linux-kernel - [PATCH] kasan: Add CONFIG_KASAN_WHITELIST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Sep 2023 09:45:59 +0530
From:   Joey Jiao <quic_jiangenj@...cinc.com>
To:     <kasan-dev@...glegroups.com>
CC:     <quic_jiangenj@...cinc.com>, <quic_likaid@...cinc.com>,
        Andrey Ryabinin <ryabinin.a.a@...il.com>,
        Alexander Potapenko <glider@...gle.com>,
        "Andrey Konovalov" <andreyknvl@...il.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Nathan Chancellor <nathan@...nel.org>,
        "Nick Desaulniers" <ndesaulniers@...gle.com>,
        Nicolas Schier <nicolas@...sle.eu>,
        <linux-kernel@...r.kernel.org>, <linux-kbuild@...r.kernel.org>
Subject: [PATCH] kasan: Add CONFIG_KASAN_WHITELIST_ONLY mode

Fow low memory device, full enabled kasan just not work.
Set KASAN_SANITIZE to n when CONFIG_KASAN_WHITELIST_ONLY=y.
So we can enable kasan for single file or module.

Signed-off-by: Joey Jiao <quic_jiangenj@...cinc.com>
---
 lib/Kconfig.kasan    | 8 ++++++++
 scripts/Makefile.lib | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index fdca89c05745..1cec4e204831 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -153,6 +153,14 @@ config KASAN_INLINE
 
 endchoice
 
+config KASAN_WHITELIST_ONLY
+	bool "Whitelist only KASAN"
+	depends on KASAN && !KASAN_HW_TAGS
+	default n
+	help
+	  Say Y here to only enable KASAN for module or files which has explicitly
+	  set KASAN_SANITIZE:=y which is helpful especially for memory limited devices.
+
 config KASAN_STACK
 	bool "Stack instrumentation (unsafe)" if CC_IS_CLANG && !COMPILE_TEST
 	depends on KASAN_GENERIC || KASAN_SW_TAGS
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 68d0134bdbf9..e8d608ea369c 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -158,6 +158,9 @@ endif
 #
 ifeq ($(CONFIG_KASAN),y)
 ifneq ($(CONFIG_KASAN_HW_TAGS),y)
+ifeq ($(CONFIG_KASAN_WHITELIST_ONLY),y)
+KASAN_SANITIZE ?= n
+endif
 _c_flags += $(if $(patsubst n%,, \
 		$(KASAN_SANITIZE_$(basetarget).o)$(KASAN_SANITIZE)y), \
 		$(CFLAGS_KASAN), $(CFLAGS_KASAN_NOSANITIZE))
-- 
2.38.1