xref: /linux/lib/Kconfig.ubsan (revision 4f3c8320c78cdd11c8fdd23c33787407f719322e)
1# SPDX-License-Identifier: GPL-2.0-only
2config ARCH_HAS_UBSAN_SANITIZE_ALL
3	bool
4
5menuconfig UBSAN
6	bool "Undefined behaviour sanity checker"
7	help
8	  This option enables the Undefined Behaviour sanity checker.
9	  Compile-time instrumentation is used to detect various undefined
10	  behaviours at runtime. For more details, see:
11	  Documentation/dev-tools/ubsan.rst
12
13if UBSAN
14
15config UBSAN_TRAP
16	bool "On Sanitizer warnings, abort the running kernel code"
17	depends on !COMPILE_TEST
18	depends on $(cc-option, -fsanitize-undefined-trap-on-error)
19	help
20	  Building kernels with Sanitizer features enabled tends to grow
21	  the kernel size by around 5%, due to adding all the debugging
22	  text on failure paths. To avoid this, Sanitizer instrumentation
23	  can just issue a trap. This reduces the kernel size overhead but
24	  turns all warnings (including potentially harmless conditions)
25	  into full exceptions that abort the running kernel code
26	  (regardless of context, locks held, etc), which may destabilize
27	  the system. For some system builders this is an acceptable
28	  trade-off.
29
30config UBSAN_KCOV_BROKEN
31	def_bool KCOV && CC_HAS_SANCOV_TRACE_PC
32	depends on CC_IS_CLANG
33	depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=bounds -fsanitize-coverage=trace-pc)
34	help
35	  Some versions of clang support either UBSAN or KCOV but not the
36	  combination of the two.
37	  See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status
38	  in newer releases.
39
40config CC_HAS_UBSAN_BOUNDS
41	def_bool $(cc-option,-fsanitize=bounds)
42
43config CC_HAS_UBSAN_ARRAY_BOUNDS
44	def_bool $(cc-option,-fsanitize=array-bounds)
45
46config UBSAN_BOUNDS
47	bool "Perform array index bounds checking"
48	default UBSAN
49	depends on !UBSAN_KCOV_BROKEN
50	depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS
51	help
52	  This option enables detection of directly indexed out of bounds
53	  array accesses, where the array size is known at compile time.
54	  Note that this does not protect array overflows via bad calls
55	  to the {str,mem}*cpy() family of functions (that is addressed
56	  by CONFIG_FORTIFY_SOURCE).
57
58config UBSAN_ONLY_BOUNDS
59	def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS
60	depends on UBSAN_BOUNDS
61	help
62	  This is a weird case: Clang's -fsanitize=bounds includes
63	  -fsanitize=local-bounds, but it's trapping-only, so for
64	  Clang, we must use -fsanitize=array-bounds when we want
65	  traditional array bounds checking enabled. For GCC, we
66	  want -fsanitize=bounds.
67
68config UBSAN_ARRAY_BOUNDS
69	def_bool CC_HAS_UBSAN_ARRAY_BOUNDS
70	depends on UBSAN_BOUNDS
71
72config UBSAN_LOCAL_BOUNDS
73	bool "Perform array local bounds checking"
74	depends on UBSAN_TRAP
75	depends on !UBSAN_KCOV_BROKEN
76	depends on $(cc-option,-fsanitize=local-bounds)
77	help
78	  This option enables -fsanitize=local-bounds which traps when an
79	  exception/error is detected. Therefore, it may only be enabled
80	  with CONFIG_UBSAN_TRAP.
81
82	  Enabling this option detects errors due to accesses through a
83	  pointer that is derived from an object of a statically-known size,
84	  where an added offset (which may not be known statically) is
85	  out-of-bounds.
86
87config UBSAN_SHIFT
88	bool "Perform checking for bit-shift overflows"
89	default UBSAN
90	depends on $(cc-option,-fsanitize=shift)
91	help
92	  This option enables -fsanitize=shift which checks for bit-shift
93	  operations that overflow to the left or go switch to negative
94	  for signed types.
