<div dir="ltr">Meanwhile, could you try to reverse the order of these two call in asan/asan_rtl.cc and see if it helps? <div> InstallSignalHandlers();<br></div><div><div> AsanTSDInit(AsanThread::TSDDtor);<br></div></div>
<div><br></div><div>--kcc </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Oct 4, 2013 at 8:56 AM, Kostya Serebryany <span dir="ltr"><<a href="mailto:kcc@google.com" target="_blank">kcc@google.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote"><div class="im">On Fri, Oct 4, 2013 at 2:00 AM, Greg Fitzgerald <span dir="ltr"><<a href="mailto:garious@gmail.com" target="_blank">garious@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Have you guys had any luck with the "use_sigaltstack=1" on Android?<br>
I've attempted to use it two versions: the latest clang/compiler-rt<br>
and clang 3.3. In both cases, the ASan runtime doesn't catch the<br>
stack overflow. Turning on verbosity=1 reports "tsd_key_inited != 0".<br></blockquote><div><br></div></div><div>I've seen such assertion failure on Linux some time ago, but then it turned into another failure.</div>
<div>The issue is tracked here: <a href="https://code.google.com/p/address-sanitizer/issues/detail?id=224" target="_blank">https://code.google.com/p/address-sanitizer/issues/detail?id=224</a></div><div><br></div><div>--kcc </div>
<div><div class="h5"><div><br>
</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Here's the full log:<br>
<br>
==28386==Parsed ASAN_OPTIONS: use_sigaltstack=1:verbosity=1<br>
==28386==AddressSanitizer: libc interceptors initialized<br>
|| `[0x20000000, 0xffffffff]` || HighMem ||<br>
|| `[0x04000000, 0x1fffffff]` || HighShadow ||<br>
|| `[0x00040000, 0x03ffffff]` || ShadowGap ||<br>
MemToShadow(shadow): 0x00000000 0x00000000 0x00800000 0x03ffffff<br>
red_zone=16<br>
quarantine_size=64M<br>
malloc_context_size=30<br>
SHADOW_SCALE: 3<br>
SHADOW_GRANULARITY: 8<br>
SHADOW_OFFSET: 0<br>
==28386==AddressSanitizer CHECK failed:<br>
<div>llvm/projects/compiler-rt/lib/asan/asan_posix.cc:110<br>
"((tsd_key_inited)) != (0)" (0x0, 0x0)<br>
</div> #0 0x40298bbf in $a _asan_rtl_<br>
#1 0x4029cb37 in __sanitizer::CheckFailed(char const*, int, char<br>
const*, unsigned long long, unsigned long long) ??:0<br>
#2 0x40294343 in __asan::AsanTSDGet() ??:0<br>
#3 0x4029a6f3 in __asan::GetCurrentThread() ??:0<br>
#4 0x4029a9ab in __asan::GetCurrentTidOrInvalid() ??:0<br>
#5 0x40293deb in __asan::SetAlternateSignalStack() ??:0<br>
#6 0x40293f5b in __asan::InstallSignalHandlers() ??:0<br>
#7 0x402984ff in __asan_init_v3 ??:0<br>
<br>
<br>
I'm running on Android JellyBean and building with NDK r9.<br>
<span><font color="#888888"><br>
-Greg<br>
</font></span><div><div><br>
<br>
On Wed, Sep 18, 2013 at 10:51 AM, Greg Fitzgerald <<a href="mailto:garious@gmail.com" target="_blank">garious@gmail.com</a>> wrote:<br>
> Minor correction (environment variable is for the runtime, not compile-time).<br>
><br>
> was:<br>
> $ ASAN_OPTIONS=use_sigaltstack=1 clang -g -fsanitize=address -o test<br>
> test.c && ./test<br>
><br>
> should be:<br>
> $ clang -g -fsanitize=address -o test test.c &&<br>
> ASAN_OPTIONS=use_sigaltstack=1 ./test<br>
><br>
> -Greg<br>
><br>
> On Wed, Sep 18, 2013 at 10:39 AM, Greg Fitzgerald <<a href="mailto:garious@gmail.com" target="_blank">garious@gmail.com</a>> wrote:<br>
>> Perfect! I can confirm this works exactly as described using clang<br>
>> 3.3 running on Ubuntu 12.04 on x86. Here's what I did:<br>
>><br>
>> $ export ASAN_SYMBOLIZER_PATH=`which llvm-symbolizer`<br>
>> $ clang --version<br>
>> clang version 3.3 (tags/RELEASE_33/final)<br>
>> Target: x86_64-unknown-linux-gnu<br>
>> Thread model: posix<br>
>><br>
>> $ cat test.c<br>
>> static void loop() {<br>
>> loop();<br>
>> }<br>
>><br>
>> int main() {<br>
>> loop();<br>
>> return 0;<br>
>> }<br>
>><br>
>> $ clang -g -o test test.c && ./test<br>
>> Segmentation fault<br>
>><br>
>> $ clang -g -fsanitize=address -o test test.c && ./test<br>
>> Segmentation fault<br>
>><br>
>> $ ASAN_OPTIONS=use_sigaltstack=1 clang -g -fsanitize=address -o test<br>
>> test.c && ./test<br>
>><br>
>> ==12279==ERROR: AddressSanitizer: SEGV on unknown address<br>
>> 0x7fffb5066960 (pc 0x00000042d4a7 sp 0x7fffb5066940 bp 0x7fffb5067970<br>
>> T0)<br>
>> AddressSanitizer can not provide additional info.<br>
>> #0 0x42d4a6 in loop test.c:1<br>
>> #1 0x42d4db in loop test.c:3<br>
>> #2 0x42d4db in loop test.c:3<br>
>> #3 0x42d4db in loop test.c:3<br>
>> ...<br>
>><br>
>> I agree that this option should be enabled by default. This is useful stuff!<br>
>><br>
>> -Greg<br>
>><br>
>> On Wed, Sep 18, 2013 at 1:19 AM, Kostya Serebryany <<a href="mailto:kcc@google.com" target="_blank">kcc@google.com</a>> wrote:<br>
>>><br>
>>><br>
>>><br>
>>> On Wed, Sep 18, 2013 at 2:18 AM, Greg Fitzgerald <<a href="mailto:garious@gmail.com" target="_blank">garious@gmