From: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
The tag-based KASAN adopts an arithemitc bit shift to convert a memory
address to a shadow memory address. While it makes a lot of sense on
arm64, it doesn't work well for all cases on x86 - either the
non-canonical hook becomes quite complex for different paging levels, or
the inline mode would need a lot more adjustments. Thus the best working
scheme is the logical bit shift and non-canonical shadow offset that x86
uses for generic KASAN, of course adjusted for the increased granularity
from 8 to 16 bytes.
Add an arch specific implementation of kasan_mem_to_shadow() that uses
the logical bit shift.
The non-canonical hook tries to calculate whether an address came from
kasan_mem_to_shadow(). First it checks whether this address fits into
the legal set of values possible to output from the mem to shadow
function.
Tie both generic and tag-based x86 KASAN modes to the address range
check associated with generic KASAN.
Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
---
Changelog v7:
- Redo the patch message and add a comment to __kasan_mem_to_shadow() to
provide better explanation on why x86 doesn't work well with the
arithemitc bit shift approach (Marco).
Changelog v4:
- Add this patch to the series.
arch/x86/include/asm/kasan.h | 15 +++++++++++++++
mm/kasan/report.c | 5 +++--
2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
index eab12527ed7f..9b7951a79753 100644
--- a/arch/x86/include/asm/kasan.h
+++ b/arch/x86/include/asm/kasan.h
@@ -31,6 +31,21 @@
#include <linux/bits.h>
#ifdef CONFIG_KASAN_SW_TAGS
+/*
+ * Using the non-arch specific implementation of __kasan_mem_to_shadow() with a
+ * arithmetic bit shift can cause high code complexity in KASAN's non-canonical
+ * hook for x86 or might not work for some paging level and KASAN mode
+ * combinations. The inline mode compiler support could also suffer from higher
+ * complexity for no specific benefit. Therefore the generic mode's logical
+ * shift implementation is used.
+ */
+static inline void *__kasan_mem_to_shadow(const void *addr)
+{
+ return (void *)((unsigned long)addr >> KASAN_SHADOW_SCALE_SHIFT)
+ + KASAN_SHADOW_OFFSET;
+}
+
+#define kasan_mem_to_shadow(addr) __kasan_mem_to_shadow(addr)
#define __tag_shifted(tag) FIELD_PREP(GENMASK_ULL(60, 57), tag)
#define __tag_reset(addr) (sign_extend64((u64)(addr), 56))
#define __tag_get(addr) ((u8)FIELD_GET(GENMASK_ULL(60, 57), (u64)addr))
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index b5beb1b10bd2..db6a9a3d01b2 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -642,13 +642,14 @@ void kasan_non_canonical_hook(unsigned long addr)
const char *bug_type;
/*
- * For Generic KASAN, kasan_mem_to_shadow() uses the logical right shift
+ * For Generic KASAN and Software Tag-Based mode on the x86
+ * architecture, kasan_mem_to_shadow() uses the logical right shift
* and never overflows with the chosen KASAN_SHADOW_OFFSET values (on
* both x86 and arm64). Thus, the possible shadow addresses (even for
* bogus pointers) belong to a single contiguous region that is the
* result of kasan_mem_to_shadow() applied to the whole address space.
*/
- if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
+ if (IS_ENABLED(CONFIG_KASAN_GENERIC) || IS_ENABLED(CONFIG_X86_64)) {
if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0ULL)) ||
addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
return;
--
2.52.0On Mon, Jan 12, 2026 at 6:28 PM Maciej Wieczor-Retman
<m.wieczorretman@pm.me> wrote:
>
> From: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
>
> The tag-based KASAN adopts an arithemitc bit shift to convert a memory
> address to a shadow memory address. While it makes a lot of sense on
> arm64, it doesn't work well for all cases on x86 - either the
> non-canonical hook becomes quite complex for different paging levels, or
> the inline mode would need a lot more adjustments. Thus the best working
> scheme is the logical bit shift and non-canonical shadow offset that x86
> uses for generic KASAN, of course adjusted for the increased granularity
> from 8 to 16 bytes.
>
> Add an arch specific implementation of kasan_mem_to_shadow() that uses
> the logical bit shift.
