v1
2026-10-23
修复maple树RCU释放缺陷 · v1
修复RCU模式maple tree销毁把节点末槽元数据误当子节点或子指针，并补充回归测试。
原始补丁链接
子 Patch（3）
1/3
maple_tree: do not descend into metadata in mt_free_walk()
mt_free_walk() frees the nodes of a dead RCU-mode tree from an RCU callback. After freeing the children of a node, it continues with the next slot of the parent if that slot is non-NULL. A maple_range
2/3
maple_tree: do not clear the metadata of a full dead node
When an RCU-mode tree that is not an allocation tree is destroyed, or a subtree of such a tree is replaced by a spanning store, mt_destroy_walk() runs with free == false and the nodes are freed later
3/3
maple_tree: add a test for destroying RCU-mode trees
Destroying an RCU-mode tree that is not an allocation tree defers freeing its nodes to mt_free_walk(). This path had two bugs, both caused by the metadata that a maple_range_64 node may keep in its la