lkml.org 
[lkml]   [2024]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [syzbot] [mm?] KASAN: slab-use-after-free Read in hugetlb_fault
Date
On Wed, 17 Apr 2024 15:30:26 -0700
> syzbot found the following issue on:
>
> HEAD commit: 9ed46da14b9b Add linux-next specific files for 20240412
> git tree: linux-next
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f89857180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 9ed46da14b9b

--- x/mm/hugetlb.c
+++ y/mm/hugetlb.c
@@ -6251,6 +6251,12 @@ static vm_fault_t hugetlb_no_page(struct
VM_UFFD_MISSING);
}

+ if (!(vma->vm_flags & VM_MAYSHARE)) {
+ ret = vmf_anon_prepare(vmf);
+ if (unlikely(ret))
+ goto out;
+ }
+
folio = alloc_hugetlb_folio(vma, vmf->address, 0);
if (IS_ERR(folio)) {
/*
@@ -6290,15 +6296,12 @@ static vm_fault_t hugetlb_no_page(struct
restore_reserve_on_error(h, vma, vmf->address,
folio);
folio_put(folio);
+ ret = VM_FAULT_SIGBUS;
goto out;
}
new_pagecache_folio = true;
} else {
folio_lock(folio);
-
- ret = vmf_anon_prepare(vmf);
- if (unlikely(ret))
- goto backout_unlocked;
anon_rmap = 1;
}
} else {
--
\
 
 \ /
  Last update: 2024-04-18 01:13    [W:0.043 / U:0.264 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site