Hi Dev, On 6/12/26 1:44 PM, Dev Jain wrote: > Introduce a boot option to tag only at allocation time of the objects. This > reduces KASAN MTE overhead, the tradeoff being reduced ability of > catching bugs.
I think most of overhead when enabling MTE comes from loading and validing tags for every memory access (either in SYNC or ASYNC mode), rather than from storing tags. > Now, when a memory object will be freed, it will retain the random tag it > had at allocation time. This compromises on catching UAF bugs, till the > time the object is not reallocated, at which point it will have a new > random tag. > > Hence, not catching "use-after-free-before-reallocation" and not catching > "double-free" will be the compromise for reduced KASAN overhead. I doubt users who care about security enough to enable HW_TAGS KASAN are willing to compromise on security just to save a few instructions to store tags in the free path. To me, it looks like too much of a compromise on security for little performance gain. > This is an RFC because we are not clear about the performance benefit. > > Android folks, please help with testing! > > --- > Applies on Linus master (9716c086c8e8). > > Dev Jain (2): > kasan: hw_tags: Use KASAN_PAGE_REDZONE for vmalloc redzoning > kasan: hw_tags: Add boot option to elide free time poisoning > > Documentation/dev-tools/kasan.rst | 4 +++ > mm/kasan/hw_tags.c | 45 +++++++++++++++++++++++++++++-- > mm/kasan/kasan.h | 23 +++++++++++++++- > 3 files changed, 69 insertions(+), 3 deletions(-) > -- Cheers, Harry / Hyeonggon
OpenPGP_signature.asc
Description: OpenPGP digital signature
