sst-linux/lib
Liam R. Howlett 883e5d542b maple_tree: fix mas_empty_area_rev() null pointer dereference
commit 955a923d2809803980ff574270f81510112be9cf upstream.

Currently the code calls mas_start() followed by mas_data_end() if the
maple state is MA_START, but mas_start() may return with the maple state
node == NULL.  This will lead to a null pointer dereference when checking
information in the NULL node, which is done in mas_data_end().

Avoid setting the offset if there is no node by waiting until after the
maple state is checked for an empty or single entry state.

A user could trigger the events to cause a kernel oops by unmapping all
vmas to produce an empty maple tree, then mapping a vma that would cause
the scenario described above.

Link: https://lkml.kernel.org/r/20240422203349.2418465-1-Liam.Howlett@oracle.com
Fixes: 54a611b605 ("Maple Tree: add new data structure")
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Reported-by: Marius Fleischer <fleischermarius@gmail.com>
Closes: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com/
Link: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com/
Tested-by: Marius Fleischer <fleischermarius@gmail.com>
Tested-by: Sidhartha Kumar <sidhartha.kumar@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-16 13:41:31 +02:00
..
842
crypto crypto: lib - remove unneeded selection of XOR_BLOCKS 2022-08-26 18:40:14 +08:00
dim linux/dim: Do nothing if no time delta between samples 2023-05-24 17:32:31 +01:00
fonts lib/fonts: fix undefined behavior in bit shift for get_default_font 2022-12-31 13:31:56 +01:00
kunit kunit: Fix kthread reference 2024-06-12 11:03:16 +02:00
livepatch
lz4
lzo
math
mpi crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init 2024-02-23 09:12:49 +01:00
pldmfw
raid6
reed_solomon treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
test_fortify
vdso lib/vdso: use "grep -E" instead of "egrep" 2022-11-23 19:50:15 +01:00
xz
zlib_deflate
zlib_dfltcc
zlib_inflate
zstd zstd: Fix array-index-out-of-bounds UBSAN warning 2023-12-13 18:39:04 +01:00
.gitignore
argv_split.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
ashldi3.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 120 2019-05-24 17:39:02 +02:00
ashrdi3.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 120 2019-05-24 17:39:02 +02:00
asn1_decoder.c Revert "lib: Revert use of fallthrough pseudo-keyword in lib/" 2020-11-18 14:15:17 -06:00
asn1_encoder.c
assoc_array.c assoc_array: Fix BUG_ON during garbage collect 2022-06-01 18:29:06 -07:00
atomic64_test.c
atomic64.c
audit.c audit: add support for the openat2 syscall 2021-10-01 16:52:48 -04:00
base64.c lib/base64: RFC4648-compliant base64 encoding 2022-08-02 17:14:47 -06:00
bcd.c
bch.c
bitfield_kunit.c
bitmap.c lib/bitmap: drop optimization of bitmap_{from,to}_arr64 2023-07-19 16:21:58 +02:00
bitrev.c
bootconfig-data.S
bootconfig.c bootconfig: use memblock_free_late to free xbc memory to buddy 2024-04-27 17:07:17 +02:00
bsearch.c
btree.c
bucket_locks.c
bug.c cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG 2023-03-10 09:33:47 +01:00
build_OID_registry
buildid.c
bust_spinlocks.c kernel/panic: Drop unblank_screen call 2022-09-01 16:55:35 +02:00
check_signature.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
checksum.c
clz_ctz.c lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels 2023-08-30 16:11:08 +02:00
clz_tab.c
cmdline_kunit.c lib/cmdline: Fix an invalid format specifier in an assertion msg 2024-03-26 18:20:28 -04:00
cmdline.c lib/cmdline: avoid page fault in next_arg 2022-09-11 21:55:06 -07:00
cmpdi2.c
compat_audit.c
cpu_rmap.c lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() 2023-06-14 11:15:22 +02:00
cpumask_kunit.c lib/test_cpumask: Add for_each_cpu_and(not) tests 2022-10-06 05:57:36 -07:00
cpumask.c lib/find_bit: add find_next{,_and}_bit_wrap 2022-10-01 10:22:57 -07:00
crc4.c
