[PATCH 0/3] kasan: common: cleanups and deduplication

[Igor Putko]

This patch series refactors KASAN common code to improve readability
and maintainability.

Specifically, it:
- Introduces a helper for quarantine reduction to eliminate boilerplate.
- Utilizes the standard ALIGN_DOWN macro instead of manual bitwise logic.
- Replaces a magic number with the KASAN_TAG_KERNEL definition.

Igor Putko (3):
kasan: deduplicate quarantine reduction logic
kasan: common: use ALIGN_DOWN macro for stack alignment
kasan: common: replace magic number with KASAN_TAG_KERNEL

mm/kasan/common.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)

--
2.47.3

[Igor Putko]

Multiple allocation functions share the exact same conditional logic for
reducing the KASAN quarantine size based on gfp flags.
Introduce the kasan_quarantine_reduce_cond() helper to eliminate this
boilerplate from the slab, kmalloc, kmalloc_large, and krealloc paths.

Signed-off-by: Igor Putko <igorpe...@gmail.com>
---
mm/kasan/common.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index b7d05c2a6..34aa0fdce 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -340,14 +340,19 @@ static inline void unpoison_slab_object(struct kmem_cache *cache, void *object,
kasan_save_alloc_info(cache, object, flags);
}

+static inline void kasan_quarantine_reduce_cond(gfp_t flags)
+{
+ if (gfpflags_allow_blocking(flags))
+ kasan_quarantine_reduce();
+}
+
void * __must_check __kasan_slab_alloc(struct kmem_cache *cache,
void *object, gfp_t flags, bool init)
{
u8 tag;
void *tagged_object;

- if (gfpflags_allow_blocking(flags))
- kasan_quarantine_reduce();
+ kasan_quarantine_reduce_cond(flags);

if (unlikely(object == NULL))
return NULL;
@@ -402,8 +407,7 @@ static inline void poison_kmalloc_redzone(struct kmem_cache *cache,
void * __must_check __kasan_kmalloc(struct kmem_cache *cache, const void *object,
size_t size, gfp_t flags)
{
- if (gfpflags_allow_blocking(flags))
- kasan_quarantine_reduce();
+ kasan_quarantine_reduce_cond(flags);

if (unlikely(object == NULL))
return NULL;
@@ -443,8 +447,7 @@ static inline void poison_kmalloc_large_redzone(const void *ptr, size_t size,
void * __must_check __kasan_kmalloc_large(const void *ptr, size_t size,
gfp_t flags)
{
- if (gfpflags_allow_blocking(flags))
- kasan_quarantine_reduce();
+ kasan_quarantine_reduce_cond(flags);

if (unlikely(ptr == NULL))
return NULL;
@@ -460,8 +463,7 @@ void * __must_check __kasan_krealloc(const void *object, size_t size, gfp_t flag
{
struct slab *slab;

- if (gfpflags_allow_blocking(flags))
- kasan_quarantine_reduce();
+ kasan_quarantine_reduce_cond(flags);

if (unlikely(object == ZERO_SIZE_PTR))
return (void *)object;
--
2.47.3

[Igor Putko]

Replace the manual bitwise alignment logic in
kasan_unpoison_task_stack_below() with the
standard ALIGN_DOWN macro. This improves code
readability and conforms to standard kernel idioms.

Signed-off-by: Igor Putko <igorpe...@gmail.com>
---

mm/kasan/common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index 34aa0fdce..5faf73c8f 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -119,7 +119,7 @@ asmlinkage void kasan_unpoison_task_stack_below(const void *watermark)
* because this function is called by early resume code which hasn't
* yet set up the percpu register (%gs).
*/
- void *base = (void *)((unsigned long)watermark & ~(THREAD_SIZE - 1));
+ void *base = (void *)ALIGN_DOWN((unsigned long)watermark, THREAD_SIZE);

kasan_unpoison(base, watermark - base, false);
}
--
2.47.3

[Igor Putko]

Replace the literal 0xff in assign_tag()
with KASAN_TAG_KERNEL to eliminate the
magic number and improve code clarity.

Signed-off-by: Igor Putko <igorpe...@gmail.com>
---
mm/kasan/common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/kasan/common.c b/mm/kasan/common.c

index 5faf73c8f..3e9b6b8f5 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -188,7 +188,7 @@ static inline u8 assign_tag(struct kmem_cache *cache,
const void *object, bool init)
{
if (IS_ENABLED(CONFIG_KASAN_GENERIC))
- return 0xff;
+ return KASAN_TAG_KERNEL;

/*
* If the cache neither has a constructor nor has SLAB_TYPESAFE_BY_RCU
--
2.47.3

[Andrey Konovalov]

On Sat, Jul 4, 2026 at 11:20 AM Igor Putko <igorpe...@gmail.com> wrote:
>
> Multiple allocation functions share the exact same conditional logic for
> reducing the KASAN quarantine size based on gfp flags.
> Introduce the kasan_quarantine_reduce_cond() helper to eliminate this
> boilerplate from the slab, kmalloc, kmalloc_large, and krealloc paths.
>
> Signed-off-by: Igor Putko <igorpe...@gmail.com>
> ---
> mm/kasan/common.c | 18 ++++++++++--------
> 1 file changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/mm/kasan/common.c b/mm/kasan/common.c
> index b7d05c2a6..34aa0fdce 100644
> --- a/mm/kasan/common.c
> +++ b/mm/kasan/common.c
> @@ -340,14 +340,19 @@ static inline void unpoison_slab_object(struct kmem_cache *cache, void *object,
> kasan_save_alloc_info(cache, object, flags);
> }
>
> +static inline void kasan_quarantine_reduce_cond(gfp_t flags)
> +{
> + if (gfpflags_allow_blocking(flags))
> + kasan_quarantine_reduce();
> +}

Not sure about this change: it's hiding the condition for when
kasan_quarantine_reduce() gets to execute and does not really improve
the code readability otherwise.

[Andrey Konovalov]

On Sat, Jul 4, 2026 at 11:20 AM Igor Putko <igorpe...@gmail.com> wrote:
>

Reviewed-by: Andrey Konovalov <andre...@gmail.com>

[Andrey Konovalov]

On Sat, Jul 4, 2026 at 11:20 AM Igor Putko <igorpe...@gmail.com> wrote:
>

> Replace the literal 0xff in assign_tag()
> with KASAN_TAG_KERNEL to eliminate the
> magic number and improve code clarity.
>
> Signed-off-by: Igor Putko <igorpe...@gmail.com>
> ---
> mm/kasan/common.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/kasan/common.c b/mm/kasan/common.c
> index 5faf73c8f..3e9b6b8f5 100644
> --- a/mm/kasan/common.c
> +++ b/mm/kasan/common.c
> @@ -188,7 +188,7 @@ static inline u8 assign_tag(struct kmem_cache *cache,
> const void *object, bool init)
> {
> if (IS_ENABLED(CONFIG_KASAN_GENERIC))
> - return 0xff;
> + return KASAN_TAG_KERNEL;

Not sure about this change either: the notion of a tag does no apply
to the Generic mode, so the code uses 0xff in such cases (the second
definition of page_kasan_tag() is another case).