* [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2
@ 2025-12-23 10:55 Breno Leitao
2025-12-23 10:55 ` [PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns Breno Leitao
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Breno Leitao @ 2025-12-23 10:55 UTC (permalink / raw)
To: Ard Biesheuvel, Catalin Marinas, Will Deacon
Cc: linux-efi, linux-kernel, linux-arm-kernel, riel, puranjay,
usamaarif642, Breno Leitao, kernel-team
I am seeing the following crash on arm64 with 6.19-rc2 (commit 9448598b22c5
("Linux 6.19-rc2"))
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8
Call trace:
cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P)
security_capable (security/security.c:?)
ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381)
__ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326)
ptrace_may_access (kernel/ptrace.c:353)
do_task_stat (fs/proc/array.c:467)
proc_tgid_stat (fs/proc/array.c:673)
proc_single_show (fs/proc/base.c:803)
seq_read_iter (fs/seq_file.c:209)
seq_read (./include/linux/ioprio.h:59 ./include/linux/ioprio.h:84 ./include/linux/fs.h:2177 fs/seq_file.c:158)
vfs_read (./arch/arm64/include/asm/uaccess.h:46 fs/read_write.c:560)
ksys_read (fs/read_write.c:705)
__arm64_sys_read (fs/read_write.c:722)
invoke_syscall (arch/arm64/kernel/syscall.c:46)
el0_svc_common+0x90/0xe0
do_el0_svc (arch/arm64/kernel/syscall.c:150)
el0_svc (arch/arm64/kernel/entry-common.c:724)
el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:743)
el0t_64_sync (arch/arm64/kernel/entry.S:596)
This was bissected to commit a5baf582f4 ("arm64/efi: Call EFI runtime services without
disabling preemption").
After the commit above, it crashes arm64 with a NULL pointer dereference in
cap_capable() when running below (ocassionally). Unfortunately I still don't
have a simple reproducer, and it takes about 10 minutes to crash on my systems.
it always crash with below[1] application.
From my investigation, the root cause is that efi_mm lacks user_ns
initialization. When kthread_use_mm(&efi_mm) temporarily adopts efi_mm
for EFI calls, LSM hooks expect mm->user_ns to be valid for credential
checks. With it being NULL, capability checks crash.
This series contains two patches:
1. efi: Initialize efi_mm.user_ns to &init_user_ns (the actual fix)
2. kthread: Add WARN_ON_ONCE() to catch similar bugs early (RFC)
The second patch is mostly an RFC that adds a warning in
kthread_use_mm() to detect any mm_struct missing user_ns initialization,
helping prevent similar NULL pointer crashes in the future.
Link: https://github.com/facebookincubator/below [1]
Signed-off-by: Breno Leitao <leitao@debian.org>
---
Breno Leitao (2):
arm64: efi: Fix NULL pointer dereference by initializing user_ns
kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()
drivers/firmware/efi/efi.c | 1 +
kernel/kthread.c | 1 +
2 files changed, 2 insertions(+)
---
base-commit: 9448598b22c50c8a5bb77a9103e2d49f134c9578
change-id: 20251223-efi_fix_619-3891ca7d2914
Best regards,
--
Breno Leitao <leitao@debian.org>
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns
2025-12-23 10:55 [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2 Breno Leitao
@ 2025-12-23 10:55 ` Breno Leitao
2025-12-23 19:24 ` Rik van Riel
2025-12-23 10:55 ` [PATCH 2/2] kthread: Warn if mm_struct lacks user_ns in kthread_use_mm() Breno Leitao
2025-12-26 10:10 ` [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2 Ard Biesheuvel
2 siblings, 1 reply; 6+ messages in thread
From: Breno Leitao @ 2025-12-23 10:55 UTC (permalink / raw)
To: Ard Biesheuvel, Catalin Marinas, Will Deacon
Cc: linux-efi, linux-kernel, linux-arm-kernel, riel, puranjay,
usamaarif642, Breno Leitao, kernel-team
Linux 6.19-rc2 (9448598b22c5 ("Linux 6.19-rc2")) is crashing with a NULL
pointer dereference on arm64 hosts:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8
pc : cap_capable (security/commoncap.c:82 security/commoncap.c:128)
Call trace:
cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P)
security_capable (security/security.c:?)
ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381)
__ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326)
ptrace_may_access (kernel/ptrace.c:353)
do_task_stat (fs/proc/array.c:467)
proc_tgid_stat (fs/proc/array.c:673)
proc_single_show (fs/proc/base.c:803)
I've bissected the problem to commit a5baf582f4c0 ("arm64/efi: Call EFI
runtime services without disabling preemption").
From my analyzes, the crash occurs because efi_mm lacks a user_ns field
initialization. This was previously harmless, but commit a5baf582f4c0
("arm64/efi: Call EFI runtime services without disabling preemption")
changed the EFI runtime call path to use kthread_use_mm(&efi_mm), which
temporarily adopts efi_mm as the current mm for the calling kthread.
