The initial change that added kernel/configs/hardening.config attempted to disable all UBSAN sanitizers except for the array bounds one while turning on UBSAN_TRAP. Unfortunately, it only got the syntax for CONFIG_UBSAN_SHIFT correct, so configurations that are on by default with CONFIG_UBSAN=y such as CONFIG_UBSAN_{BOOL,ENUM} do not get disabled properly. CONFIG_ARCH_HAS_UBSAN=y CONFIG_UBSAN=y CONFIG_UBSAN_TRAP=y CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT=y CONFIG_UBSAN_BOUNDS=y CONFIG_UBSAN_BOUNDS_STRICT=y # CONFIG_UBSAN_SHIFT is not set # CONFIG_UBSAN_DIV_ZERO is not set # CONFIG_UBSAN_UNREACHABLE is not set CONFIG_UBSAN_SIGNED_WRAP=y CONFIG_UBSAN_BOOL=y CONFIG_UBSAN_ENUM=y # CONFIG_TEST_UBSAN is not set Add the missing 'is not set' to each configuration that needs it so that they get disabled as intended. CONFIG_ARCH_HAS_UBSAN=y CONFIG_UBSAN=y CONFIG_UBSAN_TRAP=y CONFIG_CC_HAS_UBSAN_BOUNDS_STRICT=y CONFIG_UBSAN_BOUNDS=y CONFIG_UBSAN_BOUNDS_STRICT=y # CONFIG_UBSAN_SHIFT is not set # CONFIG_UBSAN_DIV_ZERO is not set # CONFIG_UBSAN_UNREACHABLE is not set CONFIG_UBSAN_SIGNED_WRAP=y # CONFIG_UBSAN_BOOL is not set # CONFIG_UBSAN_ENUM is not set # CONFIG_TEST_UBSAN is not set
Unified · Split
| @@ -39,11 +39,11 @@ CONFIG_UBSAN=y · 38 unmodified lines | |||
| 39 | CONFIG_UBSAN_TRAP=y | 39 | CONFIG_UBSAN_TRAP=y |
| 40 | CONFIG_UBSAN_BOUNDS=y | 40 | CONFIG_UBSAN_BOUNDS=y |
| 41 | # CONFIG_UBSAN_SHIFT is not set | 41 | # CONFIG_UBSAN_SHIFT is not set |
| 42 | # CONFIG_UBSAN_DIV_ZERO | 42 | # CONFIG_UBSAN_DIV_ZERO is not set |
| 43 | # CONFIG_UBSAN_UNREACHABLE | 43 | # CONFIG_UBSAN_UNREACHABLE is not set |
| 44 | # CONFIG_UBSAN_BOOL | 44 | # CONFIG_UBSAN_BOOL is not set |
| 45 | # CONFIG_UBSAN_ENUM | 45 | # CONFIG_UBSAN_ENUM is not set |
| 46 | # CONFIG_UBSAN_ALIGNMENT | 46 | # CONFIG_UBSAN_ALIGNMENT is not set |
| 47 | 47 | ||
| 48 | # Sampling-based heap out-of-bounds and use-after-free detection. | 48 | # Sampling-based heap out-of-bounds and use-after-free detection. |
| 49 | CONFIG_KFENCE=y | 49 | CONFIG_KFENCE=y |