This reverts commit cf002847a464c004a57ca4777251b1aafc33d958 i.e.,
relands ba603b5e4d44f1a25207a2a00196471d2ba93424. It was reverted
because it was subtly wrong: multiplying an uninitialized zero should
not result in an initialized zero.
This reland fixes the issue by using instrumentation analogous to
visitAnd (bitwise AND of an initialized zero and an uninitialized value
results in an initialized value). Additionally, this reland expands a
test case; fixes the commit message; and optimizes the change to avoid
the need for horizontalReduce.
The current instrumentation has false positives: it does not take into
account that multiplying an initialized zero value with an uninitialized
value results in an initialized zero value This change fixes the issue
during the multiplication step. The horizontal add step is modeled using
bitwise OR.
Future work can apply this improved handler to the AVX512 equivalent
intrinsics (x86_avx512_pmaddw_d_512, x86_avx512_pmaddubs_w_512.) and AVX
VNNI intrinsics.
With gcc 15 we end up emitting a reference to the
std::__glibcxx_assert_fail function because of this change:
361d230fd7
combined with assertion checks in the std::atomic implementation.
This reference is undefined with dfsan causing the test to fail. Fix it
by defining the macro that disables assertions.
Pull Request: https://github.com/llvm/llvm-project/pull/153873
This makes the tests pass on my AArch64 machine with 16K pages.
Not sure why some of the AArch64-specific test failures don't seem to
occur on sanitizer-aarch64-linux. I could also reproduce them by running
buildbot_cmake.sh on my machine.
Pull Request: https://github.com/llvm/llvm-project/pull/153860
This currently generates many linker warnings of this form, due to
defining mem(cpy|move|set) in every object file:
```
ld: warning: '.../build/projects/compiler-rt/lib/interception/CMakeFiles/RTInterception.ios.dir/interception_linux.cpp.o' has malformed LC_DYSYMTAB, expected 6 undefined symbols to start at index 1, found 3 undefined symbols starting at index 1
```
In order for this to actually replace these symbols on mach-o, they
would need a leading underscore, e.g. `.set _memcpy,
___sanitizer_internal_memcpy`. However doing so does not fix the
warnings, and furthermore it ends up replacing `REAL(memcpy)` calls with
`__sanitizer_internal_memcpy` in places such as
`__asan::Allocator::Reallocate`. There is no way on Apple platforms to
recreate the intended behaviour, so let's just disable this on them to
reduce warning noise.
rdar://123771479
Since we (Linaro) moved out bots to a new machine, this test has been
failing:
https://lab.llvm.org/buildbot/#/builders/121/builds/1566
Most of the time, the rss difference is greater than 512 on the first
iteration then settles down to 512 for all the rest.
```
starting rss 512
shadow pages: 1024
p = 0xe083e0800000
1536 -> 740
diff 796
1252 -> 740
diff 512
1252 -> 740
diff 512
1252 -> 740
diff 512
1252 -> 740
diff 512
1252 -> 740
diff 512
1252 -> 740
diff 512
1252 -> 740
diff 512
1252 -> 740
diff 512
1252 -> 740
diff 512
p = 0xe083e0800000
passed 1 out of 10
release-shadow.c.tmp: /home/tcwg-buildbot/worker/clang-aarch64-lld-2stage/llvm/compiler-rt/test/hwasan/TestCases/Linux/release-shadow.c:81: int main(): Assertion `success_count > total_count * 0.8' failed.
```
Given that the test was looking for a diff of at least 513, I guess that
512 is ok too.
For future reference, the original bot host was running this kernel:
Linux 5.15.0-136-generic #147-Ubuntu SMP Sat Mar 15 15:51:36 UTC 2025
aarch64 aarch64 aarch64 GNU/Linux
And the new host:
Linux 6.8.0-64-generic #67-Ubuntu SMP PREEMPT_DYNAMIC Sun Jun 15
20:23:40 UTC 2025 aarch64 aarch64 aarch64 GNU/Linux
Though the new host also has more RAM, so the kernel may be less
aggresive with memory management.
Contrary to most testcases in the libFuzzer test suite,
`focus-function.test` seems to lack the `%run` directives, which is an
inconvenience in cases when `%run` actually gets substituted for
something. This PR adds said directives.
The compiler-rt build gradually learned to target arm64e. With that, we
build builtins for arm64e, but running their tests usually isn't
possible, because most versions of macOS so far restrict arm64e (on
account of its unstable ABI).
Starting with macOS 26, arm64e executables can be run, because the
aligned linker automatically targets ptrauth ABI version 1. Without
that, (at ABI version 0) these can't be executed.
We can't rely or require new linkers (and we elsewhere explicitly
fallback to ld classic anyway), so in the meantime one way to execute
these would be to explicitly ask for ABI version 1, which we generally
try to avoid, and don't support in our llvm (which unconditionally
targets ABI version 0).
This is also an uncommon situation; sanitizer runtime tests aren't run
on arm64e today, because we haven't listed arm64e as a supported arch
yet.
