FAILED: patch "[PATCH] mm/kfence: fix KASAN hardware tag faults during late" failed to apply to 6.12-stable tree
Subsystems (4)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x d155aab90fffa00f93cea1f107aef0a3d548b2ff
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026031724-slimness-shell-ed87@gregkh' --subject-prefix 'PATCH 6.12.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From d155aab90fffa00f93cea1f107aef0a3d548b2ff Mon Sep 17 00:00:00 2001
From: Alexander Potapenko <[email protected]>
Date: Fri, 20 Feb 2026 15:49:40 +0100
Subject: [PATCH] mm/kfence: fix KASAN hardware tag faults during late
enablement
When KASAN hardware tags are enabled, re-enabling KFENCE late (via /sys/module/kfence/parameters/sample_interval) causes KASAN faults.
This happens because the KFENCE pool and metadata are allocated via the page allocator, which tags the memory, while KFENCE continues to access it using untagged pointers during initialization.
Use __GFP_SKIP_KASAN for late KFENCE pool and metadata allocations to ensure the memory remains untagged, consistent with early allocations from memblock. To support this, add __GFP_SKIP_KASAN to the allowlist in __alloc_contig_verify_gfp_mask().
mm/kfence/core.c +8 -6
@@ -1004,14 +1004,14 @@ static int kfence_init_late(void)#ifdef CONFIG_CONTIG_ALLOC struct page *pages; - pages =alloc_contig_pages (nr_pages_pool,GFP_KERNEL , first_online_node, -NULL ); + pages =alloc_contig_pages (nr_pages_pool,GFP_KERNEL | __GFP_SKIP_KASAN, + first_online_node,NULL );if (!pages)return -ENOMEM ; __kfence_pool =page_to_virt (pages); - pages =alloc_contig_pages (nr_pages_meta,GFP_KERNEL , first_online_node, -NULL ); + pages =alloc_contig_pages (nr_pages_meta,GFP_KERNEL | __GFP_SKIP_KASAN, + first_online_node,NULL );if (pages) kfence_metadata_init =page_to_virt (pages);#else
@@ -1021,11 +1021,13 @@ static int kfence_init_late(void) return -EINVAL; } - __kfence_pool =alloc_pages_exact (KFENCE_POOL_SIZE ,GFP_KERNEL ); + __kfence_pool =alloc_pages_exact (KFENCE_POOL_SIZE , +GFP_KERNEL | __GFP_SKIP_KASAN);if (!__kfence_pool)return -ENOMEM ; - kfence_metadata_init =alloc_pages_exact (KFENCE_METADATA_SIZE ,GFP_KERNEL ); + kfence_metadata_init =alloc_pages_exact (KFENCE_METADATA_SIZE , +GFP_KERNEL | __GFP_SKIP_KASAN);#endif if (!kfence_metadata_init)
mm/page_alloc.c +2 -1
@@ -6928,7 +6928,8 @@ static int __alloc_contig_verify_gfp_mask(gfp_t gfp_mask, gfp_t *gfp_cc_mask) {const gfp_t reclaim_mask = __GFP_IO | __GFP_FS | __GFP_RECLAIM;const gfp_t action_mask = __GFP_COMP | __GFP_RETRY_MAYFAIL | __GFP_NOWARN | - __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO; + __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO | + __GFP_SKIP_KASAN;const gfp_t cc_action_mask = __GFP_RETRY_MAYFAIL | __GFP_NOWARN;/*
Sasha Levin
maintainerPATCH 1/4 mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
From: "Matthew Wilcox (Oracle)" <[email protected]>
[ Upstream commit 8fd10a892a8db797fffb59a9a60bce23a56eef46 ]
In preparation for allocating frozen pages, stop initialising the page refcount in post_alloc_hook().
