LXR linux/lib/Kconfig.ubsan

   1# SPDX-License-Identifier: GPL-2.0-only
   2config ARCH_HAS_UBSAN_SANITIZE_ALL
   3        bool
   4
   5menuconfig UBSAN
   6        bool "Undefined behaviour sanity checker"
   7        help
   8          This option enables the Undefined Behaviour sanity checker.
   9          Compile-time instrumentation is used to detect various undefined
  10          behaviours at runtime. For more details, see:
  11          Documentation/dev-tools/ubsan.rst
  12
  13if UBSAN
  14
  15config UBSAN_TRAP
  16        bool "On Sanitizer warnings, abort the running kernel code"
  17        depends on !COMPILE_TEST
  18        depends on $(cc-option, -fsanitize-undefined-trap-on-error)
  19        help
  20          Building kernels with Sanitizer features enabled tends to grow
  21          the kernel size by around 5%, due to adding all the debugging
  22          text on failure paths. To avoid this, Sanitizer instrumentation
  23          can just issue a trap. This reduces the kernel size overhead but
  24          turns all warnings (including potentially harmless conditions)
  25          into full exceptions that abort the running kernel code
  26          (regardless of context, locks held, etc), which may destabilize
  27          the system. For some system builders this is an acceptable
  28          trade-off.
  29
  30config UBSAN_KCOV_BROKEN
  31        def_bool KCOV && CC_HAS_SANCOV_TRACE_PC
  32        depends on CC_IS_CLANG
  33        depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=bounds -fsanitize-coverage=trace-pc)
  34        help
  35          Some versions of clang support either UBSAN or KCOV but not the
  36          combination of the two.
  37          See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status
  38          in newer releases.
  39
  40config CC_HAS_UBSAN_BOUNDS
  41        def_bool $(cc-option,-fsanitize=bounds)
  42
  43config CC_HAS_UBSAN_ARRAY_BOUNDS
  44        def_bool $(cc-option,-fsanitize=array-bounds)
  45
  46config UBSAN_BOUNDS
  47        bool "Perform array index bounds checking"
  48        default UBSAN
  49        depends on !UBSAN_KCOV_BROKEN
  50        depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS
  51        help
  52          This option enables detection of directly indexed out of bounds
  53          array accesses, where the array size is known at compile time.
  54          Note that this does not protect array overflows via bad calls
  55          to the {str,mem}*cpy() family of functions (that is addressed
  56          by CONFIG_FORTIFY_SOURCE).
  57
  58config UBSAN_ONLY_BOUNDS
  59        def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS
  60        depends on UBSAN_BOUNDS
  61        help
  62          This is a weird case: Clang's -fsanitize=bounds includes
  63          -fsanitize=local-bounds, but it's trapping-only, so for
  64          Clang, we must use -fsanitize=array-bounds when we want
  65          traditional array bounds checking enabled. For GCC, we
  66          want -fsanitize=bounds.
  67
  68config UBSAN_ARRAY_BOUNDS
  69        def_bool CC_HAS_UBSAN_ARRAY_BOUNDS
  70        depends on UBSAN_BOUNDS
  71
  72config UBSAN_LOCAL_BOUNDS
  73        bool "Perform array local bounds checking"
  74        depends on UBSAN_TRAP
  75        depends on !UBSAN_KCOV_BROKEN
  76        depends on $(cc-option,-fsanitize=local-bounds)
  77        help
  78          This option enables -fsanitize=local-bounds which traps when an
  79          exception/error is detected. Therefore, it may only be enabled
  80          with CONFIG_UBSAN_TRAP.
  81
  82          Enabling this option detects errors due to accesses through a
  83          pointer that is derived from an object of a statically-known size,
  84          where an added offset (which may not be known statically) is
  85          out-of-bounds.
  86
  87config UBSAN_SHIFT
  88        bool "Perform checking for bit-shift overflows"
  89        default UBSAN
  90        depends on $(cc-option,-fsanitize=shift)
  91        help
  92          This option enables -fsanitize=shift which checks for bit-shift
  93          operations that overflow to the left or go switch to negative
  94          for signed types.
  95
  96config UBSAN_DIV_ZERO
  97        bool "Perform checking for integer divide-by-zero"
  98        depends on $(cc-option,-fsanitize=integer-divide-by-zero)
  99        help
 100          This option enables -fsanitize=integer-divide-by-zero which checks
 101          for integer division by zero. This is effectively redundant with the
 102          kernel's existing exception handling, though it can provide greater
 103          debugging information under CONFIG_UBSAN_REPORT_FULL.
 104
 105config UBSAN_UNREACHABLE
 106        bool "Perform checking for unreachable code"
 107        # objtool already handles unreachable checking and gets angry about
 108        # seeing UBSan instrumentation located in unreachable places.
 109        depends on !STACK_VALIDATION
 110        depends on $(cc-option,-fsanitize=unreachable)
 111        help
 112          This option enables -fsanitize=unreachable which checks for control
 113          flow reaching an expected-to-be-unreachable position.
 114
 115config UBSAN_OBJECT_SIZE
 116        bool "Perform checking for accesses beyond the end of objects"
 117        default UBSAN
 118        # gcc hugely expands stack usage with -fsanitize=object-size
 119        # https://lore.kernel.org/lkml/CAHk-=wjPasyJrDuwDnpHJS2TuQfExwe=px-SzLeN8GFMAQJPmQ@mail.gmail.com/
 120        depends on !CC_IS_GCC
 121        depends on $(cc-option,-fsanitize=object-size)
 122        help
 123          This option enables -fsanitize=object-size which checks for accesses
 124          beyond the end of objects where the optimizer can determine both the
 125          object being operated on and its size, usually seen with bad downcasts,
 126          or access to struct members from NULL pointers.
 127
 128config UBSAN_BOOL
 129        bool "Perform checking for non-boolean values used as boolean"
 130        default UBSAN
 131        depends on $(cc-option,-fsanitize=bool)
 132        help
 133          This option enables -fsanitize=bool which checks for boolean values being
 134          loaded that are neither 0 nor 1.
 135
 136config UBSAN_ENUM
 137        bool "Perform checking for out of bounds enum values"
 138        default UBSAN
 139        depends on $(cc-option,-fsanitize=enum)
 140        help
 141          This option enables -fsanitize=enum which checks for values being loaded
 142          into an enum that are outside the range of given values for the given enum.
 143
 144config UBSAN_ALIGNMENT
 145        bool "Perform checking for misaligned pointer usage"
 146        default !HAVE_EFFICIENT_UNALIGNED_ACCESS
 147        depends on !UBSAN_TRAP && !COMPILE_TEST
 148        depends on $(cc-option,-fsanitize=alignment)
 149        help
 150          This option enables the check of unaligned memory accesses.
 151          Enabling this option on architectures that support unaligned
 152          accesses may produce a lot of false positives.
 153
 154config UBSAN_SANITIZE_ALL
 155        bool "Enable instrumentation for the entire kernel"
 156        depends on ARCH_HAS_UBSAN_SANITIZE_ALL
 157        default y
 158        help
 159          This option activates instrumentation for the entire kernel.
 160          If you don't enable this option, you have to explicitly specify
 161          UBSAN_SANITIZE := y for the files/directories you want to check for UB.
 162          Enabling this option will get kernel image size increased
 163          significantly.
 164
 165config TEST_UBSAN
 166        tristate "Module for testing for undefined behavior detection"
 167        depends on m
 168        help
 169          This is a test module for UBSAN.
 170          It triggers various undefined behavior, and detect it.
 171
 172endif   # if UBSAN
 173