Re: double free in alternatives/retpoline

[Dave Airlie]

On Thu, 19 Jun 2025 at 12:33, Linus Torvalds
<torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> [ Adding Mike Rapoport ]
>
> On Wed, 18 Jun 2025 at 19:08, Dave Airlie <airlied@xxxxxxxxx> wrote:
> >
> > I've just tried to boot Linux master with KASAN enabled on a laptop here, and it showing a slab UAF for apply_retpolines.
> >
> > I haven't had a chance to bisect yet, and unfortunately I only have a photo of the oops.
>
> Hmm.
>
> I think it's due to commit a82b26451de1 ("x86/its: explicitly manage
> permissions for ITS pages").

It's definitely ITS related, turning off CONFIG_MITIGATIONS_ITS lets
two test machines I have boot.

Dave.
>
> Maybe I'm mis-reading it entirely, but I think that "its_fini_core()"
> thing is entirely bogus. It does that
>
>         kfree(its_pages.pages);
>
> but as far as I can tell, that thing is happily used later by module
> initialization.
>
> Freeing the pages that have been used and marked ROX sounds like it
> should be fine, but I think it should also do
>
>         its_pages.pages = NULL;
>         its_pages->num = 0;
>
> so that any subsequent user that comes along due to modules or
> whatever and does __its_alloc() will DTRT wrt the realloc().
>
> But I might be completely barking up the wrong tree and mis-reading
> things entirely. PeterZ? Mike?
>
>              Linus