8fk9XIW86VGk4nfcXMTgn4ukRIAuwR36a82o=
Date: Mon, 05 Jan 2026 19:40:51 -0800
To: mm-commits@vger.kernel.org,willy@infradead.org,stable@vger.kernel.org,liam.howlett@oracle.com,andrewjballance@gmail.com,aliceryhl@google.com,boudewijn@delta-utec.com,akpm@linux-foundation.org
From: Andrew Morton <akpm@linux-foundation.org>
Message-Id: <20260106034052.1A53BC116D0@smtp.kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
X-DKIM: signer='linux-foundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 25.4 (+++++++++++++++++++++++++)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (25.4 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linux-foundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [172.105.105.114 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
   25 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII
                              but isn't
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
X-Old-Subject:[to-be-updated] maple_tree-add-dead-node-check-in-mas_dup_alloc.patch removed from -mm tree
Subject:*****SPAM***** [to-be-updated] maple_tree-add-dead-node-check-in-mas_dup_alloc.patch removed from -mm tree
X-Spam-Status: Yes, score=25.4, +20 total spam score
SpamTally: Final spam score: 274


The quilt patch titled
     Subject: maple_tree: add dead node check in mas_dup_alloc()
has been removed from the -mm tree.  Its filename was
     maple_tree-add-dead-node-check-in-mas_dup_alloc.patch

This patch was dropped because an updated version will be issued

------------------------------------------------------
From: Boudewijn van der Heide <boudewijn@delta-utec.com>
Subject: maple_tree: add dead node check in mas_dup_alloc()
Date: Sat, 3 Jan 2026 17:57:58 +0100

__mt_dup() is exported and can be called without internal locking, relying
on the caller to provide appropriate synchronization.  If a caller fails
to hold proper locks, the source tree may be modified concurrently,
potentially resulting in dead nodes during traversal.

The call stack is:
  __mt_dup()
    → mas_dup_build()
      → mas_dup_alloc()  [accesses node->slot[]]

mas_dup_alloc() may access node slots without first verifying that the
node is still alive.  If a dead node is encountered, its memory layout may
have been switched to the RCU union member, making slot array access
undefined behavior as we would be reading from the rcu_head structure
instead.

If __mt_dup() is invoked without the required external locking and the
source tree is concurrently modified, a node can transition to the dead
RCU layout while mas_dup_alloc() is still traversing it.  In that case the
code may interpret the rcu_head contents as slot pointers.

Practically, this could lead to invalid pointer dereferences (kernel oops)
or corruption of the duplicated tree.  Depending on how that duplicated
tree is later used (e.g.  in mm/VMA paths), the effects could be
userspace-visible, such as fork() failures, process crashes, or broader
system instability.

My understanding is that current in-tree users hold the appropriate locks
and should not hit this, as triggering it requires violating the
__mt_dup() synchronization contract.  The risk primarily comes from the
fact that __mt_dup() is exported (EXPORT_SYMBOL), making it reachable by
out-of-tree modules or future callers which may not follow the locking
rules.

Add an explicit dead node check to detect concurrent modification during
duplication.  When a dead node is detected, return -EBUSY to indicate that
the tree is undergoing concurrent modification.

Link: https://lkml.kernel.org/r/20260103165758.74094-1-boudewijn@delta-utec.com
Fixes: fd32e4e9b764 ("maple_tree: introduce interfaces __mt_dup() and mtree_dup()")
Signed-off-by: Boudewijn van der Heide <boudewijn@delta-utec.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andrew Ballance <andrewjballance@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 lib/maple_tree.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/lib/maple_tree.c~maple_tree-add-dead-node-check-in-mas_dup_alloc
+++ a/lib/maple_tree.c
@@ -6251,6 +6251,11 @@ static inline void mas_dup_alloc(struct
 	/* Allocate memory for child nodes. */
 	type = mte_node_type(mas->node);
 	new_slots = ma_slots(new_node, type);
+	if (unlikely(ma_dead_node(node))) {
+		mas_set_err(mas, -EBUSY);
+		return;
+	}
+
 	count = mas->node_request = mas_data_end(mas) + 1;
 	mas_alloc_nodes(mas, gfp);
 	if (unlikely(mas_is_err(mas)))
_

