Don't enable CFI diagnostics by default when applying it in include
paths. Part of a broader effort to remove diagnostics mode from CFI
across the board.
This should reduce performance overhead and also allows the minimal
runtime to work when other ubsan sanitizers are enabled. CFI stack
dumps should include a CFI related function, so it should be apparent
when a crash is CFI-related.
Bug: 117417735
Test: make -j
Change-Id: I3d6326e06d7aa7d9c00382f336301ecb822ae7ec
This adds an option to turn off Scudo globally, and use it for Go.
Bug: 123228023
Test: verify that Scudo is disabled for a Go build, eg:
lunch marlin_svelte-eng && m -j, check that Scudo is not linked in
out/target/product/marlin/system/bin/mediaextractor
Test: verify that Scudo is enabled otherwise, eg:
lunch marlin-eng && m -j, check that Scudo is linked in
out/target/product/marlin/system/bin/mediaextractor
Change-Id: Idc82d581fade544a474e6f2ff0b54dd191ba0818
Merged-In: Idc82d581fade544a474e6f2ff0b54dd191ba0818
This commit fixes `linker_asan[64]` apex bootstrap build errors.
Without this change, `make -j SANITIZE_TARGET=address` results in:
FAILED: ninja: 'out/target/product/walleye/system/bin/linker_asan64',
needed by 'out/target/product/walleye/system/bin/app_process64',
missing and no known rule to make it
Test: lunch aosp_walleye-userdebug && make SANITIZE_TARGET=address
Change-Id: I980a36499cd327db307321fc8e4548925e7d56bf
Native tests (BUILD_NATIVE_TEST) use their own MODULE_CLASS.
Check for it when selecting the linker for ASAN.
Test: build a native test, readelf -l <test> | grep linker
Change-Id: I34ca8c443c792bdf8b4b1fa812806c56f13a72d0
Add a LOCAL_SANITIZE_NO_RECOVER variable that allows specifying which
sanitizers running in diagnostics mode shouldn't recover. This can help
debugging as we test enabling sanitizers in new libraries since it'll
cause tombstones to be generated along with the diagnostics information.
Bug: 80195448
Bug: 110791537
Test: Compiled test module with this flag, checked compiler command.
Test: Test module crashed, tombstone contained diagnostics information.
Change-Id: I441b9c873e54bf6404325f4d0ac59835350c2889
Same as soong. This needs do match, otherwise, for example, CFI may be
disable in a static library in soong, and left enabled in a shared
library in make; that would not work as CFI only supports DSO granularity.
Bug: 120508119, 112709969
Change-Id: I00d6b1c9c373bcb6804c135407c6eeae88b375b6
Test: hwasan build of master branch boots
* New clang compiler makes some integer santizers enabling
implicit-integer-sign-change, but Android code does not
boot with this new sanitizer yet.
Bug: 119329758
Test: build and boot with new clang compiler
Change-Id: Ic80cde49d3ef51277fbe2a0aa8c1b8f2f8bfd80c
They are executables, but they are not EXECUTABLES.
Bug: 112438058
Test: make SANITIZE_TARGET=hwaddress tests
Change-Id: I0f5d8d6259d7df4196bde50ec553b73099f2c8ac
Scudo is now compatible with the -fsanitize-minimal-runtime, and offers a new
dynamic library that doesn't bundle UBSan.
This patch adds support for this new library in make, preferring it over the
full one, unless a diagnostic dependency is found.
Test: aosp compiled with m -j
Test: local test enabling Scudo for mediaextractor
Change-Id: I99ac0d410b1619de09783f5009476c1ea2995f98
It allows use of sanitizer preprocessor macros (like __has_feature())
in assembly files.
Bug: 112438058
Test: SANITIZE_TARGET=hwaddress
Change-Id: If9da7493d69fa2e03649754c38117e36eb8d222c
Build/make support for "hwaddress".
* HWASan supports static binaries, unlike ASan.
* It will be used to build libc. Since static libraries get a .hwasan
suffix in soong, the logic that moves libc-and-friends to the end
of the link command line has to be updated.
Bug: 112438058
Test: manual, part of a bigger patch set
Change-Id: I3b52336841012622771a88ba161916bc33071dfe
The latter is not module-specific and prevents santizer configuration
for all host modules.
Test: mma HOST_SANITIZE=address hardware/google/apf
Change-Id: I62a448973c1d6526e4b475f3288996e44c88fbc9
Scudo is a hardened usermode allocator that is part of LLVM's compiler-rt
project (home of the Sanitizers). clang allows for -fsanitize=scudo as a
possible command line option to link the shared Scudo library to a binary.
This patch add Scudo as a potential sanitize option. Scudo is not compatible
with ASan and TSan and will be disabled if either is enabled.
Test: aosp compiled with m -j
Test: local experiment with LOCAL_SANITIZE := scudo to ensure that a test
target (mediaserver) could be linked with scudo.
