[PATCH v10 2/6] alloc_tag: clean up the populate failure path
From: Hao Ge <hao.ge@linux.dev>
Date: 2026-09-15 06:59:25
Also in:
linux-mm, lkml, stable
Subsystem:
memory management, memory management - allocation profiling (alloc tag), the rest · Maintainers:
Andrew Morton, Suren Baghdasaryan, Linus Torvalds
The reservation is already stored in the maple tree when
vm_module_tags_populate() fails. A failed load never unloads the
module, so nothing releases the entry. Release it and roll
module_tags.size back. Without the rollback a concurrent load that
already passed needs_section_mem() can reuse the freed gap, skip
vm_module_tags_populate() and write to unmapped memory.
vmap_pages_range() may have installed some PTEs before failing. A
retry to populate the same range would BUG on them, so undo them,
but only if vmap actually ran.
Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression")
Fixes: 0f9b685626da ("alloc_tag: populate memory for module tags as needed")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Hao Ge <hao.ge@linux.dev>
---
mm/alloc_tag.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c
index 2070e682fe10..95ddf5b743d0 100644
--- a/mm/alloc_tag.c
+++ b/mm/alloc_tag.c@@ -804,6 +804,13 @@ static int vm_module_tags_populate(void) next_page, PAGE_SHIFT) < 0) { release_pages_arg arg = { .pages = next_page }; + /* + * vmap_pages_range() only runs once all pages were + * allocated, and it may have installed some mappings + * before failing. Undo them. + */ + if (nr == more_pages) + vunmap_range(phys_end, phys_end + (nr << PAGE_SHIFT)); /* Clean up and error out */ release_pages(arg, nr); return -ENOMEM;
@@ -947,6 +954,7 @@ static void *reserve_module_tags(struct module *mod, unsigned long size, return ret; if (module_tags.size < offset + size) { + unsigned long prev_size = module_tags.size; int grow_res; module_tags.size = offset + size;
@@ -961,6 +969,8 @@ static void *reserve_module_tags(struct module *mod, unsigned long size, shutdown_mem_profiling(true); pr_err("Failed to allocate memory for allocation tags in the module %s. Memory allocation profiling is disabled!\n", mod->name); + release_module_tags(mod, false); + module_tags.size = prev_size; return ERR_PTR(grow_res); } }
--
2.25.1