>
> The non-canonical hook tries to calculate whether an address came from
> kasan_mem_to_shadow(). First it checks whether this address fits into
> the legal set of values possible to output from the mem to shadow
> function.
>
> Tie both generic and tag-based x86 KASAN modes to the address range
> check associated with generic KASAN.
>
> Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
> ---
> Changelog v7:
> - Redo the patch message and add a comment to __kasan_mem_to_shadow() to
> provide better explanation on why x86 doesn't work well with the
> arithemitc bit shift approach (Marco).
>
> Changelog v4:
> - Add this patch to the series.
>
> arch/x86/include/asm/kasan.h | 15 +++++++++++++++
> mm/kasan/report.c | 5 +++--
> 2 files changed, 18 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
> index eab12527ed7f..9b7951a79753 100644
> --- a/arch/x86/include/asm/kasan.h
> +++ b/arch/x86/include/asm/kasan.h
> @@ -31,6 +31,21 @@
> #include <linux/bits.h>
>
> #ifdef CONFIG_KASAN_SW_TAGS
> +/*
> + * Using the non-arch specific implementation of __kasan_mem_to_shadow() with a
> + * arithmetic bit shift can cause high code complexity in KASAN's non-canonical
> + * hook for x86 or might not work for some paging level and KASAN mode
> + * combinations. The inline mode compiler support could also suffer from higher
> + * complexity for no specific benefit. Therefore the generic mode's logical
> + * shift implementation is used.
> + */
> +static inline void *__kasan_mem_to_shadow(const void *addr)
> +{
> + return (void *)((unsigned long)addr >> KASAN_SHADOW_SCALE_SHIFT)
> + + KASAN_SHADOW_OFFSET;
> +}
> +
> +#define kasan_mem_to_shadow(addr) __kasan_mem_to_shadow(addr)
> #define __tag_shifted(tag) FIELD_PREP(GENMASK_ULL(60, 57), tag)
> #define __tag_reset(addr) (sign_extend64((u64)(addr), 56))
> #define __tag_get(addr) ((u8)FIELD_GET(GENMASK_ULL(60, 57), (u64)addr))
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index b5beb1b10bd2..db6a9a3d01b2 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -642,13 +642,14 @@ void kasan_non_canonical_hook(unsigned long addr)
> const char *bug_type;
>
> /*
> - * For Generic KASAN, kasan_mem_to_shadow() uses the logical right shift
> + * For Generic KASAN and Software Tag-Based mode on the x86
> + * architecture, kasan_mem_to_shadow() uses the logical right shift
> * and never overflows with the chosen KASAN_SHADOW_OFFSET values (on
> * both x86 and arm64). Thus, the possible shadow addresses (even for
> * bogus pointers) belong to a single contiguous region that is the
> * result of kasan_mem_to_shadow() applied to the whole address space.
> */
> - if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
> + if (IS_ENABLED(CONFIG_KASAN_GENERIC) || IS_ENABLED(CONFIG_X86_64)) {
Not a functionality but just a code organization related concern:
Here, we embed the CONFIG_X86_64 special case in the core KASAN code,
but the __kasan_mem_to_shadow definition to use the logical shift
exists in the x86-64 arch code, and it just copy-pastes one of the
cases from the core kasan_mem_to_shadow definition.
Should we just move the x86-64 special case to the core KASAN code too
then? I.e., change the kasan_mem_to_shadow definition in
include/linux/kasan.h to check for IS_ENABLED(CONFIG_X86_64)).
And we could also add a comment there explaining how using the logical
shift for SW_TAGS benefits some architectures (just arm64 for now, but
riscv in the future as well). And put your comment about why it's not
worth it for x86 there as well.
I don't have a strong preference, just an idea.
Any thoughts?
> if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0ULL)) ||
> addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
> return;
There's also a comment lower in the function that needs to be updated
to mention Software Tag-Based mode on arm64 specifically.
> --
> 2.52.0
>
>
On 2026-01-13 at 02:21:22 +0100, Andrey Konovalov wrote:
>On Mon, Jan 12, 2026 at 6:28 PM Maciej Wieczor-Retman
><m.wieczorretman@pm.me> wrote:
>>
>> From: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
...
