kasan-for-linux-v5.2-rc4.patch

From e88c39ea26732c66482c74f98b09a86bc106e773 Mon Sep 17 00:00:00 2001
From: Dongli Zhang <dongli.zhang0129@gmail.com>
Date: Fri, 5 Jul 2019 14:08:16 +0800
Subject: [PATCH 1/1] kasan for linux v5.2-rc4

Signed-off-by: Dongli Zhang <dongli.zhang0129@gmail.com>
---
 arch/x86/include/asm/kasan.h |  46 +++++++++++++
 mm/kasan/common.c            | 155 +++++++++++++++++++++++++++++++++++++++++++
 mm/kasan/generic.c           |  78 ++++++++++++++++++++++
 mm/kasan/generic_report.c    |   4 ++
 mm/kasan/kasan.h             |  19 ++++++
 mm/kasan/report.c            |  14 ++++
 mm/mempool.c                 |  14 ++++
 tools/objtool/builtin-orc.c  |   4 ++
 tools/objtool/check.c        |  17 +++++
 9 files changed, 351 insertions(+)

diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
index 13e70da..dd9b944 100644
--- a/arch/x86/include/asm/kasan.h
+++ b/arch/x86/include/asm/kasan.h
@@ -3,7 +3,34 @@
 #define _ASM_X86_KASAN_H
 
 #include <linux/const.h>
+/*
+ * used by:
+ *   - arch/x86/include/asm/kasan.h|25| <<KASAN_SHADOW_START>> #define KASAN_SHADOW_START (KASAN_SHADOW_OFFSET + \
+ *   - include/linux/kasan.h|29| <<kasan_mem_to_shadow>> + KASAN_SHADOW_OFFSET;
+ *   - mm/kasan/kasan.h|115| <<kasan_shadow_to_mem>> return (void *)(((unsigned long )shadow_addr - KASAN_SHADOW_OFFSET)
+ *
+ * shadow_addr = KASAN_SHADOW_OFFSET + (addr >> 3)
+ * 测试的内核是0xdffffc0000000000
+ * KASAN_SHADOW_SCALE_SHIFT=3说明每8个byte用1个byte表示
+ */
 #define KASAN_SHADOW_OFFSET _AC(CONFIG_KASAN_SHADOW_OFFSET, UL)
+/*
+ * used by:
+ *   - arch/x86/include/asm/kasan.h|27| <<KASAN_SHADOW_START>> KASAN_SHADOW_SCALE_SHIFT))
+ *   - arch/x86/include/asm/kasan.h|43| <<KASAN_SHADOW_END>> KASAN_SHADOW_SCALE_SHIFT)))
+ *   - include/linux/kasan.h|28| <<kasan_mem_to_shadow>> return (void *)((unsigned long )addr >> KASAN_SHADOW_SCALE_SHIFT)
+ *   - include/linux/moduleloader.h|91| <<MODULE_ALIGN>> #define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT)
+ *   - mm/kasan/common.c|592| <<kasan_module_alloc>> scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT;
+ *   - mm/kasan/common.c|682| <<kasan_mem_notifier>> nr_shadow_pages = mem_data->nr_pages >> KASAN_SHADOW_SCALE_SHIFT;
+ *   - mm/kasan/init.c|458| <<kasan_remove_zero_shadow>> end = addr + (size >> KASAN_SHADOW_SCALE_SHIFT);
+ *   - mm/kasan/init.c|493| <<kasan_add_zero_shadow>> shadow_end = shadow_start + (size >> KASAN_SHADOW_SCALE_SHIFT);
+ *   - mm/kasan/init.c|503| <<kasan_add_zero_shadow>> size >> KASAN_SHADOW_SCALE_SHIFT);
+ *   - mm/kasan/kasan.h|8| <<KASAN_SHADOW_SCALE_SIZE>> #define KASAN_SHADOW_SCALE_SIZE (1UL << KASAN_SHADOW_SCALE_SHIFT)
+ *   - mm/kasan/kasan.h|116| <<kasan_shadow_to_mem>> << KASAN_SHADOW_SCALE_SHIFT);
+ *
+ * 1 << 3 = 1000 = 8
+ * 每8个byte用1个byte表示
+ */
 #define KASAN_SHADOW_SCALE_SHIFT 3
 
