mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2025-04-19 20:58:31 +09:00
cdc2e1d9d9
CONFIG_UBSAN_INTEGER_WRAP is 'default UBSAN', which is problematic for a couple of reasons. The first is that this sanitizer is under active development on the compiler side to come up with a solution that is maintainable on the compiler side and usable on the kernel side. As a result of this, there are many warnings when the sanitizer is enabled that have no clear path to resolution yet but users may see them and report them in the meantime. The second is that this option was renamed from CONFIG_UBSAN_SIGNED_WRAP, meaning that if a configuration has CONFIG_UBSAN=y but CONFIG_UBSAN_SIGNED_WRAP=n and it is upgraded via olddefconfig (common in non-interactive scenarios such as CI), CONFIG_UBSAN_INTEGER_WRAP will be silently enabled again. Remove 'default UBSAN' from CONFIG_UBSAN_INTEGER_WRAP until it is ready for regular usage and testing from a broader community than the folks actively working on the feature. Cc: stable@vger.kernel.org Fixes: 557f8c582a9b ("ubsan: Reintroduce signed overflow sanitizer") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://lore.kernel.org/r/20250414-drop-default-ubsan-integer-wrap-v1-1-392522551d6b@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
169 lines
6.6 KiB
Plaintext
169 lines
6.6 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
config ARCH_HAS_UBSAN
|
|
bool
|
|
|
|
menuconfig UBSAN
|
|
bool "Undefined behaviour sanity checker"
|
|
depends on ARCH_HAS_UBSAN
|
|
help
|
|
This option enables the Undefined Behaviour sanity checker.
|
|
Compile-time instrumentation is used to detect various undefined
|
|
behaviours at runtime. For more details, see:
|
|
Documentation/dev-tools/ubsan.rst
|
|
|
|
if UBSAN
|
|
|
|
config UBSAN_TRAP
|
|
bool "Abort on Sanitizer warnings (smaller kernel but less verbose)"
|
|
depends on !COMPILE_TEST
|
|
help
|
|
Building kernels with Sanitizer features enabled tends to grow
|
|
the kernel size by around 5%, due to adding all the debugging
|
|
text on failure paths. To avoid this, Sanitizer instrumentation
|
|
can just issue a trap. This reduces the kernel size overhead but
|
|
turns all warnings (including potentially harmless conditions)
|
|
into full exceptions that abort the running kernel code
|
|
(regardless of context, locks held, etc), which may destabilize
|
|
the system. For some system builders this is an acceptable
|
|
trade-off.
|
|
|
|
Also note that selecting Y will cause your kernel to Oops
|
|
with an "illegal instruction" error with no further details
|
|
when a UBSAN violation occurs. (Except on arm64 and x86, which
|
|
will report which Sanitizer failed.) This may make it hard to
|
|
determine whether an Oops was caused by UBSAN or to figure
|
|
out the details of a UBSAN violation. It makes the kernel log
|
|
output less useful for bug reports.
|
|
|
|
config CC_HAS_UBSAN_BOUNDS_STRICT
|
|
def_bool $(cc-option,-fsanitize=bounds-strict)
|
|
help
|
|
The -fsanitize=bounds-strict option is only available on GCC,
|
|
but uses the more strict handling of arrays that includes knowledge
|
|
of flexible arrays, which is comparable to Clang's regular
|
|
-fsanitize=bounds.
|
|
|
|
config CC_HAS_UBSAN_ARRAY_BOUNDS
|
|
def_bool $(cc-option,-fsanitize=array-bounds)
|
|
help
|
|
Under Clang, the -fsanitize=bounds option is actually composed
|
|
of two more specific options, -fsanitize=array-bounds and
|
|
-fsanitize=local-bounds. However, -fsanitize=local-bounds can
|
|
only be used when trap mode is enabled. (See also the help for
|
|
CONFIG_LOCAL_BOUNDS.) Explicitly check for -fsanitize=array-bounds
|
|
so that we can build up the options needed for UBSAN_BOUNDS
|
|
with or without UBSAN_TRAP.
|
|
|
|
config UBSAN_BOUNDS
|
|
bool "Perform array index bounds checking"
|
|
default UBSAN
|
|
depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS_STRICT
|
|
help
|
|
This option enables detection of directly indexed out of bounds
|
|
array accesses, where the array size is known at compile time.
|
|
Note that this does not protect array overflows via bad calls
|
|
to the {str,mem}*cpy() family of functions (that is addressed
|
|
by CONFIG_FORTIFY_SOURCE).
|
|
|
|
config UBSAN_BOUNDS_STRICT
|
|
def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_BOUNDS_STRICT
|
|
help
|
|
GCC's bounds sanitizer. This option is used to select the
|
|
correct options in Makefile.ubsan.
