Poison, redzones and shadows: inside KASAN – Bootlin

A deep dive into the internals of KASAN (Kernel Address Sanitizer), the Linux kernel's runtime memory error detector. Covers how shadow memory works (1 byte tracks 8 bytes of kernel memory), the poisoning/unpoisoning lifecycle during allocation and deallocation, redzones for out-of-bounds detection, and how the compiler instruments memory accesses via -fsanitize=kernel-address. Includes hands-on examples using virtme-ng and GDB to observe shadow memory bytes directly, plus disassembly comparisons between outline and inline KASAN modes. Also touches on quarantine for use-after-free detection, vmalloc/stack/global variable coverage, and hardware tag-based variants on ARM64.