summaryrefslogtreecommitdiffstats
path: root/mm/kasan
diff options
context:
space:
mode:
authorPeter Collingbourne <pcc@google.com>2021-06-03 01:52:30 +0200
committerWill Deacon <will@kernel.org>2021-06-04 20:32:21 +0200
commitc275c5c6d50a0518cdb0584e85905d10e7cefc6e (patch)
treeb621c3297979537bc51d124dbf57ebc932b98ca2 /mm/kasan
parentarm64: mte: handle tags zeroing at page allocation time (diff)
downloadlinux-c275c5c6d50a0518cdb0584e85905d10e7cefc6e.tar.xz
linux-c275c5c6d50a0518cdb0584e85905d10e7cefc6e.zip
kasan: disable freed user page poisoning with HW tags
Poisoning freed pages protects against kernel use-after-free. The likelihood of such a bug involving kernel pages is significantly higher than that for user pages. At the same time, poisoning freed pages can impose a significant performance cost, which cannot always be justified for user pages given the lower probability of finding a bug. Therefore, disable freed user page poisoning when using HW tags. We identify "user" pages via the flag set GFP_HIGHUSER_MOVABLE, which indicates a strong likelihood of not being directly accessible to the kernel. Signed-off-by: Peter Collingbourne <pcc@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Link: https://linux-review.googlesource.com/id/I716846e2de8ef179f44e835770df7e6307be96c9 Link: https://lore.kernel.org/r/20210602235230.3928842-5-pcc@google.com Signed-off-by: Will Deacon <will@kernel.org>
Diffstat (limited to 'mm/kasan')
-rw-r--r--mm/kasan/hw_tags.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/mm/kasan/hw_tags.c b/mm/kasan/hw_tags.c
index 41fd5326ee0a..ed5e5b833d61 100644
--- a/mm/kasan/hw_tags.c
+++ b/mm/kasan/hw_tags.c
@@ -246,6 +246,9 @@ void kasan_alloc_pages(struct page *page, unsigned int order, gfp_t flags)
*/
bool init = !want_init_on_free() && want_init_on_alloc(flags);
+ if (flags & __GFP_SKIP_KASAN_POISON)
+ SetPageSkipKASanPoison(page);
+
if (flags & __GFP_ZEROTAGS) {
int i;