KMSAN (KernelMemorySanitizer)

KMSAN is a detector of uninitialized memory use for the Linux kernel. It is currently in development.

Contact: @ramosian-glider

Code

• The kernel branch with KMSAN patches is available at https://github.com/google/kmsan
• These will be upstreamed someday, stay tuned!

How to build

export WORLD=`pwd`

In order to build a kernel with KMSAN you'll need a fresh Clang. Please refer to https://clang.llvm.org/get_started.html and https://llvm.org/docs/CMake.html for the instructions on how to build Clang. Otherwise, consider using prebuilt compiler binaries from the Chromium project:

cd $WORLD
# Instruction taken from http://llvm.org/docs/LibFuzzer.html
mkdir TMP_CLANG
cd TMP_CLANG
git clone https://chromium.googlesource.com/chromium/src/tools/clang
cd ..
TMP_CLANG/clang/scripts/update.py
cd $WORLD
export KMSAN_CLANG_PATH=`pwd`/third_party/llvm-build/Release+Asserts/bin/

Configure and build the kernel

cd $WORLD
git clone https://github.com/google/kmsan.git kmsan
cd kmsan
# Now configure the kernel. You basically need to enable CONFIG_KMSAN and CONFIG_KCOV,
# plus maybe some 9P options to interact with QEMU.
cp .config.example .config
make CC=$KMSAN_CLANG_PATH -j64 -k 2>&1 | tee build.log

Run the kernel

You can refer to https://github.com/ramosian-glider/clang-kernel-build for the instructions on running the freshly built kernel in a QEMU VM. Also consider running a KMSAN-instrumented kernel under syzkaller.

Trophies

See https://github.com/google/kmsan/wiki/KMSAN-Trophies for the list of trophies.

Known issues

1. CONFIG_DRM_AMD_DC_DCN1_0 doesn't work with Clang because of https://bugs.llvm.org/show_bug.cgi?id=38738. To work around the problem, disable CONFIG_DRM_AMD_DC