From nobody Sat Feb 7 21:16:04 2026 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6AF5431B10D for ; Tue, 20 Jan 2026 16:16:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768925775; cv=none; b=aUvLonAODbfGc3TR/8PAz/6E7VvbHkEV4LeP5snvTX+L/+Xhc3R4FIFXWT83hmjIycNNGnQlIKn50njQ4Qv0kPUTmw4KzjTLQQCbqri9L6/AEgXXUlm/wBOn4reXGf9Hj5Q4oIjT5bjG9kuPHCpUt8U3lvBTBw+mHQ7rnUeQFTQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768925775; c=relaxed/simple; bh=cx6fHJOVY7EpVdxfguIigjRygA1bknBX31Ik7S2yhWo=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=lnJG4vf7osobyq95TJ4dOZZQgLw8ecIvTMo3lzhNvKJrLh+lFFSj7fACnD5ZQHjmA/rJRx3Awa9gFyXLO4VEjcHFOiTD+bRG3phcVsFehpeg2hnQzzzEvq8GyCSKWWJ5NJi40N8EZQtCvYuQFE+RD6y4C/9YDy1s/l5PEA5v0TM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--pimyn.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=gn4jbD0A; arc=none smtp.client-ip=209.85.128.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--pimyn.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="gn4jbD0A" Received: by mail-wm1-f74.google.com with SMTP id 5b1f17b1804b1-47edc79ff28so36172935e9.2 for ; Tue, 20 Jan 2026 08:16:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1768925772; x=1769530572; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=zECdq2qx8LIRzMbM9dI3FS5kU++am0Lig5cv/EMeCDY=; b=gn4jbD0AapBrx1aP4Vfk5X8D1PKDZ3d5mA308Or6aYJUrlrbarSGGQ6DTA+NYCqu6/ HdHo8o3ZF7FJGSulNFsZLmhLfVTCTToK982rlYsnfg4NN6+7dQ13vW1guWNW5avIW8aJ Cg/Awg22EaLh+uFOGowsjLENSqexklsqljTClzTAjnNWz/FcCZrmYaHUQqCFUEGCuemx eiUHYs+x1keKbzdwkV91zYuY4MtqtziXXEO4V1C+If6ErrJBC1zIUu3DVY9bBpLSBwk6 Vlo0uuAsX5t88a/VlOhJoA7yOiKnc6+MHAjZHeMxMUHmYzVcsqJlnA0XcMFYZFNA2QJ6 xUfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768925772; x=1769530572; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=zECdq2qx8LIRzMbM9dI3FS5kU++am0Lig5cv/EMeCDY=; b=fXlq87HoyV0/zQ/qEdSmGYJB3jDDtRBn3+5H7ROdu8qmhvzxRillH2kEpxPB9W24R2 42420KDawbd92S5ECaR/mqcvmxF/K9dcYOjvVJIIixszl8CTDiFDahBxnusNsxYuj8sC k1AGd+0iu3eAi3owyaERCJ4ZWmmXAVfFbfEDQE4q5kmhUH6LPObcoPeZEhDfcqjXOwSp JMyAETarZqp3Rs1R9wwbR8AEfrPvumKuvCJiAEgFiBGLA/XnQ4YQ0Iiy6STyrbvbqKJg bwrADY8GF9ucrdoohU1pDk27se+0+FdEuMAzJXguFCJdEpG1sdhjXOweRcIuZJgFi9Sk a2yQ== X-Forwarded-Encrypted: i=1; AJvYcCWdlFqmyknTlGp/zc1FVmfbynLl8SFs1oKyAsN8a8O28+bOBgXcKD4FZPaW3BYYCWDUyU1/F0JkttGPpd0=@vger.kernel.org X-Gm-Message-State: AOJu0YwMCv0D0PbwL9QNsRjEMcGebArsRT0Yt3UT+HpaqzN7XwtpEAwp zdlxhD5e0pqLmsf9ccQGdQgGdBf0N91PVwKqgEgukI4lqzsseoa4dFx7qpHtTI6fMcFUgmd6qD/ 2EA== X-Received: from wmsm27.prod.google.com ([2002:a05:600c:3b1b:b0:477:9769:66d0]) (user=pimyn job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:8b78:b0:47e:e8c2:905f with SMTP id 5b1f17b1804b1-4801e30a790mr216491795e9.8.1768925771811; Tue, 20 Jan 2026 08:16:11 -0800 (PST) Date: Tue, 20 Jan 2026 17:15:10 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog Message-ID: <20260120161510.3289089-1-pimyn@google.com> Subject: [PATCH] mm/kfence: randomize the freelist on initialization From: Pimyn Girgis To: pimyn@google.com Cc: akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, elver@google.com, dvyukov@google.com, glider@google.com, kasan-dev@googlegroups.com, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below(). Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop. Cc: stable@vger.kernel.org Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Pimyn Girgis Reviewed-by: Alexander Potapenko --- mm/kfence/core.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/mm/kfence/core.c b/mm/kfence/core.c index 577a1699c553..9e8b3cfd3f76 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -596,7 +596,7 @@ static void rcu_guarded_free(struct rcu_head *h) static unsigned long kfence_init_pool(void) { unsigned long addr, start_pfn; - int i; + int i, rand; =20 if (!arch_kfence_init_pool()) return (unsigned long)__kfence_pool; @@ -647,13 +647,27 @@ static unsigned long kfence_init_pool(void) INIT_LIST_HEAD(&meta->list); raw_spin_lock_init(&meta->lock); meta->state =3D KFENCE_OBJECT_UNUSED; - meta->addr =3D addr; /* Initialize for validation in metadata_to_pageadd= r(). */ - list_add_tail(&meta->list, &kfence_freelist); + /* Use addr to randomize the freelist. */ + meta->addr =3D i; =20 /* Protect the right redzone. */ - if (unlikely(!kfence_protect(addr + PAGE_SIZE))) + if (unlikely(!kfence_protect(addr + 2 * i * PAGE_SIZE + PAGE_SIZE))) goto reset_slab; + } + + for (i =3D CONFIG_KFENCE_NUM_OBJECTS; i > 0; i--) { + rand =3D get_random_u32_below(i); + swap(kfence_metadata_init[i - 1].addr, kfence_metadata_init[rand].addr); + } =20 + for (i =3D 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + struct kfence_metadata *meta_1 =3D &kfence_metadata_init[i]; + struct kfence_metadata *meta_2 =3D &kfence_metadata_init[meta_1->addr]; + + list_add_tail(&meta_2->list, &kfence_freelist); + } + for (i =3D 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + kfence_metadata_init[i].addr =3D addr; addr +=3D 2 * PAGE_SIZE; } =20 @@ -666,6 +680,7 @@ static unsigned long kfence_init_pool(void) return 0; =20 reset_slab: + addr +=3D 2 * i * PAGE_SIZE; for (i =3D 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) { struct page *page; =20 --=20 2.52.0.457.g6b5491de43-goog