xref: /openbmc/linux/lib/Kconfig.ubsan (revision fb3bd914)
1# SPDX-License-Identifier: GPL-2.0-only
2config ARCH_HAS_UBSAN_SANITIZE_ALL
3	bool
4
5menuconfig UBSAN
6	bool "Undefined behaviour sanity checker"
7	help
8	  This option enables the Undefined Behaviour sanity checker.
9	  Compile-time instrumentation is used to detect various undefined
10	  behaviours at runtime. For more details, see:
11	  Documentation/dev-tools/ubsan.rst
12
13if UBSAN
14
15config UBSAN_TRAP
16	bool "On Sanitizer warnings, abort the running kernel code"
17	depends on !COMPILE_TEST
18	help
19	  Building kernels with Sanitizer features enabled tends to grow
20	  the kernel size by around 5%, due to adding all the debugging
21	  text on failure paths. To avoid this, Sanitizer instrumentation
22	  can just issue a trap. This reduces the kernel size overhead but
23	  turns all warnings (including potentially harmless conditions)
24	  into full exceptions that abort the running kernel code
25	  (regardless of context, locks held, etc), which may destabilize
26	  the system. For some system builders this is an acceptable
27	  trade-off.
28
29config CC_HAS_UBSAN_BOUNDS_STRICT
30	def_bool $(cc-option,-fsanitize=bounds-strict)
31	help
32	  The -fsanitize=bounds-strict option is only available on GCC,
33	  but uses the more strict handling of arrays that includes knowledge
34	  of flexible arrays, which is comparable to Clang's regular
35	  -fsanitize=bounds.
36
37config CC_HAS_UBSAN_ARRAY_BOUNDS
38	def_bool $(cc-option,-fsanitize=array-bounds)
39	help
40	  Under Clang, the -fsanitize=bounds option is actually composed
41	  of two more specific options, -fsanitize=array-bounds and
42	  -fsanitize=local-bounds. However, -fsanitize=local-bounds can
43	  only be used when trap mode is enabled. (See also the help for
44	  CONFIG_LOCAL_BOUNDS.) Explicitly check for -fsanitize=array-bounds
45	  so that we can build up the options needed for UBSAN_BOUNDS
46	  with or without UBSAN_TRAP.
47
48config UBSAN_BOUNDS
49	bool "Perform array index bounds checking"
50	default UBSAN
51	depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS_STRICT
52	help
53	  This option enables detection of directly indexed out of bounds
54	  array accesses, where the array size is known at compile time.
55	  Note that this does not protect array overflows via bad calls
56	  to the {str,mem}*cpy() family of functions (that is addressed
57	  by CONFIG_FORTIFY_SOURCE).
58
59config UBSAN_BOUNDS_STRICT
60	def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_BOUNDS_STRICT
61	help
62	  GCC's bounds sanitizer. This option is used to select the
63	  correct options in Makefile.ubsan.
64
65config UBSAN_ARRAY_BOUNDS
66	def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_ARRAY_BOUNDS
67	help
68	  Clang's array bounds sanitizer. This option is used to select
69	  the correct options in Makefile.ubsan.
70
71config UBSAN_LOCAL_BOUNDS
72	def_bool UBSAN_ARRAY_BOUNDS && UBSAN_TRAP
73	help
74	  This option enables Clang's -fsanitize=local-bounds which traps
75	  when an access through a pointer that is derived from an object
76	  of a statically-known size, where an added offset (which may not
77	  be known statically) is out-of-bounds. Since this option is
78	  trap-only, it depends on CONFIG_UBSAN_TRAP.
79
80config UBSAN_SHIFT
81	bool "Perform checking for bit-shift overflows"
82	default UBSAN
83	depends on $(cc-option,-fsanitize=shift)
84	help
85	  This option enables -fsanitize=shift which checks for bit-shift
86	  operations that overflow to the left or go switch to negative
87	  for signed types.
88
89config UBSAN_DIV_ZERO
90	bool "Perform checking for integer divide-by-zero"
91	depends on $(cc-option,-fsanitize=integer-divide-by-zero)
92	# https://github.com/ClangBuiltLinux/linux/issues/1657
93	# https://github.com/llvm/llvm-project/issues/56289
94	depends on !CC_IS_CLANG
95	help
96	  This option enables -fsanitize=integer-divide-by-zero which checks
97	  for integer division by zero. This is effectively redundant with the
98	  kernel's existing exception handling, though it can provide greater
99	  debugging information under CONFIG_UBSAN_REPORT_FULL.
100
101config UBSAN_UNREACHABLE
102	bool "Perform checking for unreachable code"
103	# objtool already handles unreachable checking and gets angry about
104	# seeing UBSan instrumentation located in unreachable places.
105	depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION))
106	depends on $(cc-option,-fsanitize=unreachable)
107	help
108	  This option enables -fsanitize=unreachable which checks for control
109	  flow reaching an expected-to-be-unreachable position.
110
111config UBSAN_BOOL
112	bool "Perform checking for non-boolean values used as boolean"
113	default UBSAN
114	depends on $(cc-option,-fsanitize=bool)
115	help
116	  This option enables -fsanitize=bool which checks for boolean values being
117	  loaded that are neither 0 nor 1.
118
119config UBSAN_ENUM
120	bool "Perform checking for out of bounds enum values"
121	default UBSAN
122	depends on $(cc-option,-fsanitize=enum)
123	help
124	  This option enables -fsanitize=enum which checks for values being loaded
125	  into an enum that are outside the range of given values for the given enum.
126
127config UBSAN_ALIGNMENT
128	bool "Perform checking for misaligned pointer usage"
129	default !HAVE_EFFICIENT_UNALIGNED_ACCESS
130	depends on !UBSAN_TRAP && !COMPILE_TEST
131	depends on $(cc-option,-fsanitize=alignment)
132	help
133	  This option enables the check of unaligned memory accesses.
134	  Enabling this option on architectures that support unaligned
135	  accesses may produce a lot of false positives.
136
137config UBSAN_SANITIZE_ALL
138	bool "Enable instrumentation for the entire kernel"
139	depends on ARCH_HAS_UBSAN_SANITIZE_ALL
140	default y
141	help
142	  This option activates instrumentation for the entire kernel.
143	  If you don't enable this option, you have to explicitly specify
144	  UBSAN_SANITIZE := y for the files/directories you want to check for UB.
145	  Enabling this option will get kernel image size increased
146	  significantly.
147
148config TEST_UBSAN
149	tristate "Module for testing for undefined behavior detection"
150	depends on m
151	help
152	  This is a test module for UBSAN.
153	  It triggers various undefined behavior, and detect it.
154
155endif	# if UBSAN
156