Commit d155aab9 authored by Alexander Potapenko's avatar Alexander Potapenko Committed by Andrew Morton
Browse files

mm/kfence: fix KASAN hardware tag faults during late enablement 

When KASAN hardware tags are enabled, re-enabling KFENCE late (via
/sys/module/kfence/parameters/sample_interval) causes KASAN faults.

This happens because the KFENCE pool and metadata are allocated via the
page allocator, which tags the memory, while KFENCE continues to access it
using untagged pointers during initialization.

Use __GFP_SKIP_KASAN for late KFENCE pool and metadata allocations to
ensure the memory remains untagged, consistent with early allocations from
memblock.  To support this, add __GFP_SKIP_KASAN to the allowlist in
__alloc_contig_verify_gfp_mask().

Link: https://lkml.kernel.org/r/20260220144940.2779209-1-glider@google.com


Fixes: 0ce20dd8 ("mm: add Kernel Electric-Fence infrastructure")
Signed-off-by: default avatarAlexander Potapenko <glider@google.com>
Suggested-by: default avatarErnesto Martinez Garcia <ernesto.martinezgarcia@tugraz.at>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Marco Elver <elver@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent c80f46ac

mm/kfence/core.c

+8 −6
Original line number Diff line number Diff line
@@ -1004,14 +1004,14 @@ static int kfence_init_late(void) 
#ifdef CONFIG_CONTIG_ALLOC

	struct page *pages;



	pages = alloc_contig_pages(nr_pages_pool, GFP_KERNEL, first_online_node,

				   NULL);

	pages = alloc_contig_pages(nr_pages_pool, GFP_KERNEL | __GFP_SKIP_KASAN,

				   first_online_node, NULL);

	if (!pages)

		return -ENOMEM;



	__kfence_pool = page_to_virt(pages);

	pages = alloc_contig_pages(nr_pages_meta, GFP_KERNEL, first_online_node,

				   NULL);

	pages = alloc_contig_pages(nr_pages_meta, GFP_KERNEL | __GFP_SKIP_KASAN,

				   first_online_node, NULL);

	if (pages)

		kfence_metadata_init = page_to_virt(pages);

#else
@@ -1021,11 +1021,13 @@ static int kfence_init_late(void) 
		return -EINVAL;

	}



	__kfence_pool = alloc_pages_exact(KFENCE_POOL_SIZE, GFP_KERNEL);

	__kfence_pool = alloc_pages_exact(KFENCE_POOL_SIZE,

					  GFP_KERNEL | __GFP_SKIP_KASAN);

	if (!__kfence_pool)

		return -ENOMEM;



	kfence_metadata_init = alloc_pages_exact(KFENCE_METADATA_SIZE, GFP_KERNEL);

	kfence_metadata_init = alloc_pages_exact(KFENCE_METADATA_SIZE,

						 GFP_KERNEL | __GFP_SKIP_KASAN);

#endif



	if (!kfence_metadata_init)

mm/page_alloc.c

+2 −1
Original line number Diff line number Diff line
@@ -6928,7 +6928,8 @@ static int __alloc_contig_verify_gfp_mask(gfp_t gfp_mask, gfp_t *gfp_cc_mask) 
{

	const gfp_t reclaim_mask = __GFP_IO | __GFP_FS | __GFP_RECLAIM;

	const gfp_t action_mask = __GFP_COMP | __GFP_RETRY_MAYFAIL | __GFP_NOWARN |

				  __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO;

				  __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO |

				  __GFP_SKIP_KASAN;

	const gfp_t cc_action_mask = __GFP_RETRY_MAYFAIL | __GFP_NOWARN;



	/*