* When my_global_santitize is set and requires ASAN,
link with ASAN library even when local module is not
instrumented with ASAN, unless the local module is
the ASAN library itself.
* Add -Wl,--as-needed to my_ldflags for shared libraries
so that unneeded ASAN library would not become
a dependent of the built .so file.
* Change shared file and executable file link argument order
so that -Wl flags will have effect on linked-in libraries.
* Remove unused ADDRESS_SANITIZER_CONFIG_EXTRA_SHARED_LIBRARIES.
BUG: 27614834
Change-Id: I4eda6003f1f24e498cba91c043dbe1fabe522686
RPATH was used in order for ASan executables to prefer ASan libraries
under /data. Now ASan executables use a special loader (linker_asan),
which implements this logic. RPATH is no longer needed.
Change-Id: Ic7a39b022267b80bd0ce3e95a2e822eb308a1fba
This reverts commit f7dbab16ff.
Bug: 23396112
Switch from "-fsanitize-undefined-trap-on-error" to
"-fsanitize-trap=all". The former ends up accidentally leaving
unresolved calls to __ubsan* helper functions in the object file with
clang 3.8. The latter is used when we don't include address sanitizer,
and replaces any misbehavior with a direct call to abort().
Bug: 23396112
Switch from "-fsanitize-undefined-trap-on-error" to
"-fsanitize-trap=all". The former ends up accidentally leaving
unresolved calls to __ubsan* helper functions in the object file with
clang 3.8. The latter is used when we don't include address sanitizer,
and replaces any misbehavior with a direct call to abort().
Change-Id: I8a67461b45f5f1dd9f2d179b6b64a4ca905e999f
The sanitizer chosen by the environment (either by SANITIZE_TARGET or
SANITIZE_HOST) should be chosen over the one specified by the module.
Bug: http://b/23330588
Change-Id: I835b7d76e071fc0db2f859f98dfb9d7ff76af245
TSAN is not supported on 32-bit architectures. For non-multilib cases,
make its use an error. For multilib cases, don't use it for the 32-bit
case.
Change-Id: I8e40be4002379cc2c9aa98ab8b812b337d6e077e
Another change in bionic/linker adds linker_asan/linker_asan64 that
know where to find ASan shared libraries.
Also, include linker_asan to the required packages list when building
for ASan.
Change-Id: I8ebe7c0091bbeb0c135708a891d33d9844373d37
This is a temporary change pending code cleanup.
We are already disabling detection of ODR violations. As it turns out,
an ODR between an ASan-instrumented library and a non-instrumented library
may actually crash ASan, and there is no obvious way out, and one of those
prevents us from booting a SANITIZE_TARGET image right now.
Bug: 21951850
Change-Id: I49508242ec96089a3d4d8b7e45f36323d62f2be9
These symbols are defined in the ASan runtime library, which is always
present at runtime.
Bug:21785137
Change-Id: Ib8418c66323fd4cdfdc05548048f32380cb84ee5
This also does a bit of cleanup in config_sanitizers.mk. The result is
that `LOCAL_SANITIZE := <any arbitrary ubsan group>` should function
fine for both host and target.
This is a superset of LOCAL_DETECT_INTEGER_OVERFLOWS, so remove that.
This also checks integer division by zero. It's supposed to cover
shifting undefined behaviors as well, but apparently it does not
(though `LOCAL_SANITIZE := shift` works fine).
Change-Id: I4ac99eafa6920a3f8cb82af37ce56ff0fdb95223
The same as SANITIZE_HOST, but for the target.
Also, skip all LOCAL_FORCE_STATIC_EXECUTABLE targets, as ASan does not
support static linking.
Bug: 21785137
Change-Id: Ief53ff8de1fee18f230d6c7dd31845db5bbd415c
I've migrated all users of this to the new option now, so we can drop
this.
Dropping `SANITIZE_HOST := true` will have to wait until the build
server configs have been updated.
