Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] The return value of kasan_alloc_module_shadow() is ignored in vm_module_tags_populate(), which can lead to a kernel panic if shadow memory allocation fails. -- commit 2ae06d89a64873006e3ba06f14d9b47ec2d37bcf Author: Hao Ge <[email protected]> alloc_tag: clean up the populate failure path The reservation is already stored in the maple tree when vm_module_tags_populate() fails. A failed load never unloads the module, so nothing releases the entry. Release it and roll module_tags.size back. > diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c > index 2070e682fe106..95ddf5b743d0b 100644 > --- a/mm/alloc_tag.c > +++ b/mm/alloc_tag.c > @@ -804,6 +804,13 @@ static int vm_module_tags_populate(void) > next_page, PAGE_SHIFT) < 0) { > release_pages_arg arg = { .pages = next_page }; > > + /* > + * vmap_pages_range() only runs once all pages were > + * allocated, and it may have installed some mappings > + * before failing. Undo them. > + */ > + if (nr == more_pages) > + vunmap_range(phys_end, phys_end + (nr << > PAGE_SHIFT)); > /* Clean up and error out */ > release_pages(arg, nr); > return -ENOMEM; > } [Severity: High] This isn't a bug introduced by this patch, but just below this code in vm_module_tags_populate(), the return value of kasan_alloc_module_shadow() is ignored: if (old_shadow_end < new_shadow_end) kasan_alloc_module_shadow((void *)old_shadow_end, new_shadow_end - old_shadow_end, GFP_KERNEL); If the shadow memory allocation fails due to memory pressure, could this lead to a kernel panic? When the module later accesses its allocation tags, the KASAN instrumentation would attempt to read unmapped shadow memory, causing a fatal page fault. Since other kernel components like mm/execmem.c explicitly check the return value of this function, should vm_module_tags_populate() also check for allocation failure and error out appropriately? [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
