1# SPDX-License-Identifier: GPL-2.0-only 2config ARCH_HAS_UBSAN 3 bool 4 5menuconfig UBSAN 6 bool "Undefined behaviour sanity checker" 7 depends on ARCH_HAS_UBSAN 8 help 9 This option enables the Undefined Behaviour sanity checker. 10 Compile-time instrumentation is used to detect various undefined 11 behaviours at runtime. For more details, see: 12 Documentation/dev-tools/ubsan.rst 13 14if UBSAN 15 16config UBSAN_TRAP 17 bool "Abort on Sanitizer warnings (smaller kernel but less verbose)" 18 depends on !COMPILE_TEST 19 help 20 Building kernels with Sanitizer features enabled tends to grow 21 the kernel size by around 5%, due to adding all the debugging 22 text on failure paths. To avoid this, Sanitizer instrumentation 23 can just issue a trap. This reduces the kernel size overhead but 24 turns all warnings (including potentially harmless conditions) 25 into full exceptions that abort the running kernel code 26 (regardless of context, locks held, etc), which may destabilize 27 the system. For some system builders this is an acceptable 28 trade-off. 29 30 Also note that selecting Y will cause your kernel to Oops 31 with an "illegal instruction" error with no further details 32 when a UBSAN violation occurs. (Except on arm64 and x86, which 33 will report which Sanitizer failed.) This may make it hard to 34 determine whether an Oops was caused by UBSAN or to figure 35 out the details of a UBSAN violation. It makes the kernel log 36 output less useful for bug reports. 37 38config CC_HAS_UBSAN_BOUNDS_STRICT 39 def_bool $(cc-option,-fsanitize=bounds-strict) 40 help 41 The -fsanitize=bounds-strict option is only available on GCC, 42 but uses the more strict handling of arrays that includes knowledge 43 of flexible arrays, which is comparable to Clang's regular 44 -fsanitize=bounds. 45 46config CC_HAS_UBSAN_ARRAY_BOUNDS 47 def_bool $(cc-option,-fsanitize=array-bounds) 48 help 49 Under Clang, the -fsanitize=bounds option is actually composed 50 of two more specific options, -fsanitize=array-bounds and 51 -fsanitize=local-bounds. However, -fsanitize=local-bounds can 52 only be used when trap mode is enabled. (See also the help for 53 CONFIG_LOCAL_BOUNDS.) Explicitly check for -fsanitize=array-bounds 54 so that we can build up the options needed for UBSAN_BOUNDS 55 with or without UBSAN_TRAP. 56 57config UBSAN_BOUNDS 58 bool "Perform array index bounds checking" 59 default UBSAN 60 depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS_STRICT 61 help 62 This option enables detection of directly indexed out of bounds 63 array accesses, where the array size is known at compile time. 64 Note that this does not protect array overflows via bad calls 65 to the {str,mem}*cpy() family of functions (that is addressed 66 by CONFIG_FORTIFY_SOURCE). 67 68config UBSAN_BOUNDS_STRICT 69 def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_BOUNDS_STRICT 70 help 71 GCC's bounds sanitizer. This option is used to select the 72 correct options in Makefile.ubsan. 73 74config UBSAN_ARRAY_BOUNDS 75 def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_ARRAY_BOUNDS 76 help 77 Clang's array bounds sanitizer. This option is used to select 78 the correct options in Makefile.ubsan. 79 80config UBSAN_LOCAL_BOUNDS 81 def_bool UBSAN_ARRAY_BOUNDS && UBSAN_TRAP 82 help 83 This option enables Clang's -fsanitize=local-bounds which traps 84 when an access through a pointer that is derived from an object 85 of a statically-known size, where an added offset (which may not 86 be known statically) is out-of-bounds. Since this option is 87 trap-only, it depends on CONFIG_UBSAN_TRAP. 88 89config UBSAN_SHIFT 90 bool "Perform checking for bit-shift overflows" 91 depends on $(cc-option,-fsanitize=shift) 92 help 93 This option enables -fsanitize=shift which checks for bit-shift 94 operations that overflow to the left or go switch to negative 95 for signed types. 