lib: alloc_tag_module_unload must wait for pending kfree_rcu calls

In the Linux kernel, the following vulnerability has been resolved:

lib: alloc_tag_module_unload must wait for pending kfree_rcu calls

Ben Greear reports following splat:

------------[ cut here ]------------

net/netfilter/nf_nat_core.c:1114 module nf_nat func:nf_nat_register_fn has 256 allocated at module unload

WARNING: CPU: 1 PID: 10421 at lib/alloc_tag.c:168 alloc_tag_module_unload+0x22b/0x3f0

Modules linked in: nf_nat(-) btrfs ufs qnx4 hfsplus hfs minix vfat msdos fat

...

Hardware name: Default string Default string/SKYBAY, BIOS 5.12 08/04/2020

RIP: 0010:alloc_tag_module_unload+0x22b/0x3f0

codetag_unload_module+0x19b/0x2a0

? codetag_load_module+0x80/0x80

nf_nat module exit calls kfree_rcu on those addresses, but the free

operation is likely still pending by the time alloc_tag checks for leaks.

Wait for outstanding kfree_rcu operations to complete before checking

resolves this warning.

Reproducer:

unshare -n iptables-nft -t nat -A PREROUTING -p tcp

grep nf_nat /proc/allocinfo # will list 4 allocations

rmmod nft_chain_nat

rmmod nf_nat # will WARN.

[[email protected]: add comment]