Stable-dep-of: d155aab90fff ("mm/kfence: fix KASAN hardware tag faults during late enablement")
--- mm/compaction.c | 2 ++ mm/internal.h | 3 +-- mm/page_alloc.c | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-)
mm/compaction.c +2 -0
@@ -83,6 +83,7 @@ static inline bool is_via_compact_memory(int order) { return false; }static struct page *mark_allocated_noprof (struct page *page,unsigned int order,gfp_t gfp_flags) {post_alloc_hook (page, order, __GFP_MOVABLE); +set_page_refcounted (page);return page; }#define mark_allocated (...) alloc_hooks(mark_allocated_noprof(__VA_ARGS__))
@@ -1869,6 +1870,7 @@ static struct folio *compaction_alloc_noprof(struct folio *src, unsigned long da dst = (struct folio *)freepage;post_alloc_hook (&dst->page, order, __GFP_MOVABLE); +set_page_refcounted (&dst->page);if (order)prep_compound_page (&dst->page, order); cc->nr_freepages -=1 << order;
mm/internal.h +1 -2
@@ -729,8 +729,7 @@ static inline void prep_compound_tail(struct page *head, int tail_idx)extern void prep_compound_page (struct page *page,unsigned int order); -extern void post_alloc_hook (struct page *page,unsigned int order, -gfp_t gfp_flags); +void post_alloc_hook (struct page *page,unsigned int order,gfp_t gfp_flags);extern bool free_pages_prepare (struct page *page,unsigned int order);extern int user_min_free_kbytes;
mm/page_alloc.c +2 -1
@@ -1542,7 +1542,6 @@ inline void post_alloc_hook(struct page *page, unsigned int order,int i;set_page_private (page,0 ); -set_page_refcounted (page);arch_alloc_page (page, order);debug_pagealloc_map_pages (page,1 << order);
@@ -1598,6 +1597,7 @@ static void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags unsigned int alloc_flags) {post_alloc_hook (page, order, gfp_flags); +set_page_refcounted (page);if (order && (gfp_flags & __GFP_COMP))prep_compound_page (page, order);
@@ -6591,6 +6591,7 @@ static void split_free_pages(struct list_head *list)int i;post_alloc_hook (page, order, __GFP_MOVABLE); +set_page_refcounted (page);if (!order)continue ;
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 2/4 mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
From: David Hildenbrand <[email protected]>
[ Upstream commit f6037a4a686523dee1967ef7620349822e019ff8 ]
It's all a bit complicated for alloc_contig_range(). For example, we don't support many flags, so let's start bailing out on unsupported ones -- ignoring the placement hints, as we are already given the range to allocate.
While we currently set cc.gfp_mask, in __alloc_contig_migrate_range() we simply create yet another GFP mask whereby we ignore the reclaim flags specify by the caller. That looks very inconsistent.
Let's clean it up, constructing the gfp flags used for compaction/migration exactly once. Update the documentation of the gfp_mask parameter for alloc_contig_range() and alloc_contig_pages().
Stable-dep-of: d155aab90fff ("mm/kfence: fix KASAN hardware tag faults during late enablement")
--- mm/page_alloc.c | 48 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 44 insertions(+), 4 deletions(-)
mm/page_alloc.c +44 -4
@@ -6509,7 +6509,7 @@ int __alloc_contig_migrate_range(struct compact_control *cc,int ret =0 ;struct migration_target_control mtc = { .nid =zone_to_nid (cc->zone), - .gfp_mask =GFP_USER | __GFP_MOVABLE | __GFP_RETRY_MAYFAIL, + .gfp_mask = cc->gfp_mask, .reason =MR_CONTIG_RANGE , };struct page *page;
@@ -6605,6 +6605,39 @@ static void split_free_pages(struct list_head *list) } } +static int __alloc_contig_verify_gfp_mask (gfp_t gfp_mask,gfp_t *gfp_cc_mask) +{ +const gfp_t reclaim_mask = __GFP_IO | __GFP_FS | __GFP_RECLAIM; +const gfp_t action_mask = __GFP_COMP | __GFP_RETRY_MAYFAIL | __GFP_NOWARN; +const gfp_t cc_action_mask = __GFP_RETRY_MAYFAIL | __GFP_NOWARN; + +/* +* We are given the range to allocate; node, mobility and placement +* hints are irrelevant at this point. We'll simply ignore them. +*/ + gfp_mask &= ~(GFP_ZONEMASK | __GFP_RECLAIMABLE | __GFP_WRITE | + __GFP_HARDWALL | __GFP_THISNODE | __GFP_MOVABLE); + +/* +* We only support most reclaim flags (but not NOFAIL/NORETRY), and +* selected action flags. +*/ +if (gfp_mask & ~(reclaim_mask | action_mask)) +return -EINVAL ; + +/* +* Flags to control page compaction/migration/reclaim, to free up our +* page range. Migratable pages are movable, __GFP_MOVABLE is implied +* for them. +* +* Traditionally we always had __GFP_HARDWALL|__GFP_RETRY_MAYFAIL set, +* keep doing that to not degrade callers. +*/ + *gfp_cc_mask = (gfp_mask & (reclaim_mask | cc_action_mask)) | + __GFP_HARDWALL | __GFP_MOVABLE | __GFP_RETRY_MAYFAIL; +return 0 ; +} +/** * alloc_contig_range() -- tries to allocate given range of pages * @start: start PFN to allocate
@@ -6613,7 +6646,9 @@ static void split_free_pages(struct list_head *list)* #MIGRATE_MOVABLE or #MIGRATE_CMA). All pageblocks * in range must have the same migratetype and it must * be either of the two. -* @gfp_mask: GFP mask to use during compaction +* @gfp_mask: GFP mask. Node/zone/placement hints are ignored; only some +* action and reclaim modifiers are supported. Reclaim modifiers +* control allocation behavior during compaction/migration/reclaim. * * The PFN range does not have to be pageblock aligned. The PFN range must * belong to a single zone.