Patches currently in -mm which might be from boudewijn@delta-utec.com are





From - Wed Jan 07 09:31:40 2026
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
>From stable+bounces-206031-hi=josie.lol@vger.kernel.org Tue Jan 06 19:51:07 2026
Return-path: <stable+bounces-206031-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Tue, 06 Jan 2026 19:51:07 +0000
Received: from sea.lore.kernel.org ([172.234.253.10])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <stable+bounces-206031-hi=josie.lol@vger.kernel.org>)
	id 1vdD55-0000000HS7B-2Bna
	for hi@josie.lol;
	Tue, 06 Jan 2026 19:51:07 +0000
Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1])
	by sea.lore.kernel.org (Postfix) with ESMTP id 779C230F8907
	for <hi@josie.lol>; Tue,  6 Jan 2026 19:26:43 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id CCD1D33A6E4;
	Tue,  6 Jan 2026 19:18:43 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="jJT/hYRp"
X-Original-To: stable@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B3CE3396F7;
	Tue,  6 Jan 2026 19:18:43 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1767727123; cv=none; b=dD4CdwBWMeo+ZvS3sIDWEdAUNtffKSEdbfIt/DKltPRLR+ebof4aBTkWDYrb3KojiDh59xEBnYcSUV5ATSRdBGkDAMMVOuybiaab3HUnUL6QmKb1661iAPvvq0gKXi2n3Qe8FvynmqDTwjrqpbSV9H0NuFolNc+zAI1HNIJdp+g=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1767727123; c=relaxed/simple;
	bh=rbXyQXMkBBEvg5DAgUSRJAd4b1tBYpX+ExDUAysSWxY=;
	h=Date:To:From:Subject:Message-Id; b=elAYle206GJN+PSRuf+lb2bYpXMeyIBZ3dD10mTXuI7bqdnZcbVQqSQ4++NadSPEQhDMHoYikMZTKwq1bSH9YF4YgmWl5wuTeO5EzyO1YGtnanQDuFDWeK4VdiYuiatsB8upvsrCGKfcUoQPgOMZdkQflo7hjLijlX/GalKKROg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=jJT/hYRp; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23367C116C6;
	Tue,  6 Jan 2026 19:18:43 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org;
	s=korg; t=1767727123;
	bh=rbXyQXMkBBEvg5DAgUSRJAd4b1tBYpX+ExDUAysSWxY=;
	h=Date:To:From:Subject:From;
	b=jJT/hYRp5DMZZjq2L6koXbU2xVBQekHyow/v9l42xz22l2h8Mw8rgvPudWfoGYG4l
	 +Hufq/IxBW69PoHrBwXJyqVtUBB4u+wZvLN+4FpnDNDJOHUQY0hiHJoUyogbBLi7zu
	 KVAeYrwGVgSLs6Q+r3MmYx2ZCr9zoMXZXhDzgl84=
Date: Tue, 06 Jan 2026 11:18:42 -0800
To: mm-commits@vger.kernel.org,zhengqi.arch@bytedance.com,yuanchu@google.com,weixugc@google.com,tj@kernel.org,stable@vger.kernel.org,shakeel.butt@linux.dev,roman.gushchin@linux.dev,muchun.song@linux.dev,mkoutny@suse.com,mhocko@kernel.org,lorenzo.stoakes@oracle.com,longman@redhat.com,hannes@cmpxchg.org,gourry@gourry.net,david@kernel.org,axelrasmussen@google.com,bingjiao@google.com,akpm@linux-foundation.org
From: Andrew Morton <akpm@linux-foundation.org>
Message-Id: <20260106191843.23367C116C6@smtp.kernel.org>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
X-DKIM: signer='linux-foundation.org' status='pass' reason=''
DKIMCheck: Server passes DKIM test, 0 Spam score
X-Spam-Score: 25.4 (+++++++++++++++++++++++++)
X-Spam-Report: Spam detection soolUseID":"agent_msg_01Vk7KWFvhwBmpRa25nxS9ZG","parentToolUseID":"toolu_01RFeWadw5cQXVhjXjWGYE1p","uuid":"bf104635-01ec-4a4d-a120-c7d1d9078f0e","timestamp":"2026-03-01T09:31:41.765Z"}
