github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/docs/linux/kernel_configs.md (about)

     1  # Linux kernel configs
     2  
     3  List of recommended kernel configs for `syzkaller`. See [syzbot config](/dashboard/config/linux/upstream-apparmor-kasan.config) for a reference config.
     4  
     5  ## Syzkaller features
     6  
     7  To enable coverage collection, which is extremely important for effective fuzzing:
     8  ```
     9  CONFIG_KCOV=y
    10  CONFIG_KCOV_INSTRUMENT_ALL=y
    11  CONFIG_KCOV_ENABLE_COMPARISONS=y
    12  CONFIG_DEBUG_FS=y
    13  ```
    14  Note that `CONFIG_KCOV_ENABLE_COMPARISONS` feature also requires `gcc8+` and the following commits if you are testing an old kernel:
    15  ```
    16      kcov: support comparison operands collection
    17      kcov: fix comparison callback signature
    18  ```
    19  
    20  To detect memory leaks using the [Kernel Memory Leak Detector
    21  (kmemleak)](https://www.kernel.org/doc/html/latest/dev-tools/kmemleak.html):
    22  
    23  ```
    24  CONFIG_DEBUG_KMEMLEAK=y
    25  ```
    26  
    27  To show code coverage in web interface:
    28  ```
    29  CONFIG_DEBUG_INFO=y
    30  ```
    31  
    32  For detection of enabled syscalls and kernel bitness:
    33  ```
    34  CONFIG_KALLSYMS=y
    35  CONFIG_KALLSYMS_ALL=y
    36  ```
    37  
    38  For better sandboxing:
    39  ```
    40  CONFIG_NAMESPACES=y
    41  CONFIG_UTS_NS=y
    42  CONFIG_IPC_NS=y
    43  CONFIG_PID_NS=y
    44  CONFIG_NET_NS=y
    45  CONFIG_CGROUP_PIDS=y
    46  CONFIG_MEMCG=y
    47  ```
    48  
    49  For `namespace` sandbox:
    50  ```
    51  CONFIG_USER_NS=y
    52  ```
    53  
    54  For running in VMs `make kvm_guest.config` is generally required.
    55  
    56  Debian images produced by [tools/create-image.sh](/tools/create-image.sh) also require:
    57  ```
    58  CONFIG_CONFIGFS_FS=y
    59  CONFIG_SECURITYFS=y
    60  ```
    61  
    62  It is recommended to disable the following config (and required if your kernel doesn't have commits [arm64: setup: introduce kaslr_offset()](https://github.com/torvalds/linux/commit/7ede8665f27cde7da69e8b2fbeaa1ed0664879c5)
    63   and [kcov: make kcov work properly with KASLR enabled](https://github.com/torvalds/linux/commit/4983f0ab7ffaad1e534b21975367429736475205)):
    64  ```
    65  # CONFIG_RANDOMIZE_BASE is not set
    66  ```
    67  
    68  It is also recommended to disable the Predictable Network Interface Names mechanism. This can be done
    69  either via syzkaller configuration (see details [here](troubleshooting.md)) or by adjusting the following configs:
    70  ```
    71  CONFIG_CMDLINE_BOOL=y
    72  CONFIG_CMDLINE="net.ifnames=0"
    73  ```
    74  
    75  ## Bug detection configs
    76  
    77  Syzkaller is meant to be used with
    78  [KASAN](https://kernel.org/doc/html/latest/dev-tools/kasan.html) (available upstream with `CONFIG_KASAN=y`),
    79  [KTSAN](https://github.com/google/ktsan) (prototype available),
    80  [KMSAN](https://github.com/google/kmsan) (prototype available),
    81  or [KUBSAN](https://kernel.org/doc/html/latest/dev-tools/ubsan.html) (available upstream with `CONFIG_UBSAN=y`).
    82  
    83  Enable `KASAN` for use-after-free and out-of-bounds detection:
    84  ```
    85  CONFIG_KASAN=y
    86  CONFIG_KASAN_INLINE=y
    87  ```
    88  
    89  For testing with fault injection enable the following configs (syzkaller will pick it up automatically):
    90  ```
    91  CONFIG_FAULT_INJECTION=y
    92  CONFIG_FAULT_INJECTION_DEBUG_FS=y
    93  CONFIG_FAULT_INJECTION_USERCOPY=y
    94  CONFIG_FAILSLAB=y
    95  CONFIG_FAIL_PAGE_ALLOC=y
    96  CONFIG_FAIL_MAKE_REQUEST=y
    97  CONFIG_FAIL_IO_TIMEOUT=y
    98  CONFIG_FAIL_FUTEX=y
    99  ```
   100  Note: you also need the following commits if you are testing an old kernel:
   101  ```
   102      fault-inject: support systematic fault injection
   103      fault-inject: simplify access check for fail-nth
   104      fault-inject: fix wrong should_fail() decision in task context
   105      fault-inject: add /proc/<pid>/fail-nth
   106  ```
   107  
   108  Any other debugging configs, the more the better, here are some that proved to be especially useful:
   109  ```
   110  CONFIG_LOCKDEP=y
   111  CONFIG_PROVE_LOCKING=y
   112  CONFIG_DEBUG_ATOMIC_SLEEP=y
   113  CONFIG_PROVE_RCU=y
   114  CONFIG_DEBUG_VM=y
   115  CONFIG_REFCOUNT_FULL=y
   116  CONFIG_FORTIFY_SOURCE=y
   117  CONFIG_HARDENED_USERCOPY=y
   118  CONFIG_LOCKUP_DETECTOR=y
   119  CONFIG_SOFTLOCKUP_DETECTOR=y
   120  CONFIG_HARDLOCKUP_DETECTOR=y
   121  CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
   122  CONFIG_DETECT_HUNG_TASK=y
   123  CONFIG_WQ_WATCHDOG=y
   124  ```
   125  
   126  Increase hung/stall timeout to reduce false positive rate:
   127  ```
   128  CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=140
   129  CONFIG_RCU_CPU_STALL_TIMEOUT=100
   130  ```