|
|
|
|
config UBSAN_ARRAY_BOUNDS
|
|
def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_ARRAY_BOUNDS
|
|
help
|
|
Clang's array bounds sanitizer. This option is used to select
|
|
the correct options in Makefile.ubsan.
|
|
|
|
config UBSAN_LOCAL_BOUNDS
|
|
def_bool UBSAN_ARRAY_BOUNDS && UBSAN_TRAP
|
|
help
|
|
This option enables Clang's -fsanitize=local-bounds which traps
|
|
when an access through a pointer that is derived from an object
|
|
of a statically-known size, where an added offset (which may not
|
|
be known statically) is out-of-bounds. Since this option is
|
|
trap-only, it depends on CONFIG_UBSAN_TRAP.
|
|
|
|
config UBSAN_SHIFT
|
|
bool "Perform checking for bit-shift overflows"
|
|
depends on $(cc-option,-fsanitize=shift)
|
|
help
|
|
This option enables -fsanitize=shift which checks for bit-shift
|
|
operations that overflow to the left or go switch to negative
|
|
for signed types.
|
|
|
|
config UBSAN_DIV_ZERO
|
|
bool "Perform checking for integer divide-by-zero"
|
|
depends on $(cc-option,-fsanitize=integer-divide-by-zero)
|
|
# https://github.com/ClangBuiltLinux/linux/issues/1657
|
|
# https://github.com/llvm/llvm-project/issues/56289
|
|
depends on !CC_IS_CLANG
|
|
help
|
|
This option enables -fsanitize=integer-divide-by-zero which checks
|
|
for integer division by zero. This is effectively redundant with the
|
|
kernel's existing exception handling, though it can provide greater
|
|
debugging information under CONFIG_UBSAN_REPORT_FULL.
|
|
|
|
config UBSAN_UNREACHABLE
|
|
bool "Perform checking for unreachable code"
|
|
# objtool already handles unreachable checking and gets angry about
|
|
# seeing UBSan instrumentation located in unreachable places.
|
|
depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION))
|
|
depends on $(cc-option,-fsanitize=unreachable)
|
|
help
|
|
This option enables -fsanitize=unreachable which checks for control
|
|
flow reaching an expected-to-be-unreachable position.
|
|
|
|
config UBSAN_INTEGER_WRAP
|
|
bool "Perform checking for integer arithmetic wrap-around"
|
|
depends on !COMPILE_TEST
|
|
depends on $(cc-option,-fsanitize-undefined-ignore-overflow-pattern=all)
|
|
depends on $(cc-option,-fsanitize=signed-integer-overflow)
|
|
depends on $(cc-option,-fsanitize=unsigned-integer-overflow)
|
|
depends on $(cc-option,-fsanitize=implicit-signed-integer-truncation)
|
|
depends on $(cc-option,-fsanitize=implicit-unsigned-integer-truncation)
|
|
depends on $(cc-option,-fsanitize-ignorelist=/dev/null)
|
|
help
|
|
This option enables all of the sanitizers involved in integer overflow
|
|
(wrap-around) mitigation: signed-integer-overflow, unsigned-integer-overflow,
|
|
implicit-signed-integer-truncation, and implicit-unsigned-integer-truncation.
|
|
This is currently limited only to the size_t type while testing and
|
|
compiler development continues.
|
|
|
|
config UBSAN_BOOL
|
|
bool "Perform checking for non-boolean values used as boolean"
|
|
default UBSAN
|
|
depends on $(cc-option,-fsanitize=bool)
|
|
help
|
|
This option enables -fsanitize=bool which checks for boolean values being
|
|
loaded that are neither 0 nor 1.
|
|
|
|
config UBSAN_ENUM
|
|
bool "Perform checking for out of bounds enum values"
|
|
default UBSAN
|
|
depends on $(cc-option,-fsanitize=enum)
|
|
help
|
|
This option enables -fsanitize=enum which checks for values being loaded
|
|
into an enum that are outside the range of given values for the given enum.
|
|
|
|
config UBSAN_ALIGNMENT
|
|
bool "Perform checking for misaligned pointer usage"
|
|
default !HAVE_EFFICIENT_UNALIGNED_ACCESS
|
|
depends on !UBSAN_TRAP && !COMPILE_TEST
|
|
depends on $(cc-option,-fsanitize=alignment)
|
|
help
|
|
This option enables the check of unaligned memory accesses.
|
|
Enabling this option on architectures that support unaligned
|
|
accesses may produce a lot of false positives.
|
|
|
|
config TEST_UBSAN
|
|
tristate "Module for testing for undefined behavior detection"
|
|
depends on m
|
|
help
|
|
This is a test module for UBSAN.
|
|
It triggers various undefined behavior, and detect it.
|
|
|
|
endif # if UBSAN
|