{"parentUuid":"bf104635-01ec-4a4d-a120-c7d1d9078f0e","isSidechain":false,"userType":"external","cwd":"/home/josie/development/forks/linux","sessionId":"0264110d-7530-4e6f-9308-60ad7d2c7434","version":"2.1.63","gitBranch":"master","slug":"quiet-shimmying-bunny","type":"progress","data":{"message":{"type":"assistant","timestamp":"2026-03-01T09:31:45.446Z","message":{"model":"claude-opus-4-6","id":"msg_01RyDL4LusM4z1UQtK6gvNKi","type":"message","role":"assistant","content":[{"type":"tool_use","id":"toolu_01HwS6jpHRMRPRnqdMsek3mH","name":"Bash","input":{"command":"cd ~/development/personal/kernel-mail-mcp && git add kernel_mail_mcp/db.py tests/test_db.py pyproject.toml uv.lock","description":"Stage files for commit"},"caller":{"type":"direct"}}],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":1,"cache_creation_input_tokens":740,"cache_read_input_tokens":31848,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":740},"output_tokens":25,"service_tier":"standard","inference_geo":"not_available"},"context_management":null},"requestId":"req_011CYc8NkLqArktPjLcX4QQu","uuid":"be6423fa-0452-4570-94ab-c96175649401"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a10b012eb4d6d3bfe"},"toolUseID":"agent_msg_01Vk7KWFvhwBmpRa25nxS9ZG","parentToolUseID":"toolu_01RFeWadw5cQXVhjXjWGYE1p","uuid":"3824a5b7-b73a-4922-af73-f8d082b57d90","timestamp":"2026-03-01T09:31:45.447Z"}
{"parentUuid":"3824a5b7-b73a-4922-af73-f8d082b57d90","isSidechain":false,"userType":"external","cwd":"/home/josie/development/forks/linux","sessionId":"0264110d-7530-4e6f-9308-60ad7d2c7434","version":"2.1.63","gitBranch":"master","slug":"quiet-shimmying-bunny","type":"progress","data":{"message":{"type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_01HwS6jpHRMRPRnqdMsek3mH","type":"tool_result","content":"","is_error":false}]},"uuid":"cca03b73-988e-4efc-a2a8-8bafd692d13a","timestamp":"2026-03-01T09:32:03.825Z"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a10b012eb4d6d3bfe"},"toolUseID":"agent_msg_01Vk7KWFvhwBmpRa25nxS9ZG","parentToolUseID":"toolu_01RFeWadw5cQXVhjXjWGYE1p","uuid":"9f619e11-34d3-4cb6-a6c5-15486026f64b","timestamp":"2026-03-01T09:32:03.885Z"}
{"parentUuid":"9f619e11-34d3-4cb6-a6c5-15486026f64b","isSidechain":false,"userType":"external","cwd":"/home/josie/development/forks/linux","sessionId":"0264110d-7530-4e6f-9308-60ad7d2c7434","version":"2.1.63","gitBranch":"master","slug":"quiet-shimmying-bunny","type":"progress","data":{"message":{"type":"assistant","timestamp":"2026-03-01T09:32:08.030Z","message":{"model":"claude-opus-4-6","id":"msg_01PkUHdBLchda3tCSD2Gj8U8","type":"message","role":"assistant","content":[{"type":"tool_use","id":"toolu_01Jn2xPPVCsX1mEHGCqSxfrf","name":"Bash","input":{"command":"cd ~/development/personal/kernel-mail-mcp && git commit -m \"$(cat <<'EOF'\nAdd SQLite FTS5 database module with tests\n\nSigned-off-by: Josephine Pfeiffer <hi@josie.lol>\nEOF\n)\"","description":"Commit the database module and tests"},"caller":{"type":"direct"}}],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":1,"cache_creation_input_tokens":138,"cache_read_input_tokens":32588,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":138},"output_tokens":24,"service_tier":"standard","inference_geo":"not_available"},"context_management":null},"requestId":"req_011CYc8QNq5eStXskSYspFfX","uuid":"5acbd094-002f-4a3d-8373-a0a001dcfecf"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a10b012eb4d6d3bfe"},"toolUseID":"agent_msg_01Vk7KWFvhwBmpRa25nxS9ZG","parentToolUseID":"toolu_01RFeWadw5cQXVhjXjWGYE1p","uuid":"7cb74d74-9524-4626-9d8d-7d3ac99babfb","timestamp":"2026-03-01T09:32:08.031Z"}
{"parentUuid":"7cb74d74-9524-4626-9d8d-7d3ac99babfb","isSidechain":false,"userType":"external","cwd":"/home/josie/development/forks/linux","sessionId":"0264110d-7530-4e6f-9308-60ad7d2c7434","version":"2.1.63","gitBranch":"master","slug":"quiet-shimmying-bunny","type":"progress","data":{"message":{"type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_01Jn2xPPVCsX1mEHGCqSxfrf","type":"tool_result","content":"[master eceeaac] Add SQLite FTS5 database module with tests\n 4 files changed, 418 insertions(+)\n create mode 100644 kernel_mail_mcp/db.py\n create mode 100644 tests/test_db.py","is_error":false}]},"uuid":"b993547a-e688-473d-b4dd-0e763d3d29c5","timestamp":"2026-03-01T09:32:10.309Z"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a10b012eb4d6d3bfe"},"toolUseID":"agent_msg_01Vk7KWFvhwBmpRa25nxS9ZG","parentToolUseID":"toolu_01RFeWadw5cQXVhjXjWGYE1p","uuid":"250b8059-c974-4758-8671-a4205a2be4c6","timestamp":"2026-03-01T09:32:10.369Z"}
