Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [mm?] KASAN: slab-use-after-free Read in hugetlb_fault | Date | Thu, 18 Apr 2024 18:49:52 +0800 |
| |
On Wed, 17 Apr 2024 15:30:26 -0700 > syzbot found the following issue on: > > HEAD commit: 9ed46da14b9b Add linux-next specific files for 20240412 > git tree: linux-next > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f89857180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 9ed46da14b9b
--- x/mm/hugetlb.c +++ y/mm/hugetlb.c @@ -6251,6 +6251,12 @@ static vm_fault_t hugetlb_no_page(struct VM_UFFD_MISSING); } + if (!(vma->vm_flags & VM_MAYSHARE)) { + ret = vmf_anon_prepare(vmf); + if (unlikely(ret)) + goto out; + } + folio = alloc_hugetlb_folio(vma, vmf->address, 0); if (IS_ERR(folio)) { /* @@ -6290,15 +6296,12 @@ static vm_fault_t hugetlb_no_page(struct restore_reserve_on_error(h, vma, vmf->address, folio); folio_put(folio); + ret = VM_FAULT_SIGBUS; goto out; } new_pagecache_folio = true; } else { folio_lock(folio); - - ret = vmf_anon_prepare(vmf); - if (unlikely(ret)) - goto backout_unlocked; anon_rmap = 1; } } else { --- x/kernel/softirq.c +++ y/kernel/softirq.c @@ -564,7 +564,7 @@ restart: } if (!IS_ENABLED(CONFIG_PREEMPT_RT) && - __this_cpu_read(ksoftirqd) == current) + __this_cpu_read(ksoftirqd) == current && in_task()) rcu_softirq_qs(); local_irq_disable(); --
| |