Re: 5.9-rc7 null ptr deref in __i915_gem_userptr_get_pages_worker

From: Jason A. Donenfeld
Date: Mon Sep 28 2020 - 06:18:14 EST


Alright, the failing code seems to be in mm:

if (flags & FOLL_PIN)
atomic_set(&current->mm->has_pinned, 1);

Apparently you can't rely on current->mm being valid in this context;
it's null here, hence the +0x64 for has_pinned's offset.

This was added by 008cfe4418b3 ("mm: Introduce mm_struct.has_pinned"),
which is new for rc7 indeed.

The crash goes away when changing that to:

if ((flags & FOLL_PIN) && current->mm)
atomic_set(&current->mm->has_pinned, 1);

But I haven't really evaluated whether or not that's racy or if I need
to take locks to do such a thing.