This reverts commit 36ca6748bc9150f8c56df6ba15deb118ff700e4a.
This broke a couple Android buildbots, theoretically due to different
directory structure that has now been addressed.
The getPageSize() function is defined in the platform-specific
source files but used in common.cpp. Every function used across
files should be declared in a header so the same declaration is
in scope for the callers and the definition.
Existing `__ubsan_report_error` should be enough to solve this.
Ability to override on two levels, may result in hard to debug bugs
when in the same binary strong __ubsan_report_error and
__ubsan_handle_##name##_minimal_abort
defined in unrelated components.
With one entry point we will have at least linking error.
Reverts llvm/llvm-project#154220
Currently with HEAP_REALLOC_IN_PLACE_ONLY a new allocation
gets returned with the content copied from the original pointer,
which gets freed.
But applications may rely on HEAP_REALLOC_IN_PLACE_ONLY returning
the same pointer as they give as input to e.g. RtlReAllocateHeap.
If e.g. growing is not possible it fails without
modifying the input pointer.
Downside of this patch is, it won't detect accesses to the area
getting "free" by a shrinking reallocation.
The test currently checks that 1-byte is allocated when malloc(0) is
called, by dereferencing the pointer.
https://github.com/llvm/llvm-project/pull/155943 changed ASan to
consider the dereference to be a heap buffer overflow. This patch
changes the test to check the allocated size is still 1-byte, but not
dereference the pointer.
This aims to fix the breakage reported in
https://github.com/llvm/llvm-project/pull/155943#issuecomment-3239543505
It also enables the test for 64-bit Windows.
In crtbegin.c, `__EH_FRAME_LIST__` was previously declared as a writable
array of pointers. This caused the linker to place .eh_frame into a
segment with read-write permissions, leading to larger virtual memory
footprint at runtime (e.g. .eh_frame mapped into both LOAD and RELRO).
Changing it to `static void * const __EH_FRAME_LIST__[]` ensures that
the section is treated as read-only, matching GCC’s behavior with
`__EH_FRAME_BEGIN__`. This prevents unnecessary RW mappings of .eh_frame
while preserving the intended semantics.
Fixes: #155764
ASan now detects dereferences of zero-sized allocations
(https://github.com/llvm/llvm-project/pull/155943; the corresponding
MSan change is https://github.com/llvm/llvm-project/pull/155944). This
appears to have detected a bug in CrossOverTest.cpp, causing a buildbot
breakage. This patch fixes the test.
Buildbot report: https://lab.llvm.org/buildbot/#/builders/4/builds/8732
```
7: ==949882==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf169cfbe0010 at pc 0xb5f45efc6d1c bp 0xffffd933e460 sp 0xffffd933e458
check:20'0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
8: READ of size 1 at 0xf169cfbe0010 thread T0
check:20'0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9: #0 0xb5f45efc6d18 in LLVMFuzzerTestOneInput /home/tcwg-buildbot/worker/clang-aarch64-sve-vls-2stage/llvm/compiler-rt/test/fuzzer/CrossOverTest.cpp:48:7
check:20'0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
check:20'1 ? possible intended match
10: #1 0xb5f45eec7288 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /home/tcwg-buildbot/worker/clang-aarch64-sve-vls-2stage/llvm/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
check:20'0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
11: #2 0xb5f45eec85d4 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) /home/tcwg-buildbot/worker/clang-aarch64-sve-vls-2stage/llvm/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:812:3
check:20'0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12: #3 0xb5f45eec8c60 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) /home/tcwg-buildbot/worker/clang-aarch64-sve-vls-2stage/llvm/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:872:3
check:20'0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13: #4 0xb5f45eeb5c64 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /home/tcwg-buildbot/worker/clang-aarch64-sve-vls-2stage/llvm/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:923:6
check:20'0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
14: #5 0xb5f45eee09d0 in main /home/tcwg-buildbot/worker/clang-aarch64-sve-vls-2stage/llvm/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
check:20'0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
For context, FuzzerLoop.cpp:812 tries empty input:
```
810 // Test the callback with empty input and never try it again.
811 uint8_t dummy = 0;
812 ExecuteCallback(&dummy, 0);
```
This fixes#146120, confirmed by the original reporter
Previously reviewed as #155181, but re-submitting for better
book-keeping.
Adds versioned pthread_cond interceptors, and the
pthread_cond_init/_destroy interceptors
When a zero-byte allocation is requested, ASan actually allocates 1-byte
for compatibility. This change poisons that byte, to detect
dereferences.
Also updates the test from #155933
When a zero-byte allocation is requested, MSan actually allocates 1-byte
for compatibility. This change poisons that byte, to detect
dereferences.
Also updates the test from #155934
This reverts commit aa4bc2ed914bd08feb90ba691bd50482e8de51eb.
As discussed on #155181 , this introduced some unneeded code. Reverting
and applying the smaller version of the fix
This reverts commit 1d3c302171692293f74f92236b446b9240774d4d.
