github.com/google/syzkaller@v0.0.0-20251211124644-a066d2bc4b02/docs/linux/kernel_configs.md (about)

     1  # Linux kernel configs
     2  
     3  List of recommended kernel configs for `syzkaller`. See [syzbot config](/dashboard/config/linux/upstream-apparmor-kasan.config) for a reference config.
     4  
     5  ## Syzkaller features
     6  
     7  To enable coverage collection, which is extremely important for effective fuzzing:
     8  ```
     9  CONFIG_KCOV=y
    10  CONFIG_KCOV_INSTRUMENT_ALL=y
    11  CONFIG_KCOV_ENABLE_COMPARISONS=y
    12  CONFIG_DEBUG_FS=y
    13  ```
    14  Note that `CONFIG_KCOV_ENABLE_COMPARISONS` feature also requires `gcc8+` and the following commits if you are testing an old kernel:
    15  ```
    16      kcov: support comparison operands collection
    17      kcov: fix comparison callback signature
    18  ```
    19  
    20  To detect memory leaks using the [Kernel Memory Leak Detector
    21  (kmemleak)](https://www.kernel.org/doc/html/latest/dev-tools/kmemleak.html):
    22  
    23  ```
    24  CONFIG_DEBUG_KMEMLEAK=y
    25  ```
    26  
    27  To show code coverage in web interface:
    28  
    29  For Linux < 5.12
    30  ```
    31  CONFIG_DEBUG_INFO=y
    32  ```
    33  For Linux >= 5.12
    34  ```
    35  CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
    36  ```
    37  
    38  For detection of enabled syscalls and kernel bitness:
    39  ```
    40  CONFIG_KALLSYMS=y
    41  CONFIG_KALLSYMS_ALL=y
    42  ```
    43  
    44  For better sandboxing:
    45  ```
    46  CONFIG_NAMESPACES=y
    47  CONFIG_UTS_NS=y
    48  CONFIG_IPC_NS=y
    49  CONFIG_PID_NS=y
    50  CONFIG_NET_NS=y
    51  CONFIG_CGROUP_PIDS=y
    52  CONFIG_MEMCG=y
    53  ```
    54  
    55  For `namespace` sandbox:
    56  ```
    57  CONFIG_USER_NS=y
    58  ```
    59  
    60  For running in VMs `make kvm_guest.config` is generally required.
    61  
    62  Debian images produced by [tools/create-image.sh](/tools/create-image.sh) also require:
    63  ```
    64  CONFIG_CONFIGFS_FS=y
    65  CONFIG_SECURITYFS=y
    66  ```
    67  
    68  It is recommended to disable the following config (and required if your kernel doesn't have commits [arm64: setup: introduce kaslr_offset()](https://github.com/torvalds/linux/commit/7ede8665f27cde7da69e8b2fbeaa1ed0664879c5)
    69   and [kcov: make kcov work properly with KASLR enabled](https://github.com/torvalds/linux/commit/4983f0ab7ffaad1e534b21975367429736475205)):
    70  ```
    71  # CONFIG_RANDOMIZE_BASE is not set
    72  ```
    73  
    74  It is also recommended to disable the Predictable Network Interface Names mechanism. This can be done
    75  either via syzkaller configuration (see details [here](troubleshooting.md)) or by adjusting the following configs:
    76  ```
    77  CONFIG_CMDLINE_BOOL=y
    78  CONFIG_CMDLINE="net.ifnames=0"
    79  ```
    80  
    81  ## Bug detection configs
    82  
    83  Syzkaller is meant to be used with
    84  [KASAN](https://kernel.org/doc/html/latest/dev-tools/kasan.html) (available upstream with `CONFIG_KASAN=y`),
    85  [KTSAN](https://github.com/google/ktsan) (prototype available),
    86  [KMSAN](https://github.com/google/kmsan) (prototype available),
    87  or [KUBSAN](https://kernel.org/doc/html/latest/dev-tools/ubsan.html) (available upstream with `CONFIG_UBSAN=y`).
    88  
    89  Enable `KASAN` for use-after-free and out-of-bounds detection:
    90  ```
    91  CONFIG_KASAN=y
    92  CONFIG_KASAN_INLINE=y
    93  ```
    94  
    95  For testing with fault injection enable the following configs (syzkaller will pick it up automatically):
    96  ```
    97  CONFIG_FAULT_INJECTION=y
    98  CONFIG_FAULT_INJECTION_DEBUG_FS=y
    99  CONFIG_FAULT_INJECTION_USERCOPY=y
   100  CONFIG_FAILSLAB=y
   101  CONFIG_FAIL_PAGE_ALLOC=y
   102  CONFIG_FAIL_MAKE_REQUEST=y
   103  CONFIG_FAIL_IO_TIMEOUT=y
   104  CONFIG_FAIL_FUTEX=y
   105  ```
   106  Note: you also need the following commits if you are testing an old kernel:
   107  ```
   108      fault-inject: support systematic fault injection
   109      fault-inject: simplify access check for fail-nth
   110      fault-inject: fix wrong should_fail() decision in task context
   111      fault-inject: add /proc/<pid>/fail-nth
   112  ```
   113  
   114  Any other debugging configs, the more the better, here are some that proved to be especially useful:
   115  ```
   116  CONFIG_LOCKDEP=y
   117  CONFIG_PROVE_LOCKING=y
   118  CONFIG_DEBUG_ATOMIC_SLEEP=y
   119  CONFIG_PROVE_RCU=y
   120  CONFIG_DEBUG_VM=y
   121  CONFIG_REFCOUNT_FULL=y
   122  CONFIG_FORTIFY_SOURCE=y
   123  CONFIG_HARDENED_USERCOPY=y
   124  CONFIG_LOCKUP_DETECTOR=y
   125  CONFIG_SOFTLOCKUP_DETECTOR=y
   126  CONFIG_HARDLOCKUP_DETECTOR=y
   127  CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
   128  CONFIG_DETECT_HUNG_TASK=y
   129  CONFIG_WQ_WATCHDOG=y
   130  ```
   131  
   132  Increase hung/stall timeout to reduce false positive rate:
   133  ```
   134  CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=140
   135  CONFIG_RCU_CPU_STALL_TIMEOUT=100
   136  ```