[PATCH 3/8] mm/slub: Support disabling freelist randomisation at boot

From: Chris Down

Date: Tue Oct 27 2026 - 03:36:08 EST


Add a slab_freelist_random= early parameter, enabled by default on
kernels built with CONFIG_SLAB_FREELIST_RANDOM=y.

Signed-off-by: Chris Down <chris@xxxxxxxxxxxxxx>
---
Documentation/admin-guide/kernel-parameters.txt | 7 +++++++
mm/Kconfig | 3 +++
mm/slub.c | 16 ++++++++++++++++
3 files changed, 26 insertions(+)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index ddf2f6fd60be..5c4d784e7786 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -7021,6 +7021,13 @@ Kernel parameters
without that option.
Default: on.

+ slab_freelist_random= [MM,EARLY]
+ Format: <bool>
+ Enable or disable slab freelist randomisation on
+ kernels built with CONFIG_SLAB_FREELIST_RANDOM=y.
+ Ignored without that option.
+ Default: on.
+
slab_max_order= [MM]
Determines the maximum allowed order for slabs.
A high setting may cause OOMs due to memory
diff --git a/mm/Kconfig b/mm/Kconfig
index 3ae97fec9946..56c422684b44 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -205,6 +205,9 @@ config SLAB_FREELIST_RANDOM
security feature reduces the predictability of the kernel slab
allocator against heap overflows.

+ The randomisation is enabled by default and can be disabled at
+ boot with "slab_freelist_random=0".
+
config SLAB_FREELIST_HARDENED
bool "Harden slab freelist metadata"
depends on !SLUB_TINY
diff --git a/mm/slub.c b/mm/slub.c
index de4937fcb293..7e9dadda3d10 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3424,12 +3424,23 @@ static inline struct slab *alloc_slab_page(gfp_t flags, int node,
}

#ifdef CONFIG_SLAB_FREELIST_RANDOM
+static bool slab_freelist_random __ro_after_init = true;
+
+static int __init setup_slab_freelist_random(char *str)
+{
+ return kstrtobool(str, &slab_freelist_random);
+}
+early_param("slab_freelist_random", setup_slab_freelist_random);
+
/* Pre-initialize the random sequence cache */
static int init_cache_random_seq(struct kmem_cache *s)
{
unsigned int count = oo_objects(s->oo);
int err;

+ if (!slab_freelist_random)
+ return 0;
+
/* Bailout if already initialised */
if (s->random_seq)
return 0;
@@ -3456,6 +3467,11 @@ static void __init init_freelist_randomization(void)
{
struct kmem_cache *s;

+ if (!slab_freelist_random) {
+ pr_info("SLUB: freelist randomisation disabled\n");
+ return;
+ }
+
mutex_lock(&slab_mutex);

list_for_each_entry(s, &slab_caches, list)
--
2.54.0