1# SPDX-License-Identifier: GPL-2.0-only 2config ARCH_HAS_UBSAN_SANITIZE_ALL 3 bool 4 5menuconfig UBSAN 6 bool "Undefined behaviour sanity checker" 7 help 8 This option enables the Undefined Behaviour sanity checker. 9 Compile-time instrumentation is used to detect various undefined 10 behaviours at runtime. For more details, see: 11 Documentation/dev-tools/ubsan.rst 12 13if UBSAN 14 15config UBSAN_TRAP 16 bool "On Sanitizer warnings, abort the running kernel code" 17 depends on !COMPILE_TEST 18 depends on $(cc-option, -fsanitize-undefined-trap-on-error) 19 help 20 Building kernels with Sanitizer features enabled tends to grow 21 the kernel size by around 5%, due to adding all the debugging 22 text on failure paths. To avoid this, Sanitizer instrumentation 23 can just issue a trap. This reduces the kernel size overhead but 24 turns all warnings (including potentially harmless conditions) 25 into full exceptions that abort the running kernel code 26 (regardless of context, locks held, etc), which may destabilize 27 the system. For some system builders this is an acceptable 28 trade-off. 29 30config UBSAN_KCOV_BROKEN 31 def_bool KCOV && CC_HAS_SANCOV_TRACE_PC 32 depends on CC_IS_CLANG 33 depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=bounds -fsanitize-coverage=trace-pc) 34 help 35 Some versions of clang support either UBSAN or KCOV but not the 36 combination of the two. 37 See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status 38 in newer releases. 39 40config CC_HAS_UBSAN_BOUNDS 41 def_bool $(cc-option,-fsanitize=bounds) 42 43config CC_HAS_UBSAN_ARRAY_BOUNDS 44 def_bool $(cc-option,-fsanitize=array-bounds) 45 46config UBSAN_BOUNDS 47 bool "Perform array index bounds checking" 48 default UBSAN 49 depends on !UBSAN_KCOV_BROKEN 50 depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS 51 help 52 This option enables detection of directly indexed out of bounds 53 array accesses, where the array size is known at compile time. 54 Note that this does not protect array overflows via bad calls 55 to the {str,mem}*cpy() family of functions (that is addressed 56 by CONFIG_FORTIFY_SOURCE). 57 58config UBSAN_ONLY_BOUNDS 59 def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS 60 depends on UBSAN_BOUNDS 61 help 62 This is a weird case: Clang's -fsanitize=bounds includes 63 -fsanitize=local-bounds, but it's trapping-only, so for 64 Clang, we must use -fsanitize=array-bounds when we want 65 traditional array bounds checking enabled. For GCC, we 66 want -fsanitize=bounds. 67 68config UBSAN_ARRAY_BOUNDS 69 def_bool CC_HAS_UBSAN_ARRAY_BOUNDS 70 depends on UBSAN_BOUNDS 71 72config UBSAN_LOCAL_BOUNDS 73 bool "Perform array local bounds checking" 74 depends on UBSAN_TRAP 75 depends on !UBSAN_KCOV_BROKEN 76 depends on $(cc-option,-fsanitize=local-bounds) 77 help 78 This option enables -fsanitize=local-bounds which traps when an 79 exception/error is detected. Therefore, it may only be enabled 80 with CONFIG_UBSAN_TRAP. 81 82 Enabling this option detects errors due to accesses through a 83 pointer that is derived from an object of a statically-known size, 84 where an added offset (which may not be known statically) is 85 out-of-bounds. 86 87config UBSAN_SHIFT 88 bool "Perform checking for bit-shift overflows" 89 default UBSAN 90 depends on $(cc-option,-fsanitize=shift) 91 help 92 This option enables -fsanitize=shift which checks for bit-shift 93 operations that overflow to the left or go switch to negative 94 for signed types. 