@@ -6639,11 +6674,14 @@ int alloc_contig_range_noprof(unsigned long start, unsigned long end, .mode = MIGRATE_SYNC, .ignore_skip_hint = true, .no_set_skip_hint = true, - .gfp_mask = current_gfp_context(gfp_mask), .alloc_contig = true, };INIT_LIST_HEAD (&cc.migratepages); + gfp_mask =current_gfp_context (gfp_mask); +if (__alloc_contig_verify_gfp_mask (gfp_mask, (gfp_t *)&cc.gfp_mask)) +return -EINVAL ; +/* * What we do here is we mark all pageblocks in range as * MIGRATE_ISOLATE. Because pageblock and max order pages may
@@ -6785,7 +6823,9 @@ static bool zone_spans_last_pfn(const struct zone *zone,/** * alloc_contig_pages() -- tries to find and allocate contiguous range of pages * @nr_pages: Number of contiguous pages to allocate -* @gfp_mask: GFP mask to limit search and used during compaction +* @gfp_mask: GFP mask. Node/zone/placement hints limit the search; only some +* action and reclaim modifiers are supported. Reclaim modifiers +* control allocation behavior during compaction/migration/reclaim. * @nid: Target node * @nodemask: Mask for other possible nodes *
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 3/4 mm/page_alloc: forward the gfp flags from alloc_contig_range() to post_alloc_hook()
In reply to Sasha LevinFrom: David Hildenbrand <[email protected]>
[ Upstream commit 7b755570064fcb9cde37afd48f6bc65151097ba7 ]
In the __GFP_COMP case, we already pass the gfp_flags to prep_new_page()->post_alloc_hook(). However, in the !__GFP_COMP case, we essentially pass only hardcoded __GFP_MOVABLE to post_alloc_hook(), preventing some action modifiers from being effective..
Let's pass our now properly adjusted gfp flags there as well.
This way, we can now support __GFP_ZERO for alloc_contig_*().
As a side effect, we now also support __GFP_SKIP_ZERO and__GFP_ZEROTAGS; but we'll keep the more special stuff (KASAN, NOLOCKDEP) disabled for now.
It's worth noting that with __GFP_ZERO, we might unnecessarily zero pages when we have to release part of our range using free_contig_range() again. This can be optimized in the future, if ever required; the caller we'll be converting (powernv/memtrace) next won't trigger this.
