Re: [PATCH] lib/plist: fix plist_requeue() corrupting order in the last bucket

[Andrew Morton]

On Thu,  3 Sep 2026 17:24:56 -0500 Adam Harshbarger <handyhandyman.adam@xxxxxxxxx> wrote:

> plist_requeue() is meant to move a node to the end of its own priority
> run.  When the node heads the *last* priority bucket it is instead placed
> at the head of the whole list, leaving the plist unsorted:
> 
> ...
>
> Reachable from mm/swapfile.c, which rotates swap_avail_heads[] with
> plist_requeue().  It takes three or more swap devices: at least two
> distinct priorities, so that a later bucket exists for the ring to wrap
> round from, and two or more devices sharing the lowest priority, so that
> plist_requeue() does not return early.  One device per priority returns
> early at the node->prio != iter->prio test.  A single priority is also
> safe, but for a different reason worth stating: with one bucket no node
> is ever linked onto prio_list at all -- plist_add() skips it for the
> first node and for every node whose predecessor shares its priority --
> so list_empty(&iter->prio_list) holds and the shortcut is never entered.
> 
> ...
>

Thanks.

> Fixes: 95d4b3450ebe ("lib/plist.c: add shortcut for plist_requeue()")
> Cc: stable@xxxxxxxxxxxxxxx # v6.15+

Why the cc:stable?  A description of the userspace impact would help
people understand the need for backporting.  Please always include
such a description when fixing things.