linux-kernel - [PATCH Fix 1/2] maple_tree: Fix expanding null off the end of the data.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20220511144304.1430851-2-Liam.Howlett@oracle.com>
Date:   Wed, 11 May 2022 14:43:14 +0000
From:   Liam Howlett <liam.howlett@...cle.com>
To:     "maple-tree@...ts.infradead.org" <maple-tree@...ts.infradead.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: [PATCH Fix 1/2] maple_tree: Fix expanding null off the end of the
 data.

When expanding a write of null to another null, the metadata for the end
of the node may be off by one.  Fix this issue by setting the write end
pivot (wr_mas->end_piv) in mas_wr_extend_null().  Also use the saved
value for the end pivot during node stores instead of looking up the
same entry again.

There is also unnecessary code in mas_wr_extend_null() that can be
dropped.

Signed-off-by: Liam R. Howlett <Liam.Howlett@...cle.com>
---
 lib/maple_tree.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index c7b7a10b15d5..967631055210 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -3981,8 +3981,7 @@ static inline bool mas_wr_node_store(struct ma_wr_state *wr_mas)
 
 		new_end++;
 	} else {
-		if (mas_safe_pivot(mas, wr_mas->pivots, wr_mas->offset_end,
-				   wr_mas->type) == mas->last)
+		if (wr_mas->end_piv == mas->last)
 			wr_mas->offset_end++;
 
 		new_end -= wr_mas->offset_end - offset - 1;
@@ -4146,10 +4145,7 @@ static inline void mas_wr_extend_null(struct ma_wr_state *wr_mas)
 			mas->last = mas->max;
 		else
 			mas->last = wr_mas->pivots[wr_mas->offset_end];
-	} else if ((mas->last > wr_mas->end_piv) &&
-		   !wr_mas->slots[wr_mas->offset_end]) {
-		mas->last = wr_mas->end_piv;
-		wr_mas->offset_end++;
+		wr_mas->end_piv = mas->last;
 	}
 
 	if (!wr_mas->content) {
-- 
2.35.1