KernelMemorySanitizer v4 Published While Already Having Found 300+ Kernel Bugs

Being worked on the past several years by Google engineers and others has been the KernelMemorySanitizer (KMSAN) that has already found more than 300 kernel bugs even prior to being mainlined. Sent out prior to the US holiday weekend as the fourth iteration of these patches, building off the "request for comments" sent out in 2020.

The KernelMemorySanitizer relies on LLVM/Clang instrumentation for aiming to catch uninitialized memory problems. The new KMSAN v4 patches add a KMSAN_CHECK_PARAM_RETVAL Kconfig option for toggling Clang's "-fsanitize-memory-param-retval" option to in turn provide checking for most kernel function parameters passed by value. The KMSAN patches have also been updated against the current Linux 5.19 development state.

As for the expected current state and coverage of KMSAN, Google's Alexander Potapenko commented, "This patchset allows one to boot and run a defconfig+KMSAN kernel on a QEMU without known false positives. It however doesn't guarantee there are no false positives in drivers of certain devices or less tested subsystems, although KMSAN is actively tested on syzbot with a large config."

Learn more about KMSAN via this 2020 presentation.

See the v4 patch series if interested in this KMSAN safety feature for reporting on unitialized memory use and related kernel memory problems.