95
96config UBSAN_DIV_ZERO
97	bool "Perform checking for integer divide-by-zero"
98	depends on $(cc-option,-fsanitize=integer-divide-by-zero)
99	help
100	  This option enables -fsanitize=integer-divide-by-zero which checks
101	  for integer division by zero. This is effectively redundant with the
102	  kernel's existing exception handling, though it can provide greater
103	  debugging information under CONFIG_UBSAN_REPORT_FULL.
104
105config UBSAN_UNREACHABLE
106	bool "Perform checking for unreachable code"
107	# objtool already handles unreachable checking and gets angry about
108	# seeing UBSan instrumentation located in unreachable places.
109	depends on !STACK_VALIDATION
110	depends on $(cc-option,-fsanitize=unreachable)
111	help
112	  This option enables -fsanitize=unreachable which checks for control
113	  flow reaching an expected-to-be-unreachable position.
114
115config UBSAN_SIGNED_OVERFLOW
116	bool "Perform checking for signed arithmetic overflow"
117	default UBSAN
118	depends on $(cc-option,-fsanitize=signed-integer-overflow)
119	help
120	  This option enables -fsanitize=signed-integer-overflow which checks
121	  for overflow of any arithmetic operations with signed integers.
122
123config UBSAN_UNSIGNED_OVERFLOW
124	bool "Perform checking for unsigned arithmetic overflow"
125	depends on $(cc-option,-fsanitize=unsigned-integer-overflow)
126	help
127	  This option enables -fsanitize=unsigned-integer-overflow which checks
128	  for overflow of any arithmetic operations with unsigned integers. This
129	  currently causes x86 to fail to boot.
130
131config UBSAN_OBJECT_SIZE
132	bool "Perform checking for accesses beyond the end of objects"
133	default UBSAN
134	# gcc hugely expands stack usage with -fsanitize=object-size
135	# https://lore.kernel.org/lkml/CAHk-=wjPasyJrDuwDnpHJS2TuQfExwe=px-SzLeN8GFMAQJPmQ@mail.gmail.com/
136	depends on !CC_IS_GCC
137	depends on $(cc-option,-fsanitize=object-size)
138	help
139	  This option enables -fsanitize=object-size which checks for accesses
140	  beyond the end of objects where the optimizer can determine both the
141	  object being operated on and its size, usually seen with bad downcasts,
142	  or access to struct members from NULL pointers.
143
144config UBSAN_BOOL
145	bool "Perform checking for non-boolean values used as boolean"
146	default UBSAN
147	depends on $(cc-option,-fsanitize=bool)
148	help
149	  This option enables -fsanitize=bool which checks for boolean values being
150	  loaded that are neither 0 nor 1.
151
152config UBSAN_ENUM
153	bool "Perform checking for out of bounds enum values"
154	default UBSAN
155	depends on $(cc-option,-fsanitize=enum)
156	help
157	  This option enables -fsanitize=enum which checks for values being loaded
158	  into an enum that are outside the range of given values for the given enum.
159
160config UBSAN_ALIGNMENT
161	bool "Perform checking for misaligned pointer usage"
162	default !HAVE_EFFICIENT_UNALIGNED_ACCESS
163	depends on !UBSAN_TRAP && !COMPILE_TEST
164	depends on $(cc-option,-fsanitize=alignment)
165	help
166	  This option enables the check of unaligned memory accesses.
167	  Enabling this option on architectures that support unaligned
168	  accesses may produce a lot of false positives.
169
170config UBSAN_SANITIZE_ALL
171	bool "Enable instrumentation for the entire kernel"
172	depends on ARCH_HAS_UBSAN_SANITIZE_ALL
173	default y
174	help
175	  This option activates instrumentation for the entire kernel.
176	  If you don't enable this option, you have to explicitly specify
177	  UBSAN_SANITIZE := y for the files/directories you want to check for UB.
178	  Enabling this option will get kernel image size increased
179	  significantly.
180
181config TEST_UBSAN
182	tristate "Module for testing for undefined behavior detection"
183	depends on m
184	help
185	  This is a test module for UBSAN.
186	  It triggers various undefined behavior, and detect it.
187
188endif	# if UBSAN
189