[PATCH 1/3] lib/maple_tree: fix potential NULL dereference in mas_pop_node()

[Josh Law]

If kmem_cache_alloc_from_sheaf() returns NULL (possible under
GFP_NOWAIT pressure), mas_pop_node() falls through to the out label
and dereferences the NULL pointer in memset(ret, 0, sizeof(*ret)).

Add a WARN_ON_ONCE NULL check after the sheaf allocation to bail out
early, matching the existing pattern for the !mas->sheaf case above.

Signed-off-by: Josh Law <objecting at objecting.org>
---
 lib/maple_tree.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index 739918e859e5..87a2ba6468ca 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -1063,6 +1063,8 @@ static __always_inline struct maple_node *mas_pop_node(struct ma_state *mas)
 		return NULL;
 
 	ret = kmem_cache_alloc_from_sheaf(maple_node_cache, GFP_NOWAIT, mas->sheaf);
+	if (WARN_ON_ONCE(!ret))
+		return NULL;
 
 out:
 	memset(ret, 0, sizeof(*ret));
-- 
2.34.1