Re: [PATCH v10 6/6] alloc_tag: Defer /proc/allocinfo removal to a workqueue

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] mm: memory leak in alloc_tag_init() when proc_create() fails
--

commit 4e566e12e21d0ae73ee9a25235cceeeff9cef087
Author: Hao Ge <hao.ge@linux.dev>

alloc_tag: Defer /proc/allocinfo removal to a workqueue

shutdown_mem_profiling() calls remove_proc_entry() from
reserve_module_tags(), which runs under mod_lock held for write.
remove_proc_entry() waits for readers, and a reader takes mod_lock for
read in allocinfo_start(). This commit moves remove_proc_entry() to a
workqueue and relocates file creation to avoid panics.

> diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c
> index 1ca0409b492b8..cfa0fc84b68f9 100644
> --- a/mm/alloc_tag.c
> +++ b/mm/alloc_tag.c

[ ... ]

> @@ -1358,16 +1366,10 @@ static int __init alloc_tag_init(void)
>  		return 0;
>  	}
>  
> -	if (!proc_create(ALLOCINFO_FILE_NAME, 0400, NULL, &allocinfo_proc_ops)) {
> -		pr_err("Failed to create %s file\n", ALLOCINFO_FILE_NAME);
> -		shutdown_mem_profiling(false);
> -		return -ENOMEM;
> -	}
> -
>  	res = alloc_mod_tags_mem();
>  	if (res) {
>  		pr_err("Failed to reserve address space for module tags, errno = %d\n", res);
> -		shutdown_mem_profiling(true);
> +		shutdown_mem_profiling(false);
>  		return res;
>  	}
>  
> @@ -1375,10 +1377,16 @@ static int __init alloc_tag_init(void)
>  	if (IS_ERR(alloc_tag_cttype)) {
>  		pr_err("Allocation tags registration failed, errno = %pe\n", alloc_tag_cttype);
>  		free_mod_tags_mem();
> -		shutdown_mem_profiling(true);
> +		shutdown_mem_profiling(false);
>  		return PTR_ERR(alloc_tag_cttype);
>  	}
>  
> +	if (!proc_create(ALLOCINFO_FILE_NAME, 0400, NULL, &allocinfo_proc_ops)) {
> +		pr_err("Failed to create %s file\n", ALLOCINFO_FILE_NAME);
> +		shutdown_mem_profiling(false);
> +		return -ENOMEM;

[Severity: Medium]
Does this code leak the memory allocated by alloc_mod_tags_mem()?

Since the proc_create() call was relocated to execute after
alloc_mod_tags_mem(), this error path seems to exit without unwinding the
previous allocation by calling free_mod_tags_mem(), directly introducing a
memory leak when procfs creation fails in mm/alloc_tag.c:alloc_tag_init().

> +	}
> +
>  	return 0;
>  }
>  module_init(alloc_tag_init);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915070001.113559-1-hao.ge@linux.dev?part=6