7424fc6b86
Currently ARM64 extracts which specific sanitizer has caused a trap via
encoded data in the trap instruction. Clang on x86 currently encodes the
same data in the UD1 instruction but x86 handle_bug() and
is_valid_bugaddr() currently only look at UD2.
Bring x86 to parity with ARM64, similar to commit 25b84002af ("arm64:
Support Clang UBSAN trap codes for better reporting"). See the llvm
links for information about the code generation.
Enable the reporting of UBSAN sanitizer details on x86 compiled with clang
when CONFIG_UBSAN_TRAP=y by analysing UD1 and retrieving the type immediate
which is encoded by the compiler after the UD1.
[ tglx: Simplified it by moving the printk() into handle_bug() ]
Signed-off-by: Gatlin Newhouse <gatlin.newhouse@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/all/20240724000206.451425-1-gatlin.newhouse@gmail.com
Link: https://github.com/llvm/llvm-project/commit/c5978f42ec8e9#diff-bb68d7cd885f41cfc35843998b0f9f534adb60b415f647109e597ce448e92d9f
Link: https://github.com/llvm/llvm-project/blob/main/llvm/lib/Target/X86/X86InstrSystem.td#L27
169 lines
6.5 KiB
Plaintext
169 lines
6.5 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
config ARCH_HAS_UBSAN
|
|
bool
|
|
|
|
menuconfig UBSAN
|
|
bool "Undefined behaviour sanity checker"
|
|
depends on ARCH_HAS_UBSAN
|
|
help
|
|
This option enables the Undefined Behaviour sanity checker.
|
|
Compile-time instrumentation is used to detect various undefined
|
|
behaviours at runtime. For more details, see:
|
|
Documentation/dev-tools/ubsan.rst
|
|
|
|
if UBSAN
|
|
|
|
config UBSAN_TRAP
|
|
bool "Abort on Sanitizer warnings (smaller kernel but less verbose)"
|
|
depends on !COMPILE_TEST
|
|
help
|
|
Building kernels with Sanitizer features enabled tends to grow
|
|
the kernel size by around 5%, due to adding all the debugging
|
|
text on failure paths. To avoid this, Sanitizer instrumentation
|
|
can just issue a trap. This reduces the kernel size overhead but
|
|
turns all warnings (including potentially harmless conditions)
|
|
into full exceptions that abort the running kernel code
|
|
(regardless of context, locks held, etc), which may destabilize
|
|
the system. For some system builders this is an acceptable
|
|
trade-off.
|
|
|
|
Also note that selecting Y will cause your kernel to Oops
|
|
with an "illegal instruction" error with no further details
|
|
when a UBSAN violation occurs. (Except on arm64 and x86, which
|
|
will report which Sanitizer failed.) This may make it hard to
|
|
determine whether an Oops was caused by UBSAN or to figure
|
|
out the details of a UBSAN violation. It makes the kernel log
|
|
output less useful for bug reports.
|
|
|
|
config CC_HAS_UBSAN_BOUNDS_STRICT
|
|
def_bool $(cc-option,-fsanitize=bounds-strict)
|
|
help
|
|
The -fsanitize=bounds-strict option is only available on GCC,
|
|
but uses the more strict handling of arrays that includes knowledge
|
|
of flexible arrays, which is comparable to Clang's regular
|
|
-fsanitize=bounds.
|
|
|
|
config CC_HAS_UBSAN_ARRAY_BOUNDS
|
|
def_bool $(cc-option,-fsanitize=array-bounds)
|
|
help
|
|
Under Clang, the -fsanitize=bounds option is actually composed
|
|
of two more specific options, -fsanitize=array-bounds and
|
|
-fsanitize=local-bounds. However, -fsanitize=local-bounds can
|
|
only be used when trap mode is enabled. (See also the help for
|
|
CONFIG_LOCAL_BOUNDS.) Explicitly check for -fsanitize=array-bounds
|
|
so that we can build up the options needed for UBSAN_BOUNDS
|
|
with or without UBSAN_TRAP.
|
|
|
|
config UBSAN_BOUNDS
|
|
bool "Perform array index bounds checking"
|
|
default UBSAN
|
|
depends on CC_HAS_UBSAN_ARRAY_BOUNDS || CC_HAS_UBSAN_BOUNDS_STRICT
|
|
help
|
|
This option enables detection of directly indexed out of bounds
|
|
array accesses, where the array size is known at compile time.
|
|
Note that this does not protect array overflows via bad calls
|
|
to the {str,mem}*cpy() family of functions (that is addressed
|
|
by CONFIG_FORTIFY_SOURCE).
|
|
|
|
config UBSAN_BOUNDS_STRICT
|
|
def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_BOUNDS_STRICT
|
|
help
|
|
GCC's bounds sanitizer. This option is used to select the
|
|
correct options in Makefile.ubsan.
