[merged mm-hotfixes-stable] xarray-clear-the-new-heads-parent-before-freeing-the-old-head.patch removed from -mm tree

[merged mm-hotfixes-stable] xarray-clear-the-new-heads-parent-before-freeing-the-old-head.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: xarray: clear the new head's parent before freeing the old head
has been removed from the -mm tree.  Its filename was
     xarray-clear-the-new-heads-parent-before-freeing-the-old-head.patch

This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
Subject: xarray: clear the new head's parent before freeing the old head
Date: Tue, 27 Oct 2026 15:20:14 -0400

xas_shrink() passes the old head to xa_node_free(), which queues it with
call_rcu(), before it clears the new head's parent pointer.  A lockless
walker that loads the new head after the grace period has started can
still climb from it into the old head through xa_parent(), as xas_find(),
xas_find_marked(), xas_next() and xas_prev() do when they step past the
end of a node, and read the old head after it is freed.

Clear the parent pointer before freeing the old head, as
radix_tree_shrink() does.

With a delay injected after xa_node_free() in xas_shrink(), KASAN reports
a slab-use-after-free in the walker; with this patch it does not.

Link: https://lore.kernel.org/20261027192014.844878-1-nickolai@csail.mit.edu
Fixes: 58d6ea3085f2 ("xarray: Add XArray unconditional store operations")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
---

 lib/xarray.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/lib/xarray.c~xarray-clear-the-new-heads-parent-before-freeing-the-old-head
+++ a/lib/xarray.c
@@ -471,11 +471,12 @@ static void xas_shrink(struct xa_state *
 		if (!xa_is_node(entry))
 			RCU_INIT_POINTER(node->slots[0], XA_RETRY_ENTRY);
 		xas_update(xas, node);
+		if (xa_is_node(entry))
+			xa_to_node(entry)->parent = NULL;
 		xa_node_free(node);
 		if (!xa_is_node(entry))
 			break;
 		node = xa_to_node(entry);
-		node->parent = NULL;
 	}
 }
 
_

Patches currently in -mm which might be from nickolai@csail.mit.edu are

lib-plist-add-a-plist_test-case-for-plist_requeue-on-the-last-priority-bucket.patch