 /*
@@ -12,6 +39,16 @@
  * for kernel really starts from compiler's shadow offset +
  * 'kernel address space start' >> KASAN_SHADOW_SCALE_SHIFT
  */
+/*
+ * used by:
+ *   - arch/x86/mm/dump_pagetables.c|618| <<pt_dump_init>> address_markers[KASAN_SHADOW_START_NR].start_address = KASAN_SHADOW_START;
+ *   - arch/x86/mm/kasan_init_64.c|237| <<kasan_map_early_shadow>> unsigned long addr = KASAN_SHADOW_START & PGDIR_MASK;
+ *   - arch/x86/mm/kasan_init_64.c|332| <<kasan_init>> clear_pgds(KASAN_SHADOW_START & PGDIR_MASK, KASAN_SHADOW_END);
+ *   - arch/x86/mm/kasan_init_64.c|334| <<kasan_init>> kasan_populate_early_shadow((void *)(KASAN_SHADOW_START & PGDIR_MASK),
+ *   - mm/kasan/generic.c|206| <<check_memory_region_inline>> kasan_shadow_to_mem((void *)KASAN_SHADOW_START))) {
+ *   - mm/kasan/kasan.h|121| <<addr_has_shadow>> return (addr >= kasan_shadow_to_mem((void *)KASAN_SHADOW_START));
+ *   - mm/kasan/tags.c|113| <<check_memory_region>> kasan_shadow_to_mem((void *)KASAN_SHADOW_START))) {
+ */
 #define KASAN_SHADOW_START      (KASAN_SHADOW_OFFSET + \
 					((-1UL << __VIRTUAL_MASK_SHIFT) >> \
 						KASAN_SHADOW_SCALE_SHIFT))
@@ -19,6 +56,15 @@
  * 47 bits for kernel address -> (47 - KASAN_SHADOW_SCALE_SHIFT) bits for shadow
  * 56 bits for kernel address -> (56 - KASAN_SHADOW_SCALE_SHIFT) bits for shadow
  */
+/*
+ * used by:
+ *   - arch/x86/mm/dump_pagetables.c|619| <<pt_dump_init>> address_markers[KASAN_SHADOW_END_NR].start_address = KASAN_SHADOW_END;
+ *   - arch/x86/mm/kasan_init_64.c|238| <<kasan_map_early_shadow>> unsigned long end = KASAN_SHADOW_END;
+ *   - arch/x86/mm/kasan_init_64.c|323| <<kasan_init>> ptr = (void *)pgd_page_vaddr(*pgd_offset_k(KASAN_SHADOW_END));
+ *   - arch/x86/mm/kasan_init_64.c|325| <<kasan_init>> set_pgd(&early_top_pgt[pgd_index(KASAN_SHADOW_END)],
+ *   - arch/x86/mm/kasan_init_64.c|332| <<kasan_init>> clear_pgds(KASAN_SHADOW_START & PGDIR_MASK, KASAN_SHADOW_END);
+ *   - arch/x86/mm/kasan_init_64.c|370| <<kasan_init>> (void *)KASAN_SHADOW_END);
+ */
 #define KASAN_SHADOW_END        (KASAN_SHADOW_START + \
 					(1ULL << (__VIRTUAL_MASK_SHIFT - \
 						  KASAN_SHADOW_SCALE_SHIFT)))
diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index 242fdc0..33343b3 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -63,6 +63,10 @@ static inline unsigned int filter_irq_stacks(unsigned long *entries,
 	return nr_entries;
 }
 
+/*
+ * called by:
+ *   - mm/kasan/common.c|79| <<set_track>> track->stack = save_stack(flags);
+ */
 static inline depot_stack_handle_t save_stack(gfp_t flags)
 {
 	unsigned long entries[KASAN_STACK_DEPTH];
@@ -73,6 +77,11 @@ static inline depot_stack_handle_t save_stack(gfp_t flags)
 	return stack_depot_save(entries, nr_entries, flags);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/common.c|513| <<__kasan_slab_free>> set_track(&get_alloc_info(cache, object)->free_track, GFP_NOWAIT);
+ *   - mm/kasan/common.c|551| <<__kasan_kmalloc>> set_track(&get_alloc_info(cache, object)->alloc_track, flags);
+ */
 static inline void set_track(struct kasan_track *track, gfp_t flags)
 {
 	track->pid = current->pid;
@@ -131,6 +140,21 @@ void *memcpy(void *dest, const void *src, size_t len)
  * Poisons the shadow memory for 'size' bytes starting from 'addr'.
  * Memory addresses should be aligned to KASAN_SHADOW_SCALE_SIZE.
  */
+/*
+ * called by:
+ *   - mm/kasan/common.c|162| <<kasan_unpoison_shadow>> kasan_poison_shadow(address, size, tag);
+ *   - mm/kasan/common.c|233| <<kasan_free_pages>> kasan_poison_shadow(page_address(page),
+ *   - mm/kasan/common.c|326| <<kasan_poison_slab>> kasan_poison_shadow(page_address(page),
+ *   - mm/kasan/common.c|338| <<kasan_poison_object_data>> kasan_poison_shadow(object,
+ *   - mm/kasan/common.c|450| <<__kasan_slab_free>> kasan_poison_shadow(object, rounded_up_size, KASAN_KMALLOC_FREE);
+ *   - mm/kasan/common.c|490| <<__kasan_kmalloc>> kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start,
+ *   - mm/kasan/common.c|531| <<kasan_kmalloc_large>> kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start,
+ *   - mm/kasan/common.c|564| <<kasan_poison_kfree>> kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
+ *   - mm/kasan/generic.c|277| <<register_global>> kasan_poison_shadow(global->beg + aligned_size,
+ *   - mm/kasan/generic.c|368| <<__asan_alloca_poison>> kasan_poison_shadow(left_redzone, KASAN_ALLOCA_REDZONE_SIZE,
+ *   - mm/kasan/generic.c|370| <<__asan_alloca_poison>> kasan_poison_shadow(right_redzone,
+ *   - mm/kasan/tags.c|159| <<__hwasan_tag_memory>> kasan_poison_shadow((void *)addr, size, tag);
+ */
 void kasan_poison_shadow(const void *address, size_t size, u8 value)
 {
 	void *shadow_start, *shadow_end;
@@ -148,6 +172,47 @@ void kasan_poison_shadow(const void *address, size_t size, u8 value)
 	__memset(shadow_start, value, shadow_end - shadow_start);
 }
 
