[PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2

[PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2

[Breno Leitao]

I am seeing the following crash on arm64 with 6.19-rc2 (commit 9448598b22c5
("Linux 6.19-rc2"))

	Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8

	Call trace:
	cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P)
	security_capable (security/security.c:?)
	ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381)
	__ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326)
	ptrace_may_access (kernel/ptrace.c:353)
	do_task_stat (fs/proc/array.c:467)
	proc_tgid_stat (fs/proc/array.c:673)
	proc_single_show (fs/proc/base.c:803)
	seq_read_iter (fs/seq_file.c:209)
	seq_read (./include/linux/ioprio.h:59 ./include/linux/ioprio.h:84 ./include/linux/fs.h:2177 fs/seq_file.c:158)
	vfs_read (./arch/arm64/include/asm/uaccess.h:46 fs/read_write.c:560)
	ksys_read (fs/read_write.c:705)
	__arm64_sys_read (fs/read_write.c:722)
	invoke_syscall (arch/arm64/kernel/syscall.c:46)
	el0_svc_common+0x90/0xe0
	do_el0_svc (arch/arm64/kernel/syscall.c:150)
	el0_svc (arch/arm64/kernel/entry-common.c:724)
	el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:743)
	el0t_64_sync (arch/arm64/kernel/entry.S:596)

This was bissected to commit a5baf582f4 ("arm64/efi: Call EFI runtime services without
disabling preemption").

After the commit above, it crashes arm64 with a NULL pointer dereference in
cap_capable() when running below (ocassionally). Unfortunately I still don't
have a simple reproducer, and it takes about 10 minutes to crash on my systems.
it always crash with below[1] application.

From my investigation, the root cause is that efi_mm lacks user_ns
initialization. When kthread_use_mm(&efi_mm) temporarily adopts efi_mm
for EFI calls, LSM hooks expect mm->user_ns to be valid for credential
checks. With it being NULL, capability checks crash.

This series contains two patches:

1. efi: Initialize efi_mm.user_ns to &init_user_ns (the actual fix)
2. kthread: Add WARN_ON_ONCE() to catch similar bugs early (RFC)

The second patch is mostly an RFC that adds a warning in
kthread_use_mm() to detect any mm_struct missing user_ns initialization,
helping prevent similar NULL pointer crashes in the future.

Link: https://github.com/facebookincubator/below [1]

Signed-off-by: Breno Leitao <leitao@debian.org>
---
Breno Leitao (2):
      arm64: efi: Fix NULL pointer dereference by initializing user_ns
      kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()

 drivers/firmware/efi/efi.c | 1 +
 kernel/kthread.c           | 1 +
 2 files changed, 2 insertions(+)
---
base-commit: 9448598b22c50c8a5bb77a9103e2d49f134c9578
change-id: 20251223-efi_fix_619-3891ca7d2914

Best regards,
--  
Breno Leitao <leitao@debian.org>

[PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns

[Breno Leitao]

Linux 6.19-rc2 (9448598b22c5 ("Linux 6.19-rc2")) is crashing with a NULL
pointer dereference on arm64 hosts:

  Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8
   pc : cap_capable (security/commoncap.c:82 security/commoncap.c:128)
   Call trace:
    cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P)
    security_capable (security/security.c:?)
    ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381)
    __ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326)
    ptrace_may_access (kernel/ptrace.c:353)
    do_task_stat (fs/proc/array.c:467)
    proc_tgid_stat (fs/proc/array.c:673)
    proc_single_show (fs/proc/base.c:803)

I've bissected the problem to commit a5baf582f4c0 ("arm64/efi: Call EFI
runtime services without disabling preemption").

From my analyzes, the crash occurs because efi_mm lacks a user_ns field
initialization. This was previously harmless, but commit a5baf582f4c0
("arm64/efi: Call EFI runtime services without disabling preemption")
changed the EFI runtime call path to use kthread_use_mm(&efi_mm), which
temporarily adopts efi_mm as the current mm for the calling kthread.

When a thread has an active mm, LSM hooks like cap_capable() expect
mm->user_ns to be valid for credential checks. With efi_mm.user_ns being
NULL, capability checks during possible /proc access dereference the
NULL pointer and crash.

Fix by initializing efi_mm.user_ns to &init_user_ns.

Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 drivers/firmware/efi/efi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index a9070d00b833..55452e61af31 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -73,6 +73,7 @@ struct mm_struct efi_mm = {
 	MMAP_LOCK_INITIALIZER(efi_mm)
 	.page_table_lock	= __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock),
 	.mmlist			= LIST_HEAD_INIT(efi_mm.mmlist),
+	.user_ns		= &init_user_ns,
 	.cpu_bitmap		= { [BITS_TO_LONGS(NR_CPUS)] = 0},
 #ifdef CONFIG_SCHED_MM_CID
 	.mm_cid.lock		= __RAW_SPIN_LOCK_UNLOCKED(efi_mm.mm_cid.lock),

-- 
2.47.3

[PATCH 2/2] kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()

[Breno Leitao]

Add a WARN_ON_ONCE() check to detect mm_struct instances that are
missing user_ns initialization when passed to kthread_use_mm().

When a kthread adopts an mm via kthread_use_mm(), LSM hooks and
capability checks may access current->mm->user_ns for credential
validation. If user_ns is NULL, this leads to a NULL pointer
dereference crash.

This was observed with efi_mm on arm64, where commit a5baf582f4c0
("arm64/efi: Call EFI runtime services without disabling preemption")
introduced kthread_use_mm(&efi_mm), but efi_mm lacked user_ns
initialization, causing crashes during /proc access.

