0001 # SPDX-License-Identifier: GPL-2.0-only
0002
0003 # This config refers to the generic KASAN mode.
0004 config HAVE_ARCH_KASAN
0005 bool
0006
0007 config HAVE_ARCH_KASAN_SW_TAGS
0008 bool
0009
0010 config HAVE_ARCH_KASAN_HW_TAGS
0011 bool
0012
0013 config HAVE_ARCH_KASAN_VMALLOC
0014 bool
0015
0016 config ARCH_DISABLE_KASAN_INLINE
0017 bool
0018 help
0019 Disables both inline and stack instrumentation. Selected by
0020 architectures that do not support these instrumentation types.
0021
0022 config CC_HAS_KASAN_GENERIC
0023 def_bool $(cc-option, -fsanitize=kernel-address)
0024
0025 config CC_HAS_KASAN_SW_TAGS
0026 def_bool $(cc-option, -fsanitize=kernel-hwaddress)
0027
0028 # This option is only required for software KASAN modes.
0029 # Old GCC versions do not have proper support for no_sanitize_address.
0030 # See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89124 for details.
0031 config CC_HAS_WORKING_NOSANITIZE_ADDRESS
0032 def_bool !CC_IS_GCC || GCC_VERSION >= 80300
0033
0034 menuconfig KASAN
0035 bool "KASAN: dynamic memory safety error detector"
0036 depends on (((HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC) || \
0037 (HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS)) && \
0038 CC_HAS_WORKING_NOSANITIZE_ADDRESS) || \
0039 HAVE_ARCH_KASAN_HW_TAGS
0040 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB)
0041 select STACKDEPOT_ALWAYS_INIT
0042 help
0043 Enables KASAN (Kernel Address Sanitizer) - a dynamic memory safety
0044 error detector designed to find out-of-bounds and use-after-free bugs.
0045
0046 See Documentation/dev-tools/kasan.rst for details.
0047
0048 For better error reports, also enable CONFIG_STACKTRACE.
0049
0050 if KASAN
0051
0052 choice
0053 prompt "KASAN mode"
0054 default KASAN_GENERIC
0055 help
0056 KASAN has three modes:
0057
0058 1. Generic KASAN (supported by many architectures, enabled with
0059 CONFIG_KASAN_GENERIC, similar to userspace ASan),
0060 2. Software Tag-Based KASAN (arm64 only, based on software memory
0061 tagging, enabled with CONFIG_KASAN_SW_TAGS, similar to userspace
0062 HWASan), and
0063 3. Hardware Tag-Based KASAN (arm64 only, based on hardware memory
0064 tagging, enabled with CONFIG_KASAN_HW_TAGS).
0065
0066 See Documentation/dev-tools/kasan.rst for details about each mode.
0067
0068 config KASAN_GENERIC
0069 bool "Generic KASAN"
0070 depends on HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC
0071 depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS
0072 select SLUB_DEBUG if SLUB
0073 select CONSTRUCTORS
0074 help
0075 Enables Generic KASAN.
0076
0077 Requires GCC 8.3.0+ or Clang.
0078
0079 Consumes about 1/8th of available memory at kernel start and adds an
0080 overhead of ~50% for dynamic allocations.
0081 The performance slowdown is ~x3.
0082
0083 (Incompatible with CONFIG_DEBUG_SLAB: the kernel does not boot.)
0084
0085 config KASAN_SW_TAGS
0086 bool "Software Tag-Based KASAN"
0087 depends on HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS
0088 depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS
0089 select SLUB_DEBUG if SLUB
0090 select CONSTRUCTORS
0091 help
0092 Enables Software Tag-Based KASAN.
0093
0094 Requires GCC 11+ or Clang.
0095
0096 Supported only on arm64 CPUs and relies on Top Byte Ignore.
0097
0098 Consumes about 1/16th of available memory at kernel start and
0099 add an overhead of ~20% for dynamic allocations.
0100
0101 May potentially introduce problems related to pointer casting and
0102 comparison, as it embeds a tag into the top byte of each pointer.
0103
0104 (Incompatible with CONFIG_DEBUG_SLAB: the kernel does not boot.)