+/*
+ * [0] kasan_unpoison_shadow
+ * [0] prep_new_page
+ * [0] get_page_from_freelist
+ * [0] __alloc_pages_nodemask
+ * [0] new_slab
+ * [0] ___slab_alloc
+ * [0] __slab_alloc
+ * [0] kmem_cache_alloc
+ * [0] create_kmalloc_cache
+ * [0] new_kmalloc_cache
+ * [0] create_kmalloc_caches
+ * [0] kmem_cache_init
+ * [0] start_kernel
+ * [0] secondary_startup_64
+ *
+ * [0] kasan_unpoison_shadow
+ * [0] __kasan_kmalloc
+ * [0] kmem_cache_alloc_node
+ * [0] __kmem_cache_create
+ * [0] create_boot_cache
+ * [0] create_kmalloc_cache
+ * [0] create_kmalloc_caches
+ * [0] kmem_cache_init
+ * [0] start_kernel
+ * [0] secondary_startup_64
+ *
+ * called by:
+ *   - mm/kasan/common.c|179| <<__kasan_unpoison_stack>> kasan_unpoison_shadow(base, size);
+ *   - mm/kasan/common.c|198| <<kasan_unpoison_task_stack_below>> kasan_unpoison_shadow(base, watermark - base);
+ *   - mm/kasan/common.c|213| <<kasan_unpoison_stack_above_sp_to>> kasan_unpoison_shadow(sp, size);
+ *   - mm/kasan/common.c|227| <<kasan_alloc_pages>> kasan_unpoison_shadow(page_address(page), PAGE_SIZE << order);
+ *   - mm/kasan/common.c|333| <<kasan_unpoison_object_data>> kasan_unpoison_shadow(object, cache->object_size);
+ *   - mm/kasan/common.c|489| <<__kasan_kmalloc>> kasan_unpoison_shadow(set_tag(object, tag), size);
+ *   - mm/kasan/common.c|530| <<kasan_kmalloc_large>> kasan_unpoison_shadow(ptr, size);
+ *   - mm/kasan/generic.c|275| <<register_global>> kasan_unpoison_shadow(global->beg, global->size);
+ *   - mm/kasan/generic.c|366| <<__asan_alloca_poison>> kasan_unpoison_shadow((const void *)(addr + rounded_down_size),
+ *   - mm/kasan/generic.c|382| <<__asan_allocas_unpoison>> kasan_unpoison_shadow(stack_top, stack_bottom - stack_top);
+ *   - mm/slab.c|4232| <<ksize>> kasan_unpoison_shadow(objp, size);
+ *   - mm/slub.c|3927| <<ksize>> kasan_unpoison_shadow(object, size);
+ */
 void kasan_unpoison_shadow(const void *address, size_t size)
 {
 	u8 tag = get_tag(address);
@@ -213,6 +278,11 @@ void kasan_unpoison_stack_above_sp_to(const void *watermark)
 	kasan_unpoison_shadow(sp, size);
 }
 
+/*
+ * called by:
+ *   - mm/mempool.c|119| <<kasan_unpoison_element>> kasan_alloc_pages(element, (unsigned long )pool->pool_data);
+ *   - mm/page_alloc.c|2070| <<post_alloc_hook>> kasan_alloc_pages(page, order);
+ */
 void kasan_alloc_pages(struct page *page, unsigned int order)
 {
 	u8 tag;
@@ -254,6 +324,11 @@ static inline unsigned int optimal_redzone(unsigned int object_size)
 		object_size <= (1 << 16) - 1024 ? 1024 : 2048;
 }
 