There were three test failures:
odr-violation.cpp - Attempted to fix by keeping everything in the same
folder.
interception-in-shared-lib-test.cpp - Tried folding comments to preserve
line numberings. Almost seems like a debug info issue on PPC.
odr_c_test.c - Attempted to fix by keeping everything in the same
folder.
This patch fixes:
compiler-rt/lib/asan/tests/asan_test.cpp:398:27: error: allocation
of insufficient size '0' for type 'int' with size '4'
[-Werror,-Walloc-size]
This reverts commit 769155912787941edd32f91ef9acd7493ba64f14.
This took out at least three buildbots. Reverting until I can figure out what
is going on.
Given we are trying to deprecate %T and remove it, we also need to
remove it from the substitutions within compiler-rt. This is the last
remaining upstream user.
This slightly increases the complexity of using these substitutions
because now you need to create/cd into a %t.dir (specifically named
that) at the beginning of the directory, but I'm not sure that's more
knowledge than what was needed before to write a test using this
substitution. These tests also definitely were not race safe previously.
The majority of readily available RISC-V hardware provides sv39, rather
than
sv48. Add a memory mapping for sv39, which will allow the Go race
detector
to be used on more hardware.
This code was added in 18a7ebda99044473fdbce6376993714ff54e6690, but was
not properly reverted in d0b9c2c5647656738cda3fb670aa5d3b3a69d784.
Removing this code makes it possible to cross-compile TSan for FreeBSD
with `zig cc` which does not provide libcrypt when cross-compiling.
I also removed a `term.h` include (ncurses) which appeared to be
unnecessary and likewise prevented cross-compilation with `zig cc` from
working.
Use the system headers instead since we don't actually need anything
from libnvmm; we only care about ioctls and related structures.
This makes it possible to cross-compile TSan for NetBSD with `zig cc`
which does not provide libnvmm when cross-compiling.
I also removed a `term.h` include (ncurses) which appeared to be
unnecessary and likewise prevented cross-compilation with `zig cc` from
working.
Every once in a couple hundred runs of a downstream fuzzer test, we see
a fuzzing test freeze while waiting for a thread to be suspended. The
main thread is frozen because it's waiting to suspend either the alarm
or rss thread which is stuck waiting for an exception they sent out to
be handled. Specifically, both threads send out a synthetic
`ZX_EXCP_THREAD_STARTING` exception to be handled by the crash handling
thread which sets up an exception channel on the whole process with
`ZX_EXCEPTION_CHANNEL_DEBUGGER`. This is the only channel type that
listens to thread stop/start exceptions. Normally, the exception would
be ignored and the alarm or rss thread would continue normally once the
crash handling thread closes the read exception. However, the memory
snapshot machinery can suspend this thread while its in the process of
waiting for or handling a `ZX_EXCP_THREAD_STARTING` sent by either the
rss or alarm thread. If this is suspended first, then we attempt to
suspend either the alarm or rss thread while they're still waiting for
the crash handling thread to handle its exception, we will freeze
waiting for those threads to give the suspend signal, which they won't
because they're blocked on waiting for the exception handler. This is
the deadlock.
Until there's a way for the memory snapshot machinery to suspend the
thread while it's stuck on an exception, then we can work around this in
the meantime by just ensuring the alarm and rss threads start normally
via signals on the initial startup path. I can assert locally the
freezing doesn't occur after 6000 runs where prior we would see it every
couple hundred runs. Note this type of issue can arise again if the
fuzzing test launches any dangling threads that happen to not start yet.
One of the recommendations for writing a fuzz test is that the test may
launch threads, but they should be joined by the end of the test
(https://llvm.org/docs/LibFuzzer.html#fuzz-target), so hopefully we
won't see this type of bug rise frequently from fuzz tests. More
broadly, this can also arise if any process launches its own debugger
via `ZX_EXCEPTION_CHANNEL_DEBUGGER`, but I would think in practice this
isn't very likely to happen.
More context in https://fxbug.dev/436923423.
---------
Co-authored-by: Petr Hosek <phosek@google.com>
It broke the build:
compiler-rt/lib/hwasan/hwasan_thread.cpp:177:11: error: unknown type name 'ssize_t'; did you mean 'size_t'?
177 | (ssize_t)unique_id_, (void *)this, (void *)stack_bottom(),
| ^~~~~~~
| size_t
> This change addresses CodeQL format-string warnings across multiple
> sanitizer libraries by adding explicit casts to ensure that printf-style
> format specifiers match the actual argument types.
>
> Key updates:
> - Cast pointer arguments to (void*) when used with %p.
> - Use appropriate integer types and specifiers (e.g., size_t -> %zu,
> ssize_t -> %zd) to avoid mismatches.
> - Fix format specifier mismatches across xray, memprof, lsan, hwasan,
> dfsan.
>
> These changes are no-ops at runtime but improve type safety, silence
> static analysis warnings, and reduce the risk of UB in variadic calls.
This reverts commit d3d5751a39452327690b4e011a23de8327f02e86.
Win/ASan relies on the runtime's functions being 16-byte aligned so it
can intercept them with hotpatching. This used to be true (but not
guaranteed) until #149444.
Passing /hotpatch will give us enough alignment and generally ensure
that the functions are hotpatchable.
