tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1# SPDX-License-Identifier: GPL-2.0-only
2config ARCH_HAS_UBSAN_SANITIZE_ALL
3 bool
4
5menuconfig UBSAN
6 bool "Undefined behaviour sanity checker"
7 help
8 This option enables the Undefined Behaviour sanity checker.
9 Compile-time instrumentation is used to detect various undefined
10 behaviours at runtime. For more details, see:
11 Documentation/dev-tools/ubsan.rst
12
13if UBSAN
14
15config UBSAN_TRAP
16 bool "On Sanitizer warnings, abort the running kernel code"
17 depends on !COMPILE_TEST
18 depends on $(cc-option, -fsanitize-undefined-trap-on-error)
19 help
20 Building kernels with Sanitizer features enabled tends to grow
21 the kernel size by around 5%, due to adding all the debugging
22 text on failure paths. To avoid this, Sanitizer instrumentation
23 can just issue a trap. This reduces the kernel size overhead but
24 turns all warnings (including potentially harmless conditions)
25 into full exceptions that abort the running kernel code
26 (regardless of context, locks held, etc), which may destabilize
27 the system. For some system builders this is an acceptable
28 trade-off.
29
30config CC_HAS_UBSAN_BOUNDS
31 def_bool $(cc-option,-fsanitize=bounds)
32
33config CC_HAS_UBSAN_ARRAY_BOUNDS
34 def_bool $(cc-option,-fsanitize=array-bounds)
35
36config UBSAN_BOUNDS
37 bool "Perform array index bounds checking"
38 default UBSAN
39 depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS
40 help
41 This option enables detection of directly indexed out of bounds
42 array accesses, where the array size is known at compile time.
43 Note that this does not protect array overflows via bad calls
44 to the {str,mem}*cpy() family of functions (that is addressed
45 by CONFIG_FORTIFY_SOURCE).
46
47config UBSAN_ONLY_BOUNDS
48 def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS
49 depends on UBSAN_BOUNDS
50 help
51 This is a weird case: Clang's -fsanitize=bounds includes
52 -fsanitize=local-bounds, but it's trapping-only, so for
53 Clang, we must use -fsanitize=array-bounds when we want
54 traditional array bounds checking enabled. For GCC, we
55 want -fsanitize=bounds.
56
57config UBSAN_ARRAY_BOUNDS
58 def_bool CC_HAS_UBSAN_ARRAY_BOUNDS
59 depends on UBSAN_BOUNDS
60
61config UBSAN_LOCAL_BOUNDS
62 bool "Perform array local bounds checking"
63 depends on UBSAN_TRAP
64 depends on $(cc-option,-fsanitize=local-bounds)
65 help
66 This option enables -fsanitize=local-bounds which traps when an
67 exception/error is detected. Therefore, it may only be enabled
68 with CONFIG_UBSAN_TRAP.
69
70 Enabling this option detects errors due to accesses through a
71 pointer that is derived from an object of a statically-known size,
72 where an added offset (which may not be known statically) is
73 out-of-bounds.
74
75config UBSAN_SHIFT
76 bool "Perform checking for bit-shift overflows"
77 default UBSAN
78 depends on $(cc-option,-fsanitize=shift)
79 help
80 This option enables -fsanitize=shift which checks for bit-shift
81 operations that overflow to the left or go switch to negative
82 for signed types.
83
84config UBSAN_DIV_ZERO
85 bool "Perform checking for integer divide-by-zero"
86 depends on $(cc-option,-fsanitize=integer-divide-by-zero)
87 help
88 This option enables -fsanitize=integer-divide-by-zero which checks
89 for integer division by zero. This is effectively redundant with the
90 kernel's existing exception handling, though it can provide greater
91 debugging information under CONFIG_UBSAN_REPORT_FULL.
92
93config UBSAN_UNREACHABLE
94 bool "Perform checking for unreachable code"
95 # objtool already handles unreachable checking and gets angry about
96 # seeing UBSan instrumentation located in unreachable places.
97 depends on !STACK_VALIDATION
98 depends on $(cc-option,-fsanitize=unreachable)
99 help
100 This option enables -fsanitize=unreachable which checks for control
101 flow reaching an expected-to-be-unreachable position.
102
103config UBSAN_BOOL
104 bool "Perform checking for non-boolean values used as boolean"
105 default UBSAN
106 depends on $(cc-option,-fsanitize=bool)
107 help
108 This option enables -fsanitize=bool which checks for boolean values being
109 loaded that are neither 0 nor 1.
110
111config UBSAN_ENUM
112 bool "Perform checking for out of bounds enum values"
113 default UBSAN
114 depends on $(cc-option,-fsanitize=enum)
115 help
116 This option enables -fsanitize=enum which checks for values being loaded
117 into an enum that are outside the range of given values for the given enum.
118
119config UBSAN_ALIGNMENT
120 bool "Perform checking for misaligned pointer usage"
121 default !HAVE_EFFICIENT_UNALIGNED_ACCESS
122 depends on !UBSAN_TRAP && !COMPILE_TEST
123 depends on $(cc-option,-fsanitize=alignment)
124 help
125 This option enables the check of unaligned memory accesses.
126 Enabling this option on architectures that support unaligned
127 accesses may produce a lot of false positives.
128
129config UBSAN_SANITIZE_ALL
130 bool "Enable instrumentation for the entire kernel"
131 depends on ARCH_HAS_UBSAN_SANITIZE_ALL
132 default y
133 help
134 This option activates instrumentation for the entire kernel.
135 If you don't enable this option, you have to explicitly specify
136 UBSAN_SANITIZE := y for the files/directories you want to check for UB.
137 Enabling this option will get kernel image size increased
138 significantly.
139
140config TEST_UBSAN
141 tristate "Module for testing for undefined behavior detection"
142 depends on m
143 help
144 This is a test module for UBSAN.
145 It triggers various undefined behavior, and detect it.
146
147endif # if UBSAN