+/*
+ * called by:
+ *   - mm/slab.c|2003| <<__kmem_cache_create>> kasan_cache_create(cachep, &size, &flags);
+ *   - mm/slub.c|3543| <<calculate_sizes>> kasan_cache_create(s, &size, &s->flags);
+ */
 void kasan_cache_create(struct kmem_cache *cache, unsigned int *size,
 			slab_flags_t *flags)
 {
@@ -303,6 +378,13 @@ size_t kasan_metadata_size(struct kmem_cache *cache)
 		sizeof(struct kasan_free_meta) : 0);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/common.c|437| <<kasan_init_slab_obj>> alloc_info = get_alloc_info(cache, object);
+ *   - mm/kasan/common.c|491| <<__kasan_slab_free>> set_track(&get_alloc_info(cache, object)->free_track, GFP_NOWAIT);
+ *   - mm/kasan/common.c|529| <<__kasan_kmalloc>> set_track(&get_alloc_info(cache, object)->alloc_track, flags);
+ *   - mm/kasan/report.c|160| <<describe_object>> struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
+ */
 struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache,
 					const void *object)
 {
@@ -333,6 +415,12 @@ void kasan_unpoison_object_data(struct kmem_cache *cache, void *object)
 	kasan_unpoison_shadow(object, cache->object_size);
 }
 
+/*
+ * called by:
+ *   - mm/slab.c|2362| <<cache_init_objs_debug>> kasan_poison_object_data(
+ *   - mm/slab.c|2517| <<cache_init_objs>> kasan_poison_object_data(cachep, objp);
+ *   - mm/slub.c|1474| <<setup_object>> kasan_poison_object_data(s, object);
+ */
 void kasan_poison_object_data(struct kmem_cache *cache, void *object)
 {
 	kasan_poison_shadow(object,
@@ -354,6 +442,11 @@ void kasan_poison_object_data(struct kmem_cache *cache, void *object)
  *    based on objects indexes, so that objects that are next to each other
  *    get different tags.
  */
+/*
+ * called by:
+ *   - mm/kasan/common.c|402| <<kasan_init_slab_obj>> assign_tag(cache, object, true, false));
+ *   - mm/kasan/common.c|481| <<__kasan_kmalloc>> tag = assign_tag(cache, object, false, keep_tag);
+ */
 static u8 assign_tag(struct kmem_cache *cache, const void *object,
 			bool init, bool keep_tag)
 {
@@ -413,6 +506,11 @@ static inline bool shadow_invalid(u8 tag, s8 shadow_byte)
 		return tag != (u8)shadow_byte;
 }
 
+/*
+ * called by:
+ *   - mm/kasan/common.c|521| <<kasan_slab_free>> return __kasan_slab_free(cache, object, ip, true);
+ *   - mm/kasan/common.c|642| <<kasan_poison_kfree>> __kasan_slab_free(page->slab_cache, ptr, ip, false);
+ */
 static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
 			      unsigned long ip, bool quarantine)
 {
@@ -459,6 +557,12 @@ bool kasan_slab_free(struct kmem_cache *cache, void *object, unsigned long ip)
 	return __kasan_slab_free(cache, object, ip, true);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/common.c|563| <<kasan_slab_alloc>> return __kasan_kmalloc(cache, object, cache->object_size, flags, false);
+ *   - mm/kasan/common.c|583| <<kasan_kmalloc>> return __kasan_kmalloc(cache, object, size, flags, true);
+ *   - mm/kasan/common.c|624| <<kasan_krealloc>> return __kasan_kmalloc(page->slab_cache, object, size,
+ */
 static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
 				size_t size, gfp_t flags, bool keep_tag)
 {
@@ -491,12 +595,30 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
 	return set_tag(object, tag);
 }
 
+/*
+ * called by:
+ *   - mm/slab.h|437| <<slab_post_alloc_hook>> p[i] = kasan_slab_alloc(s, p[i], flags);
+ */
 void * __must_check kasan_slab_alloc(struct kmem_cache *cache, void *object,
 					gfp_t flags)
 {
 	return __kasan_kmalloc(cache, object, cache->object_size, flags, false);
 }
 
+/*
+ * called by:
+ *   - include/linux/slab.h|449| <<kmem_cache_alloc_trace>> ret = kasan_kmalloc(s, ret, size, flags);
+ *   - include/linux/slab.h|460| <<kmem_cache_alloc_node_trace>> ret = kasan_kmalloc(s, ret, size, gfpflags);
+ *   - mm/slab.c|3555| <<kmem_cache_alloc_trace>> ret = kasan_kmalloc(cachep, ret, size, flags);
+ *   - mm/slab.c|3599| <<kmem_cache_alloc_node_trace>> ret = kasan_kmalloc(cachep, ret, size, flags);
+ *   - mm/slab.c|3620| <<__do_kmalloc_node>> ret = kasan_kmalloc(cachep, ret, size, flags);
+ *   - mm/slab.c|3660| <<__do_kmalloc>> ret = kasan_kmalloc(cachep, ret, size, flags);
+ *   - mm/slub.c|2775| <<kmem_cache_alloc_trace>> ret = kasan_kmalloc(s, ret, size, gfpflags);
+ *   - mm/slub.c|2803| <<kmem_cache_alloc_node_trace>> ret = kasan_kmalloc(s, ret, size, gfpflags);
+ *   - mm/slub.c|3374| <<early_kmem_cache_node_alloc>> n = kasan_kmalloc(kmem_cache_node, n, sizeof(struct kmem_cache_node),
+ *   - mm/slub.c|3793| <<__kmalloc>> ret = kasan_kmalloc(s, ret, size, flags);
+ *   - mm/slub.c|3837| <<__kmalloc_node>> ret = kasan_kmalloc(s, ret, size, flags);
+ */
 void * __must_check kasan_kmalloc(struct kmem_cache *cache, const void *object,
 				size_t size, gfp_t flags)
 {
@@ -545,6 +667,20 @@ void * __must_check kasan_krealloc(const void *object, size_t size, gfp_t flags)
 						flags, true);
 }
 
