1# SPDX-License-Identifier: GPL-2.0-only 2# This config refers to the generic KASAN mode. 3config HAVE_ARCH_KASAN 4 bool 5 6config HAVE_ARCH_KASAN_SW_TAGS 7 bool 8 9config HAVE_ARCH_KASAN_VMALLOC 10 bool 11 12config CC_HAS_KASAN_GENERIC 13 def_bool $(cc-option, -fsanitize=kernel-address) 14 15config CC_HAS_KASAN_SW_TAGS 16 def_bool $(cc-option, -fsanitize=kernel-hwaddress) 17 18config CC_HAS_WORKING_NOSANITIZE_ADDRESS 19 def_bool !CC_IS_GCC || GCC_VERSION >= 80300 20 21menuconfig KASAN 22 bool "KASAN: runtime memory debugger" 23 depends on (HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC) || \ 24 (HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS) 25 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 26 depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS 27 help 28 Enables KASAN (KernelAddressSANitizer) - runtime memory debugger, 29 designed to find out-of-bounds accesses and use-after-free bugs. 30 See Documentation/dev-tools/kasan.rst for details. 31 32if KASAN 33 34choice 35 prompt "KASAN mode" 36 default KASAN_GENERIC 37 help 38 KASAN has two modes: generic KASAN (similar to userspace ASan, 39 x86_64/arm64/xtensa, enabled with CONFIG_KASAN_GENERIC) and 40 software tag-based KASAN (a version based on software memory 41 tagging, arm64 only, similar to userspace HWASan, enabled with 42 CONFIG_KASAN_SW_TAGS). 43 44 Both generic and tag-based KASAN are strictly debugging features. 45 46config KASAN_GENERIC 47 bool "Generic mode" 48 depends on HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC 49 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 50 select SLUB_DEBUG if SLUB 51 select CONSTRUCTORS 52 select STACKDEPOT 53 help 54 Enables generic KASAN mode. 55 56 This mode is supported in both GCC and Clang. With GCC it requires 57 version 8.3.0 or later. With Clang it requires version 7.0.0 or 58 later, but detection of out-of-bounds accesses for global variables 59 is supported only since Clang 11. 60 61 This mode consumes about 1/8th of available memory at kernel start 62 and introduces an overhead of ~x1.5 for the rest of the allocations. 63 The performance slowdown is ~x3. 64 65 For better error detection enable CONFIG_STACKTRACE. 66 67 Currently CONFIG_KASAN_GENERIC doesn't work with CONFIG_DEBUG_SLAB 68 (the resulting kernel does not boot). 69 70config KASAN_SW_TAGS 71 bool "Software tag-based mode" 72 depends on HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS 73 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 74 select SLUB_DEBUG if SLUB 75 select CONSTRUCTORS 76 select STACKDEPOT 77 help 78 Enables software tag-based KASAN mode. 79 80 This mode requires Top Byte Ignore support by the CPU and therefore 81 is only supported for arm64. This mode requires Clang version 7.0.0 82 or later. 83 84 This mode consumes about 1/16th of available memory at kernel start 85 and introduces an overhead of ~20% for the rest of the allocations. 86 This mode may potentially introduce problems relating to pointer 87 casting and comparison, as it embeds tags into the top byte of each 88 pointer. 89 90 For better error detection enable CONFIG_STACKTRACE. 91 92 Currently CONFIG_KASAN_SW_TAGS doesn't work with CONFIG_DEBUG_SLAB 93 (the resulting kernel does not boot). 94 95endchoice 96 97choice 98 prompt "Instrumentation type" 99 default KASAN_OUTLINE 100 101config KASAN_OUTLINE 102 bool "Outline instrumentation" 103 help 104 Before every memory access compiler insert function call 105 __asan_load*/__asan_store*. These functions performs check 106 of shadow memory. This is slower than inline instrumentation, 107 however it doesn't bloat size of kernel's .text section so 108 much as inline does. 109 110config KASAN_INLINE 111 bool "Inline instrumentation" 112 help 113 Compiler directly inserts code checking shadow memory before 114 memory accesses. This is faster than outline (in some workloads 115 it gives about x2 boost over outline instrumentation), but 116 make kernel's .text size much bigger. 117 118endchoice 119 120config KASAN_STACK_ENABLE 121 bool "Enable stack instrumentation (unsafe)" if CC_IS_CLANG && !COMPILE_TEST 122 help 123 The LLVM stack address sanitizer has a know problem that 124 causes excessive stack usage in a lot of functions, see 125 https://bugs.llvm.org/show_bug.cgi?id=38809 126 Disabling asan-stack makes it safe to run kernels build 127 with clang-8 with KASAN enabled, though it loses some of 128 the functionality. 129 This feature is always disabled when compile-testing with clang 130 to avoid cluttering the output in stack overflow warnings, 131 but clang users can still enable it for builds without 132 CONFIG_COMPILE_TEST. On gcc it is assumed to always be safe 133 to use and enabled by default. 134 135config KASAN_STACK 136 int 137 default 1 if KASAN_STACK_ENABLE || CC_IS_GCC 138 default 0 139 140config KASAN_S390_4_LEVEL_PAGING 141 bool "KASan: use 4-level paging" 142 depends on S390 143 help 144 Compiling the kernel with KASan disables automatic 3-level vs 145 4-level paging selection. 3-level paging is used by default (up 146 to 3TB of RAM with KASan enabled). This options allows to force 147 4-level paging instead. 148 149config KASAN_SW_TAGS_IDENTIFY 150 bool "Enable memory corruption identification" 151 depends on KASAN_SW_TAGS 152 help 153 This option enables best-effort identification of bug type 154 (use-after-free or out-of-bounds) at the cost of increased 155 memory consumption. 156 157config KASAN_VMALLOC 158 bool "Back mappings in vmalloc space with real shadow memory" 159 depends on HAVE_ARCH_KASAN_VMALLOC 160 help 161 By default, the shadow region for vmalloc space is the read-only 162 zero page. This means that KASAN cannot detect errors involving 163 vmalloc space. 164 165 Enabling this option will hook in to vmap/vmalloc and back those 166 mappings with real shadow memory allocated on demand. This allows 167 for KASAN to detect more sorts of errors (and to support vmapped 168 stacks), but at the cost of higher memory usage. 169 170config TEST_KASAN 171 tristate "Module for testing KASAN for bug detection" 172 depends on m 173 help 174 This is a test module doing various nasty things like 175 out of bounds accesses, use after free. It is useful for testing 176 kernel debugging features like KASAN. 177 178endif # KASAN 179