crc7.c lib/crc7: fix a kernel-doc markup 2021-01-21 14:06:00 -07:00
crc8.c lib: crc8: pointer to data block should be const 2021-05-06 19:24:12 -07:00
crc16.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230 2019-06-19 17:09:06 +02:00
crc32.c
crc32defs.h
crc32test.c
crc64-rocksoft.c
crc64.c
crc-ccitt.c
crc-itu-t.c crc-itu-t: fix typo in CRC ITU-T polynomial comment 2022-06-07 10:27:38 +02:00
crc-t10dif.c
ctype.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
debug_info.c
debug_locks.c locking/lockdep: Improve noinstr vs errors 2021-06-22 13:56:43 +02:00
debugobjects.c debugobjects: Stop accessing objects after releasing hash bucket lock 2024-02-05 20:12:47 +00:00
dec_and_lock.c
decompress_bunzip2.c
decompress_inflate.c
decompress_unlz4.c
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c lib/xz, lib/decompress_unxz.c: Fix spelling in comments 2021-10-19 23:44:30 +08:00
decompress_unzstd.c lib: zstd: Add decompress_sources.h for decompress_unzstd 2021-11-08 16:55:26 -08:00
decompress.c
devmem_is_allowed.c lib: use PFN_PHYS() in devmem_is_allowed() 2021-08-13 14:09:32 -10:00
devres.c devres: remove devm_ioremap_np 2022-09-01 18:04:43 +02:00
digsig.c
dump_stack.c printk: rename cpulock functions 2022-04-22 21:30:57 +02:00
dynamic_debug.c dyndbg: fix old BUG_ON in >control parser 2024-05-17 11:56:20 +02:00
dynamic_queue_limits.c
earlycpio.c lib: move from strlcpy with unused retval to strscpy 2022-09-11 21:55:10 -07:00
errname.c parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE error codes 2023-12-08 08:51:15 +01:00
error-inject.c lib/error-inject: traverse list with mutex 2022-07-17 17:31:38 -07:00
errseq.c kernel.h: split out mathematical helpers 2020-12-15 22:46:15 -08:00
extable.c
fault-inject-usercopy.c
fault-inject.c mm: fix unexpected changes to {failslab|fail_page_alloc}.attr 2022-11-22 18:50:44 -08:00
fdt_addresses.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c of/lib: Allow scripts/dtc/libfdt to be used from kernel code 2012-07-23 13:54:52 +01:00
fdt_strerror.c
fdt_sw.c
fdt_wip.c
fdt.c
find_bit_benchmark.c treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
find_bit.c lib/find_bit: Introduce find_next_andnot_bit() 2022-10-06 05:57:36 -07:00
flex_proportions.c flex_proportions: Disable preemption entering the write section. 2022-09-19 14:35:08 +02:00
fortify_kunit.c fortify: Adjust KUnit test for modular build 2022-09-14 07:04:15 -07:00
gen_crc32table.c
gen_crc64table.c lib: add rocksoft model crc64 2022-03-07 12:48:35 -07:00
genalloc.c
generic-radix-tree.c lib/generic-radix-tree.c: Don't overflow in peek() 2023-11-28 17:06:54 +00:00
glob.c lib: remove back_str initialization 2022-04-29 14:38:01 -07:00
globtest.c
group_cpus.c genirq/affinity: Only build SMP-only helper functions on SMP kernels 2024-01-10 17:10:36 +01:00
hexdump.c
hweight.c x86/kconfig: Disable CONFIG_GENERIC_HWEIGHT and remove __HAVE_ARCH_SW_HWEIGHT 2019-05-13 11:07:33 +02:00
idr.c ida: Fix crash in ida_free when the bitmap is empty 2024-01-20 11:50:09 +01:00
inflate.c
interval_tree_test.c
interval_tree.c
iomap_copy.c
iomap.c kmsan: add iomap support 2022-10-03 14:03:21 -07:00
iommu-helper.c
iov_iter.c instrumented.h: allow instrumenting both sides of copy_from_user() 2022-10-03 14:03:18 -07:00
irq_poll.c
irq_regs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
is_signed_type_kunit.c lib: Improve the is_signed_type() kunit test 2022-09-07 16:37:27 -07:00
is_single_threaded.c
kasprintf.c
Kconfig This update includes the following changes: 2022-10-10 13:04:25 -07:00
Kconfig.debug bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition 2024-05-17 11:55:56 +02:00
Kconfig.kasan kasan: drop CONFIG_KASAN_TAGS_IDENTIFY 2022-10-03 14:02:57 -07:00
Kconfig.kcsan
Kconfig.kfence
Kconfig.kgdb parisc: Convert PDC console to an early console 2022-10-11 12:01:24 +02:00
Kconfig.kmsan kmsan: make sure PREEMPT_RT is off 2022-11-08 15:57:24 -08:00
Kconfig.ubsan