96 97config UBSAN_DIV_ZERO 98 bool "Perform checking for integer divide-by-zero" 99 depends on $(cc-option,-fsanitize=integer-divide-by-zero) 100 # https://github.com/ClangBuiltLinux/linux/issues/1657 101 # https://github.com/llvm/llvm-project/issues/56289 102 depends on !CC_IS_CLANG 103 help 104 This option enables -fsanitize=integer-divide-by-zero which checks 105 for integer division by zero. This is effectively redundant with the 106 kernel's existing exception handling, though it can provide greater 107 debugging information under CONFIG_UBSAN_REPORT_FULL. 108 109config UBSAN_UNREACHABLE 110 bool "Perform checking for unreachable code" 111 # objtool already handles unreachable checking and gets angry about 112 # seeing UBSan instrumentation located in unreachable places. 113 depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION)) 114 depends on $(cc-option,-fsanitize=unreachable) 115 help 116 This option enables -fsanitize=unreachable which checks for control 117 flow reaching an expected-to-be-unreachable position. 118 119config UBSAN_INTEGER_WRAP 120 bool "Perform checking for integer arithmetic wrap-around" 121 # This is very experimental so drop the next line if you really want it 122 depends on BROKEN 123 depends on !COMPILE_TEST 124 depends on $(cc-option,-fsanitize-undefined-ignore-overflow-pattern=all) 125 depends on $(cc-option,-fsanitize=signed-integer-overflow) 126 depends on $(cc-option,-fsanitize=unsigned-integer-overflow) 127 depends on $(cc-option,-fsanitize=implicit-signed-integer-truncation) 128 depends on $(cc-option,-fsanitize=implicit-unsigned-integer-truncation) 129 depends on $(cc-option,-fsanitize-ignorelist=/dev/null) 130 help 131 This option enables all of the sanitizers involved in integer overflow 132 (wrap-around) mitigation: signed-integer-overflow, unsigned-integer-overflow, 133 implicit-signed-integer-truncation, and implicit-unsigned-integer-truncation. 134 This is currently limited only to the size_t type while testing and 135 compiler development continues. 136 137config UBSAN_BOOL 138 bool "Perform checking for non-boolean values used as boolean" 139 default UBSAN 140 depends on $(cc-option,-fsanitize=bool) 141 help 142 This option enables -fsanitize=bool which checks for boolean values being 143 loaded that are neither 0 nor 1. 144 145config UBSAN_ENUM 146 bool "Perform checking for out of bounds enum values" 147 default UBSAN 148 depends on $(cc-option,-fsanitize=enum) 149 help 150 This option enables -fsanitize=enum which checks for values being loaded 151 into an enum that are outside the range of given values for the given enum. 152 153config UBSAN_ALIGNMENT 154 bool "Perform checking for misaligned pointer usage" 155 default !HAVE_EFFICIENT_UNALIGNED_ACCESS 156 depends on !UBSAN_TRAP && !COMPILE_TEST 157 depends on $(cc-option,-fsanitize=alignment) 158 help 159 This option enables the check of unaligned memory accesses. 160 Enabling this option on architectures that support unaligned 161 accesses may produce a lot of false positives. 162 163config TEST_UBSAN 164 tristate "Module for testing for undefined behavior detection" 165 depends on m 166 help 167 This is a test module for UBSAN. 168 It triggers various undefined behavior, and detect it. 169 170config UBSAN_KVM_EL2 171 bool "UBSAN for KVM code at EL2" 172 depends on ARM64 173 help 174 Enable UBSAN when running on ARM64 with KVM in a split mode 175 (nvhe/hvhe/protected) for the hypervisor code running in EL2. 176 In this mode, any UBSAN violation in EL2 would panic the kernel 177 and information similar to UBSAN_TRAP would be printed. 178 179endif # if UBSAN 180