When a thread has an active mm, LSM hooks like cap_capable() expect
mm->user_ns to be valid for credential checks. With efi_mm.user_ns being
NULL, capability checks during possible /proc access dereference the
NULL pointer and crash.
Fix by initializing efi_mm.user_ns to &init_user_ns.
Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
drivers/firmware/efi/efi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index a9070d00b833..55452e61af31 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -73,6 +73,7 @@ struct mm_struct efi_mm = {
MMAP_LOCK_INITIALIZER(efi_mm)
.page_table_lock = __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock),
.mmlist = LIST_HEAD_INIT(efi_mm.mmlist),
+ .user_ns = &init_user_ns,
.cpu_bitmap = { [BITS_TO_LONGS(NR_CPUS)] = 0},
#ifdef CONFIG_SCHED_MM_CID
.mm_cid.lock = __RAW_SPIN_LOCK_UNLOCKED(efi_mm.mm_cid.lock),
--
2.47.3
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns
2025-12-23 10:55 ` [PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns Breno Leitao
@ 2025-12-23 19:24 ` Rik van Riel
0 siblings, 0 replies; 6+ messages in thread
From: Rik van Riel @ 2025-12-23 19:24 UTC (permalink / raw)
To: Breno Leitao, Ard Biesheuvel, Catalin Marinas, Will Deacon
Cc: linux-efi, linux-kernel, linux-arm-kernel, puranjay,
usamaarif642, kernel-team
On Tue, 2025-12-23 at 02:55 -0800, Breno Leitao wrote:
>
> diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
> index a9070d00b833..55452e61af31 100644
> --- a/drivers/firmware/efi/efi.c
> +++ b/drivers/firmware/efi/efi.c
> @@ -73,6 +73,7 @@ struct mm_struct efi_mm = {
> MMAP_LOCK_INITIALIZER(efi_mm)
> .page_table_lock =
> __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock),
> .mmlist =
> LIST_HEAD_INIT(efi_mm.mmlist),
> + .user_ns = &init_user_ns,
> .cpu_bitmap = { [BITS_TO_LONGS(NR_CPUS)] = 0},
> #ifdef CONFIG_SCHED_MM_CID
> .mm_cid.lock =
> __RAW_SPIN_LOCK_UNLOCKED(efi_mm.mm_cid.lock),
Seems legit?
Acked-by: Rik van Riel <riel@surriel.com>
--
All Rights Reversed.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/2] kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()
2025-12-23 10:55 [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2 Breno Leitao
2025-12-23 10:55 ` [PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns Breno Leitao
@ 2025-12-23 10:55 ` Breno Leitao
2025-12-23 19:31 ` Rik van Riel
2025-12-26 10:10 ` [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2 Ard Biesheuvel
2 siblings, 1 reply; 6+ messages in thread
From: Breno Leitao @ 2025-12-23 10:55 UTC (permalink / raw)
To: Ard Biesheuvel, Catalin Marinas, Will Deacon
Cc: linux-efi, linux-kernel, linux-arm-kernel, riel, puranjay,
usamaarif642, Breno Leitao, kernel-team
Add a WARN_ON_ONCE() check to detect mm_struct instances that are
missing user_ns initialization when passed to kthread_use_mm().
When a kthread adopts an mm via kthread_use_mm(), LSM hooks and
capability checks may access current->mm->user_ns for credential
validation. If user_ns is NULL, this leads to a NULL pointer
dereference crash.
This was observed with efi_mm on arm64, where commit a5baf582f4c0
("arm64/efi: Call EFI runtime services without disabling preemption")
introduced kthread_use_mm(&efi_mm), but efi_mm lacked user_ns
initialization, causing crashes during /proc access.
Adding this warning helps catch similar bugs early during development
rather than waiting for hard-to-debug NULL pointer crashes in
production.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
kernel/kthread.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 99a3808d086f..39511dd2abc9 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -1599,6 +1599,7 @@ void kthread_use_mm(struct mm_struct *mm)
WARN_ON_ONCE(!(tsk->flags & PF_KTHREAD));
WARN_ON_ONCE(tsk->mm);
+ WARN_ON_ONCE(!mm->user_ns);
/*
* It is possible for mm to be the same as tsk->active_mm, but
--
2.47.3
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 2/2] kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()
2025-12-23 10:55 ` [PATCH 2/2] kthread: Warn if mm_struct lacks user_ns in kthread_use_mm() Breno Leitao
@ 2025-12-23 19:31 ` Rik van Riel
0 siblings, 0 replies; 6+ messages in thread
From: Rik van Riel @ 2025-12-23 19:31 UTC (permalink / raw)
To: Breno Leitao, Ard Biesheuvel, Catalin Marinas, Will Deacon
Cc: linux-efi, linux-kernel, linux-arm-kernel, puranjay,
usamaarif642, kernel-team
On Tue, 2025-12-23 at 02:55 -0800, Breno Leitao wrote:
> Add a WARN_ON_ONCE() check to detect mm_struct instances that are
> missing user_ns initialization when passed to kthread_use_mm().
>
> When a kthread adopts an mm via kthread_use_mm(), LSM hooks and
> capability checks may access current->mm->user_ns for credential
> validation. If user_ns is NULL, this leads to a NULL pointer
> dereference crash.
