Re: [PATCH 1/1] alloc_tag: allocate percpu counters for module tags dynamically

[Andrew Morton]

On Fri, 16 May 2025 17:07:39 -0700 Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:

> When a module gets unloaded it checks whether any of its tags are still
> in use and if so, we keep the memory containing module's allocation tags
> alive until all tags are unused. However percpu counters referenced by
> the tags are freed by free_module(). This will lead to UAF if the memory
> allocated by a module is accessed after module was unloaded. To fix this
> we allocate percpu counters for module allocation tags dynamically and
> we keep it alive for tags which are still in use after module unloading.
> This also removes the requirement of a larger PERCPU_MODULE_RESERVE when
> memory allocation profiling is enabled because percpu memory for counters
> does not need to be reserved anymore.
> 
> Fixes: 0db6f8d7820a ("alloc_tag: load module tags into separate contiguous memory")
> Reported-by: David Wang <00107082@xxxxxxx>
> Closes: https://lore.kernel.org/all/20250516131246.6244-1-00107082@xxxxxxx/
> Signed-off-by: Suren Baghdasaryan <surenb@xxxxxxxxxx>
> ---
>  include/linux/alloc_tag.h | 12 ++++++
>  include/linux/codetag.h   |  8 ++--
>  include/linux/percpu.h    |  4 --
>  lib/alloc_tag.c           | 87 +++++++++++++++++++++++++++++++--------
>  lib/codetag.c             |  5 ++-
>  5 files changed, 88 insertions(+), 28 deletions(-)

Should we backport this fix into -stable kernels?  I'm thinking yes.