On Wed, Aug 22, 2018 at 11:33 AM Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > > On Wed, Aug 22, 2018 at 11:21 AM Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote: > > > > Yes, KVM is correct but the i915 bits are at least fishy. It's probably > > as simple as adding a mmget/mmput pair respectively in kvmgt_guest_init > > and kvmgt_guest_exit, or maybe mmget_not_zero. > > Definitely mmget_not_zero(). If it was just mmgrab()'ed earlier, the > actual page tables might already be gone. Side note: we _could_ do the mmget_not_zero() inside use_mm() itself, if we just knew that the mm was at least mmgrab()'ed correctly. But for some of the uses, even that isn't clear. It's not entirely obvious that the "struct mm_struct" exists _at_all_ at that point, and that a mmget_not_zero() wouldn't just have some use-after-free access. Again, independent lifetime rules could show that this isn't the case (ie "exit_aio() is always called before exit_mmap(), and kill_ioctx() takes care of it all"), but it would be good to have the users of "use_mm()" actually verify their lifetime rules are correct and enforced. Because quite often, the lifetime rule might nbot be a mmu notifier or aio_exit at all, but just be "oh, the user won't exit until this is all done". But do you *control* the user? What if the user is buggy? Linus _______________________________________________ Intel-gfx mailing list Intel-gfx@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/intel-gfx