xas_alloc() only initializes node->offset when the node has a parent. The shared radix-tree node cache clears slots and marks on reuse, but leaves the old offset intact. A new root can therefore retain the nonzero offset of a former child. Lockless iterators read a node's offset before loading its parent. If xas_expand() grows the tree between those reads, the iterator can combine the stale offset with the newly published parent and descend into the wrong subtree while retaining the original xa_index. Even xas_reload() can accept the resulting entry when the offsets within the two subtrees coincide. Page-cache callers rely on that check to validate the folio they found. Initialize every new root's offset to zero before publishing it. The offset sampled by a reader will then still be correct if the root is made a child by expansion. Non-root nodes retain their existing initialization, and shrinking only promotes a child from slot zero. This fixes the forward, reverse and marked walkers at their common source, without changing the iterator or page-cache APIs. Fixes: 58d6ea3085f2 ("xarray: Add XArray unconditional store operations") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-6-astra Signed-off-by: Kyle Zeng --- lib/xarray.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/xarray.c b/lib/xarray.c index bfe7bef80f34..509d7e4157bd 100644 --- a/lib/xarray.c +++ b/lib/xarray.c @@ -382,8 +382,8 @@ static void *xas_alloc(struct xa_state *xas, unsigned int shift) } } + node->offset = parent ? xas->xa_offset : 0; if (parent) { - node->offset = xas->xa_offset; parent->count++; XA_NODE_BUG_ON(node, parent->count > XA_CHUNK_SIZE); xas_update(xas, parent);