1# SPDX-License-Identifier: GPL-2.0-only
  2config ARCH_HAS_UBSAN_SANITIZE_ALL
  3	bool
  4
  5menuconfig UBSAN
  6	bool "Undefined behaviour sanity checker"
 
  7	help
  8	  This option enables the Undefined Behaviour sanity checker.
  9	  Compile-time instrumentation is used to detect various undefined
 10	  behaviours at runtime. For more details, see:
 11	  Documentation/dev-tools/ubsan.rst
 12
 13if UBSAN
 14
 15config UBSAN_TRAP
 16	bool "On Sanitizer warnings, abort the running kernel code"
 17	depends on !COMPILE_TEST
 18	depends on $(cc-option, -fsanitize-undefined-trap-on-error)
 19	help
 20	  Building kernels with Sanitizer features enabled tends to grow
 21	  the kernel size by around 5%, due to adding all the debugging
 22	  text on failure paths. To avoid this, Sanitizer instrumentation
 23	  can just issue a trap. This reduces the kernel size overhead but
 24	  turns all warnings (including potentially harmless conditions)
 25	  into full exceptions that abort the running kernel code
 26	  (regardless of context, locks held, etc), which may destabilize
 27	  the system. For some system builders this is an acceptable
 28	  trade-off.
 29
 30config UBSAN_KCOV_BROKEN
 31	def_bool KCOV && CC_HAS_SANCOV_TRACE_PC
 32	depends on CC_IS_CLANG
 33	depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=bounds -fsanitize-coverage=trace-pc)
 34	help
 35	  Some versions of clang support either UBSAN or KCOV but not the
 36	  combination of the two.
 37	  See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status
 38	  in newer releases.
 39
 40config CC_HAS_UBSAN_BOUNDS
 41	def_bool $(cc-option,-fsanitize=bounds)
 
 
 
 42
 43config CC_HAS_UBSAN_ARRAY_BOUNDS
 44	def_bool $(cc-option,-fsanitize=array-bounds)
 
 
 
 
 
 
 
 
 45
 46config UBSAN_BOUNDS
 47	bool "Perform array index bounds checking"
 48	default UBSAN
 49	depends on !UBSAN_KCOV_BROKEN
 50	depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS
 51	help
 52	  This option enables detection of directly indexed out of bounds
 53	  array accesses, where the array size is known at compile time.
 54	  Note that this does not protect array overflows via bad calls
 55	  to the {str,mem}*cpy() family of functions (that is addressed
 56	  by CONFIG_FORTIFY_SOURCE).
 57
 58config UBSAN_ONLY_BOUNDS
 59	def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS
 60	depends on UBSAN_BOUNDS
 61	help
 62	  This is a weird case: Clang's -fsanitize=bounds includes
 63	  -fsanitize=local-bounds, but it's trapping-only, so for
 64	  Clang, we must use -fsanitize=array-bounds when we want
 65	  traditional array bounds checking enabled. For GCC, we
 66	  want -fsanitize=bounds.
 67
 68config UBSAN_ARRAY_BOUNDS
 69	def_bool CC_HAS_UBSAN_ARRAY_BOUNDS
 70	depends on UBSAN_BOUNDS
 
 
 71
 72config UBSAN_LOCAL_BOUNDS
 73	bool "Perform array local bounds checking"
 74	depends on UBSAN_TRAP
 75	depends on !UBSAN_KCOV_BROKEN
 76	depends on $(cc-option,-fsanitize=local-bounds)
 77	help
 78	  This option enables -fsanitize=local-bounds which traps when an
 79	  exception/error is detected. Therefore, it may only be enabled
 80	  with CONFIG_UBSAN_TRAP.
 81
 82	  Enabling this option detects errors due to accesses through a
 83	  pointer that is derived from an object of a statically-known size,
 84	  where an added offset (which may not be known statically) is
 85	  out-of-bounds.
 86
 87config UBSAN_SHIFT
 88	bool "Perform checking for bit-shift overflows"
 89	default UBSAN
 90	depends on $(cc-option,-fsanitize=shift)
 91	help
 92	  This option enables -fsanitize=shift which checks for bit-shift
 93	  operations that overflow to the left or go switch to negative
 94	  for signed types.
 95
 96config UBSAN_DIV_ZERO
 97	bool "Perform checking for integer divide-by-zero"
 98	depends on $(cc-option,-fsanitize=integer-divide-by-zero)
 