0105
0106 config KASAN_HW_TAGS
0107 bool "Hardware Tag-Based KASAN"
0108 depends on HAVE_ARCH_KASAN_HW_TAGS
0109 depends on SLUB
0110 help
0111 Enables Hardware Tag-Based KASAN.
0112
0113 Requires GCC 10+ or Clang 12+.
0114
0115 Supported only on arm64 CPUs starting from ARMv8.5 and relies on
0116 Memory Tagging Extension and Top Byte Ignore.
0117
0118 Consumes about 1/32nd of available memory.
0119
0120 May potentially introduce problems related to pointer casting and
0121 comparison, as it embeds a tag into the top byte of each pointer.
0122
0123 endchoice
0124
0125 choice
0126 prompt "Instrumentation type"
0127 depends on KASAN_GENERIC || KASAN_SW_TAGS
0128 default KASAN_OUTLINE
0129
0130 config KASAN_OUTLINE
0131 bool "Outline instrumentation"
0132 help
0133 Makes the compiler insert function calls that check whether the memory
0134 is accessible before each memory access. Slower than KASAN_INLINE, but
0135 does not bloat the size of the kernel's .text section so much.
0136
0137 config KASAN_INLINE
0138 bool "Inline instrumentation"
0139 depends on !ARCH_DISABLE_KASAN_INLINE
0140 help
0141 Makes the compiler directly insert memory accessibility checks before
0142 each memory access. Faster than KASAN_OUTLINE (gives ~x2 boost for
0143 some workloads), but makes the kernel's .text size much bigger.
0144
0145 endchoice
0146
0147 config KASAN_STACK
0148 bool "Stack instrumentation (unsafe)" if CC_IS_CLANG && !COMPILE_TEST
0149 depends on KASAN_GENERIC || KASAN_SW_TAGS
0150 depends on !ARCH_DISABLE_KASAN_INLINE
0151 default y if CC_IS_GCC
0152 help
0153 Disables stack instrumentation and thus KASAN's ability to detect
0154 out-of-bounds bugs in stack variables.
0155
0156 With Clang, stack instrumentation has a problem that causes excessive
0157 stack usage, see https://bugs.llvm.org/show_bug.cgi?id=38809. Thus,
0158 with Clang, this option is deemed unsafe.
0159
0160 This option is always disabled when compile-testing with Clang to
0161 avoid cluttering the log with stack overflow warnings.
0162
0163 With GCC, enabling stack instrumentation is assumed to be safe.
0164
0165 If the architecture disables inline instrumentation via
0166 ARCH_DISABLE_KASAN_INLINE, stack instrumentation gets disabled
0167 as well, as it adds inline-style instrumentation that is run
0168 unconditionally.
0169
0170 config KASAN_TAGS_IDENTIFY
0171 bool "Memory corruption type identification"
0172 depends on KASAN_SW_TAGS || KASAN_HW_TAGS
0173 help
0174 Enables best-effort identification of the bug types (use-after-free
0175 or out-of-bounds) at the cost of increased memory consumption.
0176 Only applicable for the tag-based KASAN modes.
0177
0178 config KASAN_VMALLOC
0179 bool "Check accesses to vmalloc allocations"
0180 depends on HAVE_ARCH_KASAN_VMALLOC
0181 help
0182 Makes KASAN check the validity of accesses to vmalloc allocations.
0183
0184 With software KASAN modes, all types vmalloc allocations are
0185 checked. Enabling this option leads to higher memory usage.
0186
0187 With Hardware Tag-Based KASAN, only non-executable VM_ALLOC mappings
0188 are checked. There is no additional memory usage.
0189
0190 config KASAN_KUNIT_TEST
0191 tristate "KUnit-compatible tests of KASAN bug detection capabilities" if !KUNIT_ALL_TESTS
0192 depends on KASAN && KUNIT
0193 default KUNIT_ALL_TESTS
0194 help
0195 A KUnit-based KASAN test suite. Triggers different kinds of
0196 out-of-bounds and use-after-free accesses. Useful for testing whether
0197 KASAN can detect certain bug types.
0198
0199 For more information on KUnit and unit tests in general, please refer
0200 to the KUnit documentation in Documentation/dev-tools/kunit/.
0201
0202 config KASAN_MODULE_TEST
0203 tristate "KUnit-incompatible tests of KASAN bug detection capabilities"
0204 depends on m && KASAN && !KASAN_HW_TAGS
0205 help
0206 A part of the KASAN test suite that is not integrated with KUnit.
0207 Incompatible with Hardware Tag-Based KASAN.
0208
0209 endif # KASAN
