1 # This config refers to the generic KASAN mode.
5 config HAVE_ARCH_KASAN_SW_TAGS
8 config CC_HAS_KASAN_GENERIC
9 def_bool $(cc-option, -fsanitize=kernel-address)
11 config CC_HAS_KASAN_SW_TAGS
12 def_bool $(cc-option, -fsanitize=kernel-hwaddress)
15 bool "KASAN: runtime memory debugger"
16 depends on (HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC) || \
17 (HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS)
18 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB)
20 Enables KASAN (KernelAddressSANitizer) - runtime memory debugger,
21 designed to find out-of-bounds accesses and use-after-free bugs.
22 See Documentation/dev-tools/kasan.rst for details.
29 KASAN has two modes: generic KASAN (similar to userspace ASan,
30 x86_64/arm64/xtensa, enabled with CONFIG_KASAN_GENERIC) and
31 software tag-based KASAN (a version based on software memory
32 tagging, arm64 only, similar to userspace HWASan, enabled with
33 CONFIG_KASAN_SW_TAGS).
34 Both generic and tag-based KASAN are strictly debugging features.
38 depends on HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC
39 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB)
40 select SLUB_DEBUG if SLUB
44 Enables generic KASAN mode.
45 Supported in both GCC and Clang. With GCC it requires version 4.9.2
46 or later for basic support and version 5.0 or later for detection of
47 out-of-bounds accesses for stack and global variables and for inline
48 instrumentation mode (CONFIG_KASAN_INLINE). With Clang it requires
49 version 3.7.0 or later and it doesn't support detection of
50 out-of-bounds accesses for global variables yet.
51 This mode consumes about 1/8th of available memory at kernel start
52 and introduces an overhead of ~x1.5 for the rest of the allocations.
53 The performance slowdown is ~x3.
54 For better error detection enable CONFIG_STACKTRACE.
55 Currently CONFIG_KASAN_GENERIC doesn't work with CONFIG_DEBUG_SLAB
56 (the resulting kernel does not boot).
59 bool "Software tag-based mode"
60 depends on HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS
61 depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB)
62 select SLUB_DEBUG if SLUB
66 Enables software tag-based KASAN mode.
67 This mode requires Top Byte Ignore support by the CPU and therefore
68 is only supported for arm64.
69 This mode requires Clang version 7.0.0 or later.
70 This mode consumes about 1/16th of available memory at kernel start
71 and introduces an overhead of ~20% for the rest of the allocations.
72 This mode may potentially introduce problems relating to pointer
73 casting and comparison, as it embeds tags into the top byte of each
75 For better error detection enable CONFIG_STACKTRACE.
76 Currently CONFIG_KASAN_SW_TAGS doesn't work with CONFIG_DEBUG_SLAB
77 (the resulting kernel does not boot).
82 prompt "Instrumentation type"
87 bool "Outline instrumentation"
89 Before every memory access compiler insert function call
90 __asan_load*/__asan_store*. These functions performs check
91 of shadow memory. This is slower than inline instrumentation,
92 however it doesn't bloat size of kernel's .text section so
96 bool "Inline instrumentation"
98 Compiler directly inserts code checking shadow memory before
99 memory accesses. This is faster than outline (in some workloads
100 it gives about x2 boost over outline instrumentation), but
101 make kernel's .text size much bigger.
102 For CONFIG_KASAN_GENERIC this requires GCC 5.0 or later.
106 config KASAN_S390_4_LEVEL_PAGING
107 bool "KASan: use 4-level paging"
108 depends on KASAN && S390
110 Compiling the kernel with KASan disables automatic 3-level vs
111 4-level paging selection. 3-level paging is used by default (up
112 to 3TB of RAM with KASan enabled). This options allows to force
113 4-level paging instead.
116 tristate "Module for testing KASAN for bug detection"
117 depends on m && KASAN
119 This is a test module doing various nasty things like
120 out of bounds accesses, use after free. It is useful for testing
121 kernel debugging features like KASAN.