v2
2026-09-16
修复 maple_tree RCU 模式崩溃 · v2
修复 maple_range_64 节点在 RCU 销毁路径因末槽元数据导致的指针破坏和 mt_free_walk 非法访问，并加测试。
原始补丁链接
子 Patch（4）
1/4
maple_tree: remove mt_clear_meta() to fix a pointer corruption
mt_clear_meta() decides whether the last slot of a maple_range_64 node holds a child pointer or a struct maple_metadata with the check if (unlikely((mte_to_node(next) &&
2/4
test_maple_tree: test a full maple_range_64 node in RCU mode
Add a test that builds a tree whose root is a full maple_range_64 node. Ensure the destruction under RCU does not misinterpret the last slot as metadata. 226 insertions produce such a root on a 64-bit
3/4
maple_tree: fix invalid memory access in mt_free_walk()
mt_free_walk() descends to the left-most unvisited “parent-of-a-leaf” node by checking the condition: if ((offset < mt_slots[type]) && rcu_dereference_protected(slots[offset],
4/4
test_maple_tree: test a maple_range_64 metadata slot in RCU mode
Add a test that builds a height 3 tree whose root holds 15 child pointers and metadata in its last slot, so every slot is non-zero. Ensure the destruction under RCU does not descend into the metadata