From: Andrey Ryabinin <ryabinin.a.a@gmail.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: "Maciej Żenczykowski" <maze@google.com>,
"Maciej Wieczor-Retman" <m.wieczorretman@pm.me>,
"Alexander Potapenko" <glider@google.com>,
"Andrey Konovalov" <andreyknvl@gmail.com>,
"Dmitry Vyukov" <dvyukov@google.com>,
"Vincenzo Frascino" <vincenzo.frascino@arm.com>,
kasan-dev@googlegroups.com, "Uladzislau Rezki" <urezki@gmail.com>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
"Andrey Ryabinin" <ryabinin.a.a@gmail.com>
Subject: [PATCH] mm-kasan-fix-kasan-poisoning-in-vrealloc-fix
Date: Mon, 19 Jan 2026 15:45:09 +0100 [thread overview]
Message-ID: <20260119144509.32767-1-ryabinin.a.a@gmail.com> (raw)
In-Reply-To: <CA+fCnZcFcpbME+a34L49pk2Z-WLbT_L25bSzZFixUiNFevJXzA@mail.gmail.com>
Move kasan_enabled() check to header function to avoid function call
if kasan disabled via boot cmdline.
Move __kasan_vrealloc() to common.c to fix CONFIG_KASAN_HW_TAGS=y
Signed-off-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>
---
include/linux/kasan.h | 10 +++++++++-
mm/kasan/common.c | 21 +++++++++++++++++++++
mm/kasan/shadow.c | 24 ------------------------
3 files changed, 30 insertions(+), 25 deletions(-)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index ff27712dd3c8..338a1921a50a 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -641,9 +641,17 @@ kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms,
__kasan_unpoison_vmap_areas(vms, nr_vms, flags);
}
-void kasan_vrealloc(const void *start, unsigned long old_size,
+void __kasan_vrealloc(const void *start, unsigned long old_size,
unsigned long new_size);
+static __always_inline void kasan_vrealloc(const void *start,
+ unsigned long old_size,
+ unsigned long new_size)
+{
+ if (kasan_enabled())
+ __kasan_vrealloc(start, old_size, new_size);
+}
+
#else /* CONFIG_KASAN_VMALLOC */
static inline void kasan_populate_early_vm_area_shadow(void *start,
diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index ed489a14dddf..b7d05c2a6d93 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -606,4 +606,25 @@ void __kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms,
__kasan_unpoison_vmalloc(addr, size, flags | KASAN_VMALLOC_KEEP_TAG);
}
}
+
+void __kasan_vrealloc(const void *addr, unsigned long old_size,
+ unsigned long new_size)
+{
+ if (new_size < old_size) {
+ kasan_poison_last_granule(addr, new_size);
+
+ new_size = round_up(new_size, KASAN_GRANULE_SIZE);
+ old_size = round_up(old_size, KASAN_GRANULE_SIZE);
+ if (new_size < old_size)
+ __kasan_poison_vmalloc(addr + new_size,
+ old_size - new_size);
+ } else if (new_size > old_size) {
+ old_size = round_down(old_size, KASAN_GRANULE_SIZE);
+ __kasan_unpoison_vmalloc(addr + old_size,
+ new_size - old_size,
+ KASAN_VMALLOC_PROT_NORMAL |
+ KASAN_VMALLOC_VM_ALLOC |
+ KASAN_VMALLOC_KEEP_TAG);
+ }
+}
#endif
diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c
index e9b6b2d8e651..32fbdf759ea2 100644
--- a/mm/kasan/shadow.c
+++ b/mm/kasan/shadow.c
@@ -651,30 +651,6 @@ void __kasan_poison_vmalloc(const void *start, unsigned long size)
kasan_poison(start, size, KASAN_VMALLOC_INVALID, false);
}
-void kasan_vrealloc(const void *addr, unsigned long old_size,
- unsigned long new_size)
-{
- if (!kasan_enabled())
- return;
-
- if (new_size < old_size) {
- kasan_poison_last_granule(addr, new_size);
-
- new_size = round_up(new_size, KASAN_GRANULE_SIZE);
- old_size = round_up(old_size, KASAN_GRANULE_SIZE);
- if (new_size < old_size)
- __kasan_poison_vmalloc(addr + new_size,
- old_size - new_size);
- } else if (new_size > old_size) {
- old_size = round_down(old_size, KASAN_GRANULE_SIZE);
- __kasan_unpoison_vmalloc(addr + old_size,
- new_size - old_size,
- KASAN_VMALLOC_PROT_NORMAL |
- KASAN_VMALLOC_VM_ALLOC |
- KASAN_VMALLOC_KEEP_TAG);
- }
-}
-
#else /* CONFIG_KASAN_VMALLOC */
int kasan_alloc_module_shadow(void *addr, size_t size, gfp_t gfp_mask)
--
2.52.0
next prev parent reply other threads:[~2026-01-19 14:46 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-06 12:42 KASAN vs realloc Maciej Żenczykowski
2026-01-07 20:28 ` Kees Cook
2026-01-07 20:47 ` Maciej Wieczor-Retman
2026-01-07 21:47 ` Maciej Żenczykowski
2026-01-07 21:50 ` Maciej Żenczykowski
2026-01-07 21:55 ` Maciej Żenczykowski
2026-01-09 18:55 ` Maciej Wieczor-Retman
2026-01-09 20:05 ` Maciej Żenczykowski
2026-02-06 19:07 ` Maciej Żenczykowski
2026-02-06 20:14 ` Maciej Wieczor-Retman
2026-02-06 21:26 ` Maciej Żenczykowski
2026-01-13 19:15 ` [PATCH 1/2] mm/kasan: Fix KASAN poisoning in vrealloc() Andrey Ryabinin
2026-01-13 19:15 ` [PATCH 2/2] mm/kasan/kunit: extend vmalloc OOB tests to cover vrealloc() Andrey Ryabinin
2026-01-15 3:56 ` Andrey Konovalov
2026-01-16 13:28 ` [PATCH] mm-kasan-kunit-extend-vmalloc-oob-tests-to-cover-vrealloc-fix Andrey Ryabinin
2026-01-16 18:53 ` Maciej Wieczor-Retman
2026-01-17 1:16 ` Andrey Konovalov
2026-01-14 12:17 ` [PATCH 1/2] mm/kasan: Fix KASAN poisoning in vrealloc() Maciej Wieczor-Retman
2026-01-15 3:56 ` Andrey Konovalov
2026-01-16 13:26 ` Andrey Ryabinin
2026-01-17 1:16 ` Andrey Konovalov
2026-01-17 17:08 ` Andrey Konovalov
2026-01-19 0:48 ` Andrew Morton
2026-01-19 14:43 ` Andrey Ryabinin
2026-01-19 14:45 ` Andrey Ryabinin [this message]
2026-01-20 17:46 ` [PATCH] mm-kasan-fix-kasan-poisoning-in-vrealloc-fix Andrey Konovalov
2026-01-21 16:01 ` Andrey Ryabinin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260119144509.32767-1-ryabinin.a.a@gmail.com \
--to=ryabinin.a.a@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@gmail.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=m.wieczorretman@pm.me \
--cc=maze@google.com \
--cc=urezki@gmail.com \
--cc=vincenzo.frascino@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox