The reservation is already stored in the maple tree when
vm_module_tags_populate() fails. A failed load never unloads the
module, so nothing releases the entry. Release it and roll
module_tags.size back. Without the rollback a concurrent load that
already passed needs_section_mem() can reuse the freed gap, skip
vm_module_tags_populate() and write to unmapped memory.
Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression")
Fixes: 0f9b685626da ("alloc_tag: populate memory for module tags as needed")
Reported-by: Sashiko <[email protected]>
Cc: [email protected]
Signed-off-by: Hao Ge <[email protected]>
---
mm/alloc_tag.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c
index 2070e682fe10..3e6306ee0764 100644
--- a/mm/alloc_tag.c
+++ b/mm/alloc_tag.c
@@ -947,6 +947,7 @@ static void *reserve_module_tags(struct module *mod,
unsigned long size,
return ret;
if (module_tags.size < offset + size) {
+ unsigned long prev_size = module_tags.size;
int grow_res;
module_tags.size = offset + size;
@@ -961,6 +962,8 @@ static void *reserve_module_tags(struct module *mod,
unsigned long size,
shutdown_mem_profiling(true);
pr_err("Failed to allocate memory for allocation tags
in the module %s. Memory allocation profiling is disabled!\n",
mod->name);
+ release_module_tags(mod, false);
+ module_tags.size = prev_size;
return ERR_PTR(grow_res);
}
}
--
2.25.1
