From nobody Thu Apr 2 20:26:41 2026 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7901B34F24D for ; Fri, 13 Feb 2026 09:54:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770976460; cv=none; b=TvclXocUPvTvJLsytmM9UHzhKLgdqH0cZzOyZfipqCbaaWeVOZatmRieOI2F+6RN8clJisP/JaE4Vr/l7rkX4/VNFp0Clmt4Gz1AnlqRqv8lVTCGlwItUZfHhnHyPFM3fbiGr9vN3pHPN5dEWsb+zZCq6GcA4vs10wTBrKcdg9Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770976460; c=relaxed/simple; bh=r+HpcvjKmu0TxXhYFDAE5Rr5F09FZxMG4CrUw1YgdRE=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=DpknM7tcoP+1MdWe9UIxzufiriSn+Ez4HRcj5sQRcJLMHBlCaCMdXcmMjQewplDNruz8/qP/++96wMH/quHUuXT4et302vO2JstbHHN0iEp9jz7e6ylX1XcrnR7D/Txj6+mO4j5GrHo0DTmyXAEcI81UyurxcpVfBFyQX6ExFuo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--glider.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=esS4MH7D; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--glider.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="esS4MH7D" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-48079ae1001so5227735e9.0 for ; Fri, 13 Feb 2026 01:54:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1770976456; x=1771581256; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=LFs1D2cDtd6f/aAyQgYmfXZj2j/U+wImXIancDSX5wo=; b=esS4MH7D4GAsfjM4iZ2h9Z9hE+bv71qMJtB5/iYNSOvqNzDZap4glQMKkE8HJZ9L68 blaabODtmEhl8pf0PPMY4cNauzd8wloTnGq7ORuOXAPWimNwHA6jh9gZJwiPYtedP+lR jC2ce2aug83z0Dft3dBb4AWe/Yk0dV1E9n22NSWLiEumGyoTTf+P9yTtUVzNufQIF1sH s1BEW4QK5JIsaZ3j/7KDg+6KO3NsQIu7QzJYZ3T3jWSYYNp9CflBw1vNSq9/mrlSRKUB vgG/ho838tfHQBvAby5UlTbSM+7l38pHifRFcTVdbwIKm9/3juoICJINar6UVh5F9xan OF6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770976456; x=1771581256; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=LFs1D2cDtd6f/aAyQgYmfXZj2j/U+wImXIancDSX5wo=; b=sru3rZFinmeXhP60hltkX9BioGcf5w1VfxP2aRafRRES0/iIbAVNW5p4hhjj4rzYXC DdbwZnwfnTkC/O8xaWojYrRDe0oMlGeJUdISkPcvlsFdKZCdB7uj/b3VnDlmik7NdqZY XrLVf1CX7D2FoRk2SLE2iOZhH5hhtLOmciTx2iOT2Dlc2lPlLD5LSrkbu2JwLxwuk0lp iU0go17CSQzSxu1L6EkjCnbmdlCCR/BswFTIGrLdKwxXdswEcAQnJKbbKL6kW1XUvQ5v wSwiUPcYTgnuAb6WbkrlK2MpiNSJ8oHOjYWfiF0vHs6zj6YR+iTqFm8WgXzmgTdVxCYS oczA== X-Forwarded-Encrypted: i=1; AJvYcCUGEfxnm203g5MJZ8t+P9bqk9HY217KFkh25MRjt0WUdgtp91sbQ4uQDkGCOpZM8XUCuWyR+PhxCl893sY=@vger.kernel.org X-Gm-Message-State: AOJu0YxsxkOlWxNtaWnZ251VwiOxig5pI3sing2qdi2Y06vPqFqwzq5c goZ2+mV9N+n2xr6VGTdYo5RZMZWqzWf533u5NYERwGujUULfjRa/HvzZGzOx9HXda3C+9MsA/25 lrhkjdw== X-Received: from wmoo19.prod.google.com ([2002:a05:600d:113:b0:483:6a60:3501]) (user=glider job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:4fc8:b0:47a:814c:ee95 with SMTP id 5b1f17b1804b1-48373a234fdmr19866675e9.12.1770976455591; Fri, 13 Feb 2026 01:54:15 -0800 (PST) Date: Fri, 13 Feb 2026 10:54:10 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.53.0.273.g2a3d683680-goog Message-ID: <20260213095410.1862978-1-glider@google.com> Subject: [PATCH v1] mm/kfence: disable KFENCE upon KASAN HW tags enablement From: Alexander Potapenko To: glider@google.com Cc: akpm@linux-foundation.org, mark.rutland@arm.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, pimyn@google.com, Andrey Konovalov , Andrey Ryabinin , Dmitry Vyukov , Ernesto Martinez Garcia , Greg KH , Kees Cook , stable@vger.kernel.org, Marco Elver Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" KFENCE does not currently support KASAN hardware tags. As a result, the two features are incompatible when enabled simultaneously. Given that MTE provides deterministic protection and KFENCE is a sampling-based debugging tool, prioritize the stronger hardware protections. Disable KFENCE initialization and free the pre-allocated pool if KASAN hardware tags are detected to ensure the system maintains the security guarantees provided by MTE. Cc: Andrew Morton Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Ernesto Martinez Garcia Cc: Greg KH Cc: Kees Cook Cc: Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Suggested-by: Marco Elver Signed-off-by: Alexander Potapenko Reviewed-by: Marco Elver --- mm/kfence/core.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/mm/kfence/core.c b/mm/kfence/core.c index 4f79ec7207525..71f87072baf9b 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -911,6 +912,20 @@ void __init kfence_alloc_pool_and_metadata(void) if (!kfence_sample_interval) return; =20 + /* + * If KASAN hardware tags are enabled, disable KFENCE, because it + * does not support MTE yet. + */ + if (kasan_hw_tags_enabled()) { + pr_info("disabled as KASAN HW tags are enabled\n"); + if (__kfence_pool) { + memblock_free(__kfence_pool, KFENCE_POOL_SIZE); + __kfence_pool =3D NULL; + } + kfence_sample_interval =3D 0; + return; + } + /* * If the pool has already been initialized by arch, there is no need to * re-allocate the memory pool. --=20 2.53.0.273.g2a3d683680-goog