From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-185.mta1.migadu.com (out-185.mta1.migadu.com [95.215.58.185]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3318C3C10B9 for ; Wed, 5 Aug 2026 02:26:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.185 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785896816; cv=none; b=KBi2BBDXqhs6iqWL7Jrx89L8i+Ap8hJlWmBPUDHvxeS2m9N1DDPOkNTPNMo3b8g6Sfa86WlAziw4gHzkiiwBFtnI5r0jMzqCxsuC0rNEeLekEXW22Jzjos3WpnvdpwxLusfyDBhBaBz2QyWBe1lDyPeRg+Zt7FbiAIUoWSeV/ws= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785896816; c=relaxed/simple; bh=BpMXWW7tfMIZFD/W0Wt63S+GFgqRjkyqsN9/DXhlK+c=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=iRAvlMp0T4ibyVHHg6oP/GdZrFt8DBF8NjEjrVDzCxQL0xb3PgshCOG8dRpBDEIoh6j8c454rhbMof4ZI5JEJM1y7nNzaV972rIiHFVq81xfa75RLUYmjJeVYcEjlD8V2TjSE7oc9nj5C6ab9CxU1eTcpZkdYaHguBnU9QFoRqc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=dApTgvPb; arc=none smtp.client-ip=95.215.58.185 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="dApTgvPb" Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785896801; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qxhPyeCLidu0a6r7PQAlsqHOIelpm7O7iJDL5zwrXtA=; b=dApTgvPbD40Jr9rJ8xg6bqSqA7DUkvdQNhYWYk+bmQWF+T+z3t3L3vb9NdAYXNWg+jNXM9 QNGrayoiJN2wymZ6QXooX+GxxcZe9eXFQpLIL+9T5n39E4XFV14xlTXYsAUlw1G7JGJwxr Sl9E4w1frMLhSsDezKkitaXhkzt6uWg= Date: Wed, 5 Aug 2026 10:26:02 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH v2] alloc_tag: fix undetected compressed tag overflow when profiling is disabled To: Suren Baghdasaryan Cc: Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Abhishek Bapat , stable@vger.kernel.org References: <20260804122038.190270-1-hao.ge@linux.dev> Content-Language: en-US X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Hao Ge In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT Hi Suren Thanks a lot for your review. On 2026/8/5 04:08, Suren Baghdasaryan wrote: > On Tue, Aug 4, 2026 at 5:21 AM Hao Ge wrote: >> In reserve_module_tags(), the tag overflow check is gated on >> mem_alloc_profiling_enabled(): >> >> if (mem_alloc_profiling_enabled() && !tags_addressable()) >> >> If profiling is toggled off at runtime and a module is loaded whose >> tags exceed the compressed-mode limit, shutdown_mem_profiling() is >> skipped. vm_module_tags_populate() still maps memory for the tags and >> the module loads successfully, but the total tag count now exceeds what >> NR_UNUSED_PAGEFLAG_BITS can address. >> >> Once profiling is re-enabled, ref_to_idx() computes each tag's index >> as its position in the alloc_tag array. update_page_tag_ref() masks >> it to alloc_tag_ref_mask before storing in page->flags. Indices >> beyond the mask are truncated and idx_to_ref() resolves them to wrong >> tags. >> >> mem_alloc_profiling_enabled() and mem_profiling_compressed are >> independent. Once compressed mode is established at boot, it stays >> active regardless of runtime toggles of mem_profiling. >> >> Remove the mem_alloc_profiling_enabled() guard. Also return an error >> after shutdown_mem_profiling() to skip vm_module_tags_populate(), as >> the mapped pages would never be reused - shutdown_mem_profiling() sets >> mem_profiling_support to false, so no future module load enters the >> codetag path. >> >> Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression") >> Cc: stable@vger.kernel.org >> Signed-off-by: Hao Ge > Thanks for the fix, Hao! > >> --- >> Changes in v2: >> - Return error after shutdown_mem_profiling() to skip unnecessary >> vm_module_tags_populate() >> v1 link: https://lore.kernel.org/all/20260804064408.105033-1-hao.ge@linux.dev/ >> --- >> mm/alloc_tag.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c >> index 52aece27b00e..d8c36430f1c0 100644 >> --- a/mm/alloc_tag.c >> +++ b/mm/alloc_tag.c >> @@ -904,10 +904,11 @@ static void *reserve_module_tags(struct module *mod, unsigned long size, >> int grow_res; >> >> module_tags.size = offset + size; >> - if (mem_alloc_profiling_enabled() && !tags_addressable()) { > Makes sense but how about replacing mem_alloc_profiling_enabled() with > mem_profiling_support? Otherwise this warning will be issued multiple > times if we are loading multiple modules. That's a really good point, this duplicate warning issue will indeed happen. When I thought over your point, I realized using mem_profiling_support creates a small race window. Thread A（insmod A）                      Thread B (insmod B) --------- --------- needs_section_mem() -> true     needs_section_mem() -> true     (profiling still supported) reserve_module_tags()     overflow -> shutdown     mem_profiling_support=false     return -ENOSPC     reserve_module_tags()         mem_profiling_support==false         -> overflow check skipped         -> vm_module_tags_populate()             maps unused tag pages So I'd rather go with pr_warn_once here. >> + if (!tags_addressable()) { >> shutdown_mem_profiling(true); >> pr_warn("With module %s there are too many tags to fit in %d page flag bits. Memory allocation profiling is disabled!\n", >> mod->name, NR_UNUSED_PAGEFLAG_BITS); >> + return ERR_PTR(-ENOSPC); > This ENOSPC error will be propagated all the way up to the init_module > syscall and it's not among the error codes currently expected (see: > https://man7.org/linux/man-pages/man2/init_module.2.html). I suggest > returning ENOMEM instead. Agree, will change Thanks Best Regards Hao >> } >> >> grow_res = vm_module_tags_populate(); >> -- >> 2.25.1 >>