The patch titled
Subject: mm/page_alloc: fix a false memory corruption
has been removed from the -mm tree. Its filename was
mm-security-introduce-init_on_alloc=1-and-init_on_free=1-boot-options-fix-2.patch
This patch was dropped because it was folded into mm-security-introduce-init_on_alloc=1-and-init_on_free=1-boot-options-v9.patch
------------------------------------------------------
From: Qian Cai <cai@xxxxxx>
Subject: mm/page_alloc: fix a false memory corruption
The linux-next commit "mm: security: introduce init_on_alloc=1 and
init_on_free=1 boot options" [1] introduced a false positive when
init_on_free=1 and page_poison=on, due to the page_poison expects the
pattern 0xaa when allocating pages which were overwritten by
init_on_free=1 with 0.
Fix it by switching the order between kernel_init_free_pages() and
kernel_poison_pages() in free_pages_prepare().
[1] https://patchwork.kernel.org/patch/10999465/
Link: http://lkml.kernel.org/r/1561063566-16335-1-git-send-email-cai@xxxxxx
Signed-off-by: Qian Cai <cai@xxxxxx>
Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/page_alloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/page_alloc.c~mm-security-introduce-init_on_alloc=1-and-init_on_free=1-boot-options-fix-2
+++ a/mm/page_alloc.c
@@ -1181,9 +1181,10 @@ static __always_inline bool free_pages_p
PAGE_SIZE << order);
}
arch_free_page(page, order);
- kernel_poison_pages(page, 1 << order, 0);
if (want_init_on_free())
kernel_init_free_pages(page, 1 << order);
+
+ kernel_poison_pages(page, 1 << order, 0);
if (debug_pagealloc_enabled())
kernel_map_pages(page, 1 << order, 0);
_
Patches currently in -mm which might be from cai@xxxxxx are
iommu-replace-single-char-identifiers-in-macros.patch
mm-rework-non-root-kmem_cache-lifecycle-management-fix.patch
arm64-switch-to-generic-version-of-pte-allocation-fix.patch
drivers-base-memory-pass-a-block_id-to-init_memory_block-fix.patch
z3fold-add-inter-page-compaction-fix-2.patch
