1# SPDX-License-Identifier: GPL-2.0-only 2config ARCH_HAS_UBSAN 3 bool 4 5menuconfig UBSAN 6 bool "Undefined behaviour sanity checker" 7 help 8 This option enables the Undefined Behaviour sanity checker. 9 Compile-time instrumentation is used to detect various undefined 10 behaviours at runtime. For more details, see: 11 Documentation/dev-tools/ubsan.rst 12 13if UBSAN 14 15config UBSAN_TRAP 16 bool "Abort on Sanitizer warnings (smaller kernel but less verbose)" 17 depends on !COMPILE_TEST 18 help 19 Building kernels with Sanitizer features enabled tends to grow 20 the kernel size by around 5%, due to adding all the debugging 21 text on failure paths. To avoid this, Sanitizer instrumentation 22 can just issue a trap. This reduces the kernel size overhead but 23 turns all warnings (including potentially harmless conditions) 24 into full exceptions that abort the running kernel code 25 (regardless of context, locks held, etc), which may destabilize 26 the system. For some system builders this is an acceptable 27 trade-off. 28 29 Also note that selecting Y will cause your kernel to Oops 30 with an "illegal instruction" error with no further details 31 when a UBSAN violation occurs. (Except on arm64, which will 32 report which Sanitizer failed.) This may make it hard to 33 determine whether an Oops was caused by UBSAN or to figure 34 out the details of a UBSAN violation. It makes the kernel log 35 output less useful for bug reports. 36 37config CC_HAS_UBSAN_BOUNDS_STRICT 38 def_bool $(cc-option,-fsanitize=bounds-strict) 39 help 40 The -fsanitize=bounds-strict option is only available on GCC, 41 but uses the more strict handling of arrays that includes knowledge 42 of flexible arrays, which is comparable to Clang's regular 43 -fsanitize=bounds. 44 45config CC_HAS_UBSAN_ARRAY_BOUNDS 46 def_bool $(cc-option,-fsanitize=array-bounds) 47 help 48 Under Clang, the -fsanitize=bounds option is actually composed 49 of two more specific options, -fsanitize=array-bounds and 50 -fsanitize=local-bounds. However, -fsanitize=local-bounds can 51 only be used when trap mode is enabled. (See also the help for 52 CONFIG_LOCAL_BOUNDS.) Explicitly check for -fsanitize=array-bounds 53 so that we can build up the options needed for UBSAN_BOUNDS 54 with or without UBSAN_TRAP. 55 56config UBSAN_BOUNDS 57 bool "Perform array index bounds checking" 58 default UBSAN 59 depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS_STRICT 60 help 61 This option enables detection of directly indexed out of bounds 62 array accesses, where the array size is known at compile time. 63 Note that this does not protect array overflows via bad calls 64 to the {str,mem}*cpy() family of functions (that is addressed 65 by CONFIG_FORTIFY_SOURCE). 66 67config UBSAN_BOUNDS_STRICT 68 def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_BOUNDS_STRICT 69 help 70 GCC's bounds sanitizer. This option is used to select the 71 correct options in Makefile.ubsan. 72 73config UBSAN_ARRAY_BOUNDS 74 def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_ARRAY_BOUNDS 75 help 76 Clang's array bounds sanitizer. This option is used to select 77 the correct options in Makefile.ubsan. 78 79config UBSAN_LOCAL_BOUNDS 80 def_bool UBSAN_ARRAY_BOUNDS && UBSAN_TRAP 81 help 82 This option enables Clang's -fsanitize=local-bounds which traps 83 when an access through a pointer that is derived from an object 84 of a statically-known size, where an added offset (which may not 85 be known statically) is out-of-bounds. Since this option is 86 trap-only, it depends on CONFIG_UBSAN_TRAP. 87 88config UBSAN_SHIFT 89 bool "Perform checking for bit-shift overflows" 90 depends on $(cc-option,-fsanitize=shift) 91 help 92 This option enables -fsanitize=shift which checks for bit-shift 93 operations that overflow to the left or go switch to negative 94 for signed types. 95 96config UBSAN_DIV_ZERO 97 bool "Perform checking for integer divide-by-zero" 98 depends on $(cc-option,-fsanitize=integer-divide-by-zero) 99 # https://github.com/ClangBuiltLinux/linux/issues/1657 100 # https://github.com/llvm/llvm-project/issues/56289 101 depends on !CC_IS_CLANG 102 help 103 This option enables -fsanitize=integer-divide-by-zero which checks 104 for integer division by zero. This is effectively redundant with the 105 kernel's existing exception handling, though it can provide greater 106 debugging information under CONFIG_UBSAN_REPORT_FULL. 107 108config UBSAN_UNREACHABLE 109 bool "Perform checking for unreachable code" 110 # objtool already handles unreachable checking and gets angry about 111 # seeing UBSan instrumentation located in unreachable places. 112 depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION)) 113 depends on $(cc-option,-fsanitize=unreachable) 114 help 115 This option enables -fsanitize=unreachable which checks for control 116 flow reaching an expected-to-be-unreachable position. 117 118config UBSAN_SIGNED_WRAP 119 bool "Perform checking for signed arithmetic wrap-around" 120 default UBSAN 121 depends on !COMPILE_TEST 122 # The no_sanitize attribute was introduced in GCC with version 8. 123 depends on !CC_IS_GCC || GCC_VERSION >= 80000 124 depends on $(cc-option,-fsanitize=signed-integer-overflow) 125 help 126 This option enables -fsanitize=signed-integer-overflow which checks 127 for wrap-around of any arithmetic operations with signed integers. 128 This currently performs nearly no instrumentation due to the 129 kernel's use of -fno-strict-overflow which converts all would-be 130 arithmetic undefined behavior into wrap-around arithmetic. Future 131 sanitizer versions will allow for wrap-around checking (rather than 132 exclusively undefined behavior). 133 134config UBSAN_BOOL 135 bool "Perform checking for non-boolean values used as boolean" 136 default UBSAN 137 depends on $(cc-option,-fsanitize=bool) 138 help 139 This option enables -fsanitize=bool which checks for boolean values being 140 loaded that are neither 0 nor 1. 141 142config UBSAN_ENUM 143 bool "Perform checking for out of bounds enum values" 144 default UBSAN 145 depends on $(cc-option,-fsanitize=enum) 146 help 147 This option enables -fsanitize=enum which checks for values being loaded 148 into an enum that are outside the range of given values for the given enum. 149 150config UBSAN_ALIGNMENT 151 bool "Perform checking for misaligned pointer usage" 152 default !HAVE_EFFICIENT_UNALIGNED_ACCESS 153 depends on !UBSAN_TRAP && !COMPILE_TEST 154 depends on $(cc-option,-fsanitize=alignment) 155 help 156 This option enables the check of unaligned memory accesses. 157 Enabling this option on architectures that support unaligned 158 accesses may produce a lot of false positives. 159 160config TEST_UBSAN 161 tristate "Module for testing for undefined behavior detection" 162 depends on m 163 help 164 This is a test module for UBSAN. 165 It triggers various undefined behavior, and detect it. 166 167endif # if UBSAN 168