|
|
|
|
config UBSAN_ARRAY_BOUNDS
|
|
def_bool UBSAN_BOUNDS && CC_HAS_UBSAN_ARRAY_BOUNDS
|
|
help
|
|
Clang's array bounds sanitizer. This option is used to select
|
|
the correct options in Makefile.ubsan.
|
|
|
|
config UBSAN_LOCAL_BOUNDS
|
|
def_bool UBSAN_ARRAY_BOUNDS && UBSAN_TRAP
|
|
help
|
|
This option enables Clang's -fsanitize=local-bounds which traps
|
|
when an access through a pointer that is derived from an object
|
|
of a statically-known size, where an added offset (which may not
|
|
be known statically) is out-of-bounds. Since this option is
|
|
trap-only, it depends on CONFIG_UBSAN_TRAP.
|
|
|
|
config UBSAN_SHIFT
|
|
bool "Perform checking for bit-shift overflows"
|
|
depends on $(cc-option,-fsanitize=shift)
|
|
help
|
|
This option enables -fsanitize=shift which checks for bit-shift
|
|
operations that overflow to the left or go switch to negative
|
|
for signed types.
|
|
|
|
config UBSAN_DIV_ZERO
|
|
bool "Perform checking for integer divide-by-zero"
|
|
depends on $(cc-option,-fsanitize=integer-divide-by-zero)
|
|
# https://github.com/ClangBuiltLinux/linux/issues/1657
|
|
# https://github.com/llvm/llvm-project/issues/56289
|
|
depends on !CC_IS_CLANG
|
|
help
|
|
This option enables -fsanitize=integer-divide-by-zero which checks
|
|
for integer division by zero. This is effectively redundant with the
|
|
kernel's existing exception handling, though it can provide greater
|
|
debugging information under CONFIG_UBSAN_REPORT_FULL.
|
|
|
|
config UBSAN_UNREACHABLE
|
|
bool "Perform checking for unreachable code"
|
|
# objtool already handles unreachable checking and gets angry about
|
|
# seeing UBSan instrumentation located in unreachable places.
|
|
depends on !(OBJTOOL && (STACK_VALIDATION || UNWINDER_ORC || HAVE_UACCESS_VALIDATION))
|
|
depends on $(cc-option,-fsanitize=unreachable)
|
|
help
|
|
This option enables -fsanitize=unreachable which checks for control
|
|
flow reaching an expected-to-be-unreachable position.
|
|
|
|
config UBSAN_SIGNED_WRAP
|
|
bool "Perform checking for signed arithmetic wrap-around"
|
|
default UBSAN
|
|
depends on !COMPILE_TEST
|
|
# The no_sanitize attribute was introduced in GCC with version 8.
|
|
depends on !CC_IS_GCC || GCC_VERSION >= 80000
|
|
depends on $(cc-option,-fsanitize=signed-integer-overflow)
|
|
help
|
|
This option enables -fsanitize=signed-integer-overflow which checks
|
|
for wrap-around of any arithmetic operations with signed integers.
|
|
This currently performs nearly no instrumentation due to the
|
|
kernel's use of -fno-strict-overflow which converts all would-be
|
|
arithmetic undefined behavior into wrap-around arithmetic. Future
|
|
sanitizer versions will allow for wrap-around checking (rather than
|
|
exclusively undefined behavior).
|
|
|
|
config UBSAN_BOOL
|
|
bool "Perform checking for non-boolean values used as boolean"
|
|
default UBSAN
|
|
depends on $(cc-option,-fsanitize=bool)
|
|
help
|
|
This option enables -fsanitize=bool which checks for boolean values being
|
|
loaded that are neither 0 nor 1.
|
|
|
|
config UBSAN_ENUM
|
|
bool "Perform checking for out of bounds enum values"
|
|
default UBSAN
|
|
depends on $(cc-option,-fsanitize=enum)
|
|
help
|
|
This option enables -fsanitize=enum which checks for values being loaded
|
|
into an enum that are outside the range of given values for the given enum.
|
|
|
|
config UBSAN_ALIGNMENT
|
|
bool "Perform checking for misaligned pointer usage"
|
|
default !HAVE_EFFICIENT_UNALIGNED_ACCESS
|
|
depends on !UBSAN_TRAP && !COMPILE_TEST
|
|
depends on $(cc-option,-fsanitize=alignment)
|
|
help
|
|
This option enables the check of unaligned memory accesses.
|
|
Enabling this option on architectures that support unaligned
|
|
accesses may produce a lot of false positives.
|
|
|
|
config TEST_UBSAN
|
|
tristate "Module for testing for undefined behavior detection"
|
|
depends on m
|
|
help
|
|
This is a test module for UBSAN.
|
|
It triggers various undefined behavior, and detect it.
|
|
|
|
endif # if UBSAN
|