Everything other than builtins also tests for execution in cmake first;
we should consider that, but it has its own problems.
So we can simply disable arm64e from tests, by filtering it out as a
valid darwin host arch, which accurately reflects reality.
When we try to add arm64e sanitizer runtime build and test support,
we'll want to change that, but that's a bigger problem than builtins.
This reverts commit 29ad073c6c325dbf92c1aa5a285ca48e55cb918b i.e.,
relands 927e19f5f3b357823f86f6c4f1378abedccadf27.
It was reverted because of buildbot breakages. This reland adds
"-pthread" and also moves the test to Posix-only.
Original commit message:
ASan's instrumentation pass uses
`ASanStackFrameLayout::ComputeASanStackFrameLayout()` to calculate the
offset of variables, taking into account alignment. However, the fake
stack frames returned by the runtime's `GetFrame()` are not guaranteed
to be sufficiently aligned (and in some cases, even guaranteed to be
misaligned), hence the offset addresses may sometimes be misaligned.
This change fixes the misalignment issue by padding the FakeStack. Every
fake stack frame is guaranteed to be aligned to the size of the frame.
The memory overhead is low: 64KB per FakeStack, compared to the
FakeStack size of ~700KB (min) to 11MB (max).
Updates the test case from
https://github.com/llvm/llvm-project/pull/152889.
Reverts llvm/llvm-project#147422
Seems to be causing problems with tracebacks. Probably the trackback
code doesn't know how to switch back to the regular stack after it gets
to the top of the signal stack.
Changes:
Apple only:
* Move OutputReport (and thus symbolization) after the locked region when reporting.
* ScopedReportBase constructor requires the thread_registry lock to be held, so the regions where ScopedReports get created must be inside the locked region.
* Bail early from MemoryAccess if we are symbolizing.
Other platforms should behave as before, outputting reports while the locks are held.
This is a follow up to https://github.com/llvm/llvm-project/pull/151120,
which delayed symbolization of ScopedReports.
rdar://152829396
ASan's instrumentation pass uses `ASanStackFrameLayout::ComputeASanStackFrameLayout()` to calculate the offset of variables, taking into account alignment. However, the fake stack frames returned by the runtime's `GetFrame()` are not guaranteed to be sufficiently aligned (and in some cases, even guaranteed to be misaligned), hence the offset addresses may sometimes be misaligned.
This change fixes the misalignment issue by padding the FakeStack. Every fake stack frame is guaranteed to be aligned to the size of the frame.
The memory overhead is low: 64KB per FakeStack, compared to the FakeStack size of ~700KB (min) to 11MB (max).
Updates the test case from https://github.com/llvm/llvm-project/pull/152889.
This test case demonstrates that ASan does not currently align FakeStack frames correctly:
- for 4KB objects on a 64KB stack, alignment is deterministically incorrect
- for objects larger than 4KB, even with large stack sizes, alignment is not guaranteed
https://github.com/llvm/llvm-project/pull/152819 will fix it.
As a consequence of the ASAN DLL's initialization process on Windows,
some flags defined by the user through overriding the
__asan_default_options() method will not be honored. More information
here: [#117925](https://github.com/llvm/llvm-project/issues/117925)
This PR aims to alleviate this for the symbolize flag in relation to
this user's concern
[here.](https://developercommunity.visualstudio.com/t/Overloading-of-__asan_default_options-/10688871)
1. Declared `Symbolizer::ClearTools()`.
2. Defined `Symbolizer::ClearTools()`. Upon invocation of the weak
function callback of `__asan_default_options()`, `Symbolizer::tools_`
will be cleared if the user specifies `symbolize=0`.
3. Added tests.
---------
Co-authored-by: MacGyver Codilla <mcodilla@microsoft.com>
SA_ONSTACK is required for certain runtimes that use small stacks, for
instance the Go runtime.
See https://github.com/golang/go/issues/49075
SA_ONSTACK is a no-op unless someone also calls sigaltstack.
No behavioral change, but eliminates potential UB in strict-alignment
systems.
The previous commit (llvm#94171) bulk-updated alignment usage to C++23
spec, but missed this occurrence.
https://github.com/llvm/llvm-project/pull/152192 forgot to make the
argument changes to Android code in UBsan minimal causing a build error
for Android LLVM:
```
/b/f/w/src/git/out/llvm-project/compiler-rt/lib/ubsan_minimal/ubsan_minimal_handlers.cpp:102:3: error: no matching function for call to 'format_msg'
102 | format_msg(kind, caller, msg_buf, msg_buf + sizeof(msg_buf));
| ^~~~~~~~~~
/b/f/w/src/git/out/llvm-project/compiler-rt/lib/ubsan_minimal/ubsan_minimal_handlers.cpp:37:13:
note: candidate function not viable: requires 5 arguments, but 4 were
provided
37 | static void format_msg(const char *kind, uintptr_t caller,
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
38 | const uintptr_t *address, char *buf,
const char *end) {
```
This change adds the address argument to abort_with_message just like
__ubsan_report_error_fatal so it can be passed to format_msg.
This adds commentary to explain why ASan does not work for AArch64
non-Android Linux with 39-bit and 42-bit VMAs (e.g.,
https://github.com/llvm/llvm-project/issues/145259).