>>
>> /*
>> - * For Generic KASAN, kasan_mem_to_shadow() uses the logical right shift
>> + * For Generic KASAN and Software Tag-Based mode on the x86
>> + * architecture, kasan_mem_to_shadow() uses the logical right shift
>> * and never overflows with the chosen KASAN_SHADOW_OFFSET values (on
>> * both x86 and arm64). Thus, the possible shadow addresses (even for
>> * bogus pointers) belong to a single contiguous region that is the
>> * result of kasan_mem_to_shadow() applied to the whole address space.
>> */
>> - if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
>> + if (IS_ENABLED(CONFIG_KASAN_GENERIC) || IS_ENABLED(CONFIG_X86_64)) {
>
>Not a functionality but just a code organization related concern:
>
>Here, we embed the CONFIG_X86_64 special case in the core KASAN code,
>but the __kasan_mem_to_shadow definition to use the logical shift
>exists in the x86-64 arch code, and it just copy-pastes one of the
>cases from the core kasan_mem_to_shadow definition.
>
>Should we just move the x86-64 special case to the core KASAN code too
>then? I.e., change the kasan_mem_to_shadow definition in
>include/linux/kasan.h to check for IS_ENABLED(CONFIG_X86_64)).
>
>And we could also add a comment there explaining how using the logical
>shift for SW_TAGS benefits some architectures (just arm64 for now, but
>riscv in the future as well). And put your comment about why it's not
>worth it for x86 there as well.
>
>I don't have a strong preference, just an idea.
>
>Any thoughts?
I'm a fan of trying to keep as much arch code in the arch directories.
How about before putting a call here instead like:
if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0ULL)) ||
addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
return;
}
arch_kasan_non_canonical_hook()
There would be the generic non-arch part above (and anything shared that might
make sense here in the future) and all the arch related code would be hidden in
the per-arch helper.
So then we could move the part below:
if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) && IS_ENABLED(CONFIG_ARM64)) {
if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0xFFULL << 56)) ||
addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
return;
}
to /arch/arm64.
For x86 we'd need to duplicate the generic part into
arch_kasan_non_canonical_hook() call in /arch/x86. That seems quiet tidy to me,
granted the duplication isn't great but it would keep the non-arch part as
shared as possible. What do you think?
>
>> if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0ULL)) ||
>> addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
>> return;
>
>There's also a comment lower in the function that needs to be updated
>to mention Software Tag-Based mode on arm64 specifically.
Okay, I'll add that in
>
>
>
>
>> --
>> 2.52.0
>>
>>
--
Kind regards
Maciej Wieczór-Retman
On Wed, Jan 14, 2026 at 5:52 PM Maciej Wieczor-Retman
<maciej.wieczor-retman@intel.com> wrote:
>
> I'm a fan of trying to keep as much arch code in the arch directories.
>
> How about before putting a call here instead like:
>
> if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
> if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0ULL)) ||
> addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
> return;
> }
>
> arch_kasan_non_canonical_hook()
> There would be the generic non-arch part above (and anything shared that might
> make sense here in the future) and all the arch related code would be hidden in
> the per-arch helper.
>
> So then we could move the part below:
> if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) && IS_ENABLED(CONFIG_ARM64)) {
> if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0xFFULL << 56)) ||
> addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
> return;
> }
> to /arch/arm64.
>
> For x86 we'd need to duplicate the generic part into
> arch_kasan_non_canonical_hook() call in /arch/x86. That seems quiet tidy to me,
> granted the duplication isn't great but it would keep the non-arch part as
> shared as possible. What do you think?
Sounds good to me too, thanks!
On 2026-01-15 at 04:57:15 +0100, Andrey Konovalov wrote:
>On Wed, Jan 14, 2026 at 5:52 PM Maciej Wieczor-Retman
><maciej.wieczor-retman@intel.com> wrote:
>>
>> I'm a fan of trying to keep as much arch code in the arch directories.
>>
>> How about before putting a call here instead like:
>>
>> if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
>> if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0ULL)) ||
>> addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
>> return;
>> }
>>
>> arch_kasan_non_canonical_hook()
>> There would be the generic non-arch part above (and anything shared that might
>> make sense here in the future) and all the arch related code would be hidden in
>> the per-arch helper.
