Qun-Wei Lin 3dfb40da84 mm: krealloc: Fix MTE false alarm in __do_krealloc ... commit 704573851b upstream. This patch addresses an issue introduced by commit 1a83a716ec ("mm: krealloc: consider spare memory for __GFP_ZERO") which causes MTE (Memory Tagging Extension) to falsely report a slab-out-of-bounds error. The problem occurs when zeroing out spare memory in __do_krealloc. The original code only considered software-based KASAN and did not account for MTE. It does not reset the KASAN tag before calling memset, leading to a mismatch between the pointer tag and the memory tag, resulting in a false positive. Example of the error: ================================================================== swapper/0: BUG: KASAN: slab-out-of-bounds in __memset+0x84/0x188 swapper/0: Write at addr f4ffff8005f0fdf0 by task swapper/0/1 swapper/0: Pointer tag: [f4], memory tag: [fe] swapper/0: swapper/0: CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12. swapper/0: Hardware name: MT6991(ENG) (DT) swapper/0: Call trace: swapper/0: dump_backtrace+0xfc/0x17c swapper/0: show_stack+0x18/0x28 swapper/0: dump_stack_lvl+0x40/0xa0 swapper/0: print_report+0x1b8/0x71c swapper/0: kasan_report+0xec/0x14c swapper/0: __do_kernel_fault+0x60/0x29c swapper/0: do_bad_area+0x30/0xdc swapper/0: do_tag_check_fault+0x20/0x34 swapper/0: do_mem_abort+0x58/0x104 swapper/0: el1_abort+0x3c/0x5c swapper/0: el1h_64_sync_handler+0x80/0xcc swapper/0: el1h_64_sync+0x68/0x6c swapper/0: __memset+0x84/0x188 swapper/0: btf_populate_kfunc_set+0x280/0x3d8 swapper/0: __register_btf_kfunc_id_set+0x43c/0x468 swapper/0: register_btf_kfunc_id_set+0x48/0x60 swapper/0: register_nf_nat_bpf+0x1c/0x40 swapper/0: nf_nat_init+0xc0/0x128 swapper/0: do_one_initcall+0x184/0x464 swapper/0: do_initcall_level+0xdc/0x1b0 swapper/0: do_initcalls+0x70/0xc0 swapper/0: do_basic_setup+0x1c/0x28 swapper/0: kernel_init_freeable+0x144/0x1b8 swapper/0: kernel_init+0x20/0x1a8 swapper/0: ret_from_fork+0x10/0x20 ================================================================== Fixes: 1a83a716ec ("mm: krealloc: consider spare memory for __GFP_ZERO") Signed-off-by: Qun-Wei Lin <qun-wei.lin@mediatek.com> Acked-by: David Rientjes <rientjes@google.com> Signed-off-by: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-11-17 15:09:55 +01:00
..
damon	mm/damon/core: handle zero schemes apply interval	2024-11-14 13:21:12 +01:00
kasan	kasan: remove vmalloc_percpu test	2024-11-08 16:30:59 +01:00
kfence	mm: remove CONFIG_MEMCG_KMEM	2024-07-10 12:14:54 -07:00
kmsan	kmsan: do not pass NULL pointers as 0	2024-07-03 19:30:26 -07:00
backing-dev.c	writeback: support retrieving per group debug writeback stats of bdi	2024-05-05 17:53:51 -07:00
balloon_compaction.c	mm: remove MIGRATE_SYNC_NO_COPY mode	2024-07-03 19:30:00 -07:00
bootmem_info.c	bootmem: use kmemleak_free_part_phys in put_page_bootmem	2023-10-25 16:47:13 -07:00
cma_debug.c
cma_sysfs.c	mm/cma: add sysfs file 'release_pages_success'	2024-02-22 10:24:57 -08:00
cma.c	mm/cma: drop incorrect alignment check in cma_init_reserved_mem	2024-04-25 20:56:42 -07:00
cma.h	mm/cma: add sysfs file 'release_pages_success'	2024-02-22 10:24:57 -08:00
compaction.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
