diff options
| author | Peter Collingbourne <pcc@google.com> | 2021-06-02 16:52:30 -0700 |
|---|---|---|
| committer | Will Deacon <will@kernel.org> | 2021-06-04 19:32:21 +0100 |
| commit | c275c5c6d50a0518cdb0584e85905d10e7cefc6e (patch) | |
| tree | b621c3297979537bc51d124dbf57ebc932b98ca2 /include/linux/page-flags.h | |
| parent | 013bb59dbb7cf876449df860946458a595a96d51 (diff) | |
kasan: disable freed user page poisoning with HW tags
Poisoning freed pages protects against kernel use-after-free. The
likelihood of such a bug involving kernel pages is significantly higher
than that for user pages. At the same time, poisoning freed pages can
impose a significant performance cost, which cannot always be justified
for user pages given the lower probability of finding a bug. Therefore,
disable freed user page poisoning when using HW tags. We identify
"user" pages via the flag set GFP_HIGHUSER_MOVABLE, which indicates
a strong likelihood of not being directly accessible to the kernel.
Signed-off-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://linux-review.googlesource.com/id/I716846e2de8ef179f44e835770df7e6307be96c9
Link: https://lore.kernel.org/r/20210602235230.3928842-5-pcc@google.com
Signed-off-by: Will Deacon <will@kernel.org>
Diffstat (limited to 'include/linux/page-flags.h')
| -rw-r--r-- | include/linux/page-flags.h | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h index 04a34c08e0a6..40e2c5000585 100644 --- a/include/linux/page-flags.h +++ b/include/linux/page-flags.h @@ -138,6 +138,9 @@ enum pageflags { #ifdef CONFIG_64BIT PG_arch_2, #endif +#ifdef CONFIG_KASAN_HW_TAGS + PG_skip_kasan_poison, +#endif __NR_PAGEFLAGS, /* Filesystems */ @@ -443,6 +446,12 @@ TESTCLEARFLAG(Young, young, PF_ANY) PAGEFLAG(Idle, idle, PF_ANY) #endif +#ifdef CONFIG_KASAN_HW_TAGS +PAGEFLAG(SkipKASanPoison, skip_kasan_poison, PF_HEAD) +#else +PAGEFLAG_FALSE(SkipKASanPoison) +#endif + /* * PageReported() is used to track reported free pages within the Buddy * allocator. We can use the non-atomic version of the test and set |