>>
>> So then we could move the part below:
>> if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) && IS_ENABLED(CONFIG_ARM64)) {
>> if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0xFFULL << 56)) ||
>> addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
>> return;
>> }
>> to /arch/arm64.
>>
>> For x86 we'd need to duplicate the generic part into
>> arch_kasan_non_canonical_hook() call in /arch/x86. That seems quiet tidy to me,
>> granted the duplication isn't great but it would keep the non-arch part as
>> shared as possible. What do you think?
>
>Sounds good to me too, thanks!
x86 was easy to do because the kasan_mem_to_shadow() was already in the
asm/kasan.h. arm64 took a bit more changes since I had to write the
arch_kasan_non_canonical_hook in a separate file that would import the
linux/kasan.h header in order to use kasan_mem_to_shadow(). Anyway below are the
relevant bits from the patch - does that look okay? Or would you prefer some
different names/placements?
diff --git a/arch/arm64/include/asm/kasan.h b/arch/arm64/include/asm/kasan.h
index b167e9d3da91..16b1f2ca3ea8 100644
--- a/arch/arm64/include/asm/kasan.h
+++ b/arch/arm64/include/asm/kasan.h
@@ -17,6 +17,8 @@
asmlinkage void kasan_early_init(void);
void kasan_init(void);
+bool __arch_kasan_non_canonical_hook(unsigned long addr);
+#define arch_kasan_non_canonical_hook(addr) __arch_kasan_non_canonical_hook(addr)
#else
static inline void kasan_init(void) { }
diff --git a/arch/arm64/mm/Makefile b/arch/arm64/mm/Makefile
index c26489cf96cd..a122ea67eced 100644
--- a/arch/arm64/mm/Makefile
+++ b/arch/arm64/mm/Makefile
@@ -15,4 +15,6 @@ obj-$(CONFIG_ARM64_GCS) += gcs.o
KASAN_SANITIZE_physaddr.o += n
obj-$(CONFIG_KASAN) += kasan_init.o
+obj-$(CONFIG_KASAN) += kasan.o
KASAN_SANITIZE_kasan_init.o := n
+KASAN_SANITIZE_kasan.o := n
diff --git a/arch/arm64/mm/kasan.c b/arch/arm64/mm/kasan.c
new file mode 100644
index 000000000000..b94d5fb480ca
--- /dev/null
+++ b/arch/arm64/mm/kasan.c
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * This file contains ARM64 specific KASAN code.
+ */
+
+#include <linux/kasan.h>
+
+bool __arch_kasan_non_canonical_hook(unsigned long addr) {
+ /*
+ * For Software Tag-Based KASAN, kasan_mem_to_shadow() uses the
+ * arithmetic shift. Normally, this would make checking for a possible
+ * shadow address complicated, as the shadow address computation
+ * operation would overflow only for some memory addresses. However, due
+ * to the chosen KASAN_SHADOW_OFFSET values and the fact the
+ * kasan_mem_to_shadow() only operates on pointers with the tag reset,
+ * the overflow always happens.
+ *
+ * For arm64, the top byte of the pointer gets reset to 0xFF. Thus, the
+ * possible shadow addresses belong to a region that is the result of
+ * kasan_mem_to_shadow() applied to the memory range
+ * [0xFF000000000000, 0xFFFFFFFFFFFFFFFF]. Despite the overflow, the
+ * resulting possible shadow region is contiguous, as the overflow
+ * happens for both 0xFF000000000000 and 0xFFFFFFFFFFFFFFFF.
+ */
+ if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) {
+ if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0xFFULL << 56)) ||
+ addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
+ return true;
+ }
+ return false;
+}
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 9c6ac4b62eb9..146eecae4e9c 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
...
@@ -403,6 +409,13 @@ static __always_inline bool kasan_check_byte(const void *addr)
return true;
}
+#ifndef arch_kasan_non_canonical_hook
+static inline bool arch_kasan_non_canonical_hook(unsigned long addr)
+{
+ return false;
+}
+#endif
+
#else /* CONFIG_KASAN */
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 62c01b4527eb..1c4893729ff6 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -642,10 +642,19 @@ void kasan_non_canonical_hook(unsigned long addr)
const char *bug_type;
/*
- * All addresses that came as a result of the memory-to-shadow mapping
- * (even for bogus pointers) must be >= KASAN_SHADOW_OFFSET.
