[PATCH] xarray: initialize the offset of new root nodes

[Kyle Zeng]

xas_alloc() only initializes node->offset when the node has a parent.
The shared radix-tree node cache clears slots and marks on reuse, but
leaves the old offset intact.  A new root can therefore retain the
nonzero offset of a former child.

Lockless iterators read a node's offset before loading its parent.
If xas_expand() grows the tree between those reads, the iterator can
combine the stale offset with the newly published parent and descend
into the wrong subtree while retaining the original xa_index.  Even
xas_reload() can accept the resulting entry when the offsets within
the two subtrees coincide.  Page-cache callers rely on that check to
validate the folio they found.

Initialize every new root's offset to zero before publishing it.  The
offset sampled by a reader will then still be correct if the root is
made a child by expansion.  Non-root nodes retain their existing
initialization, and shrinking only promotes a child from slot zero.
This fixes the forward, reverse and marked walkers at their common
source, without changing the iterator or page-cache APIs.

Fixes: 58d6ea3085f2 ("xarray: Add XArray unconditional store operations")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
---
 lib/xarray.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/xarray.c b/lib/xarray.c
index bfe7bef80f34..509d7e4157bd 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -382,8 +382,8 @@ static void *xas_alloc(struct xa_state *xas, unsigned int shift)
 		}
 	}
 
+	node->offset = parent ? xas->xa_offset : 0;
 	if (parent) {
-		node->offset = xas->xa_offset;
 		parent->count++;
 		XA_NODE_BUG_ON(node, parent->count > XA_CHUNK_SIZE);
 		xas_update(xas, parent);