Adding this warning helps catch similar bugs early during development
rather than waiting for hard-to-debug NULL pointer crashes in
production.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/kthread.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/kthread.c b/kernel/kthread.c
index 99a3808d086f..39511dd2abc9 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -1599,6 +1599,7 @@ void kthread_use_mm(struct mm_struct *mm)
 
 	WARN_ON_ONCE(!(tsk->flags & PF_KTHREAD));
 	WARN_ON_ONCE(tsk->mm);
+	WARN_ON_ONCE(!mm->user_ns);
 
 	/*
 	 * It is possible for mm to be the same as tsk->active_mm, but

-- 
2.47.3

Re: [PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns

[Rik van Riel]

On Tue, 2025-12-23 at 02:55 -0800, Breno Leitao wrote:
> 
> diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
> index a9070d00b833..55452e61af31 100644
> --- a/drivers/firmware/efi/efi.c
> +++ b/drivers/firmware/efi/efi.c
> @@ -73,6 +73,7 @@ struct mm_struct efi_mm = {
>  	MMAP_LOCK_INITIALIZER(efi_mm)
>  	.page_table_lock	=
> __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock),
>  	.mmlist			=
> LIST_HEAD_INIT(efi_mm.mmlist),
> +	.user_ns		= &init_user_ns,
>  	.cpu_bitmap		= { [BITS_TO_LONGS(NR_CPUS)] = 0},
>  #ifdef CONFIG_SCHED_MM_CID
>  	.mm_cid.lock		=
> __RAW_SPIN_LOCK_UNLOCKED(efi_mm.mm_cid.lock),

Seems legit?

Acked-by: Rik van Riel <riel@surriel.com>

-- 
All Rights Reversed.

Re: [PATCH 2/2] kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()

[Rik van Riel]

On Tue, 2025-12-23 at 02:55 -0800, Breno Leitao wrote:
> Add a WARN_ON_ONCE() check to detect mm_struct instances that are
> missing user_ns initialization when passed to kthread_use_mm().
> 
> When a kthread adopts an mm via kthread_use_mm(), LSM hooks and
> capability checks may access current->mm->user_ns for credential
> validation. If user_ns is NULL, this leads to a NULL pointer
> dereference crash.
> 
> This was observed with efi_mm on arm64, where commit a5baf582f4c0
> ("arm64/efi: Call EFI runtime services without disabling preemption")
> introduced kthread_use_mm(&efi_mm), but efi_mm lacked user_ns
> initialization, causing crashes during /proc access.
> 
> Adding this warning helps catch similar bugs early during development
> rather than waiting for hard-to-debug NULL pointer crashes in
> production.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Acked-by: Rik van Riel <riel@surriel.com>

-- 
All Rights Reversed.

Re: [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2

[Ard Biesheuvel]

On Tue, 23 Dec 2025 at 11:56, Breno Leitao <leitao@debian.org> wrote:
>
> I am seeing the following crash on arm64 with 6.19-rc2 (commit 9448598b22c5
> ("Linux 6.19-rc2"))
>
>         Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8
>
>         Call trace:
>         cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P)
>         security_capable (security/security.c:?)
>         ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381)
>         __ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326)
>         ptrace_may_access (kernel/ptrace.c:353)
>         do_task_stat (fs/proc/array.c:467)
>         proc_tgid_stat (fs/proc/array.c:673)
>         proc_single_show (fs/proc/base.c:803)
>         seq_read_iter (fs/seq_file.c:209)
>         seq_read (./include/linux/ioprio.h:59 ./include/linux/ioprio.h:84 ./include/linux/fs.h:2177 fs/seq_file.c:158)
>         vfs_read (./arch/arm64/include/asm/uaccess.h:46 fs/read_write.c:560)
>         ksys_read (fs/read_write.c:705)
>         __arm64_sys_read (fs/read_write.c:722)
>         invoke_syscall (arch/arm64/kernel/syscall.c:46)
>         el0_svc_common+0x90/0xe0
>         do_el0_svc (arch/arm64/kernel/syscall.c:150)
>         el0_svc (arch/arm64/kernel/entry-common.c:724)
>         el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:743)
>         el0t_64_sync (arch/arm64/kernel/entry.S:596)
>
> This was bissected to commit a5baf582f4 ("arm64/efi: Call EFI runtime services without
> disabling preemption").
>
> After the commit above, it crashes arm64 with a NULL pointer dereference in
> cap_capable() when running below (ocassionally). Unfortunately I still don't
> have a simple reproducer, and it takes about 10 minutes to crash on my systems.
> it always crash with below[1] application.
>
> From my investigation, the root cause is that efi_mm lacks user_ns
> initialization. When kthread_use_mm(&efi_mm) temporarily adopts efi_mm
> for EFI calls, LSM hooks expect mm->user_ns to be valid for credential
> checks. With it being NULL, capability checks crash.
>
> This series contains two patches:
>
> 1. efi: Initialize efi_mm.user_ns to &init_user_ns (the actual fix)
> 2. kthread: Add WARN_ON_ONCE() to catch similar bugs early (RFC)
>
> The second patch is mostly an RFC that adds a warning in
> kthread_use_mm() to detect any mm_struct missing user_ns initialization,
> helping prevent similar NULL pointer crashes in the future.
>
> Link: https://github.com/facebookincubator/below [1]
>
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
> Breno Leitao (2):
>       arm64: efi: Fix NULL pointer dereference by initializing user_ns
>       kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()
>

Thanks for the report - I've queued these up in the EFI fixes tree.


>  drivers/firmware/efi/efi.c | 1 +
>  kernel/kthread.c           | 1 +
>  2 files changed, 2 insertions(+)
> ---
> base-commit: 9448598b22c50c8a5bb77a9103e2d49f134c9578
> change-id: 20251223-efi_fix_619-3891ca7d2914
>
> Best regards,
> --
> Breno Leitao <leitao@debian.org>
>
>