KernelMemorySanitizer, a detector of uses of uninitialized memory in the Linux kernel
C C++ Assembly Objective-C Makefile Perl Other
Clone or download
Failed to load latest commit information.
Documentation kmsan: docs and Jul 9, 2018
LICENSES LICENSES: Add Linux-OpenIB license text Apr 27, 2018
arch kmsan: fix CONFIG_KMSAN=n build Jul 13, 2018
block kmsan: unpoison pages allocated for reading in bio_copy_kern() Jul 9, 2018
certs certs/blacklist: fix const confusion Jun 26, 2018
crypto Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL Jun 28, 2018
drivers kmsan: preliminary support for virtual memory Jul 9, 2018
firmware kbuild: remove all dummy assignments to obj- Nov 18, 2017
fs kmsan: fix NULL deref Jul 9, 2018
include kmsan: fix CONFIG_KMSAN=n build Jul 13, 2018
init kmsan: enable KMSAN in start_kernel() Jul 9, 2018
ipc ipc: use new return type vm_fault_t Jun 14, 2018
kernel kmsan: better IRQ handling Jul 9, 2018
lib kmsan: disable strscpy() optimization under KMSAN Jul 9, 2018
mm kmsan: drop unused functions that copy shadow and origins around Jul 13, 2018
net kmsan: unpoison data in pdu_read() Jul 9, 2018
samples Revert "x86/cpufeature: Guard asm_volatile_goto usage for BPF compila… Jul 9, 2018
scripts kmsan: config changes Jul 9, 2018
security Merge tag 'selinux-pr-20180629' of git://… Jun 30, 2018
sound kmsan: unpoison the buffer in snd_pcm_oss_change_params_locked() Jul 13, 2018
tools Merge branch 'core-urgent-for-linus' of git://… Jul 8, 2018
usr kbuild: rename built-in.o to built-in.a Mar 25, 2018
virt KVM: arm64: Prevent KVM_COMPAT from being selected Jun 21, 2018
.clang-format clang-format: add configuration file Apr 11, 2018
.cocciconfig scripts: add Linux .cocciconfig for coccinelle Jul 22, 2016
.config.example kmsan: update .config.example Jul 9, 2018
.config.extended kmsan: added .config.extended Jul 9, 2018
.get_maintainer.ignore Add hch to .get_maintainer.ignore Aug 21, 2015
.gitattributes .gitattributes: set git diff driver for C source code files Oct 8, 2016
.gitignore Merge tag 'kbuild-v4.17-2' of git://… Apr 16, 2018
.mailmap Merge branch 'asoc-4.17' into asoc-4.18 for compress dependencies Apr 26, 2018
COPYING COPYING: use the new text with points to the license files Mar 23, 2018
Kbuild Merge tag 'kbuild-v4.15' of git://… Nov 18, 2017
Kconfig kconfig: add basic helper macros to scripts/Kconfig.include May 28, 2018
MAINTAINERS Merge tag 'dmaengine-fix-4.18-rc4' of git://… Jul 8, 2018
Makefile kmsan: disable asm-goto Jul 9, 2018
README Docs: Added a pointer to the formatted docs to README Mar 21, 2018 kmsan: updated LLVM/Clang patches to r334104 Jul 9, 2018
false-kmsan-cfq_init_cfqq.txt kmsan: add writeups Jul 9, 2018
kmsan-cfq_init_cfqq.txt kmsan: add writeups Jul 9, 2018
kmsan-clang.patch kmsan: updated LLVM/Clang patches to r334104 Jul 9, 2018
kmsan-epoll_ctl.txt kmsan: add writeups Jul 9, 2018
kmsan-first-bug-writeup.txt kmsan: add writeups Jul 9, 2018
kmsan-llvm.patch kmsan: updated LLVM/Clang patches to r334104 Jul 9, 2018
kmsan-packet_bind_spkt.txt kmsan: add writeups Jul 9, 2018
kmsan-radix_tree_insert.txt kmsan: add writeups Jul 9, 2018

KMSAN (KernelMemorySanitizer)

KMSAN is a detector of uninitialized memory use for the Linux kernel. It is currently in development.

Contact: ramosian-glider@


How to build

In order to build a kernel with KMSAN you'll need a custom Clang built from a patched tree on LLVM r298239.

export WORLD=`pwd`

Build Clang

# I sometimes forget to update this revision.
# Please refer to the contents of kmsan-llvm.patch in that case.
svn co -r $R llvm
cd llvm
(cd tools && svn co -r $R clang)
(cd projects && svn co -r $R compiler-rt)
patch -p0 -i kmsan-llvm.patch
(cd tools/clang && patch -p0 -i kmsan-clang.patch)
mkdir llvm_cmake_build && cd llvm_cmake_build
make -j64 clang
export KMSAN_CLANG_PATH=`pwd`/bin/clang

Configure and build the kernel

git clone kmsan
cd kmsan
# Now configure the kernel. You basically need to enable CONFIG_KMSAN and CONFIG_KCOV,
# plus maybe some 9P options to interact with QEMU.
cp .config.example .config
# Note that expects $KMSAN_CLANG_PATH to point to a Clang binary!
make CC=`pwd`/ -j64 -k 2>&1 | tee build.log

Run the kernel

You can refer to for the instructions on running the freshly built kernel in a QEMU VM. Also consider running a KMSAN-instrumented kernel under syzkaller.


See for the list of trophies.