linux-kernel - Re: [PATCH 1/1] alloc_tag: allocate percpu counters for module tags dynamically

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250519155145.8378a397a755c1cc5a3e2d4e@linux-foundation.org>
Date: Mon, 19 May 2025 15:51:45 -0700
From: Andrew Morton <akpm@...ux-foundation.org>
To: Suren Baghdasaryan <surenb@...gle.com>
Cc: kent.overstreet@...ux.dev, 00107082@....com, dennis@...nel.org,
 tj@...nel.org, cl@...two.org, pasha.tatashin@...een.com,
 linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] alloc_tag: allocate percpu counters for module tags
 dynamically

On Fri, 16 May 2025 17:07:39 -0700 Suren Baghdasaryan <surenb@...gle.com> wrote:

> When a module gets unloaded it checks whether any of its tags are still
> in use and if so, we keep the memory containing module's allocation tags
> alive until all tags are unused. However percpu counters referenced by
> the tags are freed by free_module(). This will lead to UAF if the memory
> allocated by a module is accessed after module was unloaded. To fix this
> we allocate percpu counters for module allocation tags dynamically and
> we keep it alive for tags which are still in use after module unloading.
> This also removes the requirement of a larger PERCPU_MODULE_RESERVE when
> memory allocation profiling is enabled because percpu memory for counters
> does not need to be reserved anymore.
> 
> Fixes: 0db6f8d7820a ("alloc_tag: load module tags into separate contiguous memory")
> Reported-by: David Wang <00107082@....com>
> Closes: https://lore.kernel.org/all/20250516131246.6244-1-00107082@163.com/
> Signed-off-by: Suren Baghdasaryan <surenb@...gle.com>
> ---
>  include/linux/alloc_tag.h | 12 ++++++
>  include/linux/codetag.h   |  8 ++--
>  include/linux/percpu.h    |  4 --
>  lib/alloc_tag.c           | 87 +++++++++++++++++++++++++++++++--------
>  lib/codetag.c             |  5 ++-
>  5 files changed, 88 insertions(+), 28 deletions(-)

Should we backport this fix into -stable kernels?  I'm thinking yes.