1# This config refers to the generic KASAN mode. 2config HAVE_ARCH_KASAN 3 bool 4 5config HAVE_ARCH_KASAN_SW_TAGS 6 bool 7 8config CC_HAS_KASAN_GENERIC 9 def_bool $(cc-option, -fsanitize=kernel-address) 10 11config CC_HAS_KASAN_SW_TAGS 12 def_bool $(cc-option, -fsanitize=kernel-hwaddress) 13 14config KASAN 15 bool "KASAN: runtime memory debugger" 16 depends on (HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC) || \ 17 (HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS) 18 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 19 help 20 Enables KASAN (KernelAddressSANitizer) - runtime memory debugger, 21 designed to find out-of-bounds accesses and use-after-free bugs. 22 See Documentation/dev-tools/kasan.rst for details. 23 24choice 25 prompt "KASAN mode" 26 depends on KASAN 27 default KASAN_GENERIC 28 help 29 KASAN has two modes: generic KASAN (similar to userspace ASan, 30 x86_64/arm64/xtensa, enabled with CONFIG_KASAN_GENERIC) and 31 software tag-based KASAN (a version based on software memory 32 tagging, arm64 only, similar to userspace HWASan, enabled with 33 CONFIG_KASAN_SW_TAGS). 34 Both generic and tag-based KASAN are strictly debugging features. 35 36config KASAN_GENERIC 37 bool "Generic mode" 38 depends on HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC 39 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 40 select SLUB_DEBUG if SLUB 41 select CONSTRUCTORS 42 select STACKDEPOT 43 help 44 Enables generic KASAN mode. 45 Supported in both GCC and Clang. With GCC it requires version 4.9.2 46 or later for basic support and version 5.0 or later for detection of 47 out-of-bounds accesses for stack and global variables and for inline 48 instrumentation mode (CONFIG_KASAN_INLINE). With Clang it requires 49 version 3.7.0 or later and it doesn't support detection of 50 out-of-bounds accesses for global variables yet. 51 This mode consumes about 1/8th of available memory at kernel start 52 and introduces an overhead of ~x1.5 for the rest of the allocations. 53 The performance slowdown is ~x3. 54 For better error detection enable CONFIG_STACKTRACE. 55 Currently CONFIG_KASAN_GENERIC doesn't work with CONFIG_DEBUG_SLAB 56 (the resulting kernel does not boot). 57 58config KASAN_SW_TAGS 59 bool "Software tag-based mode" 60 depends on HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS 61 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 62 select SLUB_DEBUG if SLUB 63 select CONSTRUCTORS 64 select STACKDEPOT 65 help 66 Enables software tag-based KASAN mode. 67 This mode requires Top Byte Ignore support by the CPU and therefore 68 is only supported for arm64. 69 This mode requires Clang version 7.0.0 or later. 70 This mode consumes about 1/16th of available memory at kernel start 71 and introduces an overhead of ~20% for the rest of the allocations. 72 This mode may potentially introduce problems relating to pointer 73 casting and comparison, as it embeds tags into the top byte of each 74 pointer. 75 For better error detection enable CONFIG_STACKTRACE. 76 Currently CONFIG_KASAN_SW_TAGS doesn't work with CONFIG_DEBUG_SLAB 77 (the resulting kernel does not boot). 78 79endchoice 80 81config KASAN_EXTRA 82 bool "KASAN: extra checks" 83 depends on KASAN_GENERIC && DEBUG_KERNEL && !COMPILE_TEST 84 help 85 This enables further checks in generic KASAN, for now it only 86 includes the address-use-after-scope check that can lead to 87 excessive kernel stack usage, frame size warnings and longer 88 compile time. 89 See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 90 91choice 92 prompt "Instrumentation type" 93 depends on KASAN 94 default KASAN_OUTLINE 95 96config KASAN_OUTLINE 97 bool "Outline instrumentation" 98 help 99 Before every memory access compiler insert function call 100 __asan_load*/__asan_store*. These functions performs check 101 of shadow memory. This is slower than inline instrumentation, 102 however it doesn't bloat size of kernel's .text section so 103 much as inline does. 104 105config KASAN_INLINE 106 bool "Inline instrumentation" 107 help 108 Compiler directly inserts code checking shadow memory before 109 memory accesses. This is faster than outline (in some workloads 110 it gives about x2 boost over outline instrumentation), but 111 make kernel's .text size much bigger. 112 For CONFIG_KASAN_GENERIC this requires GCC 5.0 or later. 113 114endchoice 115 116config KASAN_S390_4_LEVEL_PAGING 117 bool "KASan: use 4-level paging" 118 depends on KASAN && S390 119 help 120 Compiling the kernel with KASan disables automatic 3-level vs 121 4-level paging selection. 3-level paging is used by default (up 122 to 3TB of RAM with KASan enabled). This options allows to force 123 4-level paging instead. 124 125config TEST_KASAN 126 tristate "Module for testing KASAN for bug detection" 127 depends on m && KASAN 128 help 129 This is a test module doing various nasty things like 130 out of bounds accesses, use after free. It is useful for testing 131 kernel debugging features like KASAN. 132