Subject: CVE-2024-36891: maple_tree: fix mas_empty_area_rev() null pointer dereference

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

maple_tree: fix mas_empty_area_rev() null pointer dereference

Currently the code calls mas_start() followed by mas_data_end() if the
maple state is MA_START, but mas_start() may return with the maple state
node == NULL.  This will lead to a null pointer dereference when checking
information in the NULL node, which is done in mas_data_end().

Avoid setting the offset if there is no node by waiting until after the
maple state is checked for an empty or single entry state.

A user could trigger the events to cause a kernel oops by unmapping all
vmas to produce an empty maple tree, then mapping a vma that would cause
the scenario described above.

The Linux kernel CVE team has assigned CVE-2024-36891 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.1 with commit 54a611b60590 and fixed in 6.1.94 with commit 883e5d542bbd
	Issue introduced in 6.1 with commit 54a611b60590 and fixed in 6.6.31 with commit 6c9c7c1e63b1
	Issue introduced in 6.1 with commit 54a611b60590 and fixed in 6.8.10 with commit f3956791cf52
	Issue introduced in 6.1 with commit 54a611b60590 and fixed in 6.9 with commit 955a923d2809

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-36891
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	lib/maple_tree.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/883e5d542bbdddbddeba60250cb482baf3ae2415
	https://git.kernel.org/stable/c/6c9c7c1e63b198a8b979ad963eb21410f10ccb00
	https://git.kernel.org/stable/c/f3956791cf526540addd3295e4c1e0f0442486cc
	https://git.kernel.org/stable/c/955a923d2809803980ff574270f81510112be9cf