Skip to contentSkip to conversation

mm-kfence-randomize-the-freelist-on-initialization.patch removed from -mm tree

merged mm-hotfixes-stable Andrew Morton 1 participant 1 message Jan 27 Stable branch

lore
Share & tools
lore

Andrew Morton

author tree notice Applied
#0 lore raw

The quilt patch titled
Subject: mm/kfence: randomize the freelist on initialization
has been removed from the -mm tree. Its filename was
mm-kfence-randomize-the-freelist-on-initialization.patch

This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Pimyn Girgis <[email protected]>
Subject: mm/kfence: randomize the freelist on initialization
Date: Tue, 20 Jan 2026 17:15:10 +0100

Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below().

Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop.

Link https://lkml.kernel.org/r/[email protected] open here
Fixes 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
Signed-off-by Pimyn Girgis <[email protected]>
Reviewed-by Alexander Potapenko <[email protected]>
Cc Dmitry Vyukov <[email protected]>
Cc Marco Elver <[email protected]>
Cc Ernesto Martnez Garca <[email protected]>
Cc Greg KH <[email protected]>
Cc Kees Cook <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>

---

 mm/kfence/core.c |   23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)
mm/kfence/core.c renamed from mm/kfence/core.c~mm-kfence-randomize-the-freelist-on-initialization +19 -4
@@ -596,7 +596,7 @@ static void rcu_guarded_free(struct rcu_
 static unsigned long kfence_init_pool(void)
 {
 	unsigned long addr, start_pfn;
-	int i;
+	int i, rand;
 
 	if (!arch_kfence_init_pool())
 		return (unsigned long)__kfence_pool;

@@ -647,13 +647,27 @@ static unsigned long kfence_init_pool(vo
 		INIT_LIST_HEAD(&meta->list);
 		raw_spin_lock_init(&meta->lock);
 		meta->state = KFENCE_OBJECT_UNUSED;
-		meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */
-		list_add_tail(&meta->list, &kfence_freelist);
+		/* Use addr to randomize the freelist. */
+		meta->addr = i;
 
 		/* Protect the right redzone. */
-		if (unlikely(!kfence_protect(addr + PAGE_SIZE)))
+		if (unlikely(!kfence_protect(addr + 2 * i * PAGE_SIZE + PAGE_SIZE)))
 			goto reset_slab;
+	}
+
+	for (i = CONFIG_KFENCE_NUM_OBJECTS; i > 0; i--) {
+		rand = get_random_u32_below(i);
+		swap(kfence_metadata_init[i - 1].addr, kfence_metadata_init[rand].addr);
+	}
 
+	for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
+		struct kfence_metadata *meta_1 = &kfence_metadata_init[i];
+		struct kfence_metadata *meta_2 = &kfence_metadata_init[meta_1->addr];
+
+		list_add_tail(&meta_2->list, &kfence_freelist);
+	}
+	for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
+		kfence_metadata_init[i].addr = addr;
 		addr += 2 * PAGE_SIZE;
 	}
 

@@ -666,6 +680,7 @@ static unsigned long kfence_init_pool(vo
 	return 0;
 
 reset_slab:
+	addr += 2 * i * PAGE_SIZE;
 	for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) {
 		struct page *page;

_

Patches currently in -mm which might be from [email protected] are