linux-kernel - Re: [PATCH] maple_tree: Fix mas_next() when already on the last node entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <yt9dee0s41gd.fsf@linux.ibm.com>
Date:   Tue, 17 May 2022 17:34:58 +0200
From:   Sven Schnelle <svens@...ux.ibm.com>
To:     Liam Howlett <liam.howlett@...cle.com>
Cc:     "maple-tree@...ts.infradead.org" <maple-tree@...ts.infradead.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] maple_tree: Fix mas_next() when already on the last
 node entry

Liam Howlett <liam.howlett@...cle.com> writes:

> It is possible to return the metadata as the next entry if the last node
> entry is already in the maple state and the limit is not reached.  Check
> for this condition in mas_next_nentry() where the node end is returned.
>
> Signed-off-by: Liam R. Howlett <Liam.Howlett@...cle.com>

Thanks, that matches my observation from the initial report that we're
returing metadata. I just applied the patch to next-20220516 and i'm no
longer able to trigger the crash. So feel free to add my:

Tested-by: Sven Schnelle <svens@...ux.ibm.com>

However, as Heiko already wrote in another mail i would also like to
request that the maple tree code isn't merged with the next merge
window. These patches touch a lot of critical infrastructure, and i would like
to have it in next for at least one development cycle, so we can be sure
that we've seen and fixed most of the issues.

Thanks,
Sven
> ---
>  lib/maple_tree.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/lib/maple_tree.c b/lib/maple_tree.c
> index 967631055210..751aafd01c42 100644
> --- a/lib/maple_tree.c
> +++ b/lib/maple_tree.c
> @@ -4547,6 +4547,9 @@ static inline void *mas_next_nentry(struct ma_state *mas,
>  		return NULL;
>  
>  	count = ma_data_end(node, type, pivots, mas->max);
> +	if (mas->offset > count)
> +		return NULL;
> +
>  	while (mas->offset < count) {
>  		pivot = pivots[mas->offset];
>  		entry = mas_slot(mas, slots, mas->offset);