| commit | 883e5d542bbdddbddeba60250cb482baf3ae2415 | [log] [tgz] |
|---|---|---|
| author | Liam R. Howlett <[email protected]> | Mon Apr 22 16:33:49 2024 -0400 |
| committer | Greg Kroah-Hartman <[email protected]> | Sun Jun 16 13:41:31 2024 +0200 |
| tree | 07c256151307062efbad4476c4cd791c4387ff5c | |
| parent | 34f3005303582d756fe33f8aa90d74c3820fee74 [diff] |
maple_tree: fix mas_empty_area_rev() null pointer dereference commit 955a923d2809803980ff574270f81510112be9cf upstream. Currently the code calls mas_start() followed by mas_data_end() if the maple state is MA_START, but mas_start() may return with the maple state node == NULL. This will lead to a null pointer dereference when checking information in the NULL node, which is done in mas_data_end(). Avoid setting the offset if there is no node by waiting until after the maple state is checked for an empty or single entry state. A user could trigger the events to cause a kernel oops by unmapping all vmas to produce an empty maple tree, then mapping a vma that would cause the scenario described above. Link: https://lkml.kernel.org/r/[email protected] Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <[email protected]> Reported-by: Marius Fleischer <[email protected]> Closes: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com/ Link: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com/ Tested-by: Marius Fleischer <[email protected]> Tested-by: Sidhartha Kumar <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>