userfaultfd: release page in error path to avoid BUG_ON

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: release page in error path to avoid BUG_ON

Consider the following sequence of events:

1. Userspace issues a UFFD ioctl, which ends up calling into

shmem_mfill_atomic_pte(). We successfully account the blocks, we

shmem_alloc_page(), but then the copy_from_user() fails. We return

-ENOENT. We don't release the page we allocated.

2. Our caller detects this error code, tries the copy_from_user() after

dropping the mmap_lock, and retries, calling back into

shmem_mfill_atomic_pte().

3. Meanwhile, let's say another process filled up the tmpfs being used.

4. So shmem_mfill_atomic_pte() fails to account blocks this time, and

immediately returns - without releasing the page.

This triggers a BUG_ON in our caller, which asserts that the page

should always be consumed, unless -ENOENT is returned.

To fix this, detect if we have such a "dangling" page when accounting

fails, and if so, release it before returning.