+/*
+ * [0] kasan_poison_kfree
+ * [0] mempool_init_node
+ * [0] mempool_create_node
+ * [0] nfs_init_writepagecache
+ * [0] init_nfs_fs
+ * [0] do_one_initcall
+ * [0] kernel_init_freeable
+ * [0] kernel_init
+ * [0] ret_from_fork
+ *
+ * called by:
+ *   - mm/mempool.c|109| <<kasan_poison_element>> kasan_poison_kfree(element, _RET_IP_);
+ */
 void kasan_poison_kfree(void *ptr, unsigned long ip)
 {
 	struct page *page;
@@ -570,6 +706,12 @@ void kasan_kfree_large(void *ptr, unsigned long ip)
 	/* The object will be poisoned by page_alloc. */
 }
 
+/*
+ * called by:
+ *   - arch/arm64/kernel/module.c|63| <<module_alloc>> if (p && (kasan_module_alloc(p, size) < 0)) {
+ *   - arch/s390/kernel/module.c|43| <<module_alloc>> if (p && (kasan_module_alloc(p, size) < 0)) {
+ *   - arch/x86/kernel/module.c|80| <<module_alloc>> if (p && (kasan_module_alloc(p, size) < 0)) {
+ */
 int kasan_module_alloc(void *addr, size_t size)
 {
 	void *ret;
@@ -608,6 +750,19 @@ void kasan_free_shadow(const struct vm_struct *vm)
 
 extern void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip);
 
+/*
+ * called by:
+ *   - mm/kasan/generic.c|207| <<check_memory_region_inline>> kasan_report(addr, size, write, ret_ip);
+ *   - mm/kasan/generic.c|214| <<check_memory_region_inline>> kasan_report(addr, size, write, ret_ip);
+ *   - mm/kasan/generic_report.c|118| <<DEFINE_ASAN_REPORT_LOAD>> kasan_report(addr, size, false, _RET_IP_); \
+ *   - mm/kasan/generic_report.c|125| <<DEFINE_ASAN_REPORT_STORE>> kasan_report(addr, size, true, _RET_IP_); \
+ *   - mm/kasan/generic_report.c|142| <<__asan_report_load_n_noabort>> kasan_report(addr, size, false, _RET_IP_);
+ *   - mm/kasan/generic_report.c|148| <<__asan_report_store_n_noabort>> kasan_report(addr, size, true, _RET_IP_);
+ *   - mm/kasan/tags.c|114| <<check_memory_region>> kasan_report(addr, size, write, ret_ip);
+ *   - mm/kasan/tags.c|121| <<check_memory_region>> kasan_report(addr, size, write, ret_ip);
+ *
+ * 这里的addr是内核空间的地址
+ */
 void kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip)
 {
 	unsigned long flags = user_access_save();
diff --git a/mm/kasan/generic.c b/mm/kasan/generic.c
index 504c7936..ce77a80 100644
--- a/mm/kasan/generic.c
+++ b/mm/kasan/generic.c
@@ -42,23 +42,55 @@
 #include "../slab.h"
 
 /*
+ * 检查的入口是:
+ *   - check_memory_region()
+ *   - check_memory_region_inline()
+ */
+
+/*
  * All functions below always inlined so compiler could
  * perform better optimizations in each of __asan_loadX/__assn_storeX
  * depending on memory access size X.
  */
 
+/*
+ * called by:
+ *   - mm/kasan/generic.c|76| <<memory_is_poisoned_2_4_8>> return *shadow_addr || memory_is_poisoned_1(addr + size - 1);
+ *   - mm/kasan/generic.c|78| <<memory_is_poisoned_2_4_8>> return memory_is_poisoned_1(addr + size - 1);
+ *   - mm/kasan/generic.c|91| <<memory_is_poisoned_16>> return *shadow_addr || memory_is_poisoned_1(addr + 15);
+ *   - mm/kasan/generic.c|162| <<memory_is_poisoned>> return memory_is_poisoned_1(addr);
+ */
 static __always_inline bool memory_is_poisoned_1(unsigned long addr)
 {
 	s8 shadow_value = *(s8 *)kasan_mem_to_shadow((void *)addr);
 
