[PATCH] mm/alloc_tag: account for reserved tag ids in the kernel tag check

[PATCH] mm/alloc_tag: account for reserved tag ids in the kernel tag check

[Hao Ge]

The tag ids stored in the page flags include two reserved markers.
Id 0 means the page has no tag and id 1 means the tag was cleared,
so real tags start at CODETAG_ID_FIRST. The kernel-side check in
alloc_tag_sec_init() compared kernel_tags.count alone against the
addressable limit, so with the count at or just under the limit
the last tag ids wrapped into those markers. Pages allocated
through them then look the same as untagged pages on free, nothing
is ever subtracted from the real tag and /proc/allocinfo shows
that memory as still allocated.

Add the missing CODETAG_ID_FIRST, same as tags_addressable().

Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression")
Cc: stable@vger.kernel.org
Signed-off-by: Hao Ge <hao.ge@linux.dev>
---
 mm/alloc_tag.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c
index cfa0fc84b68f..cf100e7a852f 100644
--- a/mm/alloc_tag.c
+++ b/mm/alloc_tag.c
@@ -629,7 +629,7 @@ void __init alloc_tag_sec_init(void)
 	kernel_tags.count = last_codetag - kernel_tags.first_tag;
 
 	/* Check if kernel tags fit into page flags */
-	if (kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
+	if (CODETAG_ID_FIRST + kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
 		shutdown_mem_profiling(false); /* allocinfo file does not exist yet */
 		pr_err("%lu allocation tags cannot be references using %d available page flag bits. Memory allocation profiling is disabled!\n",
 			kernel_tags.count, NR_UNUSED_PAGEFLAG_BITS);
-- 
2.25.1

Re: [PATCH] mm/alloc_tag: account for reserved tag ids in the kernel tag check

[Suren Baghdasaryan]

On Wed, Sep 16, 2026 at 12:55 AM Hao Ge <hao.ge@linux.dev> wrote:
>
> The tag ids stored in the page flags include two reserved markers.
> Id 0 means the page has no tag and id 1 means the tag was cleared,
> so real tags start at CODETAG_ID_FIRST. The kernel-side check in
> alloc_tag_sec_init() compared kernel_tags.count alone against the
> addressable limit, so with the count at or just under the limit
> the last tag ids wrapped into those markers. Pages allocated
> through them then look the same as untagged pages on free, nothing
> is ever subtracted from the real tag and /proc/allocinfo shows
> that memory as still allocated.
>
> Add the missing CODETAG_ID_FIRST, same as tags_addressable().
>
> Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hao Ge <hao.ge@linux.dev>

Nice catch!

Acked-by: Suren Baghdasaryan <surenb@google.com>

> ---
>  mm/alloc_tag.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c
> index cfa0fc84b68f..cf100e7a852f 100644
> --- a/mm/alloc_tag.c
> +++ b/mm/alloc_tag.c
> @@ -629,7 +629,7 @@ void __init alloc_tag_sec_init(void)
>         kernel_tags.count = last_codetag - kernel_tags.first_tag;
>
>         /* Check if kernel tags fit into page flags */
> -       if (kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
> +       if (CODETAG_ID_FIRST + kernel_tags.count > (1UL << NR_UNUSED_PAGEFLAG_BITS)) {
>                 shutdown_mem_profiling(false); /* allocinfo file does not exist yet */
>                 pr_err("%lu allocation tags cannot be references using %d available page flag bits. Memory allocation profiling is disabled!\n",
>                         kernel_tags.count, NR_UNUSED_PAGEFLAG_BITS);
> --
> 2.25.1
>