Re: [syzbot] [mm?] KASAN: slab-use-after-free Read in hugetlb_fault

From: Hillf Danton
Date: Thu Apr 18 2024 - 06:50:15 EST


On Wed, 17 Apr 2024 15:30:26 -0700
> syzbot found the following issue on:
>
> HEAD commit: 9ed46da14b9b Add linux-next specific files for 20240412
> git tree: linux-next
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f89857180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 9ed46da14b9b

--- x/mm/hugetlb.c
+++ y/mm/hugetlb.c
@@ -6251,6 +6251,12 @@ static vm_fault_t hugetlb_no_page(struct
VM_UFFD_MISSING);
}

+ if (!(vma->vm_flags & VM_MAYSHARE)) {
+ ret = vmf_anon_prepare(vmf);
+ if (unlikely(ret))
+ goto out;
+ }
+
folio = alloc_hugetlb_folio(vma, vmf->address, 0);
if (IS_ERR(folio)) {
/*
@@ -6290,15 +6296,12 @@ static vm_fault_t hugetlb_no_page(struct
restore_reserve_on_error(h, vma, vmf->address,
folio);
folio_put(folio);
+ ret = VM_FAULT_SIGBUS;
goto out;
}
new_pagecache_folio = true;
} else {
folio_lock(folio);
-
- ret = vmf_anon_prepare(vmf);
- if (unlikely(ret))
- goto backout_unlocked;
anon_rmap = 1;
}
} else {
--- x/kernel/softirq.c
+++ y/kernel/softirq.c
@@ -564,7 +564,7 @@ restart:
}

if (!IS_ENABLED(CONFIG_PREEMPT_RT) &&
- __this_cpu_read(ksoftirqd) == current)
+ __this_cpu_read(ksoftirqd) == current && in_task())
rcu_softirq_qs();

local_irq_disable();
--