On 26.03.21 12:26, Sergei Trofimovich wrote:
init_on_free=1 does not guarantee that free pages contain only zero bytes.
Some examples:
1. page_poison=on takes presedence over init_on_alloc=1 / ini_on_free=1
s/ini_on_free/init_on_free/
2. free_pages_prepare() always poisons pages:
if (want_init_on_free())
kernel_init_free_pages(page, 1 << order);
kernel_poison_pages(page, 1 << order
In next/master, it's the other way around already.
commit 855a9c4018f3219db8be7e4b9a65ab22aebfde82
Author: Andrey Konovalov <andreyknvl@xxxxxxxxx>
Date: Thu Mar 18 17:01:40 2021 +1100
kasan, mm: integrate page_alloc init with HW_TAGS
I observed use of poisoned pages as the crash on ia64 booted with
init_on_free=1 init_on_alloc=1 (CONFIG_PAGE_POISONING=y config).
There pmd page contained 0xaaaaaaaa poison pages and led to early crash.
The change drops the assumption that init_on_free=1 guarantees free
pages to contain zeros.
Alternative would be to make interaction between runtime poisoning and
sanitizing options and build-time debug flags like CONFIG_PAGE_POISONING
more coherent. I took the simpler path.
I thought latest work be Vlastimil tried to tackle that. To me, it feels
like page_poison=on and init_on_free=1 should bail out and disable one
of both things. Having both at the same time doesn't sound helpful.
Tested the fix on rx3600.
Fixes: ?
--
Thanks,
David / dhildenb
