1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only 2918327e9SKees Cookconfig ARCH_HAS_UBSAN 3c6d30853SAndrey Ryabinin bool 4c6d30853SAndrey Ryabinin 5277a1085SKees Cookmenuconfig UBSAN 6c6d30853SAndrey Ryabinin bool "Undefined behaviour sanity checker" 7890a6481SKees Cook depends on ARCH_HAS_UBSAN 8c6d30853SAndrey Ryabinin help 90887a7ebSKees Cook This option enables the Undefined Behaviour sanity checker. 10c6d30853SAndrey Ryabinin Compile-time instrumentation is used to detect various undefined 110887a7ebSKees Cook behaviours at runtime. For more details, see: 120887a7ebSKees Cook Documentation/dev-tools/ubsan.rst 130887a7ebSKees Cook 14277a1085SKees Cookif UBSAN 15277a1085SKees Cook 160887a7ebSKees Cookconfig UBSAN_TRAP 17ce661672SJann Horn bool "Abort on Sanitizer warnings (smaller kernel but less verbose)" 1879791378SKees Cook depends on !COMPILE_TEST 190887a7ebSKees Cook help 200887a7ebSKees Cook Building kernels with Sanitizer features enabled tends to grow 210887a7ebSKees Cook the kernel size by around 5%, due to adding all the debugging 220887a7ebSKees Cook text on failure paths. To avoid this, Sanitizer instrumentation 230887a7ebSKees Cook can just issue a trap. This reduces the kernel size overhead but 240887a7ebSKees Cook turns all warnings (including potentially harmless conditions) 250887a7ebSKees Cook into full exceptions that abort the running kernel code 260887a7ebSKees Cook (regardless of context, locks held, etc), which may destabilize 270887a7ebSKees Cook the system. For some system builders this is an acceptable 280887a7ebSKees Cook trade-off. 29c6d30853SAndrey Ryabinin 30ce661672SJann Horn Also note that selecting Y will cause your kernel to Oops 31ce661672SJann Horn with an "illegal instruction" error with no further details 327424fc6bSGatlin Newhouse when a UBSAN violation occurs. (Except on arm64 and x86, which 337424fc6bSGatlin Newhouse will report which Sanitizer failed.) This may make it hard to 34ce661672SJann Horn determine whether an Oops was caused by UBSAN or to figure 35ce661672SJann Horn out the details of a UBSAN violation. It makes the kernel log 36ce661672SJann Horn output less useful for bug reports. 37ce661672SJann Horn 382d47c695SKees Cookconfig CC_HAS_UBSAN_BOUNDS_STRICT 392d47c695SKees Cook def_bool $(cc-option,-fsanitize=bounds-strict) 402d47c695SKees Cook help 412d47c695SKees Cook The -fsanitize=bounds-strict option is only available on GCC, 422d47c695SKees Cook but uses the more strict handling of arrays that includes knowledge 432d47c695SKees Cook of flexible arrays, which is comparable to Clang's regular 442d47c695SKees Cook -fsanitize=bounds. 45cdf8a76fSKees Cook 46cdf8a76fSKees Cookconfig CC_HAS_UBSAN_ARRAY_BOUNDS 47cdf8a76fSKees Cook def_bool $(cc-option,-fsanitize=array-bounds) 482d47c695SKees Cook help 492d47c695SKees Cook Under Clang, the -fsanitize=bounds option is actually composed 502d47c695SKees Cook of two more specific options, -fsanitize=array-bounds and 512d47c695SKees Cook -fsanitize=local-bounds. However, -fsanitize=local-bounds can 522d47c695SKees Cook only be used when trap mode is enabled. (See also the help for 532d47c695SKees Cook CONFIG_LOCAL_BOUNDS.) Explicitly check for -fsanitize=array-bounds 542d47c695SKees Cook so that we can build up the options needed for UBSAN_BOUNDS 552d47c695SKees Cook with or without UBSAN_TRAP. 56cdf8a76fSKees Cook 57277a1085SKees Cookconfig UBSAN_BOUNDS 58277a1085SKees Cook bool "Perform array index bounds checking" 59277a1085SKees Cook default UBSAN 602d47c695SKees Cook depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS_STRICT 61277a1085SKees Cook help 62277a1085SKees Cook This option enables detection of directly indexed out of bounds 63277a1085SKees Cook array accesses, where the array size is known at compile time. 64277a1085SKees Cook Note that this does not protect array overflows via bad calls 65277a1085SKees Cook to the {str,mem}*cpy() family of functions (that is addressed 66277a1085SKees Cook by CONFIG_FORTIFY_SOURCE). 