+	/*
+	 * Every aligned 8 bytes can have 9 states.
+	 * KASan shadow encoding:
+	 *   - 0: if access to all 8 bytes is valid
+	 *   - N: if access only to first N bytes is valid (1 <= N <= 7)
+	 *   - Negative value (poison): if access to all 8 bytes is invalid
+	 */
 	if (unlikely(shadow_value)) {
+		/*
+		 * KASAN_SHADOW_MASK是111
+		 */
 		s8 last_accessible_byte = addr & KASAN_SHADOW_MASK;
+		/*
+		 * 假设shadow_value是4, 说明访问前4个byte是可以的
+		 * 如果last_accessible_byte是5, 说明超出了可以的前4个byte, 当然返回true!!
+		 */
 		return unlikely(last_accessible_byte >= shadow_value);
 	}
 
+	/* 如果shadow_value是0, 说明8个byte都是可以访问的 */
 	return false;
 }
 
+/*
+ * 只在size是2, 4, 8的时候调用:
+ *   - mm/kasan/generic.c|158| <<memory_is_poisoned>> return memory_is_poisoned_2_4_8(addr, size);
+ */
 static __always_inline bool memory_is_poisoned_2_4_8(unsigned long addr,
 						unsigned long size)
 {
@@ -74,6 +106,10 @@ static __always_inline bool memory_is_poisoned_2_4_8(unsigned long addr,
 	return memory_is_poisoned_1(addr + size - 1);
 }
 
+/*
+ * 只在size是16的时候调用:
+ *   - mm/kasan/generic.c|160| <<memory_is_poisoned>> return memory_is_poisoned_16(addr);
+ */
 static __always_inline bool memory_is_poisoned_16(unsigned long addr)
 {
 	u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr);
@@ -127,6 +163,10 @@ static __always_inline unsigned long memory_is_nonzero(const void *start,
 	return bytes_is_nonzero(start, (end - start) % 8);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/generic.c|174| <<memory_is_poisoned>> return memory_is_poisoned_n(addr, size);
+ */
 static __always_inline bool memory_is_poisoned_n(unsigned long addr,
 						size_t size)
 {
@@ -146,8 +186,15 @@ static __always_inline bool memory_is_poisoned_n(unsigned long addr,
 	return false;
 }
 
+/*
+ * called by:
+ *   - mm/kasan/generic.c|190| <<check_memory_region_inline>> if (likely(!memory_is_poisoned(addr, size)))
+ */
 static __always_inline bool memory_is_poisoned(unsigned long addr, size_t size)
 {
+	/*
+	 * 判断size是否在编译时就可以确定其为常量,如果size为常量,该函数返回1,否则返回0
+	 */
 	if (__builtin_constant_p(size)) {
 		switch (size) {
 		case 1:
@@ -166,6 +213,12 @@ static __always_inline bool memory_is_poisoned(unsigned long addr, size_t size)
 	return memory_is_poisoned_n(addr, size);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/generic.c|199| <<check_memory_region>> check_memory_region_inline(addr, size, write, ret_ip);
+ *   - mm/kasan/generic.c|241| <<DEFINE_ASAN_LOAD_STORE>> check_memory_region_inline(addr, size, false, _RET_IP_);\
+ *   - mm/kasan/generic.c|249| <<DEFINE_ASAN_LOAD_STORE>> check_memory_region_inline(addr, size, true, _RET_IP_); \
+ */
 static __always_inline void check_memory_region_inline(unsigned long addr,
 						size_t size, bool write,
 						unsigned long ret_ip)
@@ -173,6 +226,7 @@ static __always_inline void check_memory_region_inline(unsigned long addr,
 	if (unlikely(size == 0))
 		return;
 