kfifo.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
klist.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 248 2019-06-19 17:09:08 +02:00
kobject_uevent.c
kobject.c kobject: Add sanity check for kset->kobj.ktype in kset_register() 2023-09-23 11:11:07 +02:00
kstrtox.c
kstrtox.h
libcrc32c.c
linear_ranges.c lib: add linear range get selector within 2021-08-13 18:37:38 +02:00
list_debug.c
list_sort.c
list-test.c
llist.c llist: use try_cmpxchg in llist_add_batch and llist_del_first 2022-09-11 21:55:06 -07:00
locking-selftest-hardirq.h
locking-selftest-mutex.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h [PATCH] lockdep: locking API self tests 2006-07-03 15:27:03 -07:00
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-rtmutex.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c lockdep/selftests: Adapt ww-tests for PREEMPT_RT 2021-12-04 10:56:24 +01:00
lockref.c lockref: stop doing cpu_relax in the cmpxchg loop 2023-02-01 08:34:34 +01:00
logic_iomem.c
logic_pio.c
lru_cache.c
lshrdi3.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 120 2019-05-24 17:39:02 +02:00
Makefile genirq/affinity: Move group_cpus_evenly() into lib/ 2024-01-10 17:10:33 +01:00
maple_tree.c maple_tree: fix mas_empty_area_rev() null pointer dereference 2024-06-16 13:41:31 +02:00
memcat_p.c lib: Fix ia64 bootloader linkage 2018-10-16 13:45:44 +02:00
memcpy_kunit.c lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg 2024-03-26 18:20:28 -04:00
memory-notifier-error-inject.c
memregion.c
memweight.c
muldi3.c
net_utils.c
netdev-notifier-error-inject.c
nlattr.c netlink: add nla be16/32 types to minlen array 2024-03-06 14:45:06 +00:00
nmi_backtrace.c
notifier-error-inject.c lib/notifier-error-inject: fix error when writing -errno to debugfs file 2022-12-31 13:31:58 +01:00
notifier-error-inject.h
objagg.c lib: objagg: Use the bitmap API when applicable 2021-12-24 14:54:29 -08:00
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c once: rename _SLOW to _SLEEPABLE 2022-10-03 17:34:32 -07:00
overflow_kunit.c overflow: Refactor test skips for Clang-specific issues 2022-10-25 14:57:42 -07:00
packing.c net: update NXP copyright text 2021-09-17 13:52:17 +01:00
parman.c
parser.c kernel.h: split out kstrtox() and simple_strtox() to a separate header 2021-07-01 11:06:05 -07:00
pci_iomap.c pci_iounmap(): Fix MMIO mapping leak 2024-04-03 15:19:25 +02:00
percpu_counter.c
percpu_test.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
percpu-refcount.c
plist.c
pm-notifier-error-inject.c
polynomial.c
radix-tree.c radix tree: remove unused variable 2023-08-30 16:11:08 +02:00
random32.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
ratelimit.c ratelimit: Fix data-races in ___ratelimit(). 2022-08-24 13:46:57 +01:00
rbtree_test.c
rbtree.c
ref_tracker.c
refcount.c
rhashtable.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
sbitmap.c sbitmap: Try each queue to wake up at least one waiter 2023-03-10 09:34:34 +01:00
scatterlist.c lib/scatterlist: use matched parameter type when calling __sg_free_table() 2022-07-17 17:31:39 -07:00
seq_buf.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
sg_pool.c lib/sg_pool: change module_init(sg_pool_init) to subsys_initcall 2022-09-23 16:46:19 +02:00
sg_split.c lib: scatterlist: Fix to support no mapped sg 2019-08-08 07:45:01 -06:00
show_mem.c mm: reduce noise in show_mem for lowmem allocations 2022-09-26 19:46:29 -07:00
siphash.c
slub_kunit.c mm/slub, kunit: Use inverted data to corrupt kmem cache 2024-06-12 11:03:04 +02:00
smp_processor_id.c
sort.c
stackdepot.c stackdepot: respect __GFP_NOLOCKDEP allocation flag 2024-05-02 16:29:29 +02:00
stackinit_kunit.c lib: stackinit: update reference to kunit-tool 2022-09-30 13:21:22 -06:00
stmp_device.c
string_helpers.c lib/string_helpers: Introduce parse_int_array_user() 2022-09-05 14:51:46 +01:00
string.c kmsan: disable strscpy() optimization under KMSAN 2022-10-03 14:03:22 -07:00
