[nacked] lib-maple_tree-fix-swapped-arguments-in-mas_safe_pivot-call.patch removed from -mm tree

[nacked] lib-maple_tree-fix-swapped-arguments-in-mas_safe_pivot-call.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: lib/maple_tree: fix swapped arguments in mas_safe_pivot() call
has been removed from the -mm tree.  Its filename was
     lib-maple_tree-fix-swapped-arguments-in-mas_safe_pivot-call.patch

This patch was dropped because it was nacked

------------------------------------------------------
From: Josh Law <objecting@objecting.org>
Subject: lib/maple_tree: fix swapped arguments in mas_safe_pivot() call
Date: Fri, 6 Mar 2026 20:08:20 +0000

The call to mas_safe_pivot() in mas_wr_extend_null() has the pivot index
and maple type arguments swapped.  The function signature expects (mas,
pivots, piv, type) but the call passes (mas, pivots, type, piv).

This causes the pivot index to be interpreted as a maple node type and
vice versa, leading to incorrect pivot lookups.  In practice, this means a
null-extending store into a maple tree node can read the wrong pivot
value, potentially corrupting the range tracked by the maple state.  For a
VMA maple tree, this could cause an incorrect vm_area_struct range to be
returned during operations like mmap or munmap, leading to silent memory
mapping corruption.

Every other mas_safe_pivot() call site in the file passes the arguments in
the correct (piv, type) order; this is the only one with them reversed.

Link: https://lkml.kernel.org/r/20260306225849.2824409-1-objecting@objecting.org
Link: https://lkml.kernel.org/r/20260306223219.2824040-1-objecting@objecting.org
Link: https://lkml.kernel.org/r/20260306200820.2819999-1-objecting@objecting.org
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Josh Law <objecting@objecting.org>
Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andrew Ballance <andrewjballance@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 lib/maple_tree.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/lib/maple_tree.c~lib-maple_tree-fix-swapped-arguments-in-mas_safe_pivot-call
+++ a/lib/maple_tree.c
@@ -2932,7 +2932,7 @@ static inline void mas_extend_spanning_n
 	    (r_mas->last < r_mas->max) &&
 	    !mas_slot_locked(r_mas, r_wr_mas->slots, r_mas->offset + 1)) {
 		r_mas->last = mas_safe_pivot(r_mas, r_wr_mas->pivots,
-					     r_wr_mas->type, r_mas->offset + 1);
+					     r_mas->offset + 1, r_wr_mas->type);
 		r_mas->offset++;
 		r_wr_mas->r_max = r_mas->last;
 	}
_

Patches currently in -mm which might be from objecting@objecting.org are

lib-idr-fix-ida_find_first_range-missing-ids-across-chunk-boundaries.patch