From ae1d4ccf029813108f4e194c107a66470804e5db Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Thu, 21 Nov 2024 10:11:24 -0800
Subject: [PATCH] mm: validate vseg before using it

Reported-by: syzbot+da9595a72d0762aaa48d@syzkaller.appspotmail.com
PiperOrigin-RevId: 698826152
---
 pkg/sentry/mm/syscalls.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkg/sentry/mm/syscalls.go b/pkg/sentry/mm/syscalls.go
index 3a23c2d0b..ed30b1b69 100644
--- a/pkg/sentry/mm/syscalls.go
+++ b/pkg/sentry/mm/syscalls.go
@@ -1270,6 +1270,7 @@ func (mm *MemoryManager) madviseMutateVMAs(addr hostarch.Addr, length uint64, f
 			return err
 		}
 		if ar.End <= vseg.End() {
+			mm.vmas.MergeNext(vseg)
 			break
 		}
 		vgap := vseg.NextGap()
@@ -1277,8 +1278,11 @@ func (mm *MemoryManager) madviseMutateVMAs(addr hostarch.Addr, length uint64, f
 			hadvgap = true
 		}
 		vseg = vgap.NextSegment()
+		if !vseg.Ok() {
+			// No VMA reaching to the end of ar.
+			return linuxerr.ENOMEM
+		}
 	}
-	mm.vmas.MergePrev(vseg)
 	if hadvgap {
 		return linuxerr.ENOMEM
 	}