ubsan: add trap instrumentation option (0887a7eb) · Commits · 戴 / test

Patch series "ubsan: Split out bounds checker", v5. This splits out the bounds checker so it can be individually used. This is enabled in Android and hopefully for syzbot. Includes LKDTM tests for behavioral corner-cases (beyond just the bounds checker), and adjusts ubsan and kasan slightly for correct panic handling. This patch (of 6): The Undefined Behavior Sanitizer can operate in two modes: warning reporting mode via lib/ubsan.c handler calls, or trap mode, which uses __builtin_trap() as the handler. Using lib/ubsan.c means the kernel image is about 5% larger (due to all the debugging text and reporting structures to capture details about the warning conditions). Using the trap mode, the image size changes are much smaller, though at the loss of the "warning only" mode. In order to give greater flexibility to system builders that want minimal changes to image size and are prepared to deal with kernel code being aborted and potentially destabilizing the system, this introduces CONFIG_UBSAN_TRAP. The resulting image sizes comparison: text data bss dec hex filename 19533663 6183037 18554956 44271656 2a38828 vmlinux.stock 19991849 7618513 18874448 46484810 2c54d4a vmlinux.ubsan 19712181 6284181 18366540 44362902 2a4ec96 vmlinux.ubsan-trap CONFIG_UBSAN=y: image +4.8% (text +2.3%, data +18.9%) CONFIG_UBSAN_TRAP=y: image +0.2% (text +0.9%, data +1.6%) Additionally adjusts the CONFIG_UBSAN Kconfig help for clarity and removes the mention of non-existing boot param "ubsan_handle". Suggested-by:

Elena Petrova <lenaptr@google.com> Signed-off-by:

Kees Cook <keescook@chromium.org> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Acked-by:

Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Andrey Konovalov <andreyknvl@google.com> Cc: Alexander Potapenko <glider@google.com> Cc: Dan Carpenter <dan.carpenter@oracle.com> Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Link: http://lkml.kernel.org/r/20200227193516.32566-2-keescook@chromium.org Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

lib/Kconfig.ubsan

+18 −4

Original line number	Diff line number	Diff line
		@@ -5,11 +5,25 @@ config ARCH_HAS_UBSAN_SANITIZE_ALL
		config UBSAN
		bool "Undefined behaviour sanity checker"
		help
		This option enables undefined behaviour sanity checker
		This option enables the Undefined Behaviour sanity checker.
		Compile-time instrumentation is used to detect various undefined
		behaviours in runtime. Various types of checks may be enabled
		via boot parameter ubsan_handle
		(see: Documentation/dev-tools/ubsan.rst).
		behaviours at runtime. For more details, see:
		Documentation/dev-tools/ubsan.rst

		config UBSAN_TRAP
		bool "On Sanitizer warnings, abort the running kernel code"
		depends on UBSAN
		depends on $(cc-option, -fsanitize-undefined-trap-on-error)
		help
		Building kernels with Sanitizer features enabled tends to grow
		the kernel size by around 5%, due to adding all the debugging
		text on failure paths. To avoid this, Sanitizer instrumentation
		can just issue a trap. This reduces the kernel size overhead but
		turns all warnings (including potentially harmless conditions)
		into full exceptions that abort the running kernel code
		(regardless of context, locks held, etc), which may destabilize
		the system. For some system builders this is an acceptable
		trade-off.

		config UBSAN_SANITIZE_ALL
		bool "Enable instrumentation for the entire kernel"

lib/Makefile

+2 −0

Original line number	Diff line number	Diff line
		@@ -286,7 +286,9 @@ quiet_cmd_build_OID_registry = GEN $@
		clean-files += oid_registry_data.c

		obj-$(CONFIG_UCS2_STRING) += ucs2_string.o
		ifneq ($(CONFIG_UBSAN_TRAP),y)
		obj-$(CONFIG_UBSAN) += ubsan.o
		endif

		UBSAN_SANITIZE_ubsan.o := n
		KASAN_SANITIZE_ubsan.o := n

scripts/Makefile.ubsan

+7 −2

Original line number	Diff line number	Diff line
		# SPDX-License-Identifier: GPL-2.0
		ifdef CONFIG_UBSAN

		ifdef CONFIG_UBSAN_ALIGNMENT
		CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment)
		endif

		CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift)
		CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero)
		CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable)
		@@ -9,8 +14,8 @@ ifdef CONFIG_UBSAN
		CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool)
		CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum)

		ifdef CONFIG_UBSAN_ALIGNMENT
		CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment)
		ifdef CONFIG_UBSAN_TRAP
		CFLAGS_UBSAN += $(call cc-option, -fsanitize-undefined-trap-on-error)
		endif

		# -fsanitize=* options makes GCC less smart than usual and

Admin message