Re: [PATCH v9 2/4] alloc_tag: clean up the populate failure path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The return value of kasan_alloc_module_shadow() is ignored in vm_module_tags_populate(), which can lead to a kernel panic if shadow memory allocation fails.
--

commit 2ae06d89a64873006e3ba06f14d9b47ec2d37bcf
Author: Hao Ge <hao.ge@linux.dev>

alloc_tag: clean up the populate failure path

The reservation is already stored in the maple tree when
vm_module_tags_populate() fails. A failed load never unloads the
module, so nothing releases the entry. Release it and roll
module_tags.size back.

> diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c
> index 2070e682fe106..95ddf5b743d0b 100644
> --- a/mm/alloc_tag.c
> +++ b/mm/alloc_tag.c
> @@ -804,6 +804,13 @@ static int vm_module_tags_populate(void)
>  				     next_page, PAGE_SHIFT) < 0) {
>  			release_pages_arg arg = { .pages = next_page };
>  
> +			/*
> +			 * vmap_pages_range() only runs once all pages were
> +			 * allocated, and it may have installed some mappings
> +			 * before failing. Undo them.
> +			 */
> +			if (nr == more_pages)
> +				vunmap_range(phys_end, phys_end + (nr << PAGE_SHIFT));
>  			/* Clean up and error out */
>  			release_pages(arg, nr);
>  			return -ENOMEM;
>  		}

[Severity: High]
This isn't a bug introduced by this patch, but just below this code in
vm_module_tags_populate(), the return value of kasan_alloc_module_shadow() is
ignored:

		if (old_shadow_end < new_shadow_end)
			kasan_alloc_module_shadow((void *)old_shadow_end,
						  new_shadow_end - old_shadow_end,
						  GFP_KERNEL);

If the shadow memory allocation fails due to memory pressure, could this lead
to a kernel panic?

When the module later accesses its allocation tags, the KASAN instrumentation
would attempt to read unmapped shadow memory, causing a fatal page fault.

Since other kernel components like mm/execmem.c explicitly check the return
value of this function, should vm_module_tags_populate() also check for
allocation failure and error out appropriately?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908092412.115953-1-hao.ge@linux.dev?part=2