KMSAN is a detector of uninitialized memory use for the Linux kernel. It is
currently in development.
- The kernel branch with KMSAN patches is available at https://github.com/google/kmsan
- These will be upstreamed someday, stay tuned!
How to build
In order to build a kernel with KMSAN you'll need a fresh Clang. Please refer to https://clang.llvm.org/get_started.html and https://llvm.org/docs/CMake.html for the instructions on how to build Clang. Otherwise, consider using prebuilt compiler binaries from the Chromium project:
cd $WORLD # Instruction taken from http://llvm.org/docs/LibFuzzer.html mkdir TMP_CLANG cd TMP_CLANG git clone https://chromium.googlesource.com/chromium/src/tools/clang cd .. TMP_CLANG/clang/scripts/update.py cd $WORLD export KMSAN_CLANG_PATH=`pwd`/third_party/llvm-build/Release+Asserts/bin/
Configure and build the kernel
cd $WORLD git clone https://github.com/google/kmsan.git kmsan cd kmsan # Now configure the kernel. You basically need to enable CONFIG_KMSAN and CONFIG_KCOV, # plus maybe some 9P options to interact with QEMU. cp .config.example .config make CC=$KMSAN_CLANG_PATH -j64 -k 2>&1 | tee build.log
Run the kernel
You can refer to https://github.com/ramosian-glider/clang-kernel-build for the instructions on running the freshly built kernel in a QEMU VM. Also consider running a KMSAN-instrumented kernel under syzkaller.
See https://github.com/google/kmsan/wiki/KMSAN-Trophies for the list of trophies.
CONFIG_DRM_AMD_DC_DCN1_0doesn't work with Clang because of https://bugs.llvm.org/show_bug.cgi?id=38738. To work around the problem, disable
CONFIG_UNWINDER_ORCdoesn't work yet, use