debug_page_alloc.c	mm: page_alloc: consolidate free page accounting	2024-04-25 20:56:04 -07:00
debug_page_ref.c
debug_vm_pgtable.c	mm/debug_vm_pgtable: drop RANDOM_ORVALUE trick	2024-06-15 10:43:08 -07:00
debug.c	mm/debug: print only page mapcount (excluding folio entire mapcount) in __dump_folio()	2024-05-05 17:53:31 -07:00
dmapool_test.c	mm/dmapool: add MODULE_DESCRIPTION()	2024-07-03 19:29:58 -07:00
dmapool.c	mm/mempool/dmapool: remove CONFIG_DEBUG_SLAB ifdefs	2023-12-05 11:17:58 +01:00
early_ioremap.c
execmem.c	mm/execmem, arch: convert remaining overrides of module_alloc to execmem	2024-05-14 00:31:43 -07:00
fadvise.c
fail_page_alloc.c	mm, page_alloc: put should_fail_alloc_page() back behing CONFIG_FAIL_PAGE_ALLOC	2024-07-17 21:05:18 -07:00
failslab.c	mm, slab: put should_failslab() back behind CONFIG_SHOULD_FAILSLAB	2024-07-17 21:05:18 -07:00
filemap.c	filemap: Fix bounds checking in filemap_read()	2024-11-14 13:21:11 +01:00
folio-compat.c	mm: remove page_mapping()	2024-07-03 19:29:59 -07:00
gup_test.c
gup_test.h
gup.c	mm/hugetlb: simplify refs in memfd_alloc_folio	2024-10-10 12:04:06 +02:00
highmem.c	mm/highmem: make nr_free_highpages() return "unsigned long"	2024-07-03 19:30:06 -07:00
hmm.c	mm: provide mm_struct and address to huge_ptep_get()	2024-07-12 15:52:15 -07:00
huge_memory.c	mm/thp: fix deferred split unqueue naming and locking	2024-11-14 13:21:12 +01:00
hugetlb_cgroup.c	mm/hugetlb_cgroup: switch to the new cftypes	2024-07-03 19:30:10 -07:00
hugetlb_vmemmap.c	mm: don't account memmap per-node	2024-08-15 22:16:14 -07:00
hugetlb_vmemmap.h	mm: hugetlb_vmemmap: fix reference to nonexistent file	2023-10-25 16:47:14 -07:00
hugetlb.c	mm/hugetlb: fix memfd_pin_folios resv_huge_pages leak	2024-10-10 12:04:06 +02:00
hwpoison-inject.c	mm/hwpoison: add MODULE_DESCRIPTION()	2024-07-03 19:29:58 -07:00
init-mm.c	mm: Deprecate pasid field	2023-12-12 10:11:32 +01:00
internal.h	mm/thp: fix deferred split unqueue naming and locking	2024-11-14 13:21:12 +01:00
interval_tree.c
io-mapping.c
ioremap.c
Kconfig	mm: z3fold: deprecate CONFIG_Z3FOLD	2024-10-10 12:04:14 +02:00
Kconfig.debug	mm/slub: unify all sl[au]b parameters with "slab_$param"	2024-01-22 10:31:08 +01:00
khugepaged.c	mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace point	2024-10-22 15:51:21 +02:00
kmemleak.c	mm/kmemleak: replace strncpy() with strscpy()	2024-07-17 21:05:18 -07:00
ksm.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
list_lru.c	mm: list_lru: fix UAF for memory cgroup	2024-08-07 18:33:56 -07:00
maccess.c
madvise.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
Makefile	mm: memcg: put cgroup v1-specific code under a config option	2024-07-04 18:05:54 -07:00
mapping_dirty_helpers.c
memblock.c	memblock: updates for 6.11-rc1	2024-07-18 14:48:11 -07:00
memcontrol-v1.c	mm/thp: fix deferred split unqueue naming and locking	2024-11-14 13:21:12 +01:00
memcontrol-v1.h	mm: memcg: gather memcg1-specific fields initialization in memcg1_memcg_init()	2024-07-04 18:05:56 -07:00
memcontrol.c	mm/thp: fix deferred split unqueue naming and locking	2024-11-14 13:21:12 +01:00
memfd.c	mm/hugetlb: simplify refs in memfd_alloc_folio	2024-10-10 12:04:06 +02:00
memory_hotplug.c	x86/kaslr: Expose and use the end of the physical memory address space	2024-08-20 13:44:57 +02:00