Stable-dep-of: d155aab90fff ("mm/kfence: fix KASAN hardware tag faults during late enablement")
--- mm/page_alloc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
mm/page_alloc.c +5 -4
@@ -6579,7 +6579,7 @@ int __alloc_contig_migrate_range(struct compact_control *cc,return (ret <0 ) ? ret :0 ; } -static void split_free_pages (struct list_head *list) +static void split_free_pages (struct list_head *list,gfp_t gfp_mask) {int order;
@@ -6590,7 +6590,7 @@ static void split_free_pages(struct list_head *list)list_for_each_entry_safe (page, next, &list[order], lru) {int i; -post_alloc_hook (page, order, __GFP_MOVABLE); +post_alloc_hook (page, order, gfp_mask);set_page_refcounted (page);if (!order)continue ;
@@ -6608,7 +6608,8 @@ static void split_free_pages(struct list_head *list)static int __alloc_contig_verify_gfp_mask (gfp_t gfp_mask,gfp_t *gfp_cc_mask) {const gfp_t reclaim_mask = __GFP_IO | __GFP_FS | __GFP_RECLAIM; -const gfp_t action_mask = __GFP_COMP | __GFP_RETRY_MAYFAIL | __GFP_NOWARN; +const gfp_t action_mask = __GFP_COMP | __GFP_RETRY_MAYFAIL | __GFP_NOWARN | + __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO;const gfp_t cc_action_mask = __GFP_RETRY_MAYFAIL | __GFP_NOWARN;/*
@@ -6756,7 +6757,7 @@ int alloc_contig_range_noprof(unsigned long start, unsigned long end, }if (!(gfp_mask & __GFP_COMP)) { -split_free_pages (cc.freepages); +split_free_pages (cc.freepages, gfp_mask);/* Free head and tail (if any) */ if (start != outer_start)
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 4/4 mm/kfence: fix KASAN hardware tag faults during late enablement
In reply to Sasha LevinFrom: Alexander Potapenko <[email protected]>
[ Upstream commit d155aab90fffa00f93cea1f107aef0a3d548b2ff ]
When KASAN hardware tags are enabled, re-enabling KFENCE late (via /sys/module/kfence/parameters/sample_interval) causes KASAN faults.
This happens because the KFENCE pool and metadata are allocated via the page allocator, which tags the memory, while KFENCE continues to access it using untagged pointers during initialization.
Use __GFP_SKIP_KASAN for late KFENCE pool and metadata allocations to ensure the memory remains untagged, consistent with early allocations from memblock. To support this, add __GFP_SKIP_KASAN to the allowlist in __alloc_contig_verify_gfp_mask().
--- mm/kfence/core.c | 14 ++++++++------ mm/page_alloc.c | 3 ++- 2 files changed, 10 insertions(+), 7 deletions(-)
mm/kfence/core.c +8 -6
@@ -949,14 +949,14 @@ static int kfence_init_late(void)#ifdef CONFIG_CONTIG_ALLOC struct page *pages; - pages =alloc_contig_pages (nr_pages_pool,GFP_KERNEL , first_online_node, -NULL ); + pages =alloc_contig_pages (nr_pages_pool,GFP_KERNEL | __GFP_SKIP_KASAN, + first_online_node,NULL );if (!pages)return -ENOMEM ; __kfence_pool =page_to_virt (pages); - pages =alloc_contig_pages (nr_pages_meta,GFP_KERNEL , first_online_node, -NULL ); + pages =alloc_contig_pages (nr_pages_meta,GFP_KERNEL | __GFP_SKIP_KASAN, + first_online_node,NULL );if (pages) kfence_metadata_init =page_to_virt (pages);#else
@@ -966,11 +966,13 @@ static int kfence_init_late(void) return -EINVAL; } - __kfence_pool =alloc_pages_exact (KFENCE_POOL_SIZE ,GFP_KERNEL ); + __kfence_pool =alloc_pages_exact (KFENCE_POOL_SIZE , +GFP_KERNEL | __GFP_SKIP_KASAN);if (!__kfence_pool)return -ENOMEM ; - kfence_metadata_init =alloc_pages_exact (KFENCE_METADATA_SIZE ,GFP_KERNEL ); + kfence_metadata_init =alloc_pages_exact (KFENCE_METADATA_SIZE , +GFP_KERNEL | __GFP_SKIP_KASAN);#endif if (!kfence_metadata_init)
mm/page_alloc.c +2 -1
@@ -6609,7 +6609,8 @@ static int __alloc_contig_verify_gfp_mask(gfp_t gfp_mask, gfp_t *gfp_cc_mask) {const gfp_t reclaim_mask = __GFP_IO | __GFP_FS | __GFP_RECLAIM;const gfp_t action_mask = __GFP_COMP | __GFP_RETRY_MAYFAIL | __GFP_NOWARN | - __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO; + __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO | + __GFP_SKIP_KASAN;const gfp_t cc_action_mask = __GFP_RETRY_MAYFAIL | __GFP_NOWARN;/*
Signature · 1 line
2.51.0