The patch titled
Subject: mm/page_alloc: fix a false memory corruption
has been added to the -mm tree. Its filename is
mm-security-introduce-init_on_alloc=1-and-init_on_free=1-boot-options-fix-2.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-security-introduce-init_on_alloc%3D1-and-init_on_free%3D1-boot-options-fix-2.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-security-introduce-init_on_alloc%3D1-and-init_on_free%3D1-boot-options-fix-2.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Qian Cai <cai@xxxxxx>
Subject: mm/page_alloc: fix a false memory corruption
The linux-next commit "mm: security: introduce init_on_alloc=1 and
init_on_free=1 boot options" [1] introduced a false positive when
init_on_free=1 and page_poison=on, due to the page_poison expects the
pattern 0xaa when allocating pages which were overwritten by
init_on_free=1 with 0.
Fix it by switching the order between kernel_init_free_pages() and
kernel_poison_pages() in free_pages_prepare().
[1] https://patchwork.kernel.org/patch/10999465/
Link: http://lkml.kernel.org/r/1561063566-16335-1-git-send-email-cai@xxxxxx
Signed-off-by: Qian Cai <cai@xxxxxx>
Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/page_alloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/page_alloc.c~mm-security-introduce-init_on_alloc=1-and-init_on_free=1-boot-options-fix-2
+++ a/mm/page_alloc.c
@@ -1172,9 +1172,10 @@ static __always_inline bool free_pages_p
PAGE_SIZE << order);
}
arch_free_page(page, order);
- kernel_poison_pages(page, 1 << order, 0);
if (want_init_on_free())
kernel_init_free_pages(page, 1 << order);
+
+ kernel_poison_pages(page, 1 << order, 0);
if (debug_pagealloc_enabled())
kernel_map_pages(page, 1 << order, 0);
_
Patches currently in -mm which might be from cai@xxxxxx are
iommu-replace-single-char-identifiers-in-macros.patch
mm-rework-non-root-kmem_cache-lifecycle-management-fix.patch
arm64-switch-to-generic-version-of-pte-allocation-fix.patch
drivers-base-memory-pass-a-block_id-to-init_memory_block-fix.patch
mm-security-introduce-init_on_alloc=1-and-init_on_free=1-boot-options-fix-2.patch
z3fold-add-inter-page-compaction-fix-2.patch