memory-failure.c	mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu	2024-08-15 22:16:14 -07:00
memory-tiers.c	memory tier: consolidate the initialization of memory tiers	2024-07-12 15:52:20 -07:00
memory.c	mm: don't install PMD mappings when THPs are disabled by the hw/process/vma	2024-11-01 02:02:33 +01:00
mempolicy.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
mempool.c	mm: fix xyz_noprof functions calling profiled functions	2024-06-05 19:19:26 -07:00
memremap.c	mm: convert put_devmap_managed_page_refs() to put_devmap_managed_folio_refs()	2024-05-05 17:53:49 -07:00
memtest.c	memtest: use {READ,WRITE}_ONCE in memory scanning	2024-03-13 12:12:21 -07:00
migrate_device.c	mm: extend rmap flags arguments for folio_add_new_anon_rmap	2024-07-03 19:30:18 -07:00
migrate.c	mm/thp: fix deferred split unqueue naming and locking	2024-11-14 13:21:12 +01:00
mincore.c	mm: provide mm_struct and address to huge_ptep_get()	2024-07-12 15:52:15 -07:00
mlock.c	mm/mlock: set the correct prev on failure	2024-11-14 13:21:12 +01:00
mm_init.c	alloc_tag: mark pages reserved during CMA activation as not tagged	2024-08-15 22:16:16 -07:00
mm_slot.h
mmap_lock.c	mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer	2024-07-03 19:30:26 -07:00
mmap.c	mm, mmap: limit THP alignment of anonymous mappings to PMD-aligned sizes	2024-11-08 16:31:00 +01:00
mmu_gather.c	mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing	2024-02-22 15:27:17 -08:00
mmu_notifier.c	mmu_notifier: remove the .change_pte() callback	2024-04-11 13:18:36 -04:00
mmzone.c	zswap: shrink zswap pool based on memory pressure	2023-12-12 10:57:02 -08:00
mprotect.c	mm: introduce pmd|pte_needs_soft_dirty_wp helpers for softdirty write-protect	2024-07-03 19:30:07 -07:00
mremap.c	mm/mremap: fix move_normal_pmd/retract_page_tables race	2024-10-22 15:51:20 +02:00
mseal.c	mseal: fix is_madv_discard()	2024-08-15 22:16:13 -07:00
msync.c
nommu.c	The usual shower of singleton fixes and minor series all over MM,	2024-05-19 09:21:03 -07:00
oom_kill.c	memory: remove the now superfluous sentinel element from ctl_table array	2024-04-25 20:56:32 -07:00
page_alloc.c	mm/thp: fix deferred split unqueue naming and locking	2024-11-14 13:21:12 +01:00
page_counter.c	mm/page_counter: move calculating protection values to page_counter	2024-07-12 15:52:20 -07:00
page_ext.c	mm: don't account memmap per-node	2024-08-15 22:16:14 -07:00
page_idle.c
page_io.c	mm: ignore data-race in __swap_writepage	2024-07-17 21:05:18 -07:00
page_isolation.c	mm: page_isolation: prepare for hygienic freelists	2024-04-25 20:56:04 -07:00
page_owner.c	mm/page-owner: use gfp_nested_mask() instead of open coded masking	2024-05-19 14:40:44 -07:00
page_poison.c	mm/page_poison: replace kmap_atomic() with kmap_local_page()	2023-12-10 16:51:50 -08:00
page_reporting.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
page_reporting.h
page_table_check.c	mm/page_table_check: fix crash on ZONE_DEVICE	2024-06-15 10:43:04 -07:00
page_vma_mapped.c	mm: make page_mapped_in_vma conditional on CONFIG_MEMORY_FAILURE	2024-05-05 17:53:45 -07:00
page-writeback.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
pagewalk.c	mm: remove CONFIG_ARCH_HAS_HUGEPD	2024-07-12 15:52:19 -07:00