67277a1085SKees Cook 682d47c695SKees Cookconfig UBSAN_BOUNDS_STRICT 692d47c695SKees Cook def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_BOUNDS_STRICT 70cdf8a76fSKees Cook help 712d47c695SKees Cook GCC's bounds sanitizer. This option is used to select the 722d47c695SKees Cook correct options in Makefile.ubsan. 73cdf8a76fSKees Cook 74cdf8a76fSKees Cookconfig UBSAN_ARRAY_BOUNDS 752d47c695SKees Cook def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_ARRAY_BOUNDS 762d47c695SKees Cook help 772d47c695SKees Cook Clang's array bounds sanitizer. This option is used to select 782d47c695SKees Cook the correct options in Makefile.ubsan. 79cdf8a76fSKees Cook 806a6155f6SGeorge Popescuconfig UBSAN_LOCAL_BOUNDS 812d47c695SKees Cook def_bool UBSAN_ARRAY_BOUNDS && UBSAN_TRAP 826a6155f6SGeorge Popescu help 832d47c695SKees Cook This option enables Clang's -fsanitize=local-bounds which traps 842d47c695SKees Cook when an access through a pointer that is derived from an object 852d47c695SKees Cook of a statically-known size, where an added offset (which may not 862d47c695SKees Cook be known statically) is out-of-bounds. Since this option is 872d47c695SKees Cook trap-only, it depends on CONFIG_UBSAN_TRAP. 886a6155f6SGeorge Popescu 89cdf8a76fSKees Cookconfig UBSAN_SHIFT 90c637693bSKees Cook bool "Perform checking for bit-shift overflows" 91cdf8a76fSKees Cook depends on $(cc-option,-fsanitize=shift) 92c637693bSKees Cook help 93c637693bSKees Cook This option enables -fsanitize=shift which checks for bit-shift 94c637693bSKees Cook operations that overflow to the left or go switch to negative 95c637693bSKees Cook for signed types. 96cdf8a76fSKees Cook 97cdf8a76fSKees Cookconfig UBSAN_DIV_ZERO 98c637693bSKees Cook bool "Perform checking for integer divide-by-zero" 99cdf8a76fSKees Cook depends on $(cc-option,-fsanitize=integer-divide-by-zero) 100e5d523f1SNick Desaulniers # https://github.com/ClangBuiltLinux/linux/issues/1657 101e5d523f1SNick Desaulniers # https://github.com/llvm/llvm-project/issues/56289 102e5d523f1SNick Desaulniers depends on !CC_IS_CLANG 103c637693bSKees Cook help 104c637693bSKees Cook This option enables -fsanitize=integer-divide-by-zero which checks 105c637693bSKees Cook for integer division by zero. This is effectively redundant with the 106c637693bSKees Cook kernel's existing exception handling, though it can provide greater 107*1d1fd188SStefan Wiehler debugging information. 108cdf8a76fSKees Cook 109cdf8a76fSKees Cookconfig UBSAN_UNREACHABLE 110c637693bSKees Cook bool "Perform checking for unreachable code" 111c637693bSKees Cook # objtool already handles unreachable checking and gets angry about 112c637693bSKees Cook # seeing UBSan instrumentation located in unreachable places. 113c2f75a43SJosh Poimboeuf depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION)) 114cdf8a76fSKees Cook depends on $(cc-option,-fsanitize=unreachable) 115c637693bSKees Cook help 116c637693bSKees Cook This option enables -fsanitize=unreachable which checks for control 117c637693bSKees Cook flow reaching an expected-to-be-unreachable position. 