 
 
 99	help
100	  This option enables -fsanitize=integer-divide-by-zero which checks
101	  for integer division by zero. This is effectively redundant with the
102	  kernel's existing exception handling, though it can provide greater
103	  debugging information under CONFIG_UBSAN_REPORT_FULL.
104
105config UBSAN_UNREACHABLE
106	bool "Perform checking for unreachable code"
107	# objtool already handles unreachable checking and gets angry about
108	# seeing UBSan instrumentation located in unreachable places.
109	depends on !STACK_VALIDATION
110	depends on $(cc-option,-fsanitize=unreachable)
111	help
112	  This option enables -fsanitize=unreachable which checks for control
113	  flow reaching an expected-to-be-unreachable position.
114
115config UBSAN_OBJECT_SIZE
116	bool "Perform checking for accesses beyond the end of objects"
117	default UBSAN
118	# gcc hugely expands stack usage with -fsanitize=object-size
119	# https://lore.kernel.org/lkml/CAHk-=wjPasyJrDuwDnpHJS2TuQfExwe=px-SzLeN8GFMAQJPmQ@mail.gmail.com/
120	depends on !CC_IS_GCC
121	depends on $(cc-option,-fsanitize=object-size)
122	help
123	  This option enables -fsanitize=object-size which checks for accesses
124	  beyond the end of objects where the optimizer can determine both the
125	  object being operated on and its size, usually seen with bad downcasts,
126	  or access to struct members from NULL pointers.
 
 
 
127
128config UBSAN_BOOL
129	bool "Perform checking for non-boolean values used as boolean"
130	default UBSAN
131	depends on $(cc-option,-fsanitize=bool)
132	help
133	  This option enables -fsanitize=bool which checks for boolean values being
134	  loaded that are neither 0 nor 1.
135
136config UBSAN_ENUM
137	bool "Perform checking for out of bounds enum values"
138	default UBSAN
139	depends on $(cc-option,-fsanitize=enum)
140	help
141	  This option enables -fsanitize=enum which checks for values being loaded
142	  into an enum that are outside the range of given values for the given enum.
143
144config UBSAN_ALIGNMENT
145	bool "Perform checking for misaligned pointer usage"
146	default !HAVE_EFFICIENT_UNALIGNED_ACCESS
147	depends on !UBSAN_TRAP && !COMPILE_TEST
148	depends on $(cc-option,-fsanitize=alignment)
149	help
150	  This option enables the check of unaligned memory accesses.
151	  Enabling this option on architectures that support unaligned
152	  accesses may produce a lot of false positives.
153
154config UBSAN_SANITIZE_ALL
155	bool "Enable instrumentation for the entire kernel"
156	depends on ARCH_HAS_UBSAN_SANITIZE_ALL
157	default y
158	help
159	  This option activates instrumentation for the entire kernel.
160	  If you don't enable this option, you have to explicitly specify
161	  UBSAN_SANITIZE := y for the files/directories you want to check for UB.
162	  Enabling this option will get kernel image size increased
163	  significantly.
164
165config TEST_UBSAN
166	tristate "Module for testing for undefined behavior detection"
167	depends on m
168	help
169	  This is a test module for UBSAN.
170	  It triggers various undefined behavior, and detect it.
171
172endif	# if UBSAN