percpu-internal.h	mm: remove CONFIG_MEMCG_KMEM	2024-07-10 12:14:54 -07:00
percpu-km.c
percpu-stats.c
percpu-vm.c	percpu: clean up all mappings when pcpu_map_pages() fails	2024-04-25 20:55:49 -07:00
percpu.c	mm: remove CONFIG_MEMCG_KMEM	2024-07-10 12:14:54 -07:00
pgalloc-track.h
pgtable-generic.c	mm: fix race between __split_huge_pmd_locked() and GUP-fast	2024-05-07 10:37:00 -07:00
process_vm_access.c	mm: fix process_vm_rw page counts	2023-12-10 16:51:39 -08:00
ptdump.c	mm: ptdump: add check_wx_pages debugfs attribute	2024-02-22 10:24:47 -08:00
readahead.c	Merge branch 'mm-hotfixes-stable' into mm-stable to pick up "mm: fix	2024-07-06 11:44:41 -07:00
rmap.c	mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify()	2024-11-08 16:31:01 +01:00
rodata_test.c
secretmem.c	secretmem: disable memfd_secret() if arch cannot set direct map	2024-10-17 15:27:02 +02:00
shmem_quota.c	tmpfs: fix race on handling dquot rbtree	2024-03-26 11:07:23 -07:00
shmem.c	mm: shmem: fix data-race in shmem_getattr()	2024-11-08 16:30:55 +01:00
show_mem.c	lib: add memory allocations report in show_mem()	2024-04-25 20:55:57 -07:00
shrinker_debug.c
shrinker.c	mm: shrinker: avoid memleak in alloc_shrinker_info	2024-11-08 16:30:55 +01:00
shuffle.c
shuffle.h	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
slab_common.c	mm: krealloc: Fix MTE false alarm in __do_krealloc	2024-11-17 15:09:55 +01:00
slab.h	- 875fa64577 ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
slub.c	mm, slub: avoid zeroing kmalloc redzone	2024-10-10 12:03:48 +02:00
sparse-vmemmap.c	mm: don't account memmap per-node	2024-08-15 22:16:14 -07:00
sparse.c	A set of X86 fixes:	2024-09-01 14:43:08 -07:00
swap_cgroup.c
swap_slots.c	mm: swap: update get_swap_pages() to take folio order	2024-04-25 20:56:37 -07:00
swap_state.c	mm: swap_state: use folio_alloc_mpol() in __read_swap_cache_async()	2024-07-12 15:52:22 -07:00
swap.c	mm/thp: fix deferred split unqueue naming and locking	2024-11-14 13:21:12 +01:00
swap.h	mm: swap: remove 'synchronous' argument to swap_read_folio()	2024-07-03 19:30:06 -07:00
swapfile.c	mm/swapfile: skip HugeTLB pages for unuse_vma	2024-10-22 15:51:21 +02:00
truncate.c	mm: Fix missing folio invalidation calls during truncation	2024-08-24 16:09:16 +02:00
usercopy.c
userfaultfd.c	userfaultfd: don't BUG_ON() if khugepaged yanks our page table	2024-09-01 17:59:00 -07:00
util.c	mm: only enforce minimum stack gap size if it's sensible	2024-10-04 16:38:55 +02:00
vmalloc.c	mm: vmalloc: optimize vmap_lazy_nr arithmetic when purging each vmap_area	2024-09-01 17:59:02 -07:00
vmpressure.c	eventfd: simplify eventfd_signal()	2023-11-28 14:08:38 +01:00
vmscan.c	mm/thp: fix deferred split unqueue naming and locking	2024-11-14 13:21:12 +01:00
vmstat.c	mm: don't account memmap per-node	2024-08-15 22:16:14 -07:00
workingset.c	cachestat: do not flush stats in recency check	2024-07-03 22:40:37 -07:00
z3fold.c	mm: zpool: return pool size in pages	2024-04-25 20:55:48 -07:00
zbud.c	mm: zpool: return pool size in pages	2024-04-25 20:55:48 -07:00
zpool.c	mm: zpool: return pool size in pages	2024-04-25 20:55:48 -07:00
zsmalloc.c	minmax: make generic MIN() and MAX() macros available everywhere	2024-07-28 15:49:18 -07:00
zswap.c	mm/zswap: fix a white space issue	2024-07-17 21:08:55 -07:00