FAILED: patch "[PATCH] mm/kfence: randomize the freelist on initialization" failed to apply to 6.12-stable tree

PATCH New [email protected] 2 participants 2 messages Feb 3

Subsystems (3)

Stable branch Memory management Kfence

lore

Share & tools

lore

[email protected]

author maintainer

2026-02-03 12:48 UTC #0 lore raw

The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 870ff19251bf3910dda7a7245da826924045fedd
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026020338-reformer-sensitize-b6b7@gregkh' --subject-prefix 'PATCH 6.12.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 870ff19251bf3910dda7a7245da826924045fedd Mon Sep 17 00:00:00 2001
From: Pimyn Girgis <[email protected]>
Date: Tue, 20 Jan 2026 17:15:10 +0100
Subject: [PATCH] mm/kfence: randomize the freelist on initialization

Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below().

Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop.

Link https://lkml.kernel.org/r/[email protected] open here

Fixes 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")

Signed-off-by Pimyn Girgis <[email protected]>

Reviewed-by Alexander Potapenko <[email protected]>

Cc Dmitry Vyukov <[email protected]>

Cc Marco Elver <[email protected]>

Cc Ernesto Martnez Garca <[email protected]>

Cc Greg KH <[email protected]>

Cc Kees Cook <[email protected]>

Cc <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

mm/kfence/core.c +19 -4

index da0f5b6f5744..4f79ec720752 100644
@@ -596,7 +596,7 @@ static void rcu_guarded_free(struct rcu_head *h)
 static unsigned long kfence_init_pool(void)
 {
 	unsigned long addr, start_pfn;
-	int i;
+	int i, rand;
 
 	if (!arch_kfence_init_pool())
 		return (unsigned long)__kfence_pool;

@@ -647,13 +647,27 @@ static unsigned long kfence_init_pool(void)
 		INIT_LIST_HEAD(&meta->list);
 		raw_spin_lock_init(&meta->lock);
 		meta->state = KFENCE_OBJECT_UNUSED;
-		meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */
-		list_add_tail(&meta->list, &kfence_freelist);
+		/* Use addr to randomize the freelist. */
+		meta->addr = i;
 
 		/* Protect the right redzone. */
-		if (unlikely(!kfence_protect(addr + PAGE_SIZE)))
+		if (unlikely(!kfence_protect(addr + 2 * i * PAGE_SIZE + PAGE_SIZE)))
 			goto reset_slab;
+	}
 
+	for (i = CONFIG_KFENCE_NUM_OBJECTS; i > 0; i--) {
+		rand = get_random_u32_below(i);
+		swap(kfence_metadata_init[i - 1].addr, kfence_metadata_init[rand].addr);
+	}
+
+	for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
+		struct kfence_metadata *meta_1 = &kfence_metadata_init[i];
+		struct kfence_metadata *meta_2 = &kfence_metadata_init[meta_1->addr];
+
+		list_add_tail(&meta_2->list, &kfence_freelist);
+	}
+	for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
+		kfence_metadata_init[i].addr = addr;
 		addr += 2 * PAGE_SIZE;
 	}

@@ -666,6 +680,7 @@ static unsigned long kfence_init_pool(void)
 	return 0;
 
 reset_slab:
+	addr += 2 * i * PAGE_SIZE;
 	for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) {
 		struct page *page;

Pimyn Girgis

2026-02-03 13:52 UTC #1 lore raw

PATCH 1/1 mm/kfence: randomize the freelist on initialization

Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop.

Link https://lkml.kernel.org/r/[email protected] open here

Fixes 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")

Signed-off-by Pimyn Girgis <[email protected]>

Reviewed-by Alexander Potapenko <[email protected]>

Cc Dmitry Vyukov <[email protected]>

Cc Marco Elver <[email protected]>

Cc Ernesto Martnez Garca <[email protected]>

Cc Greg KH <[email protected]>

Cc Kees Cook <[email protected]>

Cc <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

(cherry picked from commit 870ff19251bf3910dda7a7245da826924045fedd)

Signed-off-by Pimyn Girgis <[email protected]>

# Conflicts:
# mm/kfence/core.c

---
 mm/kfence/core.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

mm/kfence/core.c +19 -4

index 102048821c22..b301ca337508 100644
@@ -596,7 +596,7 @@ static unsigned long kfence_init_pool(void)
 {
 	unsigned long addr;
 	struct page *pages;
-	int i;
+	int i, rand;
 
 	if (!arch_kfence_init_pool())
 		return (unsigned long)__kfence_pool;

@@ -645,13 +645,27 @@ static unsigned long kfence_init_pool(void)
 		INIT_LIST_HEAD(&meta->list);
 		raw_spin_lock_init(&meta->lock);
 		meta->state = KFENCE_OBJECT_UNUSED;
-		meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */
-		list_add_tail(&meta->list, &kfence_freelist);
+		/* Use addr to randomize the freelist. */
+		meta->addr = i;
 
 		/* Protect the right redzone. */
-		if (unlikely(!kfence_protect(addr + PAGE_SIZE)))
+		if (unlikely(!kfence_protect(addr + 2 * i * PAGE_SIZE + PAGE_SIZE)))
 			goto reset_slab;
+	}
+
+	for (i = CONFIG_KFENCE_NUM_OBJECTS; i > 0; i--) {
+		rand = get_random_u32_below(i);
+		swap(kfence_metadata_init[i - 1].addr, kfence_metadata_init[rand].addr);
+	}
 
+	for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
+		struct kfence_metadata *meta_1 = &kfence_metadata_init[i];
+		struct kfence_metadata *meta_2 = &kfence_metadata_init[meta_1->addr];
+
+		list_add_tail(&meta_2->list, &kfence_freelist);
+	}
+	for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
+		kfence_metadata_init[i].addr = addr;
 		addr += 2 * PAGE_SIZE;
 	}

@@ -664,6 +678,7 @@ static unsigned long kfence_init_pool(void)
 	return 0;
 
 reset_slab:
+	addr += 2 * i * PAGE_SIZE;
 	for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) {
 		struct slab *slab = page_slab(nth_page(pages, i));

Signature · 1 line

2.53.0.rc1.225.gd81095ad13-goog