diff options
| author | Breno Leitao <leitao@debian.org> | 2025-12-23 02:55:44 -0800 |
|---|---|---|
| committer | Ard Biesheuvel <ardb@kernel.org> | 2025-12-24 21:32:58 +0100 |
| commit | cfe54f4591e675cedf2c0d25287ff4c0a2e0cb9d (patch) | |
| tree | 5db98f0768ffa7e81296e52be68bb409b9331570 /kernel | |
| parent | 61ed08c2fd1db0eb43c8b62ade249a3061e39444 (diff) | |
kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()
Add a WARN_ON_ONCE() check to detect mm_struct instances that are
missing user_ns initialization when passed to kthread_use_mm().
When a kthread adopts an mm via kthread_use_mm(), LSM hooks and
capability checks may access current->mm->user_ns for credential
validation. If user_ns is NULL, this leads to a NULL pointer
dereference crash.
This was observed with efi_mm on arm64, where commit a5baf582f4c0
("arm64/efi: Call EFI runtime services without disabling preemption")
introduced kthread_use_mm(&efi_mm), but efi_mm lacked user_ns
initialization, causing crashes during /proc access.
Adding this warning helps catch similar bugs early during development
rather than waiting for hard-to-debug NULL pointer crashes in
production.
Signed-off-by: Breno Leitao <leitao@debian.org>
Acked-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/kthread.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/kthread.c b/kernel/kthread.c index 99a3808d086f..39511dd2abc9 100644 --- a/kernel/kthread.c +++ b/kernel/kthread.c @@ -1599,6 +1599,7 @@ void kthread_use_mm(struct mm_struct *mm) WARN_ON_ONCE(!(tsk->flags & PF_KTHREAD)); WARN_ON_ONCE(tsk->mm); + WARN_ON_ONCE(!mm->user_ns); /* * It is possible for mm to be the same as tsk->active_mm, but |