linux-kernel - Re: [PATCH] mm/kfence: add reboot notifier to disable KFENCE on shutdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <nqzny5rxn27exzhfzaaxg4tfbshhmr5aum76ygficd46b54c4r@tqrelxeucsti>
Date: Thu, 27 Nov 2025 03:12:10 -0800
From: Breno Leitao <leitao@...ian.org>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: Alexander Potapenko <glider@...gle.com>, 
	Marco Elver <elver@...gle.com>, Dmitry Vyukov <dvyukov@...gle.com>, kasan-dev@...glegroups.com, 
	linux-mm@...ck.org, linux-kernel@...r.kernel.org, kernel-team@...a.com
Subject: Re: [PATCH] mm/kfence: add reboot notifier to disable KFENCE on
 shutdown

On Wed, Nov 26, 2025 at 10:14:53AM -0800, Andrew Morton wrote:
> On Wed, 26 Nov 2025 09:46:18 -0800 Breno Leitao <leitao@...ian.org> wrote:
> 
> > During system shutdown, KFENCE can cause IPI synchronization issues if
> > it remains active through the reboot process. To prevent this, register
> > a reboot notifier that disables KFENCE and cancels any pending timer
> > work early in the shutdown sequence.
> > 
> > This is only necessary when CONFIG_KFENCE_STATIC_KEYS is enabled, as
> > this configuration sends IPIs that can interfere with shutdown. Without
> > static keys, no IPIs are generated and KFENCE can safely remain active.
> > 
> > The notifier uses maximum priority (INT_MAX) to ensure KFENCE shuts
> > down before other subsystems that might still depend on stable memory
> > allocation behavior.
> > 
> > This fixes a late kexec CSD lockup[1] when kfence is trying to IPI a CPU
> > that is busy in a IRQ-disabled context printing characters to the
> > console.
> > 
> > Link: https://lore.kernel.org/all/sqwajvt7utnt463tzxgwu2yctyn5m6bjwrslsnupfexeml6hkd@v6sqmpbu3vvu/ [1]
> 
> 6.13 kernels and earlier, so I assume we'll want a cc:stable on this. 
> And I assume there's really no identifiable Fixes: target.

This infrastructure showed up when kfence was created, so, a possible
Fixes: target would point to commit 0ce20dd84089  ("mm: add Kernel
Electric-Fence infrastructure")