Re: [PATCH] LoongArch: restore KFENCE pages through DMW on resume

[Huacai Chen]

On Sun, Nov 8, 2026 at 3:59 PM Mike Rapoport <rppt@xxxxxxxxxx> wrote:
>
> Gentle ping :)
Sorry for the late response, would you mind if I modify it to use
#ifdef? Usually it should be avoided, but I want to signal users that
KFENCE is not a usually enabled feature.

Huacai

>
> On Sat, Oct 31, 2026 at 03:21:46PM +0200, Mike Rapoport (Microsoft) wrote:
> > With KFENCE enabled, resume from hibernation triggers KFENCE reports while
> > swsusp_asm_resume() copies the image pages, for example:
> >
> >   BUG: KFENCE: use-after-free write in swsusp_asm_resume+0x20/0x94
> >
> >   Use-after-free write at 0x00000000a57ee925 (in kfence-#254):
> >    swsusp_asm_resume+0x20/0x94
> >    hibernation_restore+0x128/0x1a0
> >    load_image_and_restore+0x6c/0xc8
> >    software_resume+0x240/0x260
> >    do_one_initcall+0x68/0x200
> >    kernel_init_freeable+0x26c/0x304
> >    kernel_init+0x20/0x134
> >    ret_from_kernel_thread+0x24/0x1d0
> >    ret_from_kernel_thread_asm+0xc/0x98
> >
> > During resume from hibernation, the image pages that occupy physical pages
> > used by the restore kernel are first loaded into free pages and then, as
> > the very last step, swsusp_asm_resume() copies them to their final location
> > pointed to by pbe->orig_address, which the hibernation core sets to
> > page_address() of the page in the restore kernel.
> >
> > The early KFENCE pool is allocated from memblock and normally occupies the
> > same physical pages in the restore kernel and in the image kernel, so these
> > pages are usually copied by swsusp_asm_resume().
> >
> > The KFENCE pool is remapped into the KFENCE area above vm_map_base and
> > set_page_address() adjusts page->virtual so that page_address() returns
> > the page-table mapped alias rather than the DMW address of the pool pages.
> >
> > Hence, pbe->orig_address of KFENCE pages points to that alias and
> > swsusp_asm_resume() writes them through the page tables. But:
> >
> > * the copy loop overwrites the kernel page tables, so a TLB refill for the
> >   KFENCE alias may use a partially restored page table
> > * the KFENCE pool pages that are protected in the restore kernel fault in
> >   the middle of the copy
> >
> > Convert pbe->orig_address to DMW addresses before starting the copy.
> >
> > Fixes: 0ca84aeaee15 ("LoongArch: Make {virt, phys, page, pfn} translation work with KFENCE")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Mike Rapoport (Microsoft) <rppt@xxxxxxxxxx>
> > ---
> > Reproduced with hibernation in QEMU, the KFENCE reports are gone with
> > this patch.
> > ---
> >  arch/loongarch/power/hibernate.c | 12 ++++++++++++
> >  1 file changed, 12 insertions(+)
> >
> > diff --git a/arch/loongarch/power/hibernate.c b/arch/loongarch/power/hibernate.c
> > index 817270410ef98..ff571ab4e8df9 100644
> > --- a/arch/loongarch/power/hibernate.c
> > +++ b/arch/loongarch/power/hibernate.c
> > @@ -59,6 +59,18 @@ extern int swsusp_asm_resume(void);
> >
> >  int swsusp_arch_resume(void)
> >  {
> > +     struct pbe *pbe;
> > +
> > +     /*
> > +      * page_address() of KFENCE pages is mapped by page tables that are
> > +      * overwritten during restore and may be protected by KFENCE, copy
> > +      * through DMW instead.
> > +      */
> > +     if (IS_ENABLED(CONFIG_KFENCE)) {
> > +             for (pbe = restore_pblist; pbe; pbe = pbe->next)
> > +                     pbe->orig_address = __va(virt_to_phys(pbe->orig_address));
> > +     }
> > +
> >       /* Avoid TLB mismatch during and after kernel resume */
> >       local_flush_tlb_all();
> >       return swsusp_asm_resume();
> >
> > ---
> > base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
> > change-id: 20261027-fixes-loongarch-fd3755f33919
> >
> > --
> > Sincerely yours,
> > Mike.
> >
>
> --
> Sincerely yours,
> Mike.