linux-kernel - Re: double free in alternatives/retpoline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPM=9tyG7+6ZQuBQY=nwiPxywWgVtOHus7cH-KjKMgn+0ADv8Q@mail.gmail.com>
Date: Thu, 19 Jun 2025 13:31:19 +1000
From: Dave Airlie <airlied@...il.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: LKML <linux-kernel@...r.kernel.org>, Ingo Molnar <mingo@...nel.org>, 
	Peter Zijlstra <peterz@...radead.org>, nik.borisov@...e.com, 
	Mike Rapoport <rppt@...nel.org>
Subject: Re: double free in alternatives/retpoline

On Thu, 19 Jun 2025 at 12:33, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
>
> [ Adding Mike Rapoport ]
>
> On Wed, 18 Jun 2025 at 19:08, Dave Airlie <airlied@...il.com> wrote:
> >
> > I've just tried to boot Linux master with KASAN enabled on a laptop here, and it showing a slab UAF for apply_retpolines.
> >
> > I haven't had a chance to bisect yet, and unfortunately I only have a photo of the oops.
>
> Hmm.
>
> I think it's due to commit a82b26451de1 ("x86/its: explicitly manage
> permissions for ITS pages").
>
> Maybe I'm mis-reading it entirely, but I think that "its_fini_core()"
> thing is entirely bogus. It does that
>
>         kfree(its_pages.pages);
>
> but as far as I can tell, that thing is happily used later by module
> initialization.
>
> Freeing the pages that have been used and marked ROX sounds like it
> should be fine, but I think it should also do
>
>         its_pages.pages = NULL;
>         its_pages->num = 0;
>
> so that any subsequent user that comes along due to modules or
> whatever and does __its_alloc() will DTRT wrt the realloc().
>
> But I might be completely barking up the wrong tree and mis-reading
> things entirely. PeterZ? Mike?

I wonder if the module code also needs the same treatment,

diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 6455f7f751b3..4653881a4ab3 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -182,6 +182,7 @@ static void its_fini_core(void)
     if (IS_ENABLED(CONFIG_STRICT_KERNEL_RWX))
         its_pages_protect(&its_pages);
     kfree(its_pages.pages);
+    its_pages.pages = NULL;
 }

 #ifdef CONFIG_MODULES
(1/2) Stage this hunk [y,n,q,a,d,j,J,g,/,e,p,?]? y
@@ -220,6 +221,8 @@ void its_free_mod(struct module *mod)
         execmem_free(page);
     }
     kfree(mod->arch.its_pages.pages);
+    mod->arch.its_pages.pages = NULL;
+    mod->arch.its_pages.num = 0;
 }
 #endif /* CONFIG_MODULES */

boots for me, but I've no idea what is required or sufficient.

Dave.
>
>              Linus