+ * For Generic KASAN, kasan_mem_to_shadow() uses the logical right shift
+ * and never overflows with the chosen KASAN_SHADOW_OFFSET values. Thus,
+ * the possible shadow addresses (even for bogus pointers) belong to a
+ * single contiguous region that is the result of kasan_mem_to_shadow()
+ * applied to the whole address space.
*/
- if (addr < KASAN_SHADOW_OFFSET)
+ if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
+ if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0ULL)) ||
+ addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
+ return;
+ }
+
+ if(arch_kasan_non_canonical_hook(addr))
return;
--
Kind regards
Maciej Wieczór-Retman
On Thu, Jan 15, 2026 at 5:43 PM Maciej Wieczor-Retman
<m.wieczorretman@pm.me> wrote:
>
> x86 was easy to do because the kasan_mem_to_shadow() was already in the
> asm/kasan.h. arm64 took a bit more changes since I had to write the
> arch_kasan_non_canonical_hook in a separate file that would import the
> linux/kasan.h header in order to use kasan_mem_to_shadow(). Anyway below are the
> relevant bits from the patch - does that look okay? Or would you prefer some
> different names/placements?
One comment below, otherwise looks fine to me, thanks!
>
> diff --git a/arch/arm64/include/asm/kasan.h b/arch/arm64/include/asm/kasan.h
> index b167e9d3da91..16b1f2ca3ea8 100644
> --- a/arch/arm64/include/asm/kasan.h
> +++ b/arch/arm64/include/asm/kasan.h
> @@ -17,6 +17,8 @@
>
> asmlinkage void kasan_early_init(void);
> void kasan_init(void);
> +bool __arch_kasan_non_canonical_hook(unsigned long addr);
> +#define arch_kasan_non_canonical_hook(addr) __arch_kasan_non_canonical_hook(addr)
>
> #else
> static inline void kasan_init(void) { }
>
> diff --git a/arch/arm64/mm/Makefile b/arch/arm64/mm/Makefile
> index c26489cf96cd..a122ea67eced 100644
> --- a/arch/arm64/mm/Makefile
> +++ b/arch/arm64/mm/Makefile
> @@ -15,4 +15,6 @@ obj-$(CONFIG_ARM64_GCS) += gcs.o
> KASAN_SANITIZE_physaddr.o += n
>
> obj-$(CONFIG_KASAN) += kasan_init.o
> +obj-$(CONFIG_KASAN) += kasan.o
> KASAN_SANITIZE_kasan_init.o := n
> +KASAN_SANITIZE_kasan.o := n
> diff --git a/arch/arm64/mm/kasan.c b/arch/arm64/mm/kasan.c
> new file mode 100644
> index 000000000000..b94d5fb480ca
> --- /dev/null
> +++ b/arch/arm64/mm/kasan.c
> @@ -0,0 +1,31 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * This file contains ARM64 specific KASAN code.
> + */
> +
> +#include <linux/kasan.h>
> +
> +bool __arch_kasan_non_canonical_hook(unsigned long addr) {
> + /*
> + * For Software Tag-Based KASAN, kasan_mem_to_shadow() uses the
> + * arithmetic shift. Normally, this would make checking for a possible
> + * shadow address complicated, as the shadow address computation
> + * operation would overflow only for some memory addresses. However, due
> + * to the chosen KASAN_SHADOW_OFFSET values and the fact the
> + * kasan_mem_to_shadow() only operates on pointers with the tag reset,
> + * the overflow always happens.
> + *
> + * For arm64, the top byte of the pointer gets reset to 0xFF. Thus, the
> + * possible shadow addresses belong to a region that is the result of
> + * kasan_mem_to_shadow() applied to the memory range
> + * [0xFF000000000000, 0xFFFFFFFFFFFFFFFF]. Despite the overflow, the
> + * resulting possible shadow region is contiguous, as the overflow
> + * happens for both 0xFF000000000000 and 0xFFFFFFFFFFFFFFFF.
