• Jason A. Donenfeld's avatar
    mm: do not rely on mm == current->mm in __get_user_pages_locked · a4d63c37
    Jason A. Donenfeld authored
    It seems likely this block was pasted from internal_get_user_pages_fast,
    which is not passed an mm struct and therefore uses current's.  But
    __get_user_pages_locked is passed an explicit mm, and current->mm is not
    always valid. This was hit when being called from i915, which uses:
    
      pin_user_pages_remote->
        __get_user_pages_remote->
          __gup_longterm_locked->
            __get_user_pages_locked
    
    Before, this would lead to an OOPS:
    
      BUG: kernel NULL pointer dereference, address: 0000000000000064
      #PF: supervisor write access in kernel mode
      #PF: error_code(0x0002) - not-present page
      CPU: 10 PID: 1431 Comm: kworker/u33:1 Tainted: P S   U     O      5.9.0-rc7+ #140
      Hardware name: LENOVO 20QTCTO1WW/20QTCTO1WW, BIOS N2OET47W (1.34 ) 08/06/2020
      Workqueue: i915-userptr-acquire __i915_gem_userptr_get_pages_worker [i915]
      RIP: 0010:__get_user_pages_remote+0xd7/0x310
      Call Trace:
       __i915_gem_userptr_get_pages_worker+0xc8/0x260 [i915]
       process_one_work+0x1ca/0x390
       worker_thread+0x48/0x3c0
       kthread+0x114/0x130
       ret_from_fork+0x1f/0x30
      CR2: 0000000000000064
    
    This commit fixes the problem by using the mm pointer passed to the
    function rather than the bogus one in current.
    
    Fixes: 008cfe44 ("mm: Introduce mm_struct.has_pinned")
    Tested-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
    Reported-by: default avatarHarald Arnesen <harald@skogtun.org>
    Reviewed-by: default avatarJason Gunthorpe <jgg@nvidia.com>
    Reviewed-by: default avatarPeter Xu <peterx@redhat.com>
    Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    a4d63c37
gup.c 84 KB