CVE-2026-72431: alloc_tag: fix use-after-free in /proc/allocinfo after module unload

In the Linux kernel, the following vulnerability has been resolved:

alloctag: fix use-after-free in /proc/allocinfo after module unload

allocinfostart() only reinitializes the codetag iterator at position 0. For subsequent reads (position > 0), it reuses cached iterator state from the previous batch. allocinfostop() drops modlock between read batches, which allows module unload to complete and free the module memory that the cached iterator still references:

CPU0 (read) CPU1 (rmmod) ---- ---- allocinfostart(pos=0) downread(modlock) allocinfoshow() ... allocinfostop() upread(modlock) codetagunloadmodule() kfree(cmod) releasemoduletags() ... freemodmem() allocinfostart(pos=N) downread(modlock) // reuses cached iter, skips re-init allocinfoshow() ct->filename <-- UAF

After freemodmem() frees the module's .rodata, allocinfoshow() dereferences ct->filename, ct->function which point there.

Save the iterator state in allocinfonext() and resume from it in allocinfostart() with codetagnextct(), which detects module removal via idrfind() returning NULL and skips to the next module.