iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4d0d7e7852
linux/lib/Kconfig.ubsan
Kees Cook 557f8c582a ubsan: Reintroduce signed overflow sanitizer 
In order to mitigate unexpected signed wrap-around[1], bring back the
signed integer overflow sanitizer. It was removed in commit 6aaa31aeb9
("ubsan: remove overflow checks") because it was effectively a no-op
when combined with -fno-strict-overflow (which correctly changes signed
overflow from being "undefined" to being explicitly "wrap around").

Compilers are adjusting their sanitizers to trap wrap-around and to
detecting common code patterns that should not be instrumented
(e.g. "var + offset < var"). Prepare for this and explicitly rename
the option from "OVERFLOW" to "WRAP" to more accurately describe the
behavior.

To annotate intentional wrap-around arithmetic, the helpers
wrapping_add/sub/mul_wrap() can be used for individual statements. At
the function level, the __signed_wrap attribute can be used to mark an
entire function as expecting its signed arithmetic to wrap around. For a
single object file the Makefile can use "UBSAN_SIGNED_WRAP_target.o := n"
to mark it as wrapping, and for an entire directory, "UBSAN_SIGNED_WRAP :=
n" can be used.

Additionally keep these disabled under CONFIG_COMPILE_TEST for now.

Link: https://github.com/KSPP/linux/issues/26 [1]
Cc: Miguel Ojeda <ojeda@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Hao Luo <haoluo@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Reviewed-by: Justin Stitt <justinstitt@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
2024-02-20 20:44:49 -08:00