>
> This was observed with efi_mm on arm64, where commit a5baf582f4c0
> ("arm64/efi: Call EFI runtime services without disabling preemption")
> introduced kthread_use_mm(&efi_mm), but efi_mm lacked user_ns
> initialization, causing crashes during /proc access.
>
> Adding this warning helps catch similar bugs early during development
> rather than waiting for hard-to-debug NULL pointer crashes in
> production.
>
> Signed-off-by: Breno Leitao <leitao@debian.org>
Acked-by: Rik van Riel <riel@surriel.com>
--
All Rights Reversed.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2
2025-12-23 10:55 [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2 Breno Leitao
2025-12-23 10:55 ` [PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns Breno Leitao
2025-12-23 10:55 ` [PATCH 2/2] kthread: Warn if mm_struct lacks user_ns in kthread_use_mm() Breno Leitao
@ 2025-12-26 10:10 ` Ard Biesheuvel
2 siblings, 0 replies; 6+ messages in thread
From: Ard Biesheuvel @ 2025-12-26 10:10 UTC (permalink / raw)
To: Breno Leitao
Cc: Catalin Marinas, Will Deacon, linux-efi, linux-kernel,
linux-arm-kernel, riel, puranjay, usamaarif642, kernel-team
On Tue, 23 Dec 2025 at 11:56, Breno Leitao <leitao@debian.org> wrote:
>
> I am seeing the following crash on arm64 with 6.19-rc2 (commit 9448598b22c5
> ("Linux 6.19-rc2"))
>
> Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8
>
> Call trace:
> cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P)
> security_capable (security/security.c:?)
> ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381)
> __ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326)
> ptrace_may_access (kernel/ptrace.c:353)
> do_task_stat (fs/proc/array.c:467)
> proc_tgid_stat (fs/proc/array.c:673)
> proc_single_show (fs/proc/base.c:803)
> seq_read_iter (fs/seq_file.c:209)
> seq_read (./include/linux/ioprio.h:59 ./include/linux/ioprio.h:84 ./include/linux/fs.h:2177 fs/seq_file.c:158)
> vfs_read (./arch/arm64/include/asm/uaccess.h:46 fs/read_write.c:560)
> ksys_read (fs/read_write.c:705)
> __arm64_sys_read (fs/read_write.c:722)
> invoke_syscall (arch/arm64/kernel/syscall.c:46)
> el0_svc_common+0x90/0xe0
> do_el0_svc (arch/arm64/kernel/syscall.c:150)
> el0_svc (arch/arm64/kernel/entry-common.c:724)
> el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:743)
> el0t_64_sync (arch/arm64/kernel/entry.S:596)
>
> This was bissected to commit a5baf582f4 ("arm64/efi: Call EFI runtime services without
> disabling preemption").
>
> After the commit above, it crashes arm64 with a NULL pointer dereference in
> cap_capable() when running below (ocassionally). Unfortunately I still don't
> have a simple reproducer, and it takes about 10 minutes to crash on my systems.
> it always crash with below[1] application.
>
> From my investigation, the root cause is that efi_mm lacks user_ns
> initialization. When kthread_use_mm(&efi_mm) temporarily adopts efi_mm
> for EFI calls, LSM hooks expect mm->user_ns to be valid for credential
> checks. With it being NULL, capability checks crash.
>
> This series contains two patches:
>
> 1. efi: Initialize efi_mm.user_ns to &init_user_ns (the actual fix)
> 2. kthread: Add WARN_ON_ONCE() to catch similar bugs early (RFC)
>
> The second patch is mostly an RFC that adds a warning in
> kthread_use_mm() to detect any mm_struct missing user_ns initialization,
> helping prevent similar NULL pointer crashes in the future.
>
> Link: https://github.com/facebookincubator/below [1]
>
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
> Breno Leitao (2):
> arm64: efi: Fix NULL pointer dereference by initializing user_ns
> kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()
>
Thanks for the report - I've queued these up in the EFI fixes tree.
> drivers/firmware/efi/efi.c | 1 +
> kernel/kthread.c | 1 +
> 2 files changed, 2 insertions(+)
> ---
> base-commit: 9448598b22c50c8a5bb77a9103e2d49f134c9578
> change-id: 20251223-efi_fix_619-3891ca7d2914
>
> Best regards,
> --
> Breno Leitao <leitao@debian.org>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-12-26 10:10 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-12-23 10:55 [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2 Breno Leitao
2025-12-23 10:55 ` [PATCH 1/2] arm64: efi: Fix NULL pointer dereference by initializing user_ns Breno Leitao
2025-12-23 19:24 ` Rik van Riel
2025-12-23 10:55 ` [PATCH 2/2] kthread: Warn if mm_struct lacks user_ns in kthread_use_mm() Breno Leitao
2025-12-23 19:31 ` Rik van Riel
2025-12-26 10:10 ` [PATCH 0/2] arm64: efi: Fix NULL pointer crash in 6.19-rc2 Ard Biesheuvel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®