# SPDX-License-Identifier: GPL-2.0-only
# This config refers to the generic [31mCONFIG_KASAN[0m mode.
config [31mCONFIG_HAVE_ARCH_KASAN[0m
bool
config [31mCONFIG_HAVE_ARCH_KASAN_SW_TAGS[0m
bool
config [31mCONFIG_CC_HAS_KASAN_GENERIC[0m
def_bool $(cc-option, -fsanitize=kernel-address)
config [31mCONFIG_CC_HAS_KASAN_SW_TAGS[0m
def_bool $(cc-option, -fsanitize=kernel-hwaddress)
config [31mCONFIG_KASAN[0m
bool "KASAN: runtime memory debugger"
depends on ([31mCONFIG_HAVE_ARCH_KASAN[0m && [31mCONFIG_CC_HAS_KASAN_GENERIC[0m) || \
([31mCONFIG_HAVE_ARCH_KASAN_SW_TAGS[0m && [31mCONFIG_CC_HAS_KASAN_SW_TAGS[0m)
depends on ([31mCONFIG_SLUB[0m && [31mCONFIG_SYSFS[0m) || ([31mCONFIG_SLAB[0m && ![31mCONFIG_DEBUG_SLAB[0m)
help
Enables [31mCONFIG_KASAN[0m (KernelAddressSANitizer) - runtime memory debugger,
designed to find out-of-bounds accesses and use-after-free bugs.
See Documentation/dev-tools/kasan.rst for details.
choice
prompt "KASAN mode"
depends on [31mCONFIG_KASAN[0m
default [31mCONFIG_KASAN_GENERIC[0m
help
[31mCONFIG_KASAN[0m has two modes: generic [31mCONFIG_KASAN[0m (similar to userspace ASan,
x86_64/arm64/xtensa, enabled with CONFIG_KASAN_GENERIC) and
software tag-based [31mCONFIG_KASAN[0m (a version based on software memory
tagging, arm64 only, similar to userspace HWASan, enabled with
CONFIG_KASAN_SW_TAGS).
Both generic and tag-based [31mCONFIG_KASAN[0m are strictly debugging features.
config [31mCONFIG_KASAN_GENERIC[0m
bool "Generic mode"
depends on [31mCONFIG_HAVE_ARCH_KASAN[0m && [31mCONFIG_CC_HAS_KASAN_GENERIC[0m
depends on ([31mCONFIG_SLUB[0m && [31mCONFIG_SYSFS[0m) || ([31mCONFIG_SLAB[0m && ![31mCONFIG_DEBUG_SLAB[0m)
select [31mCONFIG_SLUB_DEBUG[0m if [31mCONFIG_SLUB[0m
select [31mCONFIG_CONSTRUCTORS[0m
select [31mCONFIG_STACKDEPOT[0m
help
Enables generic [31mCONFIG_KASAN[0m mode.
Supported in both GCC and Clang. With GCC it requires version 4.9.2
or later for basic support and version 5.0 or later for detection of
out-of-bounds accesses for stack and global variables and for inline
instrumentation mode (CONFIG_KASAN_INLINE). With Clang it requires
version 3.7.0 or later and it doesn't support detection of
out-of-bounds accesses for global variables yet.
This mode consumes about 1/8th of available memory at kernel start
and introduces an overhead of ~x1.5 for the rest of the allocations.
The performance slowdown is ~x3.
For better error detection enable CONFIG_STACKTRACE.
Currently CONFIG_KASAN_GENERIC doesn't work with CONFIG_DEBUG_SLAB
(the resulting kernel does not boot).
config [31mCONFIG_KASAN_SW_TAGS[0m
bool "Software tag-based mode"
depends on [31mCONFIG_HAVE_ARCH_KASAN_SW_TAGS[0m && [31mCONFIG_CC_HAS_KASAN_SW_TAGS[0m
depends on ([31mCONFIG_SLUB[0m && [31mCONFIG_SYSFS[0m) || ([31mCONFIG_SLAB[0m && ![31mCONFIG_DEBUG_SLAB[0m)
select [31mCONFIG_SLUB_DEBUG[0m if [31mCONFIG_SLUB[0m
select [31mCONFIG_CONSTRUCTORS[0m
select [31mCONFIG_STACKDEPOT[0m
help
Enables software tag-based [31mCONFIG_KASAN[0m mode.
