Re: [PATCH] mm: snapshot alloc tags in alloc_tag_top_users() to avoid UAF

[Lorenzo Stoakes (ARM)]

On Sun, Nov 15, 2026 at 12:47:11AM +0800, shao.mingyin@xxxxxxxxxx wrote:
> From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
>
> mm: snapshot alloc tags in alloc_tag_top_users() to avoid UAF
>
> alloc_tag_top_users() selects tags under the codetag module-list lock,
> then returns raw codetag pointers. __show_mem() dereferences the tags,
> their strings and per-CPU counters after that lock has been released.
> Concurrent module unloading can invalidate those objects before they
> are printed in the OOM or SysRq-m report.
>
> Copy the selected tags and counters while holding the module-list lock,
> and print only the copies. Reuse allocinfo_to_params(), which copies
> names into fixed-size buffers and retains at most their last 63
> characters. Preserve the signed comparison used to select the top tags.
>
> Keep the larger output array static under the existing show_mem lock
> to avoid increasing the stack frame. The counters remain approximate
> lockless per-CPU observations; the copy protects object lifetime.
>
> Fixes: 1438d349d16b ("lib: add memory allocations report in show_mem()")
> Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

NAK.

this is generated by some AI slopper's script, spamming the kernel. The
patches I looked at were wrong/broken, so no to anything from this person.

They've sent 300 mails in under four weeks spanniing: ata, scsi, target,
ufs, nvme/nvmet, ubifs, ublk, zloop, dm, md, mmc, virtio-blk, mfd, gpio,
pwm, spi, PCI, ASoC, ACPI, net, vfs mount, block partitions, and now mm.

and 17 series across 7 subsystems over the past 23 hours.

We need a way to ban emails from people like this...

--
Cheers, Lorenzo