1# SPDX-License-Identifier: GPL-2.0-only 2 3# This config refers to the generic KASAN mode. 4config HAVE_ARCH_KASAN 5 bool 6 7config HAVE_ARCH_KASAN_SW_TAGS 8 bool 9 10config HAVE_ARCH_KASAN_HW_TAGS 11 bool 12 13config HAVE_ARCH_KASAN_VMALLOC 14 bool 15 16config ARCH_DISABLE_KASAN_INLINE 17 bool 18 help 19 Disables both inline and stack instrumentation. Selected by 20 architectures that do not support these instrumentation types. 21 22config CC_HAS_KASAN_GENERIC 23 def_bool $(cc-option, -fsanitize=kernel-address) 24 25config CC_HAS_KASAN_SW_TAGS 26 def_bool $(cc-option, -fsanitize=kernel-hwaddress) 27 28# This option is only required for software KASAN modes. 29# Old GCC versions do not have proper support for no_sanitize_address. 30# See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89124 for details. 31config CC_HAS_WORKING_NOSANITIZE_ADDRESS 32 def_bool !CC_IS_GCC || GCC_VERSION >= 80300 33 34menuconfig KASAN 35 bool "KASAN: dynamic memory safety error detector" 36 depends on (((HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC) || \ 37 (HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS)) && \ 38 CC_HAS_WORKING_NOSANITIZE_ADDRESS) || \ 39 HAVE_ARCH_KASAN_HW_TAGS 40 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB) 41 select STACKDEPOT_ALWAYS_INIT 42 help 43 Enables KASAN (Kernel Address Sanitizer) - a dynamic memory safety 44 error detector designed to find out-of-bounds and use-after-free bugs. 45 46 See Documentation/dev-tools/kasan.rst for details. 47 48 For better error reports, also enable CONFIG_STACKTRACE. 49 50if KASAN 51 52choice 53 prompt "KASAN mode" 54 default KASAN_GENERIC 55 help 56 KASAN has three modes: 57 58 1. Generic KASAN (supported by many architectures, enabled with 59 CONFIG_KASAN_GENERIC, similar to userspace ASan), 60 2. Software Tag-Based KASAN (arm64 only, based on software memory 61 tagging, enabled with CONFIG_KASAN_SW_TAGS, similar to userspace 62 HWASan), and 63 3. Hardware Tag-Based KASAN (arm64 only, based on hardware memory 64 tagging, enabled with CONFIG_KASAN_HW_TAGS). 65 66 See Documentation/dev-tools/kasan.rst for details about each mode. 67 68config KASAN_GENERIC 69 bool "Generic KASAN" 70 depends on HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC 71 depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS 72 select SLUB_DEBUG if SLUB 73 select CONSTRUCTORS 74 help 75 Enables Generic KASAN. 76 77 Requires GCC 8.3.0+ or Clang. 78 79 Consumes about 1/8th of available memory at kernel start and adds an 80 overhead of ~50% for dynamic allocations. 81 The performance slowdown is ~x3. 82 83 (Incompatible with CONFIG_DEBUG_SLAB: the kernel does not boot.) 84 85config KASAN_SW_TAGS 86 bool "Software Tag-Based KASAN" 87 depends on HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS 88 depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS 89 select SLUB_DEBUG if SLUB 90 select CONSTRUCTORS 91 help 92 Enables Software Tag-Based KASAN. 93 94 Requires GCC 11+ or Clang. 95 96 Supported only on arm64 CPUs and relies on Top Byte Ignore. 97 98 Consumes about 1/16th of available memory at kernel start and 99 add an overhead of ~20% for dynamic allocations. 100 101 May potentially introduce problems related to pointer casting and 102 comparison, as it embeds a tag into the top byte of each pointer. 103 104 (Incompatible with CONFIG_DEBUG_SLAB: the kernel does not boot.) 105 106config KASAN_HW_TAGS 107 bool "Hardware Tag-Based KASAN" 108 depends on HAVE_ARCH_KASAN_HW_TAGS 109 depends on SLUB 110 help 111 Enables Hardware Tag-Based KASAN. 