Re: [PATCH] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call

[Andrew Morton]

On Fri, 6 Mar 2026 22:11:54 +0000 Josh Law <hlcj1234567@xxxxxxxxx> wrote:

> >> --- a/lib/maple_tree.c
> >> +++ b/lib/maple_tree.c
> >> @@ -3279,7 +3279,7 @@ static inline void mas_extend_spanning_null(struct ma_wr_state *l_wr_mas,
> >>         (r_mas->last < r_mas->max) &&
> >>         !mas_slot_locked(r_mas, r_wr_mas->slots, r_mas->offset + 1)) {
> >>         r_mas->last = mas_safe_pivot(r_mas, r_wr_mas->pivots,
> >> -                        r_wr_mas->type, r_mas->offset + 1);
> >> +                        r_mas->offset + 1, r_wr_mas->type);
> >>         r_mas->offset++;
> >>     }
> >
> > Whoops.  How come nobody has noticed after 4+ years?
> >
> > I'll add
> >
> >     Fixes: 54a611b60590 ("Maple Tree: add new data structure")
> >
> > and maybe cc:stable if we have a reason to do so.
> 
> Hi Andrew, on thought, I'd like to add Cc: stable@xxxxxxxxxxxxxxx to this.
> Even though it's been 4 years, a swapped argument in a core data structure like Maple Tree is a silent bug that could cause rare corruption. Better to defuse it in the LTS kernels.

Seems appropriate.  But not as a hotfix, given the 3+ year thing.

I was hoping to hear some thoughts on why this has proven to be so benign.