Introduce a boot option to tag only at allocation time of the objects. This reduces KASAN MTE overhead, the tradeoff being reduced ability of catching bugs.
Now, when a memory object will be freed, it will retain the random tag it had at allocation time. This compromises on catching UAF bugs, till the time the object is not reallocated, at which point it will have a new random tag. Hence, not catching "use-after-free-before-reallocation" and not catching "double-free" will be the compromise for reduced KASAN overhead. This is an RFC because we are not clear about the performance benefit. Android folks, please help with testing! --- Applies on Linus master (9716c086c8e8). Dev Jain (2): kasan: hw_tags: Use KASAN_PAGE_REDZONE for vmalloc redzoning kasan: hw_tags: Add boot option to elide free time poisoning Documentation/dev-tools/kasan.rst | 4 +++ mm/kasan/hw_tags.c | 45 +++++++++++++++++++++++++++++-- mm/kasan/kasan.h | 23 +++++++++++++++- 3 files changed, 69 insertions(+), 3 deletions(-) -- 2.43.0
