# git rev-parse -q --verify a4d63c3732f1a0c91abcf5b7f32b4ef7dcd82025^{commit} a4d63c3732f1a0c91abcf5b7f32b4ef7dcd82025 already have revision, skipping fetch # git checkout -q -f -B kisskb a4d63c3732f1a0c91abcf5b7f32b4ef7dcd82025 # git clean -qxdf # < git log -1 # commit a4d63c3732f1a0c91abcf5b7f32b4ef7dcd82025 # Author: Jason A. Donenfeld # Date: Mon Sep 28 12:35:07 2020 +0200 # # mm: do not rely on mm == current->mm in __get_user_pages_locked # # It seems likely this block was pasted from internal_get_user_pages_fast, # which is not passed an mm struct and therefore uses current's. But # __get_user_pages_locked is passed an explicit mm, and current->mm is not # always valid. This was hit when being called from i915, which uses: # # pin_user_pages_remote-> # __get_user_pages_remote-> # __gup_longterm_locked-> # __get_user_pages_locked # # Before, this would lead to an OOPS: # # BUG: kernel NULL pointer dereference, address: 0000000000000064 # #PF: supervisor write access in kernel mode # #PF: error_code(0x0002) - not-present page # CPU: 10 PID: 1431 Comm: kworker/u33:1 Tainted: P S U O 5.9.0-rc7+ #140 # Hardware name: LENOVO 20QTCTO1WW/20QTCTO1WW, BIOS N2OET47W (1.34 ) 08/06/2020 # Workqueue: i915-userptr-acquire __i915_gem_userptr_get_pages_worker [i915] # RIP: 0010:__get_user_pages_remote+0xd7/0x310 # Call Trace: # __i915_gem_userptr_get_pages_worker+0xc8/0x260 [i915] # process_one_work+0x1ca/0x390 # worker_thread+0x48/0x3c0 # kthread+0x114/0x130 # ret_from_fork+0x1f/0x30 # CR2: 0000000000000064 # # This commit fixes the problem by using the mm pointer passed to the # function rather than the bogus one in current. # # Fixes: 008cfe4418b3 ("mm: Introduce mm_struct.has_pinned") # Tested-by: Chris Wilson # Reported-by: Harald Arnesen # Reviewed-by: Jason Gunthorpe # Reviewed-by: Peter Xu # Signed-off-by: Jason A. Donenfeld # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux-ld --version # < git log --format=%s --max-count=1 a4d63c3732f1a0c91abcf5b7f32b4ef7dcd82025 # < make -s -j 48 ARCH=m68k O=/kisskb/build/linus_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- defconfig # < make -s -j 48 ARCH=m68k O=/kisskb/build/linus_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- help # make -s -j 48 ARCH=m68k O=/kisskb/build/linus_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- olddefconfig # make -s -j 48 ARCH=m68k O=/kisskb/build/linus_m68k-defconfig_m68k-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/m68k-linux/bin/m68k-linux- /kisskb/src/arch/m68k/mvme16x/config.c: In function 'mvme16x_hwclk': /kisskb/src/arch/m68k/mvme16x/config.c:439:2: warning: #warning check me! [-Wcpp] #warning check me! ^~~~~~~ /kisskb/src/arch/m68k/mvme147/config.c: In function 'mvme147_hwclk': /kisskb/src/arch/m68k/mvme147/config.c:174:2: warning: #warning check me! [-Wcpp] #warning check me! ^~~~~~~ In file included from /kisskb/src/drivers/net/ethernet/8390/xsurf100.c:48: /kisskb/src/drivers/net/ethernet/8390/lib8390.c:988:27: warning: '____alloc_ei_netdev' defined but not used [-Wunused-function] static struct net_device *____alloc_ei_netdev(int size) ^~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:950:13: warning: '__ei_set_multicast_list' defined but not used [-Wunused-function] static void __ei_set_multicast_list(struct net_device *dev) ^~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:850:33: warning: '__ei_get_stats' defined but not used [-Wunused-function] static struct net_device_stats *__ei_get_stats(struct net_device *dev) ^~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:509:13: warning: '__ei_poll' defined but not used [-Wunused-function] static void __ei_poll(struct net_device *dev) ^~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:300:20: warning: '__ei_start_xmit' defined but not used [-Wunused-function] static netdev_tx_t __ei_start_xmit(struct sk_buff *skb, ^~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:254:13: warning: '__ei_tx_timeout' defined but not used [-Wunused-function] static void __ei_tx_timeout(struct net_device *dev, unsigned int txqueue) ^~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:230:12: warning: '__ei_close' defined but not used [-Wunused-function] static int __ei_close(struct net_device *dev) ^~~~~~~~~~ /kisskb/src/drivers/net/ethernet/8390/lib8390.c:201:12: warning: '__ei_open' defined but not used [-Wunused-function] static int __ei_open(struct net_device *dev) ^~~~~~~~~ In file included from /kisskb/src/arch/m68k/include/asm/atomic.h:7, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/include/linux/cpumask.h:13, from /kisskb/src/include/linux/smp.h:13, from /kisskb/src/include/linux/lockdep.h:14, from /kisskb/src/include/linux/spinlock.h:59, from /kisskb/src/include/linux/wait.h:9, from /kisskb/src/include/linux/wait_bit.h:8, from /kisskb/src/include/linux/fs.h:6, from /kisskb/src/fs/ocfs2/file.c:13: /kisskb/src/fs/ocfs2/file.c: In function 'ocfs2_file_write_iter': /kisskb/src/arch/m68k/include/asm/cmpxchg.h:79:22: warning: value computed is not used [-Wunused-value] #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/fs/ocfs2/file.c:2419:3: note: in expansion of macro 'xchg' xchg(&iocb->ki_complete, saved_ki_complete); ^~~~ Completed OK # rm -rf /kisskb/build/linus_m68k-defconfig_m68k-gcc8 # Build took: 0:02:05.490592