  1# SPDX-License-Identifier: GPL-2.0-only
  2config ARCH_HAS_UBSAN
  3	bool
  4
  5menuconfig UBSAN
  6	bool "Undefined behaviour sanity checker"
  7	depends on ARCH_HAS_UBSAN
  8	help
  9	  This option enables the Undefined Behaviour sanity checker.
 10	  Compile-time instrumentation is used to detect various undefined
 11	  behaviours at runtime. For more details, see:
 12	  Documentation/dev-tools/ubsan.rst
 13
 14if UBSAN
 15
 16config UBSAN_TRAP
 17	bool "Abort on Sanitizer warnings (smaller kernel but less verbose)"
 18	depends on !COMPILE_TEST
 
 19	help
 20	  Building kernels with Sanitizer features enabled tends to grow
 21	  the kernel size by around 5%, due to adding all the debugging
 22	  text on failure paths. To avoid this, Sanitizer instrumentation
 23	  can just issue a trap. This reduces the kernel size overhead but
 24	  turns all warnings (including potentially harmless conditions)
 25	  into full exceptions that abort the running kernel code
 26	  (regardless of context, locks held, etc), which may destabilize
 27	  the system. For some system builders this is an acceptable
 28	  trade-off.
 29
 30	  Also note that selecting Y will cause your kernel to Oops
 31	  with an "illegal instruction" error with no further details
 32	  when a UBSAN violation occurs. (Except on arm64 and x86, which
 33	  will report which Sanitizer failed.) This may make it hard to
 34	  determine whether an Oops was caused by UBSAN or to figure
 35	  out the details of a UBSAN violation. It makes the kernel log
 36	  output less useful for bug reports.
 37
 38config CC_HAS_UBSAN_BOUNDS_STRICT
 39	def_bool $(cc-option,-fsanitize=bounds-strict)
 40	help
 41	  The -fsanitize=bounds-strict option is only available on GCC,
 42	  but uses the more strict handling of arrays that includes knowledge
 43	  of flexible arrays, which is comparable to Clang's regular
 44	  -fsanitize=bounds.
 45
 46config CC_HAS_UBSAN_ARRAY_BOUNDS
 47	def_bool $(cc-option,-fsanitize=array-bounds)
 48	help
 49	  Under Clang, the -fsanitize=bounds option is actually composed
 50	  of two more specific options, -fsanitize=array-bounds and
 51	  -fsanitize=local-bounds. However, -fsanitize=local-bounds can
 52	  only be used when trap mode is enabled. (See also the help for
 53	  CONFIG_LOCAL_BOUNDS.) Explicitly check for -fsanitize=array-bounds
 54	  so that we can build up the options needed for UBSAN_BOUNDS
 55	  with or without UBSAN_TRAP.
 56
 57config UBSAN_BOUNDS
 58	bool "Perform array index bounds checking"
 59	default UBSAN
 60	depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS_STRICT
 
 61	help
 62	  This option enables detection of directly indexed out of bounds
 63	  array accesses, where the array size is known at compile time.
 64	  Note that this does not protect array overflows via bad calls
 65	  to the {str,mem}*cpy() family of functions (that is addressed
 66	  by CONFIG_FORTIFY_SOURCE).
 67
 68config UBSAN_BOUNDS_STRICT
 69	def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_BOUNDS_STRICT
 70	help
 71	  GCC's bounds sanitizer. This option is used to select the
 72	  correct options in Makefile.ubsan.
 
 
 
 
 73
 74config UBSAN_ARRAY_BOUNDS
 75	def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_ARRAY_BOUNDS
 76	help
 77	  Clang's array bounds sanitizer. This option is used to select
 78	  the correct options in Makefile.ubsan.
 79
 80config UBSAN_LOCAL_BOUNDS
 81	def_bool UBSAN_ARRAY_BOUNDS && UBSAN_TRAP
 82	help
 83	  This option enables Clang's -fsanitize=local-bounds which traps
 84	  when an access through a pointer that is derived from an object
 85	  of a statically-known size, where an added offset (which may not
 86	  be known statically) is out-of-bounds. Since this option is
 87	  trap-only, it depends on CONFIG_UBSAN_TRAP.
 
