In __damon_va_three_regions(), the VMA tree is traversed without
checking if the address space is stable. If the OOM reaper runs
concurrently, it may mark the mm as MMF_UNSTABLE and leave empty
markers in the maple tree.
Add a check_stable_address_space(mm) call before iterating over
the VMAs to avoid potential NULL pointer dereferences.

Signed-off-by: Igor Putko <igorpetindev@gmail.com>
---
 mm/damon/vaddr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
index 345b89b5d..e756ac147 100644
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -11,6 +11,7 @@
 #include <linux/hugetlb.h>
 #include <linux/mman.h>
 #include <linux/mmu_notifier.h>
+#include <linux/oom.h>
 #include <linux/page_idle.h>
 #include <linux/pagewalk.h>
 #include <linux/sched/mm.h>
@@ -84,6 +85,9 @@ static int __damon_va_three_regions(struct mm_struct *mm,
 	 * If this is too slow, it can be optimised to examine the maple
 	 * tree gaps.
 	 */
+	if (!check_stable_address_space(mm))
+		return -EINVAL;
+
 	for_each_vma(vmi, vma) {
 		unsigned long gap;
 
-- 
2.47.3