Additionally, it updates the 42-bit VMA shadow map comment, which has
been outdated for the last 10 years
(18b2258c92df93c83bc7fce94c20baff3c06e2c6 changed 39-bit and 42-bit to
use the same offset), and adds a comment for the 48-bit VMA shadow map.
+ Changed type_mismatch minimal handler to accept and print pointer.
This will allow to distinguish null pointer use, misallignment and
incorrect object size.
The change increases binary size by ~1% and has almost no performance
impact.
Fixes#149943
There is an issue tracking lsan incompatibility on these platforms:
https://github.com/llvm/llvm-project/issues/131678. Many of these tests
are currently failing and creating CI noise.
rdar://157252316
Fixes corner cases of https://github.com/llvm/llvm-project/pull/151406:
- Don't run TestPTrace() on SPARC, because internal_fork() on SPARC
actually calls __fork(). We can't safely __fork(), because it's possible
seccomp has been configured to disallow fork() but allow clone().
- if internal_fork() fails for whatever reason, we shouldn't give up. It
is strictly worse to give up early than to attempt StopTheWorld.
Also updates some comments/TODOs.
StopTheWorld() clones a child process (with shared virtual address space
and shared TLS) that calls ptrace before releasing a mutex; the parent
process yields until the mutex is unlocked. If seccomp kills the child
process, the parent process will silently hang. The parent process
cannot use waitpid to detect that the child process has been killed,
because the processes share errno.
This patch forks the process one-time to test whether ptrace is allowed.
If it fails, it prints an informational message (though it does not
abort the sanitizer).
Fixes https://github.com/llvm/llvm-project/issues/150380 and
https://github.com/google/sanitizers/issues/777
Sanitizer-specific tests don't use the sanitizer_common flags, but the
issues they address probably also apply to the individual sanitizers.
This was observed in #119071: moving a test from sanitizer_common to
msan broke it in builds with CMAKE_SYSROOT set, because the --sysroot
argument was no longer applied to the test.
When compiling TSan I currently get a handful of warnings like this:
"warning: format specifies type 'void *' but the argument has type 'X
*'". This patch adds the necessary casts to fix them.
Make clang calls using custom suffix to allow correct calls without
reading cfg.py. As I see tests for other other specific checks are doing
it too (e.g. %clangxx_asan).
Instead of writing out in native endian, write out the raw profile bytes
in little endian. Also update the MIB data in little endian. Also clean
up some lint and unused includes in rawprofile.cpp.
Add a new configuration option QuarantineDisabled that allows all of the
quarantine code to be compiled out.
Add new tests that verify that the code is removed properly.
On Android, this saves ~4000 bytes for 32 bit and ~6000 bytes for 64
bit.
On Android, I used some microbenchmarks that do malloc/free in a loop
and for allocations in the primary, the performance is about the same
for both 32 bit and 64 bit. For secondary allocations, I saw ~8% speed
up on 32 bit and ~3% on 64 bit speed up which feels like it could just
be code size improvements.
Reapply #147854 after fixes merged in #151398.
Change memory access histogram storage from uint64_t to uint16_t to
reduce profile size on disk. This change updates the raw profile format
to v5. Also add a histogram test in compiler-rt since we didn't have one
before. With this change the histogram memprof raw for the basic test
reduces from 75KB -> 20KB.
Add the necessary sanitizer interface decls required when the memprof
runtime is built in dynamic mode. This was a latent issue since we didn't
add tests for the histogram feature in compiler-rt. These tests are run
with `ninja check-memprof-dynamic`. I discovered this after the CI
failures for #147854.
Change memory access histogram storage from uint64_t to uint16_t to
reduce profile size on disk. This change updates the raw profile format
to v5. Also add a histogram test in compiler-rt since we didn't have one
before. With this change the histogram memprof raw for the basic test
reduces from 75KB -> 20KB.
This is the refactoring portion of:
https://github.com/llvm/llvm-project/pull/149516. My aim is for this
change to replicate current behaviour - just with Symbolization done
explicitly (and later than previously).
This change will enable us to perform symboliaztion after releasing the
locks in `OutputReport`; this is necessary on Apple platforms in order
to avoid a deadlock.
This reverts commit 3c3523c15850f3c42de35ae725288368414e4e91.
Keeping the directory structure the same as before fixes the failures.
They trivially reproduced locally and only passed before because I was
not cleaning up the temp test directory in between invocations.
%T has been deprecated for about seven years and use is to be avoided
given it doesn't actually create a unique test directory per test, which
can lead to races. Remove it from compiler-rt so we can hopefully remove
it from within llvm-lit.
This patch just touches the tests. There are still uses in some
substitutions defined in compiler-rt/test/lit.common.cfg.py that I want
to leave for a separate patch because it is quite a bit more thorny.