> + */
> + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) {
> + if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0xFFULL << 56)) ||
> + addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
> + return true;
> + }
> + return false;
> +}
> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
> index 9c6ac4b62eb9..146eecae4e9c 100644
> --- a/include/linux/kasan.h
> +++ b/include/linux/kasan.h
> ...
> @@ -403,6 +409,13 @@ static __always_inline bool kasan_check_byte(const void *addr)
> return true;
> }
>
> +#ifndef arch_kasan_non_canonical_hook
> +static inline bool arch_kasan_non_canonical_hook(unsigned long addr)
> +{
> + return false;
> +}
> +#endif
Let's put this next to kasan_non_canonical_hook declaration.
> +
> #else /* CONFIG_KASAN */
>
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index 62c01b4527eb..1c4893729ff6 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -642,10 +642,19 @@ void kasan_non_canonical_hook(unsigned long addr)
> const char *bug_type;
>
> /*
> - * All addresses that came as a result of the memory-to-shadow mapping
> - * (even for bogus pointers) must be >= KASAN_SHADOW_OFFSET.
> + * For Generic KASAN, kasan_mem_to_shadow() uses the logical right shift
> + * and never overflows with the chosen KASAN_SHADOW_OFFSET values. Thus,
> + * the possible shadow addresses (even for bogus pointers) belong to a
> + * single contiguous region that is the result of kasan_mem_to_shadow()
> + * applied to the whole address space.
> */
> - if (addr < KASAN_SHADOW_OFFSET)
> + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
> + if (addr < (unsigned long)kasan_mem_to_shadow((void *)(0ULL)) ||
> + addr > (unsigned long)kasan_mem_to_shadow((void *)(~0ULL)))
> + return;
> + }
> +
> + if(arch_kasan_non_canonical_hook(addr))
> return;
>
> --
> Kind regards
> Maciej Wieczór-Retman
>
On 2026-01-17 at 02:21:31 +0100, Andrey Konovalov wrote:
>On Thu, Jan 15, 2026 at 5:43 PM Maciej Wieczor-Retman
><m.wieczorretman@pm.me> wrote:
>> +#ifndef arch_kasan_non_canonical_hook
>> +static inline bool arch_kasan_non_canonical_hook(unsigned long addr)
>> +{
>> + return false;
>> +}
>> +#endif
>
>Let's put this next to kasan_non_canonical_hook declaration.
Just occured to me that, as opposed to to kasan_non_canonical_hook(),
arch_kasan_non_canonical_hook() is only used internally in mm/kasan/report.c so
I should toss it into mm/kasan/kasan.h instead.
--
Kind regards
Maciej Wieczór-Retman
On 2026-01-17 at 02:21:31 +0100, Andrey Konovalov wrote:
>On Thu, Jan 15, 2026 at 5:43 PM Maciej Wieczor-Retman
><m.wieczorretman@pm.me> wrote:
>>
>> x86 was easy to do because the kasan_mem_to_shadow() was already in the
>> asm/kasan.h. arm64 took a bit more changes since I had to write the
>> arch_kasan_non_canonical_hook in a separate file that would import the
>> linux/kasan.h header in order to use kasan_mem_to_shadow(). Anyway below are the
>> relevant bits from the patch - does that look okay? Or would you prefer some
>> different names/placements?
>
>One comment below, otherwise looks fine to me, thanks!
>
...
>> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
>> index 9c6ac4b62eb9..146eecae4e9c 100644
>> --- a/include/linux/kasan.h
>> +++ b/include/linux/kasan.h
>> ...
>> @@ -403,6 +409,13 @@ static __always_inline bool kasan_check_byte(const void *addr)
>> return true;
>> }
>>
>> +#ifndef arch_kasan_non_canonical_hook
>> +static inline bool arch_kasan_non_canonical_hook(unsigned long addr)
>> +{
>> + return false;
>> +}
>> +#endif
>
>Let's put this next to kasan_non_canonical_hook declaration.
>
Sure, will do! Thank :)
--
Kind regards
Maciej Wieczór-Retman
© 2016 - 2026 Red Hat, Inc.