linux-kernel - [PATCH] maple_tree: Fix out of bounds access on mas_wr_node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20220713021256.542856-1-Liam.Howlett@oracle.com>
Date:   Wed, 13 Jul 2022 02:13:12 +0000
From:   Liam Howlett <liam.howlett@...cle.com>
To:     "maple-tree@...ts.infradead.org" <maple-tree@...ts.infradead.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>
CC:     Yu Zhao <yuzhao@...gle.com>
Subject: [PATCH] maple_tree: Fix out of bounds access on mas_wr_node_walk()

When walking the node, check to see if offset is within the range of
pivots before reading that pivot, otherwise return the max of the node.

Reported-by: Yu Zhao <yuzhao@...gle.com>
Fixes: d0aac5e48048 (Maple Tree: add new data structure)
Signed-off-by: Liam R. Howlett <Liam.Howlett@...cle.com>
---
 lib/maple_tree.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index 14e9ab14c1da..768707770926 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -2254,10 +2254,10 @@ static inline void mas_wr_node_walk(struct ma_wr_state *wr_mas)
 					       wr_mas->pivots, mas->max);
 	offset = mas->offset;
 	min = mas_safe_min(mas, wr_mas->pivots, offset);
-	max = wr_mas->pivots[offset];
 	if (unlikely(offset == count))
-		goto max; /* may have been set to zero */
+		goto max;
 
+	max = wr_mas->pivots[offset];
 	index = mas->index;
 	if (unlikely(index <= max))
 		goto done;
-- 
2.35.1