118cdf8a76fSKees Cook 119ed2b548fSKees Cookconfig UBSAN_INTEGER_WRAP 120ed2b548fSKees Cook bool "Perform checking for integer arithmetic wrap-around" 121d6a0e0bfSKees Cook # This is very experimental so drop the next line if you really want it 122d6a0e0bfSKees Cook depends on BROKEN 123557f8c58SKees Cook depends on !COMPILE_TEST 124272a7670SKees Cook depends on $(cc-option,-fsanitize-undefined-ignore-overflow-pattern=all) 125557f8c58SKees Cook depends on $(cc-option,-fsanitize=signed-integer-overflow) 126ed2b548fSKees Cook depends on $(cc-option,-fsanitize=unsigned-integer-overflow) 127ed2b548fSKees Cook depends on $(cc-option,-fsanitize=implicit-signed-integer-truncation) 128ed2b548fSKees Cook depends on $(cc-option,-fsanitize=implicit-unsigned-integer-truncation) 12947f4af43SKees Cook depends on $(cc-option,-fsanitize-ignorelist=/dev/null) 130557f8c58SKees Cook help 131ed2b548fSKees Cook This option enables all of the sanitizers involved in integer overflow 132ed2b548fSKees Cook (wrap-around) mitigation: signed-integer-overflow, unsigned-integer-overflow, 133ed2b548fSKees Cook implicit-signed-integer-truncation, and implicit-unsigned-integer-truncation. 134ed2b548fSKees Cook This is currently limited only to the size_t type while testing and 135ed2b548fSKees Cook compiler development continues. 136557f8c58SKees Cook 137cdf8a76fSKees Cookconfig UBSAN_BOOL 138c637693bSKees Cook bool "Perform checking for non-boolean values used as boolean" 139c637693bSKees Cook default UBSAN 140cdf8a76fSKees Cook depends on $(cc-option,-fsanitize=bool) 141c637693bSKees Cook help 142c637693bSKees Cook This option enables -fsanitize=bool which checks for boolean values being 143c637693bSKees Cook loaded that are neither 0 nor 1. 144cdf8a76fSKees Cook 145cdf8a76fSKees Cookconfig UBSAN_ENUM 146c637693bSKees Cook bool "Perform checking for out of bounds enum values" 147c637693bSKees Cook default UBSAN 148cdf8a76fSKees Cook depends on $(cc-option,-fsanitize=enum) 149c637693bSKees Cook help 150c637693bSKees Cook This option enables -fsanitize=enum which checks for values being loaded 151c637693bSKees Cook into an enum that are outside the range of given values for the given enum. 152c637693bSKees Cook 153c637693bSKees Cookconfig UBSAN_ALIGNMENT 154c637693bSKees Cook bool "Perform checking for misaligned pointer usage" 155c637693bSKees Cook default !HAVE_EFFICIENT_UNALIGNED_ACCESS 156c637693bSKees Cook depends on !UBSAN_TRAP && !COMPILE_TEST 157c637693bSKees Cook depends on $(cc-option,-fsanitize=alignment) 158c637693bSKees Cook help 159c637693bSKees Cook This option enables the check of unaligned memory accesses. 160c637693bSKees Cook Enabling this option on architectures that support unaligned 161c637693bSKees Cook accesses may produce a lot of false positives. 162cdf8a76fSKees Cook 163854686f4SJinbum Parkconfig TEST_UBSAN 164854686f4SJinbum Park tristate "Module for testing for undefined behavior detection" 165277a1085SKees Cook depends on m 166854686f4SJinbum Park help 167854686f4SJinbum Park This is a test module for UBSAN. 168854686f4SJinbum Park It triggers various undefined behavior, and detect it. 169277a1085SKees Cook 17061b38f75SMostafa Salehconfig UBSAN_KVM_EL2 17161b38f75SMostafa Saleh bool "UBSAN for KVM code at EL2" 17261b38f75SMostafa Saleh depends on ARM64 17361b38f75SMostafa Saleh help 17461b38f75SMostafa Saleh Enable UBSAN when running on ARM64 with KVM in a split mode 17561b38f75SMostafa Saleh (nvhe/hvhe/protected) for the hypervisor code running in EL2. 17661b38f75SMostafa Saleh In this mode, any UBSAN violation in EL2 would panic the kernel 17761b38f75SMostafa Saleh and information similar to UBSAN_TRAP would be printed. 17861b38f75SMostafa Saleh 179277a1085SKees Cookendif # if UBSAN 180