mas_pop_node() may return NULL when memory allocation fails or when mas->sheaf is invalid. Several callers of mas_pop_node() did not check the return value and directly dereferenced the pointer, which could lead to a NULL pointer dereference and kernel crash. Fixes: 54a611b60590 ("maple_tree: add mas_pop_node() helper") Signed-off-by: Huiwen He --- lib/maple_tree.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/maple_tree.c b/lib/maple_tree.c index 39bb779cb311..524e1cfb4439 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -3085,6 +3085,9 @@ static inline void mas_root_expand(struct ma_state *mas, void *entry) int slot = 0; node = mas_pop_node(mas); + if (unlikely(!node)) + return; + pivots = ma_pivots(node, type); slots = ma_slots(node, type); node->parent = ma_parent_ptr(mas_tree_parent(mas)); @@ -3367,6 +3370,9 @@ static inline void mas_new_root(struct ma_state *mas, void *entry) } node = mas_pop_node(mas); + if (unlikely(!node)) + return; + pivots = ma_pivots(node, type); slots = ma_slots(node, type); node->parent = ma_parent_ptr(mas_tree_parent(mas)); @@ -3506,6 +3512,9 @@ static inline void mas_wr_node_store(struct ma_wr_state *wr_mas, newnode = &reuse; } + if (unlikely(!newnode)) + return; + newnode->parent = mas_mn(mas)->parent; dst_pivots = ma_pivots(newnode, wr_mas->type); dst_slots = ma_slots(newnode, wr_mas->type); -- 2.43.0