Re: [syzbot] [mm?] KASAN: slab-use-after-free Read in hugetlb_fault

[Hillf Danton]

On Wed, 17 Apr 2024 15:30:26 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    9ed46da14b9b Add linux-next specific files for 20240412
> git tree:       linux-next
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16f89857180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git  9ed46da14b9b

--- x/mm/hugetlb.c
+++ y/mm/hugetlb.c
@@ -6251,6 +6251,12 @@ static vm_fault_t hugetlb_no_page(struct
 							VM_UFFD_MISSING);
 		}
 
+		if (!(vma->vm_flags & VM_MAYSHARE)) {
+			ret = vmf_anon_prepare(vmf);
+			if (unlikely(ret))
+				goto out;
+		}
+
 		folio = alloc_hugetlb_folio(vma, vmf->address, 0);
 		if (IS_ERR(folio)) {
 			/*
@@ -6290,15 +6296,12 @@ static vm_fault_t hugetlb_no_page(struct
 				restore_reserve_on_error(h, vma, vmf->address,
 							folio);
 				folio_put(folio);
+				ret = VM_FAULT_SIGBUS;
 				goto out;
 			}
 			new_pagecache_folio = true;
 		} else {
 			folio_lock(folio);
-
-			ret = vmf_anon_prepare(vmf);
-			if (unlikely(ret))
-				goto backout_unlocked;
 			anon_rmap = 1;
 		}
 	} else {
--- x/kernel/softirq.c
+++ y/kernel/softirq.c
@@ -564,7 +564,7 @@ restart:
 	}
 
 	if (!IS_ENABLED(CONFIG_PREEMPT_RT) &&
-	    __this_cpu_read(ksoftirqd) == current)
+	    __this_cpu_read(ksoftirqd) == current && in_task())
 		rcu_softirq_qs();
 
 	local_irq_disable();
--