Re: [PATCH] kbuild: ubsan: skip UBSAN for external modules by default

Re: [PATCH] kbuild: ubsan: skip UBSAN for external modules by default

[Nathan Chancellor]

+ Kees and linux-hardening@ for visibility

On Thu, Aug 20, 2026 at 09:01:58PM +0200, Ferran Duarri wrote:
> External modules built with KBUILD_EXTMOD set inherit UBSAN sanitizer
> flags from the kernel's KBUILD_CFLAGS because is-kernel-object is 'y'
> for any obj-m object. This silently breaks third-party modules whose
> source code (e.g. VMware vmnet/vmmon) triggers UBSAN UB checks at
> runtime, causing packet-forwarding failures and VM instability while
> the module itself loads successfully.
> 
> Make UBSAN opt-in for external modules: skip the is-kernel-object 'y'
> fallback when KBUILD_EXTMOD is set. External modules that explicitly
> need UBSAN can still opt in by setting UBSAN_SANITIZE := y.
> 
> In-kernel module builds are not affected.
> Signed-off-by: Ferran Duarri <ferran.duarri@me.com>

I am open to other opinions but I am not inclined to apply this change.
If an external module has issues with these checks, it should either be
fixed or 'UBSAN_SANITIZE := n' can be added to the module's Makefile,
rather than making the default worse for everyone else, especially given
the importance of UBSAN_BOUNDS for avoiding out of bounds accesses and
writes.

-- 
Cheers,
Nathan

Re: [PATCH] kbuild: ubsan: skip UBSAN for external modules by default

[Nicolas Schier]

On Fri, Aug 21, 2026 at 12:07:01PM -0700, Nathan Chancellor wrote:
> + Kees and linux-hardening@ for visibility
> 
> On Thu, Aug 20, 2026 at 09:01:58PM +0200, Ferran Duarri wrote:
> > External modules built with KBUILD_EXTMOD set inherit UBSAN sanitizer
> > flags from the kernel's KBUILD_CFLAGS because is-kernel-object is 'y'
> > for any obj-m object. This silently breaks third-party modules whose
> > source code (e.g. VMware vmnet/vmmon) triggers UBSAN UB checks at
> > runtime, causing packet-forwarding failures and VM instability while
> > the module itself loads successfully.
> > 
> > Make UBSAN opt-in for external modules: skip the is-kernel-object 'y'
> > fallback when KBUILD_EXTMOD is set. External modules that explicitly
> > need UBSAN can still opt in by setting UBSAN_SANITIZE := y.
> > 
> > In-kernel module builds are not affected.
> > Signed-off-by: Ferran Duarri <ferran.duarri@me.com>
> 
> I am open to other opinions but I am not inclined to apply this change.
> If an external module has issues with these checks, it should either be
> fixed or 'UBSAN_SANITIZE := n' can be added to the module's Makefile,
> rather than making the default worse for everyone else, especially given
> the importance of UBSAN_BOUNDS for avoiding out of bounds accesses and
> writes.

Yes, I second that.

-- 
Nicolas