From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f180.google.com (mail-oi1-f180.google.com [209.85.167.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C52FE2C235F for ; Tue, 23 Dec 2025 10:56:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766487368; cv=none; b=KPULrBtOv99wxG67YXD8gyGzZYhbS6PbI/xxnbUyTKyCEG3l56iFgynpszYpqIGQRRkfnTYpDsXjOE/QzosDG07/P1jrdBf5aqYUwpi0kggi/0XwUMZNFjn3jMSo/bncWo3z17DO/27gEKIdc3NtMxU1oboqoPCgT4w+iGfoLAE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766487368; c=relaxed/simple; bh=UFL3EYFptdWksL2TrqK20utlZjnMf15IQidFIh37P6U=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=dj5S6dI2Kjy7ENAPEnEZKrEc1KDCsBKRCbgBJ6rwi4l4ohvEDbU3QYHQ0hUxi4wO62o4El3PEOUT9M694EMpnYSt5ODw02TPwi6HscEx4lct1PFcXoWAp5iouXB9/hGpGpX01WPsj/XHOFNSy1MU29WXFTsDCxauhznzVzxtsqE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.167.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oi1-f180.google.com with SMTP id 5614622812f47-4557f0e5ed2so2929599b6e.1 for ; Tue, 23 Dec 2025 02:56:06 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766487366; x=1767092166; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=spoP0+Albf1P/crjcQ63AptEOAl1TVHeih5dAbMZP+Q=; b=tEXO0Cpl+Cj6VvTLE22bCwkrPXeA6kV+QCYhVr0lWl0oS2CsMBTiVc+QCSWBsIwdW5 BIuTlTyXJGpNPA9aI4PIwr0vW0cZmf/tkUWm8ZLOhTwP/EHO00UODYLYJEMlv1whFauX K4hOt4wmbR58+Mj+EqBOS5wJPA5PBqbFIGqtzzDU4mguyKxK8Z93e3+EnXqIVjidxonF xDFrUv/XzYhpeGHmZzKVNnOSbp5klSom31DbATHr7EflE3E/pmfz0ei/v1dhxgQhjPPX t/Y3+RDLxaEW/MsKGfEZf7p8lGUmKkxq6r07QU7kNGqW+jksOFssNOPVZQ5a9UBB96C2 uZJQ== X-Forwarded-Encrypted: i=1; AJvYcCVTUARMSy2uBZWTeiW9cFx2jql3wvR01xsqNgJp/7krTJDFDCcDFRTWP1hcQFw0zm0dUWlKNQvnWxuJjxU=@vger.kernel.org X-Gm-Message-State: AOJu0Ywofe8oEX8ZwXbI7b47Fbf8jrEJHfwvLzIx5reP1UeX7FgJnBmv 5vSoIsswQp2Yh4+EEEyueRezszsPVAzERPy2ERATlagPojkOrXpCKxpW X-Gm-Gg: AY/fxX7uMqZSUVTNfES7H6ZCYqj+yxdvVzODpY9uG1nrD1bN954IQsBw93UpzzSkoel G+DzyRt+vx/faXIHYo8/zgQWAyced8N9K30w7H4AY1NOy3Rm5vWvB54ihyP53XoyWG3vlA4ASRA mve9VTvQlGY2VFc+BZD4H+5xixsDNB1x1LuOoHLui9FgG/W3fK40vnF6l2WwVQoF2wiRVCraHAW t7VFuUB9zUtKqqyXQgWXGrwqtdG/JOBaN7JqU+ZyMx4J/0RrJpNui+mMiFu5/40w1+3kSXX+/yh Unn3Y8aacO28XVRCAHHxctfsQkrZYp6AH3A+WCY1+bwsb1wWfQDrSiY4rmiBZbv54HIEG88/yRX pDC8/GRAEoovRsOglO8LOTPDGkYuziAvAxIe++ZNlXvlIIMkWDq7DXXofVEHMBzy/lyU4+DSJw8 5CkuN4UTkhqZJ+hZSE0A9HbGw= X-Google-Smtp-Source: AGHT+IGiZkiYPTPZNUrOfsgRj6L7DBQ+OVmkgtvSX3FWGLRox+YADwlzHeeAwjVmg585DG80xaAIMA== X-Received: by 2002:a05:6808:1b2c:b0:450:f45e:f4a7 with SMTP id 5614622812f47-457a28920femr7624447b6e.8.1766487365699; Tue, 23 Dec 2025 02:56:05 -0800 (PST) Received: from localhost ([2a03:2880:10ff:5::]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-3fdaac129c7sm7610763fac.21.2025.12.23.02.56.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Dec 2025 02:56:05 -0800 (PST) From: Breno Leitao Subject: [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2 Date: Tue, 23 Dec 2025 02:55:42 -0800 Message-Id: <20251223-efi_fix_619-v1-0-e0146b8b9d73@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAC91SmkC/yXMQQ6CMBAF0KtM/pomzqBiexViCJYpjgs0LRgSw t2Nunybt6FoNi0ItCHr24o9JwTiihDv/TSqswGBIAc5sUjtNFmXbO3O7F198Rz7ZhDPR1SEV9Z k629rr3+X5fbQOH8L7PsHLVOPoW8AAAA= X-Change-ID: 20251223-efi_fix_619-3891ca7d2914 To: Ard Biesheuvel , Catalin Marinas , Will Deacon Cc: linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, riel@surriel.com, puranjay@kernel.org, usamaarif642@gmail.com, Breno Leitao , kernel-team@meta.com X-Mailer: b4 0.15-dev-47773 X-Developer-Signature: