Re: double free in alternatives/retpoline

[Linus Torvalds]

[ Adding Mike Rapoport ]

On Wed, 18 Jun 2025 at 19:08, Dave Airlie <airlied@xxxxxxxxx> wrote:
>
> I've just tried to boot Linux master with KASAN enabled on a laptop here, and it showing a slab UAF for apply_retpolines.
>
> I haven't had a chance to bisect yet, and unfortunately I only have a photo of the oops.

Hmm.

I think it's due to commit a82b26451de1 ("x86/its: explicitly manage
permissions for ITS pages").

Maybe I'm mis-reading it entirely, but I think that "its_fini_core()"
thing is entirely bogus. It does that

        kfree(its_pages.pages);

but as far as I can tell, that thing is happily used later by module
initialization.

Freeing the pages that have been used and marked ROX sounds like it
should be fine, but I think it should also do

        its_pages.pages = NULL;
        its_pages->num = 0;

so that any subsequent user that comes along due to modules or
whatever and does __its_alloc() will DTRT wrt the realloc().

But I might be completely barking up the wrong tree and mis-reading
things entirely. PeterZ? Mike?

             Linus