mm/kfence: fix KASAN hardware tag faults during late enablement

When KASAN hardware tags are enabled, re-enabling KFENCE late (via
/sys/module/kfence/parameters/sample_interval) causes KASAN faults.

This happens because the KFENCE pool and metadata are allocated via the
page allocator, which tags the memory, while KFENCE continues to access it
using untagged pointers during initialization.

Use __GFP_SKIP_KASAN for late KFENCE pool and metadata allocations to
ensure the memory remains untagged, consistent with early allocations from
memblock.  To support this, add __GFP_SKIP_KASAN to the allowlist in
__alloc_contig_verify_gfp_mask().

Link: https://lkml.kernel.org/r/20260220144940.2779209-1-glider@google.com
Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
Signed-off-by: Alexander Potapenko <glider@google.com>
Suggested-by: Ernesto Martinez Garcia <ernesto.martinezgarcia@tugraz.at>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Marco Elver <elver@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/kfence/core.c b/mm/kfence/core.c
index b5aedf505cecc9587a2ff46ace3018d88d47ae56..7393957f9a202ba1f42f30ea5d3a216a0ae14507 100644 (file)
--- a/mm/kfence/core.c
+++ b/mm/kfence/core.c
@@ -1004,14 +1004,14 @@ static int kfence_init_late(void)
 #ifdef CONFIG_CONTIG_ALLOC
        struct page *pages;
 
-       pages = alloc_contig_pages(nr_pages_pool, GFP_KERNEL, first_online_node,
-                                  NULL);
+       pages = alloc_contig_pages(nr_pages_pool, GFP_KERNEL | __GFP_SKIP_KASAN,
+                                  first_online_node, NULL);
        if (!pages)
                return -ENOMEM;
 
        __kfence_pool = page_to_virt(pages);
-       pages = alloc_contig_pages(nr_pages_meta, GFP_KERNEL, first_online_node,
-                                  NULL);
+       pages = alloc_contig_pages(nr_pages_meta, GFP_KERNEL | __GFP_SKIP_KASAN,
+                                  first_online_node, NULL);
        if (pages)
                kfence_metadata_init = page_to_virt(pages);
 #else
@@ -1021,11 +1021,13 @@ static int kfence_init_late(void)
                return -EINVAL;
        }
 
-       __kfence_pool = alloc_pages_exact(KFENCE_POOL_SIZE, GFP_KERNEL);
+       __kfence_pool = alloc_pages_exact(KFENCE_POOL_SIZE,
+                                         GFP_KERNEL | __GFP_SKIP_KASAN);
        if (!__kfence_pool)
                return -ENOMEM;
 
-       kfence_metadata_init = alloc_pages_exact(KFENCE_METADATA_SIZE, GFP_KERNEL);
+       kfence_metadata_init = alloc_pages_exact(KFENCE_METADATA_SIZE,
+                                                GFP_KERNEL | __GFP_SKIP_KASAN);
 #endif
 
        if (!kfence_metadata_init)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index fcc32737f451eaf9542df34068113ed52ef01fee..2d4b6f1a554ed21e0f169cd85b5e1ef8190bdf02 100644 (file)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6928,7 +6928,8 @@ static int __alloc_contig_verify_gfp_mask(gfp_t gfp_mask, gfp_t *gfp_cc_mask)
 {
        const gfp_t reclaim_mask = __GFP_IO | __GFP_FS | __GFP_RECLAIM;
        const gfp_t action_mask = __GFP_COMP | __GFP_RETRY_MAYFAIL | __GFP_NOWARN |
-                                 __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO;
+                                 __GFP_ZERO | __GFP_ZEROTAGS | __GFP_SKIP_ZERO |
+                                 __GFP_SKIP_KASAN;
        const gfp_t cc_action_mask = __GFP_RETRY_MAYFAIL | __GFP_NOWARN;
 
        /*