From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C23D31F583D for ; Tue, 3 Feb 2026 12:48:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770122933; cv=none; b=NGdeHpKRKaV/s06RZfsvjWS7jig3G72/H+QzN1O3AHKZ2NFuScaLvFeYzJu7R9WbS25WKZ92u7uFcMvy/VGG821vsl1wIThbGdI9EqGdkfXkt+RDYqILecvTPPM19Kk8mrQaky+ZrbXLNARhOo36iKXQXmcGsocpDfqAorsNDqQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770122933; c=relaxed/simple; bh=EVTHuCDjIKss5yRANOcYt3DVxBW80huKFO1M9VbKi+M=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=V6BWkgVsbiKupe8xWMfZW924p3FLsypn/c9d9959XLukqxy1fbKoaoAgIiW2RFI88ZbdnUn9PfiytqJ0mCkgdW9Vv+veErmD0FGvz/hn6zPojcPR1futBhi0fkJTIT7ZQ2Lysz5UF/uO9lwowDRkSM1TRpvV+jvlTpELlAAR/TI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KrDpOFhF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KrDpOFhF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A7F7C116D0; Tue, 3 Feb 2026 12:48:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1770122933; bh=EVTHuCDjIKss5yRANOcYt3DVxBW80huKFO1M9VbKi+M=; h=Subject:To:Cc:From:Date:From; b=KrDpOFhFtTqL38BhCHBv56r8wbo800ekFLYLelr0QDJgXRcqSXo99Gvxmn+5NAkxy lz9Mdwk12PYmMpOcxdy5jFivmOAFelTOxpzaQrpuXdnWHOn10rWtA0YZ9J4kWlwtSM 5tCMkVNdkroCZBWF4f0d0O9iUu04+suMfzob2EPU= Subject: FAILED: patch "[PATCH] mm/kfence: randomize the freelist on initialization" failed to apply to 5.15-stable tree To: pimyn@google.com,akpm@linux-foundation.org,dvyukov@google.com,elver@google.com,ernesto.martinezgarcia@tugraz.at,glider@google.com,gregkh@linuxfoundation.org,kees@kernel.org,stable@vger.kernel.org Cc: From: Date: Tue, 03 Feb 2026 13:48:39 +0100 Message-ID: <2026020339-trickery-vegan-e9c3@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 870ff19251bf3910dda7a7245da826924045fedd # git commit -s git send-email --to '' --in-reply-to '2026020339-trickery-vegan-e9c3@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 870ff19251bf3910dda7a7245da826924045fedd Mon Sep 17 00:00:00 2001 From: Pimyn Girgis Date: Tue, 20 Jan 2026 17:15:10 +0100 Subject: [PATCH] mm/kfence: randomize the freelist on initialization Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below(). Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop. Link: https://lkml.kernel.org/r/20260120161510.3289089-1-pimyn@google.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Pimyn Girgis Reviewed-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Marco Elver Cc: Ernesto Martnez Garca Cc: Greg KH Cc: Kees Cook Cc: Signed-off-by: Andrew Morton diff --git a/mm/kfence/core.c b/mm/kfence/core.c index da0f5b6f5744..4f79ec720752 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -596,7 +596,7 @@ static void rcu_guarded_free(struct rcu_head *h) static unsigned long kfence_init_pool(void) { unsigned long addr, start_pfn; - int i; + int i, rand; if (!arch_kfence_init_pool()) return (unsigned long)__kfence_pool; @@ -647,13 +647,27 @@ static unsigned long kfence_init_pool(void) INIT_LIST_HEAD(&meta->list); raw_spin_lock_init(&meta->lock); meta->state = KFENCE_OBJECT_UNUSED; - meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */ - list_add_tail(&meta->list, &kfence_freelist); + /* Use addr to randomize the freelist. */ + meta->addr = i; /* Protect the right redzone. */ - if (unlikely(!kfence_protect(addr + PAGE_SIZE))) + if (unlikely(!kfence_protect(addr + 2 * i * PAGE_SIZE + PAGE_SIZE))) goto reset_slab; + } + for (i = CONFIG_KFENCE_NUM_OBJECTS; i > 0; i--) { + rand = get_random_u32_below(i); + swap(kfence_metadata_init[i - 1].addr, kfence_metadata_init[rand].addr); + } + + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + struct kfence_metadata *meta_1 = &kfence_metadata_init[i]; + struct kfence_metadata *meta_2 = &kfence_metadata_init[meta_1->addr]; + + list_add_tail(&meta_2->list, &kfence_freelist); + } + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + kfence_metadata_init[i].addr = addr; addr += 2 * PAGE_SIZE; } @@ -666,6 +680,7 @@ static unsigned long kfence_init_pool(void) return 0; reset_slab: + addr += 2 * i * PAGE_SIZE; for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) { struct page *page;