diff options
| author | Peter Collingbourne <pcc@google.com> | 2021-06-02 16:52:30 -0700 |
|---|---|---|
| committer | Will Deacon <will@kernel.org> | 2021-06-04 19:32:21 +0100 |
| commit | c275c5c6d50a0518cdb0584e85905d10e7cefc6e (patch) | |
| tree | b621c3297979537bc51d124dbf57ebc932b98ca2 /mm/kasan | |
| parent | 013bb59dbb7cf876449df860946458a595a96d51 (diff) | |
| download | linux-stable-c275c5c6d50a0518cdb0584e85905d10e7cefc6e.tar.gz linux-stable-c275c5c6d50a0518cdb0584e85905d10e7cefc6e.tar.bz2 linux-stable-c275c5c6d50a0518cdb0584e85905d10e7cefc6e.zip | |
kasan: disable freed user page poisoning with HW tags
Poisoning freed pages protects against kernel use-after-free. The
likelihood of such a bug involving kernel pages is significantly higher
than that for user pages. At the same time, poisoning freed pages can
impose a significant performance cost, which cannot always be justified
for user pages given the lower probability of finding a bug. Therefore,
disable freed user page poisoning when using HW tags. We identify
"user" pages via the flag set GFP_HIGHUSER_MOVABLE, which indicates
a strong likelihood of not being directly accessible to the kernel.
Signed-off-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://linux-review.googlesource.com/id/I716846e2de8ef179f44e835770df7e6307be96c9
Link: https://lore.kernel.org/r/20210602235230.3928842-5-pcc@google.com
Signed-off-by: Will Deacon <will@kernel.org>
Diffstat (limited to 'mm/kasan')
| -rw-r--r-- | mm/kasan/hw_tags.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/mm/kasan/hw_tags.c b/mm/kasan/hw_tags.c index 41fd5326ee0a..ed5e5b833d61 100644 --- a/mm/kasan/hw_tags.c +++ b/mm/kasan/hw_tags.c @@ -246,6 +246,9 @@ void kasan_alloc_pages(struct page *page, unsigned int order, gfp_t flags) */ bool init = !want_init_on_free() && want_init_on_alloc(flags); + if (flags & __GFP_SKIP_KASAN_POISON) + SetPageSkipKASanPoison(page); + if (flags & __GFP_ZEROTAGS) { int i; |