 
 
 
 
 
 88
 89config UBSAN_SHIFT
 90	bool "Perform checking for bit-shift overflows"
 
 91	depends on $(cc-option,-fsanitize=shift)
 92	help
 93	  This option enables -fsanitize=shift which checks for bit-shift
 94	  operations that overflow to the left or go switch to negative
 95	  for signed types.
 96
 97config UBSAN_DIV_ZERO
 98	bool "Perform checking for integer divide-by-zero"
 99	depends on $(cc-option,-fsanitize=integer-divide-by-zero)
100	# https://github.com/ClangBuiltLinux/linux/issues/1657
101	# https://github.com/llvm/llvm-project/issues/56289
102	depends on !CC_IS_CLANG
103	help
104	  This option enables -fsanitize=integer-divide-by-zero which checks
105	  for integer division by zero. This is effectively redundant with the
106	  kernel's existing exception handling, though it can provide greater
107	  debugging information under CONFIG_UBSAN_REPORT_FULL.
108
109config UBSAN_UNREACHABLE
110	bool "Perform checking for unreachable code"
111	# objtool already handles unreachable checking and gets angry about
112	# seeing UBSan instrumentation located in unreachable places.
113	depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION))
114	depends on $(cc-option,-fsanitize=unreachable)
115	help
116	  This option enables -fsanitize=unreachable which checks for control
117	  flow reaching an expected-to-be-unreachable position.
118
119config UBSAN_SIGNED_WRAP
120	bool "Perform checking for signed arithmetic wrap-around"
121	default UBSAN
122	depends on !COMPILE_TEST
123	# The no_sanitize attribute was introduced in GCC with version 8.
124	depends on !CC_IS_GCC || GCC_VERSION >= 80000
125	depends on $(cc-option,-fsanitize=signed-integer-overflow)
126	help
127	  This option enables -fsanitize=signed-integer-overflow which checks
128	  for wrap-around of any arithmetic operations with signed integers.
129	  This currently performs nearly no instrumentation due to the
130	  kernel's use of -fno-strict-overflow which converts all would-be
131	  arithmetic undefined behavior into wrap-around arithmetic. Future
132	  sanitizer versions will allow for wrap-around checking (rather than
133	  exclusively undefined behavior).
134
135config UBSAN_BOOL
136	bool "Perform checking for non-boolean values used as boolean"
137	default UBSAN
138	depends on $(cc-option,-fsanitize=bool)
139	help
140	  This option enables -fsanitize=bool which checks for boolean values being
141	  loaded that are neither 0 nor 1.
142
143config UBSAN_ENUM
144	bool "Perform checking for out of bounds enum values"
145	default UBSAN
146	depends on $(cc-option,-fsanitize=enum)
147	help
148	  This option enables -fsanitize=enum which checks for values being loaded
149	  into an enum that are outside the range of given values for the given enum.
150
151config UBSAN_ALIGNMENT
152	bool "Perform checking for misaligned pointer usage"
153	default !HAVE_EFFICIENT_UNALIGNED_ACCESS
154	depends on !UBSAN_TRAP && !COMPILE_TEST
155	depends on $(cc-option,-fsanitize=alignment)
156	help
157	  This option enables the check of unaligned memory accesses.
158	  Enabling this option on architectures that support unaligned
159	  accesses may produce a lot of false positives.
 
 
 
 
 
 
 
 
 
 
 
160
161config TEST_UBSAN
162	tristate "Module for testing for undefined behavior detection"
163	depends on m
164	help
165	  This is a test module for UBSAN.
166	  It triggers various undefined behavior, and detect it.
167
168endif	# if UBSAN