linux-hardening - regresion v5.13-rc1+ - page_poison broken since 51cba1ebc60d

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <YL+f8LKmLOb4iSeq@light.dominikbrodowski.net>
Date:   Tue, 8 Jun 2021 18:50:56 +0200
From:   Dominik Brodowski <linux@...inikbrodowski.net>
To:     keescook@...omium.org, andreyknvl@...gle.com
Cc:     linux-hardening@...r.kernel.org, linux-mm@...ck.org,
        tglx@...utronix.de, glider@...gle.com, vbabka@...e.cz
Subject: regresion v5.13-rc1+ - page_poison broken since 51cba1ebc60d

Hi Kees, Andrey,

a "git bisect" points to commit 51cba1ebc60d ("init_on_alloc: Optimize
static branches") as breaking page poisoning ("page_poison=on"). Starting
with this commit, booting -- with this option enabled on the kernel command
line -- hangs quite early, before anything meaningful is printed. Booting
51cba1ebc60d without this option proceeds just fine.

Since 1bb5eab30d68 ("kasan, mm: integrate page_alloc init with HW_TAGS") the
behaviour becomes different: Since that commit, booting with
"page_poison=on" and "slub_debug=P" continues up to the initramfs
stage, but then fails quite spectacularly with a large number of page
poisonings being reported.

While "page_poision=on slub_debug=P" doesn't seem to be necessary any longer
if CONFIG_INIT_ON_ALLOC_DEFAULT_ON and CONFIG_INIT_ON_FREE_DEFAULT_ON are
enabled[*], this still looks like a regression.

Thanks,
	Dominik

[*] https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings