Re: [PATCH 1/1] alloc_tag: allocate percpu counters for module tags dynamically

[Suren Baghdasaryan]

On Mon, May 19, 2025 at 3:51 PM Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> On Fri, 16 May 2025 17:07:39 -0700 Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:
>
> > When a module gets unloaded it checks whether any of its tags are still
> > in use and if so, we keep the memory containing module's allocation tags
> > alive until all tags are unused. However percpu counters referenced by
> > the tags are freed by free_module(). This will lead to UAF if the memory
> > allocated by a module is accessed after module was unloaded. To fix this
> > we allocate percpu counters for module allocation tags dynamically and
> > we keep it alive for tags which are still in use after module unloading.
> > This also removes the requirement of a larger PERCPU_MODULE_RESERVE when
> > memory allocation profiling is enabled because percpu memory for counters
> > does not need to be reserved anymore.
> >
> > Fixes: 0db6f8d7820a ("alloc_tag: load module tags into separate contiguous memory")
> > Reported-by: David Wang <00107082@xxxxxxx>
> > Closes: https://lore.kernel.org/all/20250516131246.6244-1-00107082@xxxxxxx/
> > Signed-off-by: Suren Baghdasaryan <surenb@xxxxxxxxxx>
> > ---
> >  include/linux/alloc_tag.h | 12 ++++++
> >  include/linux/codetag.h   |  8 ++--
> >  include/linux/percpu.h    |  4 --
> >  lib/alloc_tag.c           | 87 +++++++++++++++++++++++++++++++--------
> >  lib/codetag.c             |  5 ++-
> >  5 files changed, 88 insertions(+), 28 deletions(-)
>
> Should we backport this fix into -stable kernels?  I'm thinking yes.

Yes, I should have CC'ed stable. The patch this one is fixing was
first introduced in 6.13. I just tried and it applies cleanly to
stable linux-6.13.y and linux-6.14.y.
Should I forward this email to stable or send a separate patch to them?