strncpy_from_user.c lib/strn*,objtool: Enforce user_access_begin() rules 2022-04-19 21:58:47 +02:00
strnlen_user.c
syscall.c
test_bitmap.c lib/bitmap: workaround const_eval test build failure 2023-08-11 12:08:10 +02:00
test_bitops.c
test_bits.c
test_blackhole_dev.c net: blackhole_dev: fix build warning for ethh set but not used 2024-03-26 18:20:33 -04:00
test_bpf.c
test_debug_virtual.c
test_dynamic_debug.c dyndbg: test DECLARE_DYNDBG_CLASSMAP, sysfs nodes 2022-09-07 17:04:49 +02:00
test_firmware.c test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation 2023-08-03 10:24:19 +02:00
test_fprobe.c fprobe: Pass entry_data to handlers 2023-10-25 12:03:12 +02:00
test_fpu.c selftests/fpu: Fix debugfs_simple_attr.cocci warning 2021-01-18 11:03:26 +01:00
test_free_pages.c
test_hash.c test_hash.c: refactor into kunit 2022-01-20 08:52:54 +02:00
test_hexdump.c treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
test_hmm_uapi.h hmm-tests: add test for migrate_device_range() 2022-10-12 18:51:50 -07:00
test_hmm.c lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure 2024-06-12 11:03:29 +02:00
test_ida.c ida: Fix crash in ida_free when the bitmap is empty 2024-01-20 11:50:09 +01:00
test_kmod.c
test_kprobes.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
test_linear_ranges.c lib/test_linear_ranges: add a test for the 'linear_ranges' 2020-05-08 18:18:12 +01:00
test_list_sort.c treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
test_lockup.c
test_maple_tree.c maple_tree: add GFP_KERNEL to allocations in mas_expected_entries() 2023-11-02 09:35:24 +01:00
test_memcat_p.c
test_meminit.c lib/test_meminit: fix off-by-one error in test_pages() 2023-10-15 18:32:41 +02:00
test_min_heap.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
test_module.c
test_objagg.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
test_parman.c lib: fix spelling mistake: "actualy" -> "actually" 2017-02-26 11:03:38 -05:00
test_printf.c
test_ref_tracker.c
test_rhashtable.c rhashtable: make test actually random 2022-10-26 13:39:09 +01:00
test_scanf.c lib: test_scanf: Add explicit type cast to result initialization in test_number_prefix() 2023-09-19 12:28:05 +02:00
test_siphash.c
test_sort.c lib/test: convert test_sort.c to use KUnit 2021-09-08 11:50:26 -07:00
test_static_key_base.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282 2019-06-05 17:36:37 +02:00
test_static_keys.c
test_string.c
test_strscpy.c
test_sysctl.c
test_ubsan.c
test_user_copy.c usercopy: Avoid soft lockups in test_check_nonzero_user() 2019-10-16 14:56:21 +02:00
test_uuid.c
test_vmalloc.c treewide: use get_random_{u8,u16}() when possible, part 2 2022-10-11 17:42:58 -06:00
test_xarray.c XArray: Fix xas_create_range() when multi-order entry present 2022-03-28 19:25:11 -04:00
test-kstrtox.c kstrto*: accept "-0" for signed conversion 2015-09-10 13:29:01 -07:00
test-string_helpers.c treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
textsearch.c
timerqueue.c
trace_readwrite.c
ts_bm.c lib/ts_bm: reset initial match offset for every block of text 2023-07-19 16:21:13 +02:00
ts_fsm.c
ts_kmp.c
ubsan.c panic: Consolidate open-coded panic_on_warn checks 2023-01-24 07:24:41 +01:00
ubsan.h ubsan: implement __ubsan_handle_alignment_assumption 2021-02-05 11:03:47 -08:00
ucmpdi2.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 120 2019-05-24 17:39:02 +02:00
ucs2_string.c lib/ucs2_string.c: add MODULE_LICENSE() 2018-06-07 17:34:39 -07:00
usercopy.c uaccess: Add speculation barrier to copy_from_user() 2023-02-25 11:25:41 +01:00
uuid.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
vsprintf.c lib/vsprintf: Fix %pfwf when current node refcount == 0 2024-01-01 12:39:07 +00:00
win_minmax.c
xarray.c XArray: Do not return sibling entries from xa_load() 2023-09-13 09:43:00 +02:00
xxhash.c lib/: replace HTTP links with HTTPS ones 2020-08-12 10:58:00 -07:00