Re: [PATCH] lib/maple_tree: fix swapped arguments in mas_safe_pivot() call

[Josh Law]

6 Mar 2026 22:54:36 Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>:

> On Fri, 6 Mar 2026 22:11:54 +0000 Josh Law <hlcj1234567@xxxxxxxxx> wrote:
>
>>>> --- a/lib/maple_tree.c
>>>> +++ b/lib/maple_tree.c
>>>> @@ -3279,7 +3279,7 @@ static inline void mas_extend_spanning_null(struct ma_wr_state *l_wr_mas,
>>>>         (r_mas->last < r_mas->max) &&
>>>>         !mas_slot_locked(r_mas, r_wr_mas->slots, r_mas->offset + 1)) {
>>>>         r_mas->last = mas_safe_pivot(r_mas, r_wr_mas->pivots,
>>>> -                        r_wr_mas->type, r_mas->offset + 1);
>>>> +                        r_mas->offset + 1, r_wr_mas->type);
>>>>         r_mas->offset++;
>>>>     }
>>>
>>> Whoops.  How come nobody has noticed after 4+ years?
>>>
>>> I'll add
>>>
>>>     Fixes: 54a611b60590 ("Maple Tree: add new data structure")
>>>
>>> and maybe cc:stable if we have a reason to do so.
>>
>> Hi Andrew, on thought, I'd like to add Cc: stable@xxxxxxxxxxxxxxx to this.
>> Even though it's been 4 years, a swapped argument in a core data structure like Maple Tree is a silent bug that could cause rare corruption. Better to defuse it in the LTS kernels.
>
>> Seems appropriate.  But not as a hotfix, given the 3+ year thing.
>>
>> I was hoping to hear some thoughts on why this has proven to be so benign. 

I suspect it has proven benign because, in most common workloads, the maple_type enum and the offset happen to be small, overlapping integers. mas_safe_pivot likely returned a 'plausible' boundary that didn't trigger an immediate OOB access, and the tree's walking logic is resilient enough to handle a slightly miscalculated pivot during a spanning-null extension without crashing. It was a silent logic error rather than a loud memory error.

V/R

V/R


Josh law