Loading...
1# SPDX-License-Identifier: GPL-2.0-only
2config ARCH_HAS_UBSAN_SANITIZE_ALL
3 bool
4
5menuconfig UBSAN
6 bool "Undefined behaviour sanity checker"
7 help
8 This option enables the Undefined Behaviour sanity checker.
9 Compile-time instrumentation is used to detect various undefined
10 behaviours at runtime. For more details, see:
11 Documentation/dev-tools/ubsan.rst
12
13if UBSAN
14
15config UBSAN_TRAP
16 bool "On Sanitizer warnings, abort the running kernel code"
17 depends on !COMPILE_TEST
18 depends on $(cc-option, -fsanitize-undefined-trap-on-error)
19 help
20 Building kernels with Sanitizer features enabled tends to grow
21 the kernel size by around 5%, due to adding all the debugging
22 text on failure paths. To avoid this, Sanitizer instrumentation
23 can just issue a trap. This reduces the kernel size overhead but
24 turns all warnings (including potentially harmless conditions)
25 into full exceptions that abort the running kernel code
26 (regardless of context, locks held, etc), which may destabilize
27 the system. For some system builders this is an acceptable
28 trade-off.
29
30config UBSAN_KCOV_BROKEN
31 def_bool KCOV && CC_HAS_SANCOV_TRACE_PC
32 depends on CC_IS_CLANG
33 depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=bounds -fsanitize-coverage=trace-pc)
34 help
35 Some versions of clang support either UBSAN or KCOV but not the
36 combination of the two.
37 See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status
38 in newer releases.
39
40config CC_HAS_UBSAN_BOUNDS
41 def_bool $(cc-option,-fsanitize=bounds)
42
43config CC_HAS_UBSAN_ARRAY_BOUNDS
44 def_bool $(cc-option,-fsanitize=array-bounds)
45
46config UBSAN_BOUNDS
47 bool "Perform array index bounds checking"
48 default UBSAN
49 depends on !UBSAN_KCOV_BROKEN
50 depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS
51 help
52 This option enables detection of directly indexed out of bounds
53 array accesses, where the array size is known at compile time.
54 Note that this does not protect array overflows via bad calls
55 to the {str,mem}*cpy() family of functions (that is addressed
56 by CONFIG_FORTIFY_SOURCE).
57
58config UBSAN_ONLY_BOUNDS
59 def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS
60 depends on UBSAN_BOUNDS
61 help
62 This is a weird case: Clang's -fsanitize=bounds includes
63 -fsanitize=local-bounds, but it's trapping-only, so for
64 Clang, we must use -fsanitize=array-bounds when we want
65 traditional array bounds checking enabled. For GCC, we
66 want -fsanitize=bounds.
67
68config UBSAN_ARRAY_BOUNDS
69 def_bool CC_HAS_UBSAN_ARRAY_BOUNDS
70 depends on UBSAN_BOUNDS
71
72config UBSAN_LOCAL_BOUNDS
73 bool "Perform array local bounds checking"
74 depends on UBSAN_TRAP
75 depends on !UBSAN_KCOV_BROKEN
76 depends on $(cc-option,-fsanitize=local-bounds)
77 help
78 This option enables -fsanitize=local-bounds which traps when an
79 exception/error is detected. Therefore, it may only be enabled
80 with CONFIG_UBSAN_TRAP.
81
82 Enabling this option detects errors due to accesses through a
83 pointer that is derived from an object of a statically-known size,
84 where an added offset (which may not be known statically) is
85 out-of-bounds.
86
87config UBSAN_SHIFT
88 bool "Perform checking for bit-shift overflows"
89 default UBSAN
90 depends on $(cc-option,-fsanitize=shift)
91 help
92 This option enables -fsanitize=shift which checks for bit-shift
93 operations that overflow to the left or go switch to negative
94 for signed types.
95
96config UBSAN_DIV_ZERO
97 bool "Perform checking for integer divide-by-zero"
98 depends on $(cc-option,-fsanitize=integer-divide-by-zero)
99 help
100 This option enables -fsanitize=integer-divide-by-zero which checks
101 for integer division by zero. This is effectively redundant with the
102 kernel's existing exception handling, though it can provide greater
103 debugging information under CONFIG_UBSAN_REPORT_FULL.
104
105config UBSAN_UNREACHABLE
106 bool "Perform checking for unreachable code"
107 # objtool already handles unreachable checking and gets angry about
108 # seeing UBSan instrumentation located in unreachable places.
