Kconfig.ubsan 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172
  1. # SPDX-License-Identifier: GPL-2.0-only
  2. config ARCH_HAS_UBSAN_SANITIZE_ALL
  3. bool
  4. menuconfig UBSAN
  5. bool "Undefined behaviour sanity checker"
  6. help
  7. This option enables the Undefined Behaviour sanity checker.
  8. Compile-time instrumentation is used to detect various undefined
  9. behaviours at runtime. For more details, see:
  10. Documentation/dev-tools/ubsan.rst
  11. if UBSAN
  12. config UBSAN_TRAP
  13. bool "On Sanitizer warnings, abort the running kernel code"
  14. depends on !COMPILE_TEST
  15. depends on $(cc-option, -fsanitize-undefined-trap-on-error)
  16. help
  17. Building kernels with Sanitizer features enabled tends to grow
  18. the kernel size by around 5%, due to adding all the debugging
  19. text on failure paths. To avoid this, Sanitizer instrumentation
  20. can just issue a trap. This reduces the kernel size overhead but
  21. turns all warnings (including potentially harmless conditions)
  22. into full exceptions that abort the running kernel code
  23. (regardless of context, locks held, etc), which may destabilize
  24. the system. For some system builders this is an acceptable
  25. trade-off.
  26. config UBSAN_KCOV_BROKEN
  27. def_bool KCOV && CC_HAS_SANCOV_TRACE_PC
  28. depends on CC_IS_CLANG
  29. depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=bounds -fsanitize-coverage=trace-pc)
  30. help
  31. Some versions of clang support either UBSAN or KCOV but not the
  32. combination of the two.
  33. See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status
  34. in newer releases.
  35. config CC_HAS_UBSAN_BOUNDS
  36. def_bool $(cc-option,-fsanitize=bounds)
  37. config CC_HAS_UBSAN_ARRAY_BOUNDS
  38. def_bool $(cc-option,-fsanitize=array-bounds)
  39. config UBSAN_BOUNDS
  40. bool "Perform array index bounds checking"
  41. default UBSAN
  42. depends on !UBSAN_KCOV_BROKEN
  43. depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS
  44. help
  45. This option enables detection of directly indexed out of bounds
  46. array accesses, where the array size is known at compile time.
  47. Note that this does not protect array overflows via bad calls
  48. to the {str,mem}*cpy() family of functions (that is addressed
  49. by CONFIG_FORTIFY_SOURCE).
  50. config UBSAN_ONLY_BOUNDS
  51. def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS
  52. depends on UBSAN_BOUNDS
  53. help
  54. This is a weird case: Clang's -fsanitize=bounds includes
  55. -fsanitize=local-bounds, but it's trapping-only, so for
  56. Clang, we must use -fsanitize=array-bounds when we want
  57. traditional array bounds checking enabled. For GCC, we
  58. want -fsanitize=bounds.
  59. config UBSAN_ARRAY_BOUNDS
  60. def_bool CC_HAS_UBSAN_ARRAY_BOUNDS
  61. depends on UBSAN_BOUNDS
  62. config UBSAN_LOCAL_BOUNDS
  63. bool "Perform array local bounds checking"
  64. depends on UBSAN_TRAP
  65. depends on !UBSAN_KCOV_BROKEN
  66. depends on $(cc-option,-fsanitize=local-bounds)
  67. help
  68. This option enables -fsanitize=local-bounds which traps when an
  69. exception/error is detected. Therefore, it may only be enabled
  70. with CONFIG_UBSAN_TRAP.
  71. Enabling this option detects errors due to accesses through a
  72. pointer that is derived from an object of a statically-known size,
  73. where an added offset (which may not be known statically) is
  74. out-of-bounds.
  75. config UBSAN_SHIFT
  76. bool "Perform checking for bit-shift overflows"
  77. default UBSAN
  78. depends on $(cc-option,-fsanitize=shift)
  79. help
  80. This option enables -fsanitize=shift which checks for bit-shift
  81. operations that overflow to the left or go switch to negative
  82. for signed types.
  83. config UBSAN_DIV_ZERO
  84. bool "Perform checking for integer divide-by-zero"
  85. depends on $(cc-option,-fsanitize=integer-divide-by-zero)
  86. help
  87. This option enables -fsanitize=integer-divide-by-zero which checks
  88. for integer division by zero. This is effectively redundant with the
  89. kernel's existing exception handling, though it can provide greater
  90. debugging information under CONFIG_UBSAN_REPORT_FULL.
  91. config UBSAN_UNREACHABLE
  92. bool "Perform checking for unreachable code"
  93. # objtool already handles unreachable checking and gets angry about
  94. # seeing UBSan instrumentation located in unreachable places.
  95. depends on !STACK_VALIDATION
  96. depends on $(cc-option,-fsanitize=unreachable)
  97. help
  98. This option enables -fsanitize=unreachable which checks for control
  99. flow reaching an expected-to-be-unreachable position.
  100. config UBSAN_OBJECT_SIZE
  101. bool "Perform checking for accesses beyond the end of objects"
  102. default UBSAN
  103. # gcc hugely expands stack usage with -fsanitize=object-size
  104. # https://lore.kernel.org/lkml/CAHk-=wjPasyJrDuwDnpHJS2TuQfExwe=px-SzLeN8GFMAQJPmQ@mail.gmail.com/
  105. depends on !CC_IS_GCC
  106. depends on $(cc-option,-fsanitize=object-size)
  107. help
  108. This option enables -fsanitize=object-size which checks for accesses
  109. beyond the end of objects where the optimizer can determine both the
  110. object being operated on and its size, usually seen with bad downcasts,
  111. or access to struct members from NULL pointers.
  112. config UBSAN_BOOL
  113. bool "Perform checking for non-boolean values used as boolean"
  114. default UBSAN
  115. depends on $(cc-option,-fsanitize=bool)
  116. help
  117. This option enables -fsanitize=bool which checks for boolean values being
  118. loaded that are neither 0 nor 1.
  119. config UBSAN_ENUM
  120. bool "Perform checking for out of bounds enum values"
  121. default UBSAN
  122. depends on $(cc-option,-fsanitize=enum)
  123. help
  124. This option enables -fsanitize=enum which checks for values being loaded
  125. into an enum that are outside the range of given values for the given enum.
  126. config UBSAN_ALIGNMENT
  127. bool "Perform checking for misaligned pointer usage"
  128. default !HAVE_EFFICIENT_UNALIGNED_ACCESS
  129. depends on !UBSAN_TRAP && !COMPILE_TEST
  130. depends on $(cc-option,-fsanitize=alignment)
  131. help
  132. This option enables the check of unaligned memory accesses.
  133. Enabling this option on architectures that support unaligned
  134. accesses may produce a lot of false positives.
  135. config UBSAN_SANITIZE_ALL
  136. bool "Enable instrumentation for the entire kernel"
  137. depends on ARCH_HAS_UBSAN_SANITIZE_ALL
  138. default y
  139. help
  140. This option activates instrumentation for the entire kernel.
  141. If you don't enable this option, you have to explicitly specify
  142. UBSAN_SANITIZE := y for the files/directories you want to check for UB.
  143. Enabling this option will get kernel image size increased
  144. significantly.
  145. config TEST_UBSAN
  146. tristate "Module for testing for undefined behavior detection"
  147. depends on m
  148. help
  149. This is a test module for UBSAN.
  150. It triggers various undefined behavior, and detect it.
  151. endif # if UBSAN