linux-kernel - Re: [PATCH] mm/mm_init: Pull CONFIG_DEBUG_CHECK_PAGES out of CONFIG_DEBUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b1ae4706-b56b-432f-bde6-7d76e9b02598@suse.cz>
Date: Fri, 21 Nov 2025 23:03:01 +0100
From: Vlastimil Babka <vbabka@...e.cz>
To: Joshua Hahn <joshua.hahnjy@...il.com>,
 David Hildenbrand <david@...nel.org>
Cc: "Liam R. Howlett" <Liam.Howlett@...cle.com>,
 Andrew Morton <akpm@...ux-foundation.org>,
 Lorenzo Stoakes <lorenzo.stoakes@...cle.com>, Michal Hocko
 <mhocko@...e.com>, Mike Rapoport <rppt@...nel.org>,
 Suren Baghdasaryan <surenb@...gle.com>, linux-kernel@...r.kernel.org,
 linux-mm@...ck.org, kernel-team@...a.com, Kees Cook <kees@...nel.org>
Subject: Re: [PATCH] mm/mm_init: Pull CONFIG_DEBUG_CHECK_PAGES out of
 CONFIG_DEBUG_VM

On 11/21/25 21:44, Joshua Hahn wrote:
> Use-after-free and double-free bugs can be very difficult to track down.
> The kernel is good at tracking these and preventing bad pages from being
> used/created through simple checks gated behind "check_pages_enabled".
> 
> Currently, the only ways to enable this flag is by building with
> CONFIG_DEBUG_VM, or as a side effect of other checks such as
> init_on_{alloc, free}, page_poisoning, or debug_pagealloc among others.
> These solutions are powerful, but may often be too coarse in balancing
> the performance vs. safety that a user may want, particularly in
> latency-sensitie production environments.

OK. Would a boot parameter work for you instead? It's more flexible than a
config option. Then we could perhaps also decouple it from
init_on_alloc/init_on_free as it's a bit odd side-effect for those anyway.

> Introduce CONFIG_DEBUG_CHECK_PAGES, which sets is_check_pages_enabled
> with no other side effects. Setting CONFIG_DEBUG_VM automatically
> enables this as well as to have backwards compatibility.
> 
> Developed on top of 7f1dae318f81e508ef59835bc82bdf33e4cb1021 "mm: swap:
> remove scan_swap_map_slots() references from comments" of mm-new.
> 
> Signed-off-by: Joshua Hahn <joshua.hahnjy@...il.com>
> ---
>  mm/Kconfig.debug | 12 ++++++++++++
>  mm/internal.h    |  2 +-
>  mm/mm_init.c     |  8 ++++----
>  3 files changed, 17 insertions(+), 5 deletions(-)
> 
> diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
> index 32b65073d0cc..366abde25026 100644
> --- a/mm/Kconfig.debug
> +++ b/mm/Kconfig.debug
> @@ -45,6 +45,18 @@ config DEBUG_PAGEALLOC_ENABLE_DEFAULT
>  	  Enable debug page memory allocations by default? This value
>  	  can be overridden by debug_pagealloc=off|on.
>  
> +config DEBUG_CHECK_PAGES
> +	bool "Debug VM page allocation/free sanity checks"
> +	depends on DEBUG_KERNEL
> +	default y if DEBUG_VM
> +	help
> +	  Enable sanity checking of pages after allocations / before freeing.
> +	  This adds checks to catch double-frees, use-after-frees, and other
> +	  sources of page corruption by inspecting page internals (flags,
> +	  mapcount/refcount, memcg_data, etc.).
> +
> +	  This is automatically enabled if CONFIG_DEBUG_VM is set.
> +
>  config SLUB_DEBUG
>  	default y
>  	bool "Enable SLUB debugging support" if EXPERT
> diff --git a/mm/internal.h b/mm/internal.h
> index 04c307ee33ae..b8decdfc0930 100644
> --- a/mm/internal.h
> +++ b/mm/internal.h
> @@ -562,7 +562,7 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address);
>  extern char * const zone_names[MAX_NR_ZONES];
>  
>  /* perform sanity checks on struct pages being allocated or freed */
> -DECLARE_STATIC_KEY_MAYBE(CONFIG_DEBUG_VM, check_pages_enabled);
> +DECLARE_STATIC_KEY_MAYBE(CONFIG_DEBUG_CHECK_PAGES, check_pages_enabled);
>  
>  extern int min_free_kbytes;
>  extern int defrag_mode;
> diff --git a/mm/mm_init.c b/mm/mm_init.c
> index c6812b4dbb2e..7f47b22864dd 100644
> --- a/mm/mm_init.c
> +++ b/mm/mm_init.c
> @@ -2523,7 +2523,7 @@ static int __init early_init_on_free(char *buf)
>  }
>  early_param("init_on_free", early_init_on_free);
>  
> -DEFINE_STATIC_KEY_MAYBE(CONFIG_DEBUG_VM, check_pages_enabled);
> +DEFINE_STATIC_KEY_MAYBE(CONFIG_DEBUG_CHECK_PAGES, check_pages_enabled);
>  
>  /*
>   * Enable static keys related to various memory debugging and hardening options.
> @@ -2588,10 +2588,10 @@ static void __init mem_debugging_and_hardening_init(void)
>  
>  	/*
>  	 * Any page debugging or hardening option also enables sanity checking
> -	 * of struct pages being allocated or freed. With CONFIG_DEBUG_VM it's
> -	 * enabled already.
> +	 * of struct pages being allocated or freed. With CONFIG_DEBUG_VM or
> +	 * CONFIG_DEBUG_CHECK_PAGES it's enabled already.
>  	 */
> -	if (!IS_ENABLED(CONFIG_DEBUG_VM) && want_check_pages)
> +	if (!IS_ENABLED(CONFIG_DEBUG_CHECK_PAGES) && want_check_pages)
>  		static_branch_enable(&check_pages_enabled);
>  }
>  
> 
> base-commit: 7f1dae318f81e508ef59835bc82bdf33e4cb1021