Change-Id: I462843b9d5512fba2c4a3ac1a0c356ca90bce4e5
This CL enables CFI on security sensitive components for product
configs that inherit core_64_bit.mk (and core_64_bit_only.mk). Note
that this only requests the build system to do so. Internal build
logic will dictate if this is actually enabled on the build or
not (CFI is currently disabled for ARM32 and MIPS for example).
In addition, this also restricts CFI_INCLUDE_PATHS and
PRODUCT_CFI_INCLUDE_PATHS to Arm64 architectures only. This helps
narrow which targets enable CFI out of the box.
Bug: 66301104
Test: CFI is enabled on aosp_* targets
Change-Id: I52af499dc34cd4b42fbfb1175f6a37aaf17b65dd
When linking in the UBSan minimal runtime, don't export the symbols.
This was resulting in an edge case where symbols were sometimes
undefined at runtime on address sanitized builds if static library
dependencies were integer overflow sanitized.
Bug: 78766744
Test: readelf on libraries show either inclusion of the shared library
or no undefined symbols related to the minimal runtime.
Change-Id: I4382cc72baefd7fa96cd83e8349e82f7b083f5aa
Merged-In: I4382cc72baefd7fa96cd83e8349e82f7b083f5aa
(cherry picked from commit e508169caf)
When linking in the UBSan minimal runtime, don't export the symbols.
This was resulting in an edge case where symbols were sometimes
undefined at runtime on address sanitized builds if static library
dependencies were integer overflow sanitized.
Bug: 78766744
Test: readelf on libraries show either inclusion of the shared library
or no undefined symbols related to the minimal runtime.
Change-Id: I4382cc72baefd7fa96cd83e8349e82f7b083f5aa
This CL changes PRODUCT_CFI_INCLUDE_PATHS to be included in all
product configs by default. To maintain the status quo, the sanitizer
logic has been modified to only respect this product config for Arm64
devices (where this was previously enabled).
Bug: 63926619
Test: m -j60 # the device still has CFI enabled thanks to the default
opt-in
Change-Id: I22788d92be881d3290568488f5458c85e02ee8c7
AUX modules are not necessarily using the same toolchain
as the TARGET modules. they don't have to depend on
this library.
Bug: 77221668
Change-Id: Ib50cf0eb26c257ae3eb69a43aa1a12c41d5d39b0
Merged-In: Ib50cf0eb26c257ae3eb69a43aa1a12c41d5d39b0
Signed-off-by: Alexey Polyudov <apolyudov@google.com>
(cherry picked from commit e98e5625ad)
AUX modules are not necessarily using the same toolchain
as the TARGET modules. they don't have to depend on
this library.
Change-Id: Ib50cf0eb26c257ae3eb69a43aa1a12c41d5d39b0
Signed-off-by: Alexey Polyudov <apolyudov@google.com>
This allows the integer_overflow LOCAL_SANITIZE setting to be used with
static targets, to mirror Soong.
Bug: 73283972
Test: make SANITIZE_TARGET{,_DIAG}=integer_overflow
Test: Enabled sanitizer in a static target and tested for SIGABRT.
Change-Id: I0103dc3485b63b86a3dd36a7277b5001813b37fd
Adds Make support for -fsanitze-minimal-runtime when using
the integer overflow sanitizers. This makes the crashes due to these
sanitizers less mysterious. This also cleans up the handling of the
integer_overflow flag.
Bug: 64091660
Test: Compiled and checked the generated compiler commands
Test: Checked program that overflows for the abort reason
Test: Checked integer_overflow flag still emits overflow checks
Change-Id: I11012ed0cbbf51935f549a08bd17109b5ce6f330
Merged-In: I11012ed0cbbf51935f549a08bd17109b5ce6f330
(cherry picked from commit 911cb99bc1)
Adds Make support for -fsanitze-minimal-runtime when using
the integer overflow sanitizers. This makes the crashes due to these
sanitizers less mysterious. This also cleans up the handling of the
integer_overflow flag.
Bug: 64091660
Test: Compiled and checked the generated compiler commands
Test: Checked program that overflows for the abort reason
Test: Checked integer_overflow flag still emits overflow checks
Change-Id: I11012ed0cbbf51935f549a08bd17109b5ce6f330
Enables signed and unsigned integer overflow sanitization on-by-default
for modules in frameworks/ and system/ by using the integer_overflow
sanitization setting. This applies sanitization to dynamically linked
binaries and shared libraries, and comes with a default set of regex for
functions to exclude from sanitization.
(see build/soong/cc/config/integer_overflow_blacklist.txt)
Prepare to enable minimal runtime diagnostics for integer overflow
sanitization on userdebug and eng builds.
Adds an additional Make and product variable pair to apply integer
overflow sanitization by default to additional code paths.