Change-Id: I591436e197a6c6c079a6cd6a2decb702b574cd71
Add build system support for LOCAL_DETECT_INTEGER_OVERFLOWS. When enabled,
an attempt to perform an integer arithmetic operation which overflows
will result in a call to abort(). This is intended for security
sensitive code, where integer overflow operations are not expected
nor desirable.
Two classes of underflows/overflows are detected and blocked:
1) Signed integer underflow/overflow.
2) Unsigned integer underflow/overflows.
Signed integer overflows are undefined behavior, according to the
C standard. Unsigned integer overflows are defined behavior, but
still undesirable in security sensitive code.
Only clang is supported today. gcc has -ftrapv for handling signed
integer overflow, but it's widely considered broken
(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=35412) and we're
deliberately avoiding it's use here.
Change-Id: Ib4918dc84e37e83d4205e5035544545d91671e5f
Vaguely-Related-Bug: 11859726
The relocation packer is causing the kernel to load the executable
overlapping ASAN's shadow space.
Bug: http://b/20665974
Change-Id: Ifc5914f4fbed5f4f00ed1c795d01cf2fcb849cfe
Always link libm with asan. Hasn't been a problem before because ASAN
was only ever used when libc++ was as well, which already links libm.
Pass --no-as-needed for host modules.
These aren't needed for the target builds because the target uses the
shared RTL.
Change-Id: I5d6a3c2dd557b5231be2b7711df6438693753a88
ASan runtime library (when using dynamic linking) must be the first
dependency of the main executable to achieve correct symbol
interposition. This matches how the clang driver works.
In multilib setup, ASan-RT name depends on the target arch:
/system/lib/libclang_rt.asan-arm-android.so
/system/lib64/libclang_rt.asan-arm64-android.so
We also set RPATH to /system/lib/asan or /system/lib64/asan
to have a place for ASan-only versions of system libraries.
Change-Id: I5c0cdb89e5e08a1950eb276e406da9f31a6e52dd
This is needed for projects that have known ubsan issues that we can't
fix right away (perhaps because it's an upstream project that we're
diligent about keeping in sync with upsteam).
Also make the normal ubsan use -fno-sanitize-recover=all by default.
Change-Id: I1b0f3309792f32dbd08c18816d7306e76c8d7c30
Some of the ubsan checks expose a few pathological performance cases
in clang, and thus aren't suited to be used in SANITIZE_HOST.
This mode is also supported on the target despite not having the
target runtime libraries for ubsan by generating traps.
Change-Id: I0b0f0a08ca84d72e44e2174a66726b1c5e5cad7e
Ying pointed out in https://android-review.googlesource.com/#/c/147290
that my_sanitize_host would be read as some garbage value for target
builds. Move the configuration later and don't use the local at all.
Change-Id: Id8a095821d000a184e72f950b9481597073a7044
Previously using a sanitizer would imply clang. It should be an error
instead so it's more obvious.
Change-Id: I67c949bfda3718a0d19da7e358b5fde447fce334
* Refactor a few pieces to avoid deeply nested conditionals.
* LOCAL_SANITIZE := never replaces LOCAL_ADDRESS_SANITIZER := false.
Change-Id: I68bb8c5edda6ecd40179c5ba9f18d06e96aaa260
Rather than adding LOCAL_UB_SANITIZER, LOCAL_THREAD_SANITIZER, etc for
each new sanitizer, deprecate LOCAL_ADDRESS_SANITIZER in favor of
LOCAL_SANITZE that mirrors the behavior of -fsanitize=<sanitizers>.
For example, the following will use both asan and ubsan:
LOCAL_SANITIZE := address undefined
We'll leave LOCAL_ADDRESS_SANITIZER around for compatibility until we
can clean up the tree.
Change-Id: I8a62315129d4753f8e992584ca6db1e5dfdd4d2a
We had discussed the idea of making all host tools default to using
ASAN. Even if we don't make it the default, this makes it easy for the
user to switch all host binaries over.
Change-Id: I64a5c741b1b4e9aefed3a6be8dcd4f386e06b29c
