1# SPDX-License-Identifier: GPL-2.0-only 2config ARCH_HAS_UBSAN_SANITIZE_ALL 3 bool 4 5menuconfig UBSAN 6 bool "Undefined behaviour sanity checker" 7 help 8 This option enables the Undefined Behaviour sanity checker. 9 Compile-time instrumentation is used to detect various undefined 10 behaviours at runtime. For more details, see: 11 Documentation/dev-tools/ubsan.rst 12 13if UBSAN 14 15config UBSAN_TRAP 16 bool "On Sanitizer warnings, abort the running kernel code" 17 depends on !COMPILE_TEST 18 depends on $(cc-option, -fsanitize-undefined-trap-on-error) 19 help 20 Building kernels with Sanitizer features enabled tends to grow 21 the kernel size by around 5%, due to adding all the debugging 22 text on failure paths. To avoid this, Sanitizer instrumentation 23 can just issue a trap. This reduces the kernel size overhead but 24 turns all warnings (including potentially harmless conditions) 25 into full exceptions that abort the running kernel code 26 (regardless of context, locks held, etc), which may destabilize 27 the system. For some system builders this is an acceptable 28 trade-off. 29 30config CC_HAS_UBSAN_BOUNDS 31 def_bool $(cc-option,-fsanitize=bounds) 32 33config CC_HAS_UBSAN_ARRAY_BOUNDS 34 def_bool $(cc-option,-fsanitize=array-bounds) 35 36config UBSAN_BOUNDS 37 bool "Perform array index bounds checking" 38 default UBSAN 39 depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS 40 help 41 This option enables detection of directly indexed out of bounds 42 array accesses, where the array size is known at compile time. 43 Note that this does not protect array overflows via bad calls 44 to the {str,mem}*cpy() family of functions (that is addressed 45 by CONFIG_FORTIFY_SOURCE). 46 47config UBSAN_ONLY_BOUNDS 48 def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS 49 depends on UBSAN_BOUNDS 50 help 51 This is a weird case: Clang's -fsanitize=bounds includes 52 -fsanitize=local-bounds, but it's trapping-only, so for 53 Clang, we must use -fsanitize=array-bounds when we want 54 traditional array bounds checking enabled. For GCC, we 55 want -fsanitize=bounds. 56 57config UBSAN_ARRAY_BOUNDS 58 def_bool CC_HAS_UBSAN_ARRAY_BOUNDS 59 depends on UBSAN_BOUNDS 60 61config UBSAN_LOCAL_BOUNDS 62 bool "Perform array local bounds checking" 63 depends on UBSAN_TRAP 64 depends on $(cc-option,-fsanitize=local-bounds) 65 help 66 This option enables -fsanitize=local-bounds which traps when an 67 exception/error is detected. Therefore, it may only be enabled 68 with CONFIG_UBSAN_TRAP. 69 70 Enabling this option detects errors due to accesses through a 71 pointer that is derived from an object of a statically-known size, 72 where an added offset (which may not be known statically) is 73 out-of-bounds. 74 75config UBSAN_SHIFT 76 bool "Perform checking for bit-shift overflows" 77 default UBSAN 78 depends on $(cc-option,-fsanitize=shift) 79 help 80 This option enables -fsanitize=shift which checks for bit-shift 81 operations that overflow to the left or go switch to negative 82 for signed types. 83 84config UBSAN_DIV_ZERO 85 bool "Perform checking for integer divide-by-zero" 86 depends on $(cc-option,-fsanitize=integer-divide-by-zero) 87 # https://github.com/ClangBuiltLinux/linux/issues/1657 88 # https://github.com/llvm/llvm-project/issues/56289 89 depends on !CC_IS_CLANG 90 help 91 This option enables -fsanitize=integer-divide-by-zero which checks 92 for integer division by zero. This is effectively redundant with the 93 kernel's existing exception handling, though it can provide greater 94 debugging information under CONFIG_UBSAN_REPORT_FULL. 95 96config UBSAN_UNREACHABLE 97 bool "Perform checking for unreachable code" 98 # objtool already handles unreachable checking and gets angry about 99 # seeing UBSan instrumentation located in unreachable places. 100 depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION)) 101 depends on $(cc-option,-fsanitize=unreachable) 102 help 103 This option enables -fsanitize=unreachable which checks for control 104 flow reaching an expected-to-be-unreachable position. 105 106config UBSAN_BOOL 107 bool "Perform checking for non-boolean values used as boolean" 108 default UBSAN 109 depends on $(cc-option,-fsanitize=bool) 110 help 111 This option enables -fsanitize=bool which checks for boolean values being 112 loaded that are neither 0 nor 1. 113 114config UBSAN_ENUM 115 bool "Perform checking for out of bounds enum values" 116 default UBSAN 117 depends on $(cc-option,-fsanitize=enum) 118 help 119 This option enables -fsanitize=enum which checks for values being loaded 120 into an enum that are outside the range of given values for the given enum. 121 122config UBSAN_ALIGNMENT 123 bool "Perform checking for misaligned pointer usage" 124 default !HAVE_EFFICIENT_UNALIGNED_ACCESS 125 depends on !UBSAN_TRAP && !COMPILE_TEST 126 depends on $(cc-option,-fsanitize=alignment) 127 help 128 This option enables the check of unaligned memory accesses. 129 Enabling this option on architectures that support unaligned 130 accesses may produce a lot of false positives. 131 132config UBSAN_SANITIZE_ALL 133 bool "Enable instrumentation for the entire kernel" 134 depends on ARCH_HAS_UBSAN_SANITIZE_ALL 135 default y 136 help 137 This option activates instrumentation for the entire kernel. 138 If you don't enable this option, you have to explicitly specify 139 UBSAN_SANITIZE := y for the files/directories you want to check for UB. 140 Enabling this option will get kernel image size increased 141 significantly. 142 143config TEST_UBSAN 144 tristate "Module for testing for undefined behavior detection" 145 depends on m 146 help 147 This is a test module for UBSAN. 148 It triggers various undefined behavior, and detect it. 149 150endif # if UBSAN 151