linux-kernel - Re: [PATCH 1/1] alloc_tag: allocate percpu counters for module tags dynamically

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJuCfpGgwkAVZJJ-ffLdkBfmggm3=d+Z450matW=TzeQZJ=LDQ@mail.gmail.com>
Date: Mon, 19 May 2025 16:13:28 -0700
From: Suren Baghdasaryan <surenb@...gle.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: kent.overstreet@...ux.dev, 00107082@....com, dennis@...nel.org, 
	tj@...nel.org, cl@...two.org, pasha.tatashin@...een.com, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] alloc_tag: allocate percpu counters for module tags dynamically

On Mon, May 19, 2025 at 3:51 PM Andrew Morton <akpm@...ux-foundation.org> wrote:
>
> On Fri, 16 May 2025 17:07:39 -0700 Suren Baghdasaryan <surenb@...gle.com> wrote:
>
> > When a module gets unloaded it checks whether any of its tags are still
> > in use and if so, we keep the memory containing module's allocation tags
> > alive until all tags are unused. However percpu counters referenced by
> > the tags are freed by free_module(). This will lead to UAF if the memory
> > allocated by a module is accessed after module was unloaded. To fix this
> > we allocate percpu counters for module allocation tags dynamically and
> > we keep it alive for tags which are still in use after module unloading.
> > This also removes the requirement of a larger PERCPU_MODULE_RESERVE when
> > memory allocation profiling is enabled because percpu memory for counters
> > does not need to be reserved anymore.
> >
> > Fixes: 0db6f8d7820a ("alloc_tag: load module tags into separate contiguous memory")
> > Reported-by: David Wang <00107082@....com>
> > Closes: https://lore.kernel.org/all/20250516131246.6244-1-00107082@163.com/
> > Signed-off-by: Suren Baghdasaryan <surenb@...gle.com>
> > ---
> >  include/linux/alloc_tag.h | 12 ++++++
> >  include/linux/codetag.h   |  8 ++--
> >  include/linux/percpu.h    |  4 --
> >  lib/alloc_tag.c           | 87 +++++++++++++++++++++++++++++++--------
> >  lib/codetag.c             |  5 ++-
> >  5 files changed, 88 insertions(+), 28 deletions(-)
>
> Should we backport this fix into -stable kernels?  I'm thinking yes.

Yes, I should have CC'ed stable. The patch this one is fixing was
first introduced in 6.13. I just tried and it applies cleanly to
stable linux-6.13.y and linux-6.14.y.
Should I forward this email to stable or send a separate patch to them?