{"parentUuid":"250b8059-c974-4758-8671-a4205a2be4c6","isSidechain":false,"userType":"external","cwd":"/home/josie/development/forks/linux","sessionId":"0264110d-7530-4e6f-9308-60ad7d2c7434","version":"2.1.63","gitBranch":"master","slug":"quiet-shimmying-bunny","type":"progress","data":{"message":{"type":"assistant","timestamp":"2026-03-01T09:32:12.872Z","message":{"model":"claude-opus-4-6","id":"msg_014MRsUDC6C9XL7EBbphPEoh","type":"message","role":"assistant","content":[{"type":"tool_use","id":"toolu_01JJuK1a76GWsNAvroJVWQBA","name":"Bash","input":{"command":"cd ~/development/personal/kernel-mail-mcp && git status","description":"Verify clean working tree after commit"},"caller":{"type":"direct"}}],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":1,"cache_creation_input_tokens":215,"cache_read_input_tokens":32726,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":215},"output_tokens":25,"service_tier":"standard","inference_geo":"not_available"},"context_management":null},"requestId":"req_011CYc8QqbeXTgAoiGCoeNdZ","uuid":"09b159d1-60b6-4038-8c47-52368ca7b65a"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a10b012eb4d6d3bfe"},"toolUseID":"agent_msg_01Vk7KWFvhwBmpRa25nxS9ZG","parentToolUseID":"toolu_01RFeWadw5cQXVhjXjWGYE1p","uuid":"745710a9-7fcb-4a05-a31d-1b4d7c67498a","timestamp":"2026-03-01T09:32:12.872Z"}
{"parentUuid":"745710a9-7fcb-4a05-a31d-1b4d7c67498a","isSidechain":false,"userType":"external","cwd":"/home/josie/development/forks/linux","sessionId":"0264110d-7530-4e6f-9308-60ad7d2c7434","version":"2.1.63","gitBranch":"master","slug":"quiet-shimmying-bunny","type":"progress","data":{"message":{"type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_01JJuK1a76GWsNAvroJVWQBA","type":"tool_result","content":"On branch master\nUntracked files:\n  (use \"git add <file>...\" to include in what will be committed)\n\tkernel_mail_mcp/__pycache__/\n\ttests/__pycache__/\n\nnothing added to commit but untracked files present (use \"git add\" to track)","is_error":false}]},"uuid":"b6fce8bd-1665-463d-b18c-6ba9dcd74587","timestamp":"2026-03-01T09:33:59.755Z"},"normalizedMessages":[],"type":"agent_progress","prompt":"","agentId":"a10b012eb4d6d3bfe"},"toolUseID":"agent_msg_01Vk7KWFvhwBmpRa25nxS9ZG","parentToolUseID":"toolu_01RFeWadw5cQXVhjXjWGYE1p","uuid":"fb8001b1-c23d-466c-9eeb-57557a33380f","timestamp":"2026-03-01T09:33:59.810Z"}
{"parentUuid":"fb8001b1-c23d-466c-9eeb-57557a33380f","isSidechain":false,"userType":"external","cwd":"/home/josie/development/forks/linux","sessionId":"0264110d-7530-4e6f-9308-60ad7d2c7434","version":"2.1.63","gitBranch":"master","slug":"quiet-shimmying-bunny","type":"progress","data":{"message":{"type":"assistant","timestamp":"2026-03-01T09:34:03.294Z","message":{"model":"claude-opus-4-6","id":"msg_01R4QE6gsaZCHKMN1wA4675C","type":"message","role":"assistant","content":[{"type":"tool_use","id":"toolu_01DvbpCCwbGH6BtQtCnpXWEd","name":"TaskUpdate","input":{"taskId":"8","status":"completed"},"caller":{"type":"direct"}}],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":1,"cache_creation_input_tokens":172,"cache_read_input_tokens":32941,"cache_creation":{"ephemeral_5m_input_tokens":0,"../../ca-certificates/extracted/cadir/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.pem