The initial change that added kernel/configs/hardening.config attempted to disable all UBSAN sanitizers except for the array bounds one while turning on UBSAN_TRAP. Unfortunately, it only got the syntax for CONFIG_UBSAN_SHIFT correct, so configurations that are on by default with CONFIG_UBSAN=y such as CONFIG_UBSAN_{BOOL,ENUM} do not get disabled properly. CONFIG_ARCH_HAS_UBSAN=y CONFIG_UBSAN=y CONFIG_UBSAN_TRAP=y CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT=y CONFIG_UBSAN_BOUNDS=y CONFIG_UBSAN_BOUNDS_STRICT=y # CONFIG_UBSAN_SHIFT is not set # CONFIG_UBSAN_DIV_ZERO is not set # CONFIG_UBSAN_UNREACHABLE is not set CONFIG_UBSAN_SIGNED_WRAP=y CONFIG_UBSAN_BOOL=y CONFIG_UBSAN_ENUM=y # CONFIG_TEST_UBSAN is not set Add the missing 'is not set' to each configuration that needs it so that they get disabled as intended. CONFIG_ARCH_HAS_UBSAN=y CONFIG_UBSAN=y CONFIG_UBSAN_TRAP=y CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT=y CONFIG_UBSAN_BOUNDS=y CONFIG_UBSAN_BOUNDS_STRICT=y # CONFIG_UBSAN_SHIFT is not set # CONFIG_UBSAN_DIV_ZERO is not set # CONFIG_UBSAN_UNREACHABLE is not set CONFIG_UBSAN_SIGNED_WRAP=y # CONFIG_UBSAN_BOOL is not set # CONFIG_UBSAN_ENUM is not set # CONFIG_TEST_UBSAN is not set
Unified · Split
| @@ -39,11 +39,11 @@ CONFIG_UBSAN=y · 38 unmodified lines | ||
| 39 | 39 | CONFIG_UBSAN_TRAP=y |
| 40 | 40 | CONFIG_UBSAN_BOUNDS=y |
| 41 | 41 | # CONFIG_UBSAN_SHIFT is not set |
| 42 | −# CONFIG_UBSAN_DIV_ZERO | |
| 43 | −# CONFIG_UBSAN_UNREACHABLE | |
| 44 | −# CONFIG_UBSAN_BOOL | |
| 45 | −# CONFIG_UBSAN_ENUM | |
| 46 | −# CONFIG_UBSAN_ALIGNMENT | |
| 42 | +# CONFIG_UBSAN_DIV_ZERO is not set | |
| 43 | +# CONFIG_UBSAN_UNREACHABLE is not set | |
| 44 | +# CONFIG_UBSAN_BOOL is not set | |
| 45 | +# CONFIG_UBSAN_ENUM is not set | |
| 46 | +# CONFIG_UBSAN_ALIGNMENT is not set | |
| 47 | 47 | |
| 48 | 48 | # Sampling-based heap out-of-bounds and use-after-free detection. |
| 49 | 49 | CONFIG_KFENCE=y |