1# SPDX-License-Identifier: GPL-2.0-only
2config ARCH_HAS_UBSAN_SANITIZE_ALL
3	bool
4
5menuconfig UBSAN
6	bool "Undefined behaviour sanity checker"
7	help
8	  This option enables the Undefined Behaviour sanity checker.
9	  Compile-time instrumentation is used to detect various undefined
10	  behaviours at runtime. For more details, see:
11	  Documentation/dev-tools/ubsan.rst
12
13if UBSAN
14
15config UBSAN_TRAP
16	bool "On Sanitizer warnings, abort the running kernel code"
17	depends on !COMPILE_TEST
18	depends on $(cc-option, -fsanitize-undefined-trap-on-error)
19	help
20	  Building kernels with Sanitizer features enabled tends to grow
21	  the kernel size by around 5%, due to adding all the debugging
22	  text on failure paths. To avoid this, Sanitizer instrumentation
23	  can just issue a trap. This reduces the kernel size overhead but
24	  turns all warnings (including potentially harmless conditions)
25	  into full exceptions that abort the running kernel code
26	  (regardless of context, locks held, etc), which may destabilize
27	  the system. For some system builders this is an acceptable
28	  trade-off.
29
30config CC_HAS_UBSAN_BOUNDS
31	def_bool $(cc-option,-fsanitize=bounds)
32
33config CC_HAS_UBSAN_ARRAY_BOUNDS
34	def_bool $(cc-option,-fsanitize=array-bounds)
35
36config UBSAN_BOUNDS
37	bool "Perform array index bounds checking"
38	default UBSAN
39	depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS
40	help
41	  This option enables detection of directly indexed out of bounds
42	  array accesses, where the array size is known at compile time.
43	  Note that this does not protect array overflows via bad calls
44	  to the {str,mem}*cpy() family of functions (that is addressed
45	  by CONFIG_FORTIFY_SOURCE).
46
47config UBSAN_ONLY_BOUNDS
48	def_bool CC_HAS_UBSAN_BOUNDS && !CC_HAS_UBSAN_ARRAY_BOUNDS
49	depends on UBSAN_BOUNDS
50	help
51	  This is a weird case: Clang's -fsanitize=bounds includes
52	  -fsanitize=local-bounds, but it's trapping-only, so for
53	  Clang, we must use -fsanitize=array-bounds when we want
54	  traditional array bounds checking enabled. For GCC, we
55	  want -fsanitize=bounds.
56
57config UBSAN_ARRAY_BOUNDS
58	def_bool CC_HAS_UBSAN_ARRAY_BOUNDS
59	depends on UBSAN_BOUNDS
60
61config UBSAN_LOCAL_BOUNDS
62	bool "Perform array local bounds checking"
63	depends on UBSAN_TRAP
64	depends on $(cc-option,-fsanitize=local-bounds)
65	help
66	  This option enables -fsanitize=local-bounds which traps when an
67	  exception/error is detected. Therefore, it may only be enabled
68	  with CONFIG_UBSAN_TRAP.
69
70	  Enabling this option detects errors due to accesses through a
71	  pointer that is derived from an object of a statically-known size,
72	  where an added offset (which may not be known statically) is
73	  out-of-bounds.
74
75config UBSAN_SHIFT
76	bool "Perform checking for bit-shift overflows"
77	default UBSAN
78	depends on $(cc-option,-fsanitize=shift)
79	help
80	  This option enables -fsanitize=shift which checks for bit-shift
81	  operations that overflow to the left or go switch to negative
82	  for signed types.
83
84config UBSAN_DIV_ZERO
85	bool "Perform checking for integer divide-by-zero"
86	depends on $(cc-option,-fsanitize=integer-divide-by-zero)
87	# https://github.com/ClangBuiltLinux/linux/issues/1657
88	# https://github.com/llvm/llvm-project/issues/56289
89	depends on !CC_IS_CLANG
90	help
91	  This option enables -fsanitize=integer-divide-by-zero which checks
92	  for integer division by zero. This is effectively redundant with the
93	  kernel's existing exception handling, though it can provide greater
94	  debugging information under CONFIG_UBSAN_REPORT_FULL.
95
96config UBSAN_UNREACHABLE
97	bool "Perform checking for unreachable code"
98	# objtool already handles unreachable checking and gets angry about
99	# seeing UBSan instrumentation located in unreachable places.
100	depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION))
101	depends on $(cc-option,-fsanitize=unreachable)
102	help
103	  This option enables -fsanitize=unreachable which checks for control
104	  flow reaching an expected-to-be-unreachable position.
105
106config UBSAN_BOOL
107	bool "Perform checking for non-boolean values used as boolean"
108	default UBSAN
109	depends on $(cc-option,-fsanitize=bool)
110	help
111	  This option enables -fsanitize=bool which checks for boolean values being
112	  loaded that are neither 0 nor 1.
113
114config UBSAN_ENUM
115	bool "Perform checking for out of bounds enum values"
116	default UBSAN
117	depends on $(cc-option,-fsanitize=enum)
118	help
119	  This option enables -fsanitize=enum which checks for values being loaded
120	  into an enum that are outside the range of given values for the given enum.
121
122config UBSAN_ALIGNMENT
123	bool "Perform checking for misaligned pointer usage"
124	default !HAVE_EFFICIENT_UNALIGNED_ACCESS
125	depends on !UBSAN_TRAP && !COMPILE_TEST
126	depends on $(cc-option,-fsanitize=alignment)
127	help
128	  This option enables the check of unaligned memory accesses.
129	  Enabling this option on architectures that support unaligned
130	  accesses may produce a lot of false positives.
131
132config UBSAN_SANITIZE_ALL
133	bool "Enable instrumentation for the entire kernel"
134	depends on ARCH_HAS_UBSAN_SANITIZE_ALL
135	default y
136	help
137	  This option activates instrumentation for the entire kernel.
138	  If you don't enable this option, you have to explicitly specify
139	  UBSAN_SANITIZE := y for the files/directories you want to check for UB.
140	  Enabling this option will get kernel image size increased
141	  significantly.
142
143config TEST_UBSAN
144	tristate "Module for testing for undefined behavior detection"
145	depends on m
146	help
147	  This is a test module for UBSAN.
148	  It triggers various undefined behavior, and detect it.
149
150endif	# if UBSAN
151