+	/* 检查确认这是内核空间的地址 */
 	if (unlikely((void *)addr <
 		kasan_shadow_to_mem((void *)KASAN_SHADOW_START))) {
 		kasan_report(addr, size, write, ret_ip);
@@ -185,6 +239,18 @@ static __always_inline void check_memory_region_inline(unsigned long addr,
 	kasan_report(addr, size, write, ret_ip);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/common.c|94| <<kasan_check_read>> check_memory_region((unsigned long )p, size, false, _RET_IP_);
+ *   - mm/kasan/common.c|100| <<kasan_check_write>> check_memory_region((unsigned long )p, size, true, _RET_IP_);
+ *   - mm/kasan/common.c|107| <<memset>> check_memory_region((unsigned long )addr, len, true, _RET_IP_);
+ *   - mm/kasan/common.c|115| <<memmove>> check_memory_region((unsigned long )src, len, false, _RET_IP_);
+ *   - mm/kasan/common.c|116| <<memmove>> check_memory_region((unsigned long )dest, len, true, _RET_IP_);
+ *   - mm/kasan/common.c|124| <<memcpy>> check_memory_region((unsigned long )src, len, false, _RET_IP_);
+ *   - mm/kasan/common.c|125| <<memcpy>> check_memory_region((unsigned long )dest, len, true, _RET_IP_);
+ *   - mm/kasan/generic.c|285| <<__asan_loadN>> check_memory_region(addr, size, false, _RET_IP_);
+ *   - mm/kasan/generic.c|295| <<__asan_storeN>> check_memory_region(addr, size, true, _RET_IP_);
+ */
 void check_memory_region(unsigned long addr, size_t size, bool write,
 				unsigned long ret_ip)
 {
@@ -202,6 +268,10 @@ void kasan_cache_shutdown(struct kmem_cache *cache)
 		quarantine_remove_cache(cache);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/generic.c|287| <<__asan_register_globals>> register_global(&globals[i]);
+ */
 static void register_global(struct kasan_global *global)
 {
 	size_t aligned_size = round_up(global->size, KASAN_SHADOW_SCALE_SIZE);
@@ -227,6 +297,14 @@ void __asan_unregister_globals(struct kasan_global *globals, size_t size)
 }
 EXPORT_SYMBOL(__asan_unregister_globals);
 
+/*
+ * called by:
+ *   - mm/kasan/generic.c|289| <<global>> DEFINE_ASAN_LOAD_STORE(1);
+ *   - mm/kasan/generic.c|290| <<global>> DEFINE_ASAN_LOAD_STORE(2);
+ *   - mm/kasan/generic.c|291| <<global>> DEFINE_ASAN_LOAD_STORE(4);
+ *   - mm/kasan/generic.c|292| <<global>> DEFINE_ASAN_LOAD_STORE(8);
+ *   - mm/kasan/generic.c|293| <<global>> DEFINE_ASAN_LOAD_STORE(16);
+ */
 #define DEFINE_ASAN_LOAD_STORE(size)					\
 	void __asan_load##size(unsigned long addr)			\
 	{								\
diff --git a/mm/kasan/generic_report.c b/mm/kasan/generic_report.c
index 36c6459..ec94609 100644
--- a/mm/kasan/generic_report.c
+++ b/mm/kasan/generic_report.c
@@ -105,6 +105,10 @@ static const char *get_wild_bug_type(struct kasan_access_info *info)
 	return bug_type;
 }
 
+/*
+ * called by only:
+ *   - mm/kasan/report.c|71| <<print_error_description>> get_bug_type(info), (void *)info->ip);
+ */
 const char *get_bug_type(struct kasan_access_info *info)
 {
 	if (addr_has_shadow(info->access_addr))
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index 3ce956e..d461cbd 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -110,12 +110,31 @@ struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache,
 struct kasan_free_meta *get_free_info(struct kmem_cache *cache,
 					const void *object);
 
+/*
+ * called by:
+ *   - mm/kasan/generic.c|212| <<check_memory_region_inline>> kasan_shadow_to_mem((void *)KASAN_SHADOW_START))) {
+ *   - mm/kasan/kasan.h|121| <<addr_has_shadow>> return (addr >= kasan_shadow_to_mem((void *)KASAN_SHADOW_START));
+ *   - mm/kasan/report.c|236| <<print_shadow_for_address>> const void *kaddr = kasan_shadow_to_mem(shadow_row);
+ *   - mm/kasan/tags.c|113| <<check_memory_region>> kasan_shadow_to_mem((void *)KASAN_SHADOW_START))) {
+ */
 static inline const void *kasan_shadow_to_mem(const void *shadow_addr)
 {
+	/*
+	 * shadow_addr = KASAN_SHADOW_OFFSET + (addr >> 3)
+	 * 测试的内核是0xdffffc0000000000
+	 * KASAN_SHADOW_SCALE_SHIFT=3说明每8个byte用1个byte表示
+	 */
 	return (void *)(((unsigned long)shadow_addr - KASAN_SHADOW_OFFSET)
 		<< KASAN_SHADOW_SCALE_SHIFT);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/generic_report.c|114| <<get_bug_type>> if (addr_has_shadow(info->access_addr))
+ *   - mm/kasan/report.c|315| <<__kasan_report>> if (addr_has_shadow(untagged_addr))
+ *   - mm/kasan/report.c|326| <<__kasan_report>> if (addr_has_shadow(untagged_addr))
+ *   - mm/kasan/report.c|330| <<__kasan_report>> if (addr_has_shadow(untagged_addr)) {
+ */
 static inline bool addr_has_shadow(const void *addr)
 {
 	return (addr >= kasan_shadow_to_mem((void *)KASAN_SHADOW_START));
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 03a4435..05ba571 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -65,6 +65,10 @@ static int __init kasan_set_multi_shot(char *str)
 }
 __setup("kasan_multi_shot", kasan_set_multi_shot);
 
