Poison, redzones and shadows: inside KASAN
KASAN detects memory bugs in the Linux kernel using compiler instrumentation, memory poisoning, redzones around allocations, and a shadow memory map to track valid and invalid memory areas at runtime.
Background
- KASAN (Kernel Address SANitizer) is a dynamic memory error detector built into the Linux kernel. It catches use-after-free, out-of-bounds access, and other memory bugs at runtime — similar to what AddressSanitizer (ASan) does for userspace programs.
- The piece digs into KASAN's three core mechanisms: poison values (special byte patterns written to freed or redzone memory), redzones (guard regions placed around allocated objects), and shadow memory (a compact metadata map that records which bytes are valid and which are poisoned).
- Generic KASAN uses a shadow memory scheme where 1 byte of shadow tracks 8 bytes of kernel memory; a non-zero shadow byte means the corresponding memory is inaccessible. Hardware-assisted KASAN (KASAN_HW_TAGS) offloads this tracking to ARM's Memory Tagging Extension (MTE), reducing performance overhead.
- Understanding KASAN is relevant because Linux kernel memory bugs are a leading cause of security vulnerabilities (CVEs) and system crashes. KASAN is a key tool for kernel developers and security researchers, but its internals are rarely described in detail outside of source code or LWN articles.