Re: [syzbot] [mm?] general protection fault in find_lock_task_mm

[Hillf Danton <hdanton@sina.com>]

On Mon, 16 Dec 2024 11:16:28 -0800
> syzbot found the following issue on:
> 
> HEAD commit:    231825b2e1ff Revert "unicode: Don't special case ignorable..
> git tree:       upstream
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=102844f8580000

#syz test

--- x/mm/oom_kill.c
+++ y/mm/oom_kill.c
@@ -137,7 +137,10 @@ struct task_struct *find_lock_task_mm(st
 	rcu_read_lock();
 
 	for_each_thread(p, t) {
+		if (!tryget_task_struct(t))
+			continue;
 		task_lock(t);
+		put_task_struct(t);
 		if (likely(t->mm))
 			goto found;
 		task_unlock(t);
--- x/include/net/neighbour.h
+++ y/include/net/neighbour.h
@@ -302,8 +302,11 @@ static inline struct neighbour *___neigh
 	struct neigh_hash_table *nht = rcu_dereference(tbl->nht);
 	struct neighbour *n;
 	u32 hash_val;
+	u32 shift = 32 - nht->hash_shift;
 
-	hash_val = hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
+	if (shift > 31)
+		shift = 31;
+	hash_val = hash(pkey, dev, nht->hash_rnd) >> shift;
 	neigh_for_each_in_bucket_rcu(n, &nht->hash_heads[hash_val])
 		if (n->dev == dev && key_eq(n, pkey))
 			return n;
--