Skip to content

Commit

Permalink
kernel: add missing UBSAN config symbols
Browse files Browse the repository at this point in the history
Enabling KERNEL_UBSAN exposes several missing symbols. Add new kernel
build options for UBSAN_BOUNDS and UBSAN_TRAP, disable CONFIG_TEST_UBSAN
in the generic kernel configs and enable CONFIG_UBSAN_MISC in generic
5.10 config. The latter symbol was removed in later kernels, as it was
causing some issues, so just disable it in 5.10 instead of adding a
build option for it.

Fixes build failures with KERNEL_UBSAN enabled.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
  • Loading branch information
stintel committed Nov 7, 2021
1 parent ec68c75 commit c5fa7ec
Show file tree
Hide file tree
Showing 3 changed files with 26 additions and 0 deletions.
23 changes: 23 additions & 0 deletions config/Config-kernel.in
Expand Up @@ -114,13 +114,36 @@ config KERNEL_UBSAN_ALIGNMENT
Enabling this option on architectures that support unaligned
accesses may produce a lot of false positives.

config KERNEL_UBSAN_BOUNDS
bool "Perform array index bounds checking"
depends on KERNEL_UBSAN
help
This option enables detection of directly indexed out of bounds array
accesses, where the array size is known at compile time. Note that
this does not protect array overflows via bad calls to the
{str,mem}*cpy() family of functions (that is addressed by
FORTIFY_SOURCE).

config KERNEL_UBSAN_NULL
bool "Enable checking of null pointers"
depends on KERNEL_UBSAN
help
This option enables detection of memory accesses via a
null pointer.

config KERNEL_UBSAN_TRAP
bool "On Sanitizer warnings, abort the running kernel code"
depends on KERNEL_UBSAN
help
Building kernels with Sanitizer features enabled tends to grow the
kernel size by around 5%, due to adding all the debugging text on
failure paths. To avoid this, Sanitizer instrumentation can just
issue a trap. This reduces the kernel size overhead but turns all
warnings (including potentially harmless conditions) into full
exceptions that abort the running kernel code (regardless of context,
locks held, etc), which may destabilize the system. For some system
builders this is an acceptable trade-off.

config KERNEL_KASAN
bool "Compile the kernel with KASan: runtime memory debugger"
select KERNEL_SLUB_DEBUG
Expand Down
2 changes: 2 additions & 0 deletions target/linux/generic/config-5.10
Expand Up @@ -6083,6 +6083,7 @@ CONFIG_TCP_CONG_CUBIC=y
# CONFIG_TEST_STRING_HELPERS is not set
# CONFIG_TEST_STRSCPY is not set
# CONFIG_TEST_SYSCTL is not set
# CONFIG_TEST_UBSAN is not set
# CONFIG_TEST_UDELAY is not set
# CONFIG_TEST_USER_COPY is not set
# CONFIG_TEST_UUID is not set
Expand Down Expand Up @@ -6349,6 +6350,7 @@ CONFIG_UBIFS_FS_ZLIB=y
CONFIG_UBIFS_FS_ZSTD=y
# CONFIG_UBSAN is not set
CONFIG_UBSAN_ALIGNMENT=y
# CONFIG_UBSAN_MISC is not set
# CONFIG_UCB1400_CORE is not set
# CONFIG_UCSI is not set
# CONFIG_UDF_FS is not set
Expand Down
1 change: 1 addition & 0 deletions target/linux/generic/config-5.4
Expand Up @@ -5631,6 +5631,7 @@ CONFIG_TCP_CONG_CUBIC=y
# CONFIG_TEST_STRING_HELPERS is not set
# CONFIG_TEST_STRSCPY is not set
# CONFIG_TEST_SYSCTL is not set
# CONFIG_TEST_UBSAN is not set
# CONFIG_TEST_UDELAY is not set
# CONFIG_TEST_USER_COPY is not set
# CONFIG_TEST_UUID is not set
Expand Down

0 comments on commit c5fa7ec

Please sign in to comment.