6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam R. Howlett Liam.Howlett@oracle.com
commit fba46a5d83ca8decb338722fb4899026d8d9ead2 upstream.
Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_STATE_PREALLOC flag is set. This flag is meant to avoid re-allocating in bulk allocation mode, and to detect issues with preallocation calculations.
The MA_STATE_PREALLOC flag should also always be set on zero allocations so that detection of underflow allocations will print a WARN_ON() during consumption.
User visible effect of this flaw is a WARN_ON() followed by a null pointer dereference when subsequent requests for larger number of nodes is ignored, such as the vma merge retry in mmap_region() caused by drivers altering the vma flags (which happens in v6.6, at least)
Link: https://lkml.kernel.org/r/20250616184521.3382795-3-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Liam.Howlett@oracle.com Reported-by: Zhaoyang Huang zhaoyang.huang@unisoc.com Reported-by: Hailong Liu hailong.liu@oppo.com Link: https://lore.kernel.org/all/1652f7eb-a51b-4fee-8058-c73af63bacd1@oppo.com/ Link: https://lore.kernel.org/all/20250428184058.1416274-1-Liam.Howlett@oracle.com... Link: https://lore.kernel.org/all/20250429014754.1479118-1-Liam.Howlett@oracle.com... Cc: Lorenzo Stoakes lorenzo.stoakes@oracle.com Cc: Suren Baghdasaryan surenb@google.com Cc: Hailong Liu hailong.liu@oppo.com Cc: zhangpeng.00@bytedance.com zhangpeng.00@bytedance.com Cc: Steve Kang Steve.Kang@unisoc.com Cc: Matthew Wilcox willy@infradead.org Cc: Sidhartha Kumar sidhartha.kumar@oracle.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Liam R. Howlett Liam.Howlett@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- lib/maple_tree.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
--- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -5802,10 +5802,12 @@ int mas_preallocate(struct ma_state *mas { int ret;
+ mas->mas_flags &= ~MA_STATE_PREALLOC; mas_node_count_gfp(mas, 1 + mas_mt_height(mas) * 3, gfp); - mas->mas_flags |= MA_STATE_PREALLOC; - if (likely(!mas_is_err(mas))) + if (likely(!mas_is_err(mas))) { + mas->mas_flags |= MA_STATE_PREALLOC; return 0; + }
mas_set_alloc_req(mas, 0); ret = xa_err(mas->node);