95 96config UBSAN_DIV_ZERO 97 bool "Perform checking for integer divide-by-zero" 98 depends on $(cc-option,-fsanitize=integer-divide-by-zero) 99 help 100 This option enables -fsanitize=integer-divide-by-zero which checks 101 for integer division by zero. This is effectively redundant with the 102 kernel's existing exception handling, though it can provide greater 103 debugging information under CONFIG_UBSAN_REPORT_FULL. 104 105config UBSAN_UNREACHABLE 106 bool "Perform checking for unreachable code" 107 # objtool already handles unreachable checking and gets angry about 108 # seeing UBSan instrumentation located in unreachable places. 109 depends on !STACK_VALIDATION 110 depends on $(cc-option,-fsanitize=unreachable) 111 help 112 This option enables -fsanitize=unreachable which checks for control 113 flow reaching an expected-to-be-unreachable position. 114 115config UBSAN_SIGNED_OVERFLOW 116 bool "Perform checking for signed arithmetic overflow" 117 default UBSAN 118 depends on $(cc-option,-fsanitize=signed-integer-overflow) 119 help 120 This option enables -fsanitize=signed-integer-overflow which checks 121 for overflow of any arithmetic operations with signed integers. 122 123config UBSAN_UNSIGNED_OVERFLOW 124 bool "Perform checking for unsigned arithmetic overflow" 125 depends on $(cc-option,-fsanitize=unsigned-integer-overflow) 126 depends on !X86_32 # avoid excessive stack usage on x86-32/clang 127 help 128 This option enables -fsanitize=unsigned-integer-overflow which checks 129 for overflow of any arithmetic operations with unsigned integers. This 130 currently causes x86 to fail to boot. 131 132config UBSAN_OBJECT_SIZE 133 bool "Perform checking for accesses beyond the end of objects" 134 default UBSAN 135 # gcc hugely expands stack usage with -fsanitize=object-size 136 # https://lore.kernel.org/lkml/CAHk-=wjPasyJrDuwDnpHJS2TuQfExwe=px-SzLeN8GFMAQJPmQ@mail.gmail.com/ 137 depends on !CC_IS_GCC 138 depends on $(cc-option,-fsanitize=object-size) 139 help 140 This option enables -fsanitize=object-size which checks for accesses 141 beyond the end of objects where the optimizer can determine both the 142 object being operated on and its size, usually seen with bad downcasts, 143 or access to struct members from NULL pointers. 144 145config UBSAN_BOOL 146 bool "Perform checking for non-boolean values used as boolean" 147 default UBSAN 148 depends on $(cc-option,-fsanitize=bool) 149 help 150 This option enables -fsanitize=bool which checks for boolean values being 151 loaded that are neither 0 nor 1. 152 153config UBSAN_ENUM 154 bool "Perform checking for out of bounds enum values" 155 default UBSAN 156 depends on $(cc-option,-fsanitize=enum) 157 help 158 This option enables -fsanitize=enum which checks for values being loaded 159 into an enum that are outside the range of given values for the given enum. 160 161config UBSAN_ALIGNMENT 162 bool "Perform checking for misaligned pointer usage" 163 default !HAVE_EFFICIENT_UNALIGNED_ACCESS 164 depends on !UBSAN_TRAP && !COMPILE_TEST 165 depends on $(cc-option,-fsanitize=alignment) 166 help 167 This option enables the check of unaligned memory accesses. 168 Enabling this option on architectures that support unaligned 169 accesses may produce a lot of false positives. 170 171config UBSAN_SANITIZE_ALL 172 bool "Enable instrumentation for the entire kernel" 173 depends on ARCH_HAS_UBSAN_SANITIZE_ALL 174 default y 175 help 176 This option activates instrumentation for the entire kernel. 177 If you don't enable this option, you have to explicitly specify 178 UBSAN_SANITIZE := y for the files/directories you want to check for UB. 179 Enabling this option will get kernel image size increased 180 significantly. 181 182config TEST_UBSAN 183 tristate "Module for testing for undefined behavior detection" 184 depends on m 185 help 186 This is a test module for UBSAN. 187 It triggers various undefined behavior, and detect it. 188 189endif # if UBSAN 190