+/*
+ * called by:
+ *   - mm/kasan/report.c|315| <<__kasan_report>> print_error_description(&info);
+ */
 static void print_error_description(struct kasan_access_info *info)
 {
 	pr_err("BUG: KASAN: %s in %pS\n",
@@ -150,6 +154,10 @@ static void describe_object_addr(struct kmem_cache *cache, void *object,
 		(void *)(object_addr + cache->object_size));
 }
 
+/*
+ * called by only:
+ *   - mm/kasan/report.c|199| <<print_address_description>> describe_object(cache, object, addr);
+ */
 static void describe_object(struct kmem_cache *cache, void *object,
 				const void *addr)
 {
@@ -282,6 +290,12 @@ void kasan_report_invalid_free(void *object, unsigned long ip)
 	end_report(&flags);
 }
 
+/*
+ * called by:
+ *   - mm/kasan/common.c|614| <<kasan_report>> __kasan_report(addr, size, is_write, ip);
+ *
+ * 这里的addr是内核空间的地址
+ */
 void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip)
 {
 	struct kasan_access_info info;
diff --git a/mm/mempool.c b/mm/mempool.c
index 85efab3..fa3dcd7a 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -103,6 +103,10 @@ static inline void poison_element(mempool_t *pool, void *element)
 }
 #endif /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */
 
+/*
+ * called by:
+ *   - mm/mempool.c|126| <<add_element>> kasan_poison_element(pool, element);
+ */
 static __always_inline void kasan_poison_element(mempool_t *pool, void *element)
 {
 	if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)
@@ -111,6 +115,10 @@ static __always_inline void kasan_poison_element(mempool_t *pool, void *element)
 		kasan_free_pages(element, (unsigned long)pool->pool_data);
 }
 
+/*
+ * called by:
+ *   - mm/mempool.c|135| <<remove_element>> kasan_unpoison_element(pool, element);
+ */
 static void kasan_unpoison_element(mempool_t *pool, void *element)
 {
 	if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)
@@ -119,6 +127,12 @@ static void kasan_unpoison_element(mempool_t *pool, void *element)
 		kasan_alloc_pages(element, (unsigned long)pool->pool_data);
 }
 
+/*
+ * called by:
+ *   - mm/mempool.c|207| <<mempool_init_node>> add_element(pool, element);
+ *   - mm/mempool.c|347| <<mempool_resize>> add_element(pool, element);
+ *   - mm/mempool.c|495| <<mempool_free>> add_element(pool, element);
+ */
 static __always_inline void add_element(mempool_t *pool, void *element)
 {
 	BUG_ON(pool->curr_nr >= pool->min_nr);
diff --git a/tools/objtool/builtin-orc.c b/tools/objtool/builtin-orc.c
index 5f7cc61..7435efe 100644
--- a/tools/objtool/builtin-orc.c
+++ b/tools/objtool/builtin-orc.c
@@ -23,6 +23,10 @@ static const char *orc_usage[] = {
 	NULL,
 };
 
+/*
+ * called by only:
+ *   - tools/objtool/objtool.c|37| <<global>> {"orc", cmd_orc, "Generate in-place ORC unwind tables for an object file" },
+ */
 int cmd_orc(int argc, const char **argv)
 {
 	const char *objname;
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 172f991..b0f2a61 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -440,6 +440,10 @@ static void add_ignores(struct objtool_file *file)
  *
  * These functions must not directly change AC, but may PUSHF/POPF.
  */
+/*
+ * used by only:
+ *   - tools/objtool/check.c|503| <<add_uaccess_safe>> for (name = uaccess_safe_builtin; *name; name++) {
+ */
 static const char *uaccess_safe_builtin[] = {
 	/* KASAN */
 	"kasan_report",
@@ -492,6 +496,10 @@ static const char *uaccess_safe_builtin[] = {
 	NULL
 };
 
+/*
+ * called by only:
+ *   - tools/objtool/check.c|1310| <<decode_sections>> add_uaccess_safe(file);
+ */
 static void add_uaccess_safe(struct objtool_file *file)
 {
 	struct symbol *func;
@@ -1292,6 +1300,10 @@ static void mark_rodata(struct objtool_file *file)
 	file->rodata = found;
 }
 
+/*
+ * called by:
+ *   - tools/objtool/check.c|2422| <<check>> ret = decode_sections(&file);
+ */
 static int decode_sections(struct objtool_file *file)
 {
 	int ret;
@@ -2401,6 +2413,11 @@ static void cleanup(struct objtool_file *file)
 
 static struct objtool_file file;
 
+/*
+ * called by:
+ *   - tools/objtool/builtin-check.c|48| <<cmd_check>> return check(objname, false);
+ *   - tools/objtool/builtin-orc.c|41| <<cmd_orc>> return check(objname, true);
+ */
 int check(const char *_objname, bool orc)
 {
 	int ret, warnings = 0;
-- 
2.7.4