From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E81DF7261C for ; Tue, 3 Feb 2026 20:13:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770149626; cv=none; b=lCB650SToA2NR2Fg8QIEOZmP1uoJQQS4dZ9jYhkFfesq3O3RFfzVEJrn+jO9AY1xsx92RF5dxndbq7gVdsGZlX+ByeeQrhow0hybXvv2Wh4a9reZ0ovnIEQHLqOX4u+QVMNj9Mia9m9Ww/T0bNCUGk3n6xjL7scS5gTsLJO/Tok= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770149626; c=relaxed/simple; bh=Q46r51HdIJB5o5l7hsYvpTB08Qu1AP/8OX8zaJIRsAk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QGVGELHYIQkHredzPZMVkn++pV8daZfBlxAR7H7gmNq+yhf4SiFuVwY00oLYTo/i0oF1qOHWPlPPfeMLdCxlUKJCF27IYZ+9Jt6jRU1jKXP2RVJlPKb6/iNh41rruyXWwx+CmU9v48CDro6hacAfUCaHvRzQ3NslqYXnP03jiAA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=p0pWiY1Z; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="p0pWiY1Z" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 92872C116D0; Tue, 3 Feb 2026 20:13:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1770149625; bh=Q46r51HdIJB5o5l7hsYvpTB08Qu1AP/8OX8zaJIRsAk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p0pWiY1ZhxvkclmLrs8fpp8oKTarRxbNPIdwoe+fYIIIR9saIXDMwEDrffMk4Y6Hx 5e+I/ZdOVma37tBDRD0ux49THE9pY74Qk+c58ubFXI8XvpzQCLW/1TIQEtWWSPDQRt 66h0/0T7NE16KpHpPZNpsv5AuxRce1QWhNIUUQoHhhfaQEsnl/ot6ElxnZrbJ0dTAG noVMOe0birTDlZW7B+JGYE6A5p8AH0k8NWRfB4ozxEFW+ifLXCrKh4UTLbovND2l40 J4qPxNhcwY/QEpYdX1ot7VIxepXxpnqOUZQubwPi/gMXr153pj/in3Fms94G2XghhX 4igcexHqc+WaA== From: Sasha Levin To: stable@vger.kernel.org Cc: Pimyn Girgis , Alexander Potapenko , Dmitry Vyukov , Marco Elver , Ernesto Martnez Garca , Greg KH , Kees Cook , Andrew Morton , Sasha Levin Subject: [PATCH 6.1.y] mm/kfence: randomize the freelist on initialization Date: Tue, 3 Feb 2026 15:13:42 -0500 Message-ID: <20260203201342.1383528-1-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <2026020339-buddhism-daytime-9e95@gregkh> References: <2026020339-buddhism-daytime-9e95@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Pimyn Girgis [ Upstream commit 870ff19251bf3910dda7a7245da826924045fedd ] Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below(). Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop. Link: https://lkml.kernel.org/r/20260120161510.3289089-1-pimyn@google.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Pimyn Girgis Reviewed-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Marco Elver Cc: Ernesto Martnez Garca Cc: Greg KH Cc: Kees Cook Cc: Signed-off-by: Andrew Morton [ replaced kfence_metadata_init with kfence_metadata ] Signed-off-by: Sasha Levin --- mm/kfence/core.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/mm/kfence/core.c b/mm/kfence/core.c index 799d8503f35f0..edf6deb382b67 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -542,7 +542,7 @@ static unsigned long kfence_init_pool(void) { unsigned long addr = (unsigned long)__kfence_pool; struct page *pages; - int i; + int i, rand; if (!arch_kfence_init_pool()) return addr; @@ -590,19 +590,34 @@ static unsigned long kfence_init_pool(void) INIT_LIST_HEAD(&meta->list); raw_spin_lock_init(&meta->lock); meta->state = KFENCE_OBJECT_UNUSED; - meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */ - list_add_tail(&meta->list, &kfence_freelist); + /* Use addr to randomize the freelist. */ + meta->addr = i; /* Protect the right redzone. */ - if (unlikely(!kfence_protect(addr + PAGE_SIZE))) + if (unlikely(!kfence_protect(addr + 2 * i * PAGE_SIZE + PAGE_SIZE))) goto reset_slab; + } + + for (i = CONFIG_KFENCE_NUM_OBJECTS; i > 0; i--) { + rand = get_random_u32_below(i); + swap(kfence_metadata[i - 1].addr, kfence_metadata[rand].addr); + } + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + struct kfence_metadata *meta_1 = &kfence_metadata[i]; + struct kfence_metadata *meta_2 = &kfence_metadata[meta_1->addr]; + + list_add_tail(&meta_2->list, &kfence_freelist); + } + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + kfence_metadata[i].addr = addr; addr += 2 * PAGE_SIZE; } return 0; reset_slab: + addr += 2 * i * PAGE_SIZE; for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) { struct slab *slab = page_slab(nth_page(pages, i)); -- 2.51.0