v=1; a=openpgp-sha256; l=2771; i=leitao@debian.org; h=from:subject:message-id; bh=UFL3EYFptdWksL2TrqK20utlZjnMf15IQidFIh37P6U=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBpSnVEfEn88+VR44GzKHbDtxIvHlHSEjjrsUc4Z UbZAdtQHR6JAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaUp1RAAKCRA1o5Of/Hh3 bVv/D/4xoP7Y2y+3fcB+zUfr4xmdyGo5n5zqDOli8tg0MB89tYdCdmkVdAYEMmP3vSKTXqClnvs UmrNtHWvGGzJYz5PIo+0Kl4WUqqptbSBIwmHGaJvKVEOtZFrTMZBV9if9ipzZG30ZnaMxLPbGZs mD3A8ViD32tj+U4sHI3yAuWeg/8oXXe19hP9nKi4z9FzFjoC6MQYlYT0etsbrR8yv/odZnBDCnz JipP/fejbbmkM1pUTy7gkR3jDrJXl2AopNSDNF9tHirQoZKuRMTXGvpUBjIC9GiEKDYVhEkskwG RNHb3wJjiPjkluPHGsEoJROxJLsbXoH/oDybAhg8sA/9rrm86lYLi0CDoFhqIWiCp9fPT6Z3WOW J48ClXay2ExTVxR3sxsQ4yxFL//XlDKp8z6eUSTCUZwN4UpEXk628sFIfqBeL/pgDY9nyehCJLi p0wiIiIfpD/pVZf+qFIXKvkRuFdb4Ok7VafjRFTJUxqdAEIL2t9/sVCX0de47D7lktxCi+7mbZi 38hqCxb0nHW/tWoXkFy27ZDkgjCFtdhWpLh9KJmPValJ6pDFyZAwKV6Oe6wIHmxjViYKjwBKIbm iWROh78kfH/W1WOjwtQqe8LlRIA+jis99v58RIvBjtt/QCIW06ok5WKjvKIlx+c6djDZ4PhhhNe EExYfr5jjmGbHJw== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D I am seeing the following crash on arm64 with 6.19-rc2 (commit 9448598b22c5 ("Linux 6.19-rc2")) Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8 Call trace: cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P) security_capable (security/security.c:?) ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381) __ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326) ptrace_may_access (kernel/ptrace.c:353) do_task_stat (fs/proc/array.c:467) proc_tgid_stat (fs/proc/array.c:673) proc_single_show (fs/proc/base.c:803) seq_read_iter (fs/seq_file.c:209) seq_read (./include/linux/ioprio.h:59 ./include/linux/ioprio.h:84 ./include/linux/fs.h:2177 fs/seq_file.c:158) vfs_read (./arch/arm64/include/asm/uaccess.h:46 fs/read_write.c:560) ksys_read (fs/read_write.c:705) __arm64_sys_read (fs/read_write.c:722) invoke_syscall (arch/arm64/kernel/syscall.c:46) el0_svc_common+0x90/0xe0 do_el0_svc (arch/arm64/kernel/syscall.c:150) el0_svc (arch/arm64/kernel/entry-common.c:724) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:743) el0t_64_sync (arch/arm64/kernel/entry.S:596) This was bissected to commit a5baf582f4 ("arm64/efi: Call EFI runtime services without disabling preemption"). After the commit above, it crashes arm64 with a NULL pointer dereference in cap_capable() when running below (ocassionally). Unfortunately I still don't have a simple reproducer, and it takes about 10 minutes to crash on my systems. it always crash with below[1] application. >From my investigation, the root cause is that efi_mm lacks user_ns initialization. When kthread_use_mm(&efi_mm) temporarily adopts efi_mm for EFI calls, LSM hooks expect mm->user_ns to be valid for credential checks. With it being NULL, capability checks crash. This series contains two patches: 1. efi: Initialize efi_mm.user_ns to &init_user_ns (the actual fix) 2. kthread: Add WARN_ON_ONCE() to catch similar bugs early (RFC) The second patch is mostly an RFC that adds a warning in kthread_use_mm() to detect any mm_struct missing user_ns initialization, helping prevent similar NULL pointer crashes in the future. Link: https://github.com/facebookincubator/below [1] Signed-off-by: Breno Leitao --- Breno Leitao (2): arm64: efi: Fix NULL pointer dereference by initializing user_ns kthread: Warn if mm_struct lacks user_ns in kthread_use_mm() drivers/firmware/efi/efi.c | 1 + kernel/kthread.c | 1 + 2 files changed, 2 insertions(+) --- base-commit: 9448598b22c50c8a5bb77a9103e2d49f134c9578 change-id: 20251223-efi_fix_619-3891ca7d2914 Best regards, -- Breno Leitao