linux-kernel - [PATCH Fix 1/2] maple_tree: Fix mas_spanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220629152340.3451959-2-Liam.Howlett@oracle.com>
Date:   Wed, 29 Jun 2022 15:23:50 +0000
From:   Liam Howlett <liam.howlett@...cle.com>
To:     "maple-tree@...ts.infradead.org" <maple-tree@...ts.infradead.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>
CC:     Yu Zhao <yuzhao@...gle.com>
Subject: [PATCH Fix 1/2] maple_tree: Fix mas_spanning_rebalance() corner case

When a node is insufficient during a spanning rebalance loop and
mast_spanning_rebalance() is called to combine neighbouring nodes, the
loop should not terminate regardless of if neighbours exist or not.
This will allow the data to be stored in the correct node.

Reported-by: Yu Zhao <yuzhao@...gle.com>
Fixes: 37a4d714b7d9 (maple_tree: fix underflow in mas_spanning_rebalance())
Signed-off-by: Liam R. Howlett <Liam.Howlett@...cle.com>
---
 lib/maple_tree.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index d8457122ca5d..2cccd8f2153f 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -3029,8 +3029,7 @@ static int mas_spanning_rebalance(struct ma_state *mas,
 		if (mas_is_root_limits(mast->orig_l))
 			break;
 
-		if (!mast_spanning_rebalance(mast))
-			break;
+		mast_spanning_rebalance(mast);
 
 		/* rebalancing from other nodes may require another loop. */
 		if (!count)
@@ -6521,6 +6520,7 @@ static inline void *mas_first_entry(struct ma_state *mas, struct maple_node *mn,
 	max = mas->max;
 	mas->offset = 0;
 	while (likely(!ma_is_leaf(mt))) {
+		MT_BUG_ON(mas->tree, mte_dead_node(mas->node));
 		slots = ma_slots(mn, mt);
 		pivots = ma_pivots(mn, mt);
 		max = pivots[0];
@@ -6531,6 +6531,7 @@ static inline void *mas_first_entry(struct ma_state *mas, struct maple_node *mn,
 		mn = mas_mn(mas);
 		mt = mte_node_type(mas->node);
 	}
+	MT_BUG_ON(mas->tree, mte_dead_node(mas->node));
 
 	mas->max = max;
 	slots = ma_slots(mn, mt);
-- 
2.35.1