Breno Leitao 61ed08c2fd arm64: efi: Fix NULL pointer dereference by initializing user_ns ... Linux 6.19-rc2 (9448598b22 ("Linux 6.19-rc2")) is crashing with a NULL pointer dereference on arm64 hosts: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8 pc : cap_capable (security/commoncap.c:82 security/commoncap.c:128) Call trace: cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P) security_capable (security/security.c:?) ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381) __ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326) ptrace_may_access (kernel/ptrace.c:353) do_task_stat (fs/proc/array.c:467) proc_tgid_stat (fs/proc/array.c:673) proc_single_show (fs/proc/base.c:803) I've bissected the problem to commit a5baf582f4 ("arm64/efi: Call EFI runtime services without disabling preemption"). >From my analyzes, the crash occurs because efi_mm lacks a user_ns field initialization. This was previously harmless, but commit a5baf582f4 ("arm64/efi: Call EFI runtime services without disabling preemption") changed the EFI runtime call path to use kthread_use_mm(&efi_mm), which temporarily adopts efi_mm as the current mm for the calling kthread. When a thread has an active mm, LSM hooks like cap_capable() expect mm->user_ns to be valid for credential checks. With efi_mm.user_ns being NULL, capability checks during possible /proc access dereference the NULL pointer and crash. Fix by initializing efi_mm.user_ns to &init_user_ns. Fixes: a5baf582f4 ("arm64/efi: Call EFI runtime services without disabling preemption") Signed-off-by: Breno Leitao <leitao@debian.org> Acked-by: Rik van Riel <riel@surriel.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>		2025-12-24 21:32:57 +01:00
..
arm_ffa	firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor	2025-10-13 10:34:46 +01:00
arm_scmi	firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode	2025-10-15 15:28:49 +01:00
broadcom	…
cirrus	firmware: cs_dsp: Add test cases for client_ops == NULL	2025-11-28 11:47:56 +00:00
efi	arm64: efi: Fix NULL pointer dereference by initializing user_ns	2025-12-24 21:32:57 +01:00
google	…
imx	firmware: imx: scu: Use devm_mutex_init	2025-10-27 14:43:48 +08:00
meson	firmware: firmware: meson-sm: fix compile-test default	2025-09-10 09:31:20 +02:00
microchip	…
psci	…
qcom	firmware: qcom: scm: Simplify with of_machine_device_match()	2025-11-26 19:42:46 -06:00
samsung	firmware: exynos-acpm: register ACPM clocks pdev	2025-10-20 08:49:50 +02:00
smccc	…
tegra	firmware: tegra: Do not warn on missing memory-region property	2025-09-15 18:28:09 +02:00
xilinx	SCSI misc on 20251204	2025-12-05 19:56:50 -08:00
Kconfig	…
Makefile	…
arm_scpi.c	…
arm_sdei.c	…
dmi-id.c	…
dmi-sysfs.c	…
dmi_scan.c	…
edd.c	…
iscsi_ibft.c	…
iscsi_ibft_find.c	…
memmap.c	…
mtk-adsp-ipc.c	…
qemu_fw_cfg.c	…
raspberrypi.c	…
stratix10-rsu.c	firmware: stratix10-rsu: replace scnprintf() with sysfs_emit() in *_show() functions	2025-11-13 06:32:58 -06:00
stratix10-svc.c	Char/Misc/IIO driver updates for 6.19-rc1	2025-12-06 18:34:24 -08:00
sysfb.c	…
sysfb_simplefb.c	…
thead,th1520-aon.c	…
ti_sci.c	firmware: ti_sci: Partial-IO support	2025-11-13 13:03:55 -06:00
ti_sci.h	firmware: ti_sci: Partial-IO support	2025-11-13 13:03:55 -06:00
trusted_foundations.c	…
turris-mox-rwtm.c	…