109 depends on !STACK_VALIDATION
110 depends on $(cc-option,-fsanitize=unreachable)
111 help
112 This option enables -fsanitize=unreachable which checks for control
113 flow reaching an expected-to-be-unreachable position.
114
115config UBSAN_OBJECT_SIZE
116 bool "Perform checking for accesses beyond the end of objects"
117 default UBSAN
118 # gcc hugely expands stack usage with -fsanitize=object-size
119 # https://lore.kernel.org/lkml/CAHk-=wjPasyJrDuwDnpHJS2TuQfExwe=px-SzLeN8GFMAQJPmQ@mail.gmail.com/
120 depends on !CC_IS_GCC
121 depends on $(cc-option,-fsanitize=object-size)
122 help
123 This option enables -fsanitize=object-size which checks for accesses
124 beyond the end of objects where the optimizer can determine both the
125 object being operated on and its size, usually seen with bad downcasts,
126 or access to struct members from NULL pointers.
127
128config UBSAN_BOOL
129 bool "Perform checking for non-boolean values used as boolean"
130 default UBSAN
131 depends on $(cc-option,-fsanitize=bool)
132 help
133 This option enables -fsanitize=bool which checks for boolean values being
134 loaded that are neither 0 nor 1.
135
136config UBSAN_ENUM
137 bool "Perform checking for out of bounds enum values"
138 default UBSAN
139 depends on $(cc-option,-fsanitize=enum)
140 help
141 This option enables -fsanitize=enum which checks for values being loaded
142 into an enum that are outside the range of given values for the given enum.
143
144config UBSAN_ALIGNMENT
145 bool "Perform checking for misaligned pointer usage"
146 default !HAVE_EFFICIENT_UNALIGNED_ACCESS
147 depends on !UBSAN_TRAP && !COMPILE_TEST
148 depends on $(cc-option,-fsanitize=alignment)
149 help
150 This option enables the check of unaligned memory accesses.
151 Enabling this option on architectures that support unaligned
152 accesses may produce a lot of false positives.
153
154config UBSAN_SANITIZE_ALL
155 bool "Enable instrumentation for the entire kernel"
156 depends on ARCH_HAS_UBSAN_SANITIZE_ALL
157 default y
158 help
159 This option activates instrumentation for the entire kernel.
160 If you don't enable this option, you have to explicitly specify
161 UBSAN_SANITIZE := y for the files/directories you want to check for UB.
162 Enabling this option will get kernel image size increased
163 significantly.
164
165config TEST_UBSAN
166 tristate "Module for testing for undefined behavior detection"
167 depends on m
168 help
169 This is a test module for UBSAN.
170 It triggers various undefined behavior, and detect it.
171
172endif # if UBSAN
1# SPDX-License-Identifier: GPL-2.0-only
2config ARCH_HAS_UBSAN_SANITIZE_ALL
3 bool
4
5menuconfig UBSAN
6 bool "Undefined behaviour sanity checker"
7 help
8 This option enables the Undefined Behaviour sanity checker.
9 Compile-time instrumentation is used to detect various undefined
10 behaviours at runtime. For more details, see:
11 Documentation/dev-tools/ubsan.rst
12
13if UBSAN
14
15config UBSAN_TRAP
16 bool "On Sanitizer warnings, abort the running kernel code"
17 depends on !COMPILE_TEST
18 depends on $(cc-option, -fsanitize-undefined-trap-on-error)
19 help
20 Building kernels with Sanitizer features enabled tends to grow
21 the kernel size by around 5%, due to adding all the debugging
22 text on failure paths. To avoid this, Sanitizer instrumentation
23 can just issue a trap. This reduces the kernel size overhead but
24 turns all warnings (including potentially harmless conditions)
25 into full exceptions that abort the running kernel code
26 (regardless of context, locks held, etc), which may destabilize
27 the system. For some system builders this is an acceptable
28 trade-off.
29
30config CC_HAS_UBSAN_BOUNDS
31 def_bool $(cc-option,-fsanitize=bounds)
32
33config CC_HAS_UBSAN_ARRAY_BOUNDS
34 def_bool $(cc-option,-fsanitize=array-bounds)
35
36config UBSAN_BOUNDS
37 bool "Perform array index bounds checking"
38 default UBSAN
39 depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS
40 help
41 This option enables detection of directly indexed out of bounds
42 array accesses, where the array size is known at compile time.
