[folded-merged] maple_tree-fix-reverse-iterator-state-when-the-root-disappears.patch removed from -mm tree

[folded-merged] maple_tree-fix-reverse-iterator-state-when-the-root-disappears.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: maple_tree: fix reverse iterator state when the root disappears
has been removed from the -mm tree.  Its filename was
     maple_tree-fix-reverse-iterator-state-when-the-root-disappears.patch

This patch was dropped because it was folded into maple_tree-fix-rcu-reader-null-dereference-after-the-tree-is-emptied.patch

------------------------------------------------------
From: Andrew Morton <akpm@linux-foundation.org>
Subject: maple_tree: fix reverse iterator state when the root disappears
Date: Tue, 03 Nov 2026 04:28:56 +0000

A reverse walk restarting from a dead node can observe a direct root entry
in mas_rewalk() and then an empty root in mas_prev_no_node().  The second
root read returns NULL, but leaves the iterator in ma_root with index and
last both zero.

Consequently, mas_prev_range() and mas_find_range_rev() can report an
empty range of [0, 0] instead of [0, ULONG_MAX].  A subsequent forward
range walk starts at index 1, omitting index 0 from the empty range.

Set ma_none and extend last to ULONG_MAX when the second root read returns
NULL.  Keep the existing encoded-node retry in mas_prev_slot() for a root
that has grown into a node again.

A deterministic userspace Maple test reproduces the stale state through
both reverse range APIs before this change and checks the full empty range
afterwards, including a subsequent forward walk.

Link: https://lore.kernel.org/20261104104137.2058705ac29734a7ab5666c1@linux-foundation.org
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/sashiko-outbox-194509@kernel.org
Reviewed-by: Liam R. Howlett (Google) <liam@infradead.org>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andrew Ballance <andrewjballance@gmail.com>
Cc: Chris Mason <mason@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
---

 lib/maple_tree.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/lib/maple_tree.c~maple_tree-fix-reverse-iterator-state-when-the-root-disappears
+++ a/lib/maple_tree.c
@@ -3930,6 +3930,8 @@ static inline void *mas_next_no_node(str
 static inline void *mas_prev_no_node(struct ma_state *mas, unsigned long index,
 		unsigned long min)
 {
+	void *entry;
+
 	mas->index = 0;
 	if (mas_is_none(mas)) {
 		mas->last = ULONG_MAX;
@@ -3940,7 +3942,13 @@ static inline void *mas_prev_no_node(str
 	if (!index || min)
 		return NULL;
 
-	return mas_root(mas);
+	entry = mas_root(mas);
+	if (!entry) {
+		mas->status = ma_none;
+		mas->last = ULONG_MAX;
+	}
+
+	return entry;
 }
 
 /*
_

Patches currently in -mm which might be from akpm@linux-foundation.org are

mm-mempolicy-use-one-node-set-for-interleave-weights.patch
maple_tree-fix-rcu-reader-null-dereference-after-the-tree-is-emptied.patch
shmem-consume-the-reserved-xattr-space-despite-remount.patch
selftests-mm-check-madv_cold-and-madv_pageout-on-partly-advised-thps-fix.patch
alloc_tag-introduce-ioctls-to-toggle-allocation-tracepoints-fix-fix.patch
alloc_tag-introduce-ioctls-to-toggle-allocation-tracepoints-fix.patch
mm-migrate_device-allocate-deferred-split-sublists-for-new-huge-folios.patch
profile-account-for-partial-proc-profile-reads.patch
profile-simplify-proc-profile-read-layout.patch
ipc-msg-clamp-negative-msg_info-usage-counts.patch
squashfs-fix-leaked-page-locks-when-page-actor-allocation-fails-fix.patch
drivers-media-v4l2-core-v4l2-vp9c-reduce-inlining.patch