Messages in this thread | | | From | "Jason A. Donenfeld" <> | Date | Mon, 28 Sep 2020 12:17:58 +0200 | Subject | Re: 5.9-rc7 null ptr deref in __i915_gem_userptr_get_pages_worker |
| |
Alright, the failing code seems to be in mm:
if (flags & FOLL_PIN) atomic_set(¤t->mm->has_pinned, 1);
Apparently you can't rely on current->mm being valid in this context; it's null here, hence the +0x64 for has_pinned's offset.
This was added by 008cfe4418b3 ("mm: Introduce mm_struct.has_pinned"), which is new for rc7 indeed.
The crash goes away when changing that to:
if ((flags & FOLL_PIN) && current->mm) atomic_set(¤t->mm->has_pinned, 1);
But I haven't really evaluated whether or not that's racy or if I need to take locks to do such a thing.
| |