43 Note that this does not protect array overflows via bad calls
44 to the {str,mem}*cpy() family of functions (that is addressed
45 by CONFIG_FORTIFY_SOURCE).
46
47config UBSAN_ONLY_BOUNDS
48 def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS
49 depends on UBSAN_BOUNDS
50 help
51 This is a weird case: Clang's -fsanitize=bounds includes
52 -fsanitize=local-bounds, but it's trapping-only, so for
53 Clang, we must use -fsanitize=array-bounds when we want
54 traditional array bounds checking enabled. For GCC, we
55 want -fsanitize=bounds.
56
57config UBSAN_ARRAY_BOUNDS
58 def_bool CC_HAS_UBSAN_ARRAY_BOUNDS
59 depends on UBSAN_BOUNDS
60
61config UBSAN_LOCAL_BOUNDS
62 bool "Perform array local bounds checking"
63 depends on UBSAN_TRAP
64 depends on $(cc-option,-fsanitize=local-bounds)
65 help
66 This option enables -fsanitize=local-bounds which traps when an
67 exception/error is detected. Therefore, it may only be enabled
68 with CONFIG_UBSAN_TRAP.
69
70 Enabling this option detects errors due to accesses through a
71 pointer that is derived from an object of a statically-known size,
72 where an added offset (which may not be known statically) is
73 out-of-bounds.
74
75config UBSAN_SHIFT
76 bool "Perform checking for bit-shift overflows"
77 default UBSAN
78 depends on $(cc-option,-fsanitize=shift)
79 help
80 This option enables -fsanitize=shift which checks for bit-shift
81 operations that overflow to the left or go switch to negative
82 for signed types.
83
84config UBSAN_DIV_ZERO
85 bool "Perform checking for integer divide-by-zero"
86 depends on $(cc-option,-fsanitize=integer-divide-by-zero)
87 # https://github.com/ClangBuiltLinux/linux/issues/1657
88 # https://github.com/llvm/llvm-project/issues/56289
89 depends on !CC_IS_CLANG
90 help
91 This option enables -fsanitize=integer-divide-by-zero which checks
92 for integer division by zero. This is effectively redundant with the
93 kernel's existing exception handling, though it can provide greater
94 debugging information under CONFIG_UBSAN_REPORT_FULL.
95
96config UBSAN_UNREACHABLE
97 bool "Perform checking for unreachable code"
98 # objtool already handles unreachable checking and gets angry about
99 # seeing UBSan instrumentation located in unreachable places.
100 depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION))
101 depends on $(cc-option,-fsanitize=unreachable)
102 help
103 This option enables -fsanitize=unreachable which checks for control
104 flow reaching an expected-to-be-unreachable position.
105
106config UBSAN_BOOL
107 bool "Perform checking for non-boolean values used as boolean"
108 default UBSAN
109 depends on $(cc-option,-fsanitize=bool)
110 help
111 This option enables -fsanitize=bool which checks for boolean values being
112 loaded that are neither 0 nor 1.
113
114config UBSAN_ENUM
115 bool "Perform checking for out of bounds enum values"
116 default UBSAN
117 depends on $(cc-option,-fsanitize=enum)
118 help
119 This option enables -fsanitize=enum which checks for values being loaded
120 into an enum that are outside the range of given values for the given enum.
121
122config UBSAN_ALIGNMENT
123 bool "Perform checking for misaligned pointer usage"
124 default !HAVE_EFFICIENT_UNALIGNED_ACCESS
125 depends on !UBSAN_TRAP && !COMPILE_TEST
126 depends on $(cc-option,-fsanitize=alignment)
127 help
128 This option enables the check of unaligned memory accesses.
129 Enabling this option on architectures that support unaligned
130 accesses may produce a lot of false positives.
131
132config UBSAN_SANITIZE_ALL
133 bool "Enable instrumentation for the entire kernel"
134 depends on ARCH_HAS_UBSAN_SANITIZE_ALL
135 default y
136 help
137 This option activates instrumentation for the entire kernel.
138 If you don't enable this option, you have to explicitly specify
139 UBSAN_SANITIZE := y for the files/directories you want to check for UB.
140 Enabling this option will get kernel image size increased
141 significantly.
142
143config TEST_UBSAN
144 tristate "Module for testing for undefined behavior detection"
145 depends on m
146 help
147 This is a test module for UBSAN.
148 It triggers various undefined behavior, and detect it.
149
150endif # if UBSAN