diff options
| author | Peng Zhang <[email protected]> | 2023-04-11 04:10:04 +0000 |
|---|---|---|
| committer | Andrew Morton <[email protected]> | 2023-04-16 17:41:26 +0000 |
| commit | 1f5f12ece722aacea1769fb644f27790ede339dc (patch) | |
| tree | 8ed92d450eaa56a0a8d362efdfe1c0606a0b352a /fs | |
| parent | tools/mm/page_owner_sort.c: fix TGID output when cull=tg is used (diff) | |
| download | kernel-1f5f12ece722aacea1769fb644f27790ede339dc.tar.gz kernel-1f5f12ece722aacea1769fb644f27790ede339dc.zip | |
maple_tree: fix a potential memory leak, OOB access, or other unpredictable bug
In mas_alloc_nodes(), "node->node_count = 0" means to initialize the
node_count field of the new node, but the node may not be a new node. It
may be a node that existed before and node_count has a value, setting it
to 0 will cause a memory leak. At this time, mas->alloc->total will be
greater than the actual number of nodes in the linked list, which may
cause many other errors. For example, out-of-bounds access in
mas_pop_node(), and mas_pop_node() may return addresses that should not be
used. Fix it by initializing node_count only for new nodes.
Also, by the way, an if-else statement was removed to simplify the code.
Link: https://lkml.kernel.org/r/[email protected]
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Peng Zhang <[email protected]>
Reviewed-by: Liam R. Howlett <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Diffstat (limited to 'fs')
0 files changed, 0 insertions, 0 deletions
