[BUG] KASAN: use-after-free in idempotent() / finit_module concurrent fd close [ath10k_pci] [syzkaller]

Hi,

Using the same fuzzing campaign as the sibling slab-UAF report, we hit a
use-after-free in the module loader's `idempotent()` while concurrently
loading ath10k_pci modules. This variant frees the backing physical page
entirely (returned to buddy, all KASAN shadow `0xff`), and is followed by a
GPF in the same function.

Reproducer summary:

    BUG: KASAN: use-after-free in idempotent kernel/module/main.c:3682 [inline]
    BUG: KASAN: use-after-free in idempotent_init_module kernel/module/main.c:3788 [inline]
    BUG: KASAN: use-after-free in __do_sys_finit_module kernel/module/main.c:3815 [inline]
    Read of size 8 at addr ffff88800f54fe48 by task modprobe/733

    The buggy address belongs to the physical page:
    page: refcount:0 mapcount:0 ... pfn:0xf54f   (shadow all 0xff = freed)

Followed by:

    Oops: general protection fault, probably for non-canonical address
    0xdffffc00000003a5; KASAN: probably user-memory-access in range
    [0x0000000000001d28-0x0000000000001d2f] inside idempotent().

`idempotent()` walks the global `idem_hash` list comparing `existing->cookie !=
cookie` where `cookie = file_inode(f)`. `fdget` pins only the `struct file`, not
the inode/backing page. A concurrent `close()` of the module-load fd frees the
inode's page and returns it to the buddy allocator (refcount 0, shadow all
`0xff`); another in-flight `finit_module` then dereferences that freed cookie.

This is the same root cause as the sibling slab-UAF (https://lore.kernel.org/all/[email protected]/) — the
only difference is the object type released: a whole buddy page here vs. a
`UNIX-STREAM` slab object there. Should be fixed together in
`idempotent_init_module()` / `idempotent()`.

The crash report shows below:

BUG: KASAN: use-after-free in idempotent kernel/module/main.c:3682 [inline]
BUG: KASAN: use-after-free in idempotent_init_module kernel/module/main.c:3788 [inline]
BUG: KASAN: use-after-free in __do_sys_finit_module kernel/module/main.c:3815 [inline]
BUG: KASAN: use-after-free in __se_sys_finit_module+0x2ce/0x570 kernel/module/main.c:3799
Read of size 8 at addr ffff88800f54fe48 by task modprobe/733

CPU: 0 UID: 0 PID: 733 Comm: modprobe Tainted: G      D             7.1.0 #1 PREEMPT(lazy) 
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xa2/0xd0 lib/dump_stack.c:120
 print_address_description+0x77/0x200 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 idempotent kernel/module/main.c:3682 [inline]
 idempotent_init_module kernel/module/main.c:3788 [inline]
 __do_sys_finit_module kernel/module/main.c:3815 [inline]
 __se_sys_finit_module+0x2ce/0x570 kernel/module/main.c:3799
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x143/0x470 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3387df725d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffda1809848 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000055fcd40f9e40 RCX: 00007f3387df725d
RDX: 0000000000000000 RSI: 000055fcbe6cfe52 RDI: 0000000000000008
RBP: 00007ffda1809900 R08: 0000000000000040 R09: 00007ffda1809890
R10: 00007f3387ed3b20 R11: 0000000000000246 R12: 000055fcbe6cfe52
R13: 0000000000040000 R14: 000055fcd4101590 R15: 0000000000000000
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xf54f
flags: 0x100000000000000(node=0|zone=1)
raw: 0100000000000000 0000000000000000 ffffea00003d53c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88800f54fd00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88800f54fd80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88800f54fe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff88800f54fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88800f54ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Regards,
Yang Zi