diff mbox series

kernel: enable CONFIG_PAGE_POISONING on aarch64 and armv5tel

Message ID 39f9e032-50e4-fc53-753b-18c6b6b81ffe@ipfire.org
State Dropped
Headers
Series kernel: enable CONFIG_PAGE_POISONING on aarch64 and armv5tel |

Commit Message

Peter Müller June 21, 2020, 9:38 a.m. UTC 
  Quoted from https://capsule8.com/blog/kernel-configuration-glossary/:

> Significance: Medium
>
> Fill the pages with poison patterns after free_pages() and verify the patterns
> before alloc_pages. The filling of the memory helps reduce the risk of
> information leaks from freed data. This does have a potential performance
> impact if enabled with the "page_poison=1" kernel boot option.

This was forgotten for aarch64 and armv5tel, while a corresponding patch
for x86_64 was merged as commit efd508e9f60d17d8d2205ba8ef3f03407c720fa8.

Since Fireinfo only reports a few aarch64 and armv5tel systems running
IPFire 2.x, enabling this seems to be not that critical to me. Anyway,
sorry for the chaos...

Partially fixes: #12362

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 config/kernel/kernel.config.aarch64-ipfire        | 4 +++-
 config/kernel/kernel.config.armv5tel-ipfire-multi | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
index c616cbb85..bd9e09c96 100644
--- a/config/kernel/kernel.config.aarch64-ipfire
+++ b/config/kernel/kernel.config.aarch64-ipfire
@@ -6357,7 +6357,9 @@  CONFIG_DEBUG_KERNEL=y
 #
 # CONFIG_PAGE_EXTENSION is not set
 # CONFIG_DEBUG_PAGEALLOC is not set
-# CONFIG_PAGE_POISONING is not set
+CONFIG_PAGE_POISONING=y
+# CONFIG_PAGE_POISONING_NO_SANITY is not set
+CONFIG_PAGE_POISONING_ZERO=y
 # CONFIG_DEBUG_PAGE_REF is not set
 # CONFIG_DEBUG_RODATA_TEST is not set
 # CONFIG_DEBUG_OBJECTS is not set
diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi
index 5280a6a62..d8ca5605b 100644
--- a/config/kernel/kernel.config.armv5tel-ipfire-multi
+++ b/config/kernel/kernel.config.armv5tel-ipfire-multi
@@ -6842,7 +6842,9 @@  CONFIG_DEBUG_KERNEL=y
 #
 # CONFIG_PAGE_EXTENSION is not set
 # CONFIG_DEBUG_PAGEALLOC is not set
-# CONFIG_PAGE_POISONING is not set
+CONFIG_PAGE_POISONING=y
+# CONFIG_PAGE_POISONING_NO_SANITY is not set
+CONFIG_PAGE_POISONING_ZERO=y
 # CONFIG_DEBUG_PAGE_REF is not set
 # CONFIG_DEBUG_RODATA_TEST is not set
 # CONFIG_DEBUG_OBJECTS is not set