166 lines
6.4 KiB
Plaintext
Raw Blame History

# SPDX-License-Identifier: GPL-2.0-only
config ARCH_HAS_UBSAN
bool
menuconfig UBSAN
bool "Undefined behaviour sanity checker"
help
This option enables the Undefined Behaviour sanity checker.
Compile-time instrumentation is used to detect various undefined
behaviours at runtime. For more details, see:
Documentation/dev-tools/ubsan.rst
if UBSAN
config UBSAN_TRAP
bool "Abort on Sanitizer warnings (smaller kernel but less verbose)"
depends on !COMPILE_TEST
help
Building kernels with Sanitizer features enabled tends to grow
the kernel size by around 5%, due to adding all the debugging
text on failure paths. To avoid this, Sanitizer instrumentation
can just issue a trap. This reduces the kernel size overhead but
turns all warnings (including potentially harmless conditions)
into full exceptions that abort the running kernel code
(regardless of context, locks held, etc), which may destabilize
the system. For some system builders this is an acceptable
trade-off.
Also note that selecting Y will cause your kernel to Oops
with an "illegal instruction" error with no further details
when a UBSAN violation occurs. (Except on arm64, which will
report which Sanitizer failed.) This may make it hard to
determine whether an Oops was caused by UBSAN or to figure
out the details of a UBSAN violation. It makes the kernel log
output less useful for bug reports.
config CC_HAS_UBSAN_BOUNDS_STRICT
def_bool $(cc-option,-fsanitize=bounds-strict)
help
The -fsanitize=bounds-strict option is only available on GCC,
but uses the more strict handling of arrays that includes knowledge
of flexible arrays, which is comparable to Clang's regular
-fsanitize=bounds.
config CC_HAS_UBSAN_ARRAY_BOUNDS
def_bool $(cc-option,-fsanitize=array-bounds)
help
Under Clang, the -fsanitize=bounds option is actually composed
of two more specific options, -fsanitize=array-bounds and
-fsanitize=local-bounds. However, -fsanitize=local-bounds can
only be used when trap mode is enabled. (See also the help for
CONFIG_LOCAL_BOUNDS.) Explicitly check for -fsanitize=array-bounds
so that we can build up the options needed for UBSAN_BOUNDS
with or without UBSAN_TRAP.
config UBSAN_BOUNDS
bool "Perform array index bounds checking"
default UBSAN
depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS_STRICT
help
This option enables detection of directly indexed out of bounds
array accesses, where the array size is known at compile time.
Note that this does not protect array overflows via bad calls
to the {str,mem}*cpy() family of functions (that is addressed
by CONFIG_FORTIFY_SOURCE).
config UBSAN_BOUNDS_STRICT
def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_BOUNDS_STRICT
help
GCC's bounds sanitizer. This option is used to select the
correct options in Makefile.ubsan.
config UBSAN_ARRAY_BOUNDS
def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_ARRAY_BOUNDS
help
Clang's array bounds sanitizer. This option is used to select
the correct options in Makefile.ubsan.
config UBSAN_LOCAL_BOUNDS
def_bool UBSAN_ARRAY_BOUNDS && UBSAN_TRAP
help
This option enables Clang's -fsanitize=local-bounds which traps
when an access through a pointer that is derived from an object
of a statically-known size, where an added offset (which may not
be known statically) is out-of-bounds. Since this option is
trap-only, it depends on CONFIG_UBSAN_TRAP.
config UBSAN_SHIFT
bool "Perform checking for bit-shift overflows"
depends on $(cc-option,-fsanitize=shift)
help
This option enables -fsanitize=shift which checks for bit-shift
operations that overflow to the left or go switch to negative
for signed types.
config UBSAN_DIV_ZERO
bool "Perform checking for integer divide-by-zero"
depends on $(cc-option,-fsanitize=integer-divide-by-zero)
# https://github.com/ClangBuiltLinux/linux/issues/1657
# https://github.com/llvm/llvm-project/issues/56289
depends on !CC_IS_CLANG
help
This option enables -fsanitize=integer-divide-by-zero which checks
for integer division by zero. This is effectively redundant with the
kernel's existing exception handling, though it can provide greater
debugging information under CONFIG_UBSAN_REPORT_FULL.
config UBSAN_UNREACHABLE
bool "Perform checking for unreachable code"
# objtool already handles unreachable checking and gets angry about
# seeing UBSan instrumentation located in unreachable places.
depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION))
depends on $(cc-option,-fsanitize=unreachable)
help
This option enables -fsanitize=unreachable which checks for control
flow reaching an expected-to-be-unreachable position.
config UBSAN_SIGNED_WRAP
bool "Perform checking for signed arithmetic wrap-around"
default UBSAN
depends on !COMPILE_TEST
depends on $(cc-option,-fsanitize=signed-integer-overflow)
help
This option enables -fsanitize=signed-integer-overflow which checks
for wrap-around of any arithmetic operations with signed integers.
This currently performs nearly no instrumentation due to the
kernel's use of -fno-strict-overflow which converts all would-be
arithmetic undefined behavior into wrap-around arithmetic. Future
sanitizer versions will allow for wrap-around checking (rather than
exclusively undefined behavior).
config UBSAN_BOOL
bool "Perform checking for non-boolean values used as boolean"
default UBSAN
depends on $(cc-option,-fsanitize=bool)
help
This option enables -fsanitize=bool which checks for boolean values being
loaded that are neither 0 nor 1.
config UBSAN_ENUM
bool "Perform checking for out of bounds enum values"
default UBSAN
depends on $(cc-option,-fsanitize=enum)
help
This option enables -fsanitize=enum which checks for values being loaded
into an enum that are outside the range of given values for the given enum.
config UBSAN_ALIGNMENT
bool "Perform checking for misaligned pointer usage"
default !HAVE_EFFICIENT_UNALIGNED_ACCESS
depends on !UBSAN_TRAP && !COMPILE_TEST
depends on $(cc-option,-fsanitize=alignment)
help
This option enables the check of unaligned memory accesses.
Enabling this option on architectures that support unaligned
accesses may produce a lot of false positives.
config TEST_UBSAN
tristate "Module for testing for undefined behavior detection"
depends on m
help
This is a test module for UBSAN.
It triggers various undefined behavior, and detect it.
endif # if UBSAN
Reference in New Issue View Git Blame Copy Permalink