Bug: 30969751
Bug: 63927620
Test: Included paths are being sanitized.
Test: CTS test suite run on Pixel, runtime errors resolved.
Test: Performance impact in benchmarks acceptable.
Test: Boot-up successful on current Google devices.
Test: Teamfooded in diagnostics mode on Pixel for a month.
Test: Phone calls, camera photos + videos, bluetooth pairing.
Test: Wifi, work profiles, streaming videos, app installation.
Test: Split-screen, airplane mode, battery saver.
Test: Toggling accessibility settings.
Change-Id: Icc7a558c86f8655267afb4ca01b316773325c91a
This CL repoints static dependencies to their .cfi variants for CFI
enabled targets. It also disables CFI for host targets because the
version of ar intended for hosts does not have plugin support (which
CFI requires).
Bug: 67507323
Test: m -j40
Change-Id: Id11afd0c8765469858f406aace2a192afff6d042
This CL adds the ability to centrally enable or disable CFI for
components using either an environment or product config
variable. This is a better, nore manageable option that enabling CFI
across each component individually.
Bug: 67507323
Test: CFI_INCLUDE_PATHS= system/nfc m -j40
Test: CFI_EXCLUDE_PATHS = frameworks/av m -j40
Change-Id: I02fe1960a822c124fd101ab5419aa81e2dd51adf
Bug: http://b/33678192
Clang has been updated past the revision mentioned in the work around.
So this is no longer necessary.
Test: Build
Change-Id: I08f8e75936bbc3527abc86ba4ce0f2c10382d332
This reverts commit 3d3e1cf260.
Rationale: part of a group of commits that left aosp_x86_64 not
building. (See https://android-build.googleplex.com/builds/
submitted/4426589/aosp_x86_64-eng/latest/logs/build_error.log)
Bug: 30227045
Test: builds
Change-Id: Ie22590abe3d1cdccb8d141baf6480d49dedf8789
This CL makes the following changes:
(a) It disables diagnostics for CFI which requires the runtime ubsan
library (which isn't included in static executables).
(b) It applies the ar flags for CFI correctly for nested .a
archives.
(c) Applies the version script to export CFI shadow for non-static
binaries
(d) Doesn't apply cross-dso CFI for static executables
Bug: 30227045
Test: Static executables build correctly and do not complain about
missing symbols from the ubsan runtime library.
Test: Nested .a files correctly use the gold plugin.
Change-Id: Id8fe3c13f6b76565aafbf1266e95f50d1447a790
libm is a default library for device builds, so default it for host
builds as well.
Also removes duplicate additions of -ldl, -lpthread, -lm and -lrt.
Test: m host
Change-Id: I6a07e12053090eb6997b79d4091c28ac9a9022de
INTEGER_OVERFLOW_EXCLUDE_PATHS should only apply to the global sanitizer
setting, and should not override local module settings. This pulls out
the check so it occurs earlier and does not interfere with local
settings. This makes Make consistent with Soong's behavior as well.
Bug: 30969751
Test: Created a test build file with this explicitly set, excluded the
path, and checked if it was still being sanitized.
Change-Id: I9020d92bae136b6087d37f71d5337acaefe850b4
Ubsan is currently support ARM/ARM64,
so It's OK to enable the build Flag
Test: build test module with flags in Android.mk:
LOCAL_SANITIZE := undefined
LOCAL_SANITIZE_DIAG := undefined
BUG:38250996
Change-Id: I6c640bad67353cc736640b2e3c4a0b1812dde3fc
Add support for excluding paths from having integer_overflow applied to
them when using SANITIZE_TARGET=integer_overflow via an
INTEGER_OVERFLOW_EXCLUDE_PATHS make and product variable. This covers
the make side of the change.
Bug: 30969751
Test: Build with SANITIZE_TARGET=integer_overflow
SANITIZE_TARGET_DIAG=integer_overflow
INTEGER_OVERFLOW_EXCLUDE_PATHS=<path> and confirmed this was no
longer being applied to binaries in that path.
Change-Id: I24e328257bc5a7962024c8676a1e23d7d70a8666
Adds the SANITIZE_TARGET=integer_overflow build option to apply signed and
unsigned integer overflow sanitization globally. This implements the
Make side of the build option.
A LOCAL_SANITIZE_BLACKLIST variable is added to allow blacklists to be
defined in make files, mirroring similar functionality provided in Soong.
An additional build option is provided to control whether or not to run
in diagnostics mode, controlled by SANITIZE_TARGET_DIAG. This works the
same way that SANITIZE_TARGET does and currently only supports
'integer_overflow' as an option.
Bug: 30969751
Test: Building with and without the new flags, device boot-up, tested
various permutations of controlling the new flags from build files.
Change-Id: Iacc47e196f21aa1edff5b406bfbc564b5f4e42bd