112 113 Requires GCC 10+ or Clang 12+. 114 115 Supported only on arm64 CPUs starting from ARMv8.5 and relies on 116 Memory Tagging Extension and Top Byte Ignore. 117 118 Consumes about 1/32nd of available memory. 119 120 May potentially introduce problems related to pointer casting and 121 comparison, as it embeds a tag into the top byte of each pointer. 122 123endchoice 124 125choice 126 prompt "Instrumentation type" 127 depends on KASAN_GENERIC || KASAN_SW_TAGS 128 default KASAN_OUTLINE 129 130config KASAN_OUTLINE 131 bool "Outline instrumentation" 132 help 133 Makes the compiler insert function calls that check whether the memory 134 is accessible before each memory access. Slower than KASAN_INLINE, but 135 does not bloat the size of the kernel's .text section so much. 136 137config KASAN_INLINE 138 bool "Inline instrumentation" 139 depends on !ARCH_DISABLE_KASAN_INLINE 140 help 141 Makes the compiler directly insert memory accessibility checks before 142 each memory access. Faster than KASAN_OUTLINE (gives ~x2 boost for 143 some workloads), but makes the kernel's .text size much bigger. 144 145endchoice 146 147config KASAN_STACK 148 bool "Stack instrumentation (unsafe)" if CC_IS_CLANG && !COMPILE_TEST 149 depends on KASAN_GENERIC || KASAN_SW_TAGS 150 depends on !ARCH_DISABLE_KASAN_INLINE 151 default y if CC_IS_GCC 152 help 153 Disables stack instrumentation and thus KASAN's ability to detect 154 out-of-bounds bugs in stack variables. 155 156 With Clang, stack instrumentation has a problem that causes excessive 157 stack usage, see https://bugs.llvm.org/show_bug.cgi?id=38809. Thus, 158 with Clang, this option is deemed unsafe. 159 160 This option is always disabled when compile-testing with Clang to 161 avoid cluttering the log with stack overflow warnings. 162 163 With GCC, enabling stack instrumentation is assumed to be safe. 164 165 If the architecture disables inline instrumentation via 166 ARCH_DISABLE_KASAN_INLINE, stack instrumentation gets disabled 167 as well, as it adds inline-style instrumentation that is run 168 unconditionally. 169 170config KASAN_VMALLOC 171 bool "Check accesses to vmalloc allocations" 172 depends on HAVE_ARCH_KASAN_VMALLOC 173 help 174 Makes KASAN check the validity of accesses to vmalloc allocations. 175 176 With software KASAN modes, all types vmalloc allocations are 177 checked. Enabling this option leads to higher memory usage. 178 179 With Hardware Tag-Based KASAN, only non-executable VM_ALLOC mappings 180 are checked. There is no additional memory usage. 181 182config KASAN_KUNIT_TEST 183 tristate "KUnit-compatible tests of KASAN bug detection capabilities" if !KUNIT_ALL_TESTS 184 depends on KASAN && KUNIT 185 default KUNIT_ALL_TESTS 186 help 187 A KUnit-based KASAN test suite. Triggers different kinds of 188 out-of-bounds and use-after-free accesses. Useful for testing whether 189 KASAN can detect certain bug types. 190 191 For more information on KUnit and unit tests in general, please refer 192 to the KUnit documentation in Documentation/dev-tools/kunit/. 193 194config KASAN_MODULE_TEST 195 tristate "KUnit-incompatible tests of KASAN bug detection capabilities" 196 depends on m && KASAN && !KASAN_HW_TAGS 197 help 198 A part of the KASAN test suite that is not integrated with KUnit. 199 Incompatible with Hardware Tag-Based KASAN. 200 201endif # KASAN 202