From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 026B429A9C3; Mon, 9 Feb 2026 14:53:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770648823; cv=none; b=i5O7VQB5M3DRTCzNH6cQ3+W04QnZ7g2kynTPYQbYoSmhNJhvgruI3ZWmiARe5XoYbk/gCQOexL9ZcT50jnjsk5SjLOpGnxuHfEnOxRcmtZCK+mXxjGrGtYSKQY8TbtbBaz4kM6mNm+zpNMvhH/Hs9QPCn1ftRAoKzYE40ECZcss= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770648823; c=relaxed/simple; bh=fE+HtipzH/1H9aOuvcR+j5tKa9xLcEfyoT08Zs74viM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MZBZHmdm0VX0n0aUyBq4UveGqLLi2YteJ4BW0b+AyoTcWChLRa11xgQJg8+mfzJVZHLZw/4+3FGCUySW5DGh6uRg8FYRNXulK0TgNrEre1n9VayhDJB5DkirMKf2IzGYev9ff3SVVvJzo/r/fSkzSJWVtGDrLqONhxJA3VYgPCw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=G5lvPMJZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="G5lvPMJZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 505F3C116C6; Mon, 9 Feb 2026 14:53:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1770648822; bh=fE+HtipzH/1H9aOuvcR+j5tKa9xLcEfyoT08Zs74viM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G5lvPMJZ6r7gga6w0qaDS1ChyX9ZRWN3VsQKsi3WodnJm7jA0MSc3dEq1TgMPA/EI GyYcl+0DkupWlwm5nbyo0q3Liy334A8wXkwhwAYIsJY7Vb6Q8Zq9G6grcOSkJFDTO1 ss0YRr8m+zlk79niVp0v1nF+dlW8T5MZRlsXQsGs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pimyn Girgis , Alexander Potapenko , Dmitry Vyukov , Marco Elver , Ernesto Martnez Garca , Kees Cook , Andrew Morton Subject: [PATCH 5.15 06/75] mm/kfence: randomize the freelist on initialization Date: Mon, 9 Feb 2026 15:24:03 +0100 Message-ID: <20260209142302.068182390@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260209142301.830618238@linuxfoundation.org> References: <20260209142301.830618238@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pimyn Girgis commit 870ff19251bf3910dda7a7245da826924045fedd upstream. Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below(). Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop. Link: https://lkml.kernel.org/r/20260120161510.3289089-1-pimyn@google.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Pimyn Girgis Reviewed-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Marco Elver Cc: Ernesto Martnez Garca Cc: Greg KH Cc: Kees Cook Cc: Signed-off-by: Andrew Morton Signed-off-by: Pimyn Girgis Signed-off-by: Greg Kroah-Hartman --- mm/kfence/core.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -520,7 +520,7 @@ static bool __init kfence_init_pool(void { unsigned long addr = (unsigned long)__kfence_pool; struct page *pages; - int i; + int i, rand; char *p; if (!__kfence_pool) @@ -576,13 +576,30 @@ static bool __init kfence_init_pool(void INIT_LIST_HEAD(&meta->list); raw_spin_lock_init(&meta->lock); meta->state = KFENCE_OBJECT_UNUSED; - meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */ - list_add_tail(&meta->list, &kfence_freelist); + /* Use addr to randomize the freelist. */ + meta->addr = i; /* Protect the right redzone. */ - if (unlikely(!kfence_protect(addr + PAGE_SIZE))) + if (unlikely(!kfence_protect(addr + 2 * i * PAGE_SIZE + PAGE_SIZE))) { + addr += 2 * i * PAGE_SIZE; goto err; + } + } + + for (i = CONFIG_KFENCE_NUM_OBJECTS; i > 0; i--) { + rand = get_random_u32() % i; + swap(kfence_metadata[i - 1].addr, kfence_metadata[rand].addr); + } + + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + struct kfence_metadata *meta_1 = &kfence_metadata[i]; + struct kfence_metadata *meta_2 = &kfence_metadata[meta_1->addr]; + + list_add_tail(&meta_2->list, &kfence_freelist); + } + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + kfence_metadata[i].addr = addr; addr += 2 * PAGE_SIZE; }