1# SPDX-License-Identifier: GPL-2.0-only 2# This config refers to the generic KASAN mode. 3config HAVE_ARCH_KASAN 4 bool 5 6config HAVE_ARCH_KASAN_SW_TAGS 7 bool 8 9config HAVE_ARCH_KASAN_VMALLOC 10 bool 11 12config CC_HAS_KASAN_GENERIC 13 def_bool $(cc-option, -fsanitize=kernel-address) 14 15config CC_HAS_KASAN_SW_TAGS 16 def_bool $(cc-option, -fsanitize=kernel-hwaddress) 17 18config KASAN 19 bool "KASAN: runtime memory debugger" 20 depends on (HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC) || \ 21 (HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS) 22 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 23 help 24 Enables KASAN (KernelAddressSANitizer) - runtime memory debugger, 25 designed to find out-of-bounds accesses and use-after-free bugs. 26 See Documentation/dev-tools/kasan.rst for details. 27 28choice 29 prompt "KASAN mode" 30 depends on KASAN 31 default KASAN_GENERIC 32 help 33 KASAN has two modes: generic KASAN (similar to userspace ASan, 34 x86_64/arm64/xtensa, enabled with CONFIG_KASAN_GENERIC) and 35 software tag-based KASAN (a version based on software memory 36 tagging, arm64 only, similar to userspace HWASan, enabled with 37 CONFIG_KASAN_SW_TAGS). 38 Both generic and tag-based KASAN are strictly debugging features. 39 40config KASAN_GENERIC 41 bool "Generic mode" 42 depends on HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC 43 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 44 select SLUB_DEBUG if SLUB 45 select CONSTRUCTORS 46 select STACKDEPOT 47 help 48 Enables generic KASAN mode. 49 Supported in both GCC and Clang. With GCC it requires version 4.9.2 50 or later for basic support and version 5.0 or later for detection of 51 out-of-bounds accesses for stack and global variables and for inline 52 instrumentation mode (CONFIG_KASAN_INLINE). With Clang it requires 53 version 3.7.0 or later and it doesn't support detection of 54 out-of-bounds accesses for global variables yet. 55 This mode consumes about 1/8th of available memory at kernel start 56 and introduces an overhead of ~x1.5 for the rest of the allocations. 57 The performance slowdown is ~x3. 58 For better error detection enable CONFIG_STACKTRACE. 59 Currently CONFIG_KASAN_GENERIC doesn't work with CONFIG_DEBUG_SLAB 60 (the resulting kernel does not boot). 61 62config KASAN_SW_TAGS 63 bool "Software tag-based mode" 64 depends on HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS 65 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 66 select SLUB_DEBUG if SLUB 67 select CONSTRUCTORS 68 select STACKDEPOT 69 help 70 Enables software tag-based KASAN mode. 71 This mode requires Top Byte Ignore support by the CPU and therefore 72 is only supported for arm64. 73 This mode requires Clang version 7.0.0 or later. 74 This mode consumes about 1/16th of available memory at kernel start 75 and introduces an overhead of ~20% for the rest of the allocations. 76 This mode may potentially introduce problems relating to pointer 77 casting and comparison, as it embeds tags into the top byte of each 78 pointer. 79 For better error detection enable CONFIG_STACKTRACE. 80 Currently CONFIG_KASAN_SW_TAGS doesn't work with CONFIG_DEBUG_SLAB 81 (the resulting kernel does not boot). 82 83endchoice 84 85choice 86 prompt "Instrumentation type" 87 depends on KASAN 88 default KASAN_OUTLINE 89 90config KASAN_OUTLINE 91 bool "Outline instrumentation" 92 help 93 Before every memory access compiler insert function call 94 __asan_load*/__asan_store*. These functions performs check 95 of shadow memory. This is slower than inline instrumentation, 96 however it doesn't bloat size of kernel's .text section so 97 much as inline does. 98 99config KASAN_INLINE 100 bool "Inline instrumentation" 101 help 102 Compiler directly inserts code checking shadow memory before 103 memory accesses. This is faster than outline (in some workloads 104 it gives about x2 boost over outline instrumentation), but 105 make kernel's .text size much bigger. 106 For CONFIG_KASAN_GENERIC this requires GCC 5.0 or later. 107 108endchoice 109 110config KASAN_STACK_ENABLE 111 bool "Enable stack instrumentation (unsafe)" if CC_IS_CLANG && !COMPILE_TEST 112 depends on KASAN 113 help 114 The LLVM stack address sanitizer has a know problem that 115 causes excessive stack usage in a lot of functions, see 116 https://bugs.llvm.org/show_bug.cgi?id=38809 117 Disabling asan-stack makes it safe to run kernels build 118 with clang-8 with KASAN enabled, though it loses some of 119 the functionality. 120 This feature is always disabled when compile-testing with clang 121 to avoid cluttering the output in stack overflow warnings, 122 but clang users can still enable it for builds without 123 CONFIG_COMPILE_TEST. On gcc it is assumed to always be safe 124 to use and enabled by default. 125 126config KASAN_STACK 127 int 128 default 1 if KASAN_STACK_ENABLE || CC_IS_GCC 129 default 0 130 131config KASAN_S390_4_LEVEL_PAGING 132 bool "KASan: use 4-level paging" 133 depends on KASAN && S390 134 help 135 Compiling the kernel with KASan disables automatic 3-level vs 136 4-level paging selection. 3-level paging is used by default (up 137 to 3TB of RAM with KASan enabled). This options allows to force 138 4-level paging instead. 139 140config KASAN_SW_TAGS_IDENTIFY 141 bool "Enable memory corruption identification" 142 depends on KASAN_SW_TAGS 143 help 144 This option enables best-effort identification of bug type 145 (use-after-free or out-of-bounds) at the cost of increased 146 memory consumption. 147 148config KASAN_VMALLOC 149 bool "Back mappings in vmalloc space with real shadow memory" 150 depends on KASAN && HAVE_ARCH_KASAN_VMALLOC 151 help 152 By default, the shadow region for vmalloc space is the read-only 153 zero page. This means that KASAN cannot detect errors involving 154 vmalloc space. 155 156 Enabling this option will hook in to vmap/vmalloc and back those 157 mappings with real shadow memory allocated on demand. This allows 158 for KASAN to detect more sorts of errors (and to support vmapped 159 stacks), but at the cost of higher memory usage. 160 161config TEST_KASAN 162 tristate "Module for testing KASAN for bug detection" 163 depends on m && KASAN 164 help 165 This is a test module doing various nasty things like 166 out of bounds accesses, use after free. It is useful for testing 167 kernel debugging features like KASAN. 168