This mode requires Top Byte Ignore support by the CPU and therefore
is only supported for arm64.
This mode requires Clang version 7.0.0 or later.
This mode consumes about 1/16th of available memory at kernel start
and introduces an overhead of ~20% for the rest of the allocations.
This mode may potentially introduce problems relating to pointer
casting and comparison, as it embeds tags into the top byte of each
pointer.
For better error detection enable CONFIG_STACKTRACE.
Currently CONFIG_KASAN_SW_TAGS doesn't work with CONFIG_DEBUG_SLAB
(the resulting kernel does not boot).
endchoice
choice
prompt "Instrumentation type"
depends on [31mCONFIG_KASAN[0m
default [31mCONFIG_KASAN_OUTLINE[0m
config [31mCONFIG_KASAN_OUTLINE[0m
bool "Outline instrumentation"
help
Before every memory access compiler insert function call
__asan_load*/__asan_store*. These functions performs check
of shadow memory. This is slower than inline instrumentation,
however it doesn't bloat size of kernel's .text section so
much as inline does.
config [31mCONFIG_KASAN_INLINE[0m
bool "Inline instrumentation"
help
Compiler directly inserts code checking shadow memory before
memory accesses. This is faster than outline (in some workloads
it gives about x2 boost over outline instrumentation), but
make kernel's .text size much bigger.
For CONFIG_KASAN_GENERIC this requires GCC 5.0 or later.
endchoice
config [31mCONFIG_KASAN_STACK_ENABLE[0m
bool "Enable stack instrumentation (unsafe)" if [31mCONFIG_CC_IS_CLANG[0m && ![31mCONFIG_COMPILE_TEST[0m
depends on [31mCONFIG_KASAN[0m
help
The LLVM stack address sanitizer has a know problem that
causes excessive stack usage in a lot of functions, see
https://bugs.llvm.org/show_bug.cgi?id=38809
Disabling asan-stack makes it safe to run kernels build
with clang-8 with [31mCONFIG_KASAN[0m enabled, though it loses some of
the functionality.
This feature is always disabled when compile-testing with clang
to avoid cluttering the output in stack overflow warnings,
but clang users can still enable it for builds without
CONFIG_COMPILE_TEST. On gcc it is assumed to always be safe
to use and enabled by default.
config [31mCONFIG_KASAN_STACK[0m
int
default 1 if [31mCONFIG_KASAN_STACK_ENABLE[0m || [31mCONFIG_CC_IS_GCC[0m
default 0
config [31mCONFIG_KASAN_S390_4_LEVEL_PAGING[0m
bool "KASan: use 4-level paging"
depends on [31mCONFIG_KASAN[0m && [31mCONFIG_S390[0m
help
Compiling the kernel with KASan disables automatic 3-level vs
4-level paging selection. 3-level paging is used by default (up
to 3TB of RAM with KASan enabled). This options allows to force
4-level paging instead.
config [31mCONFIG_KASAN_SW_TAGS_IDENTIFY[0m
bool "Enable memory corruption identification"
depends on [31mCONFIG_KASAN_SW_TAGS[0m
help
This option enables best-effort identification of bug type
(use-after-free or out-of-bounds) at the cost of increased
memory consumption.
config [31mCONFIG_TEST_KASAN[0m
tristate "Module for testing KASAN for bug detection"
depends on m && [31mCONFIG_KASAN[0m
help
This is a test module doing various nasty things like
out of bounds accesses, use after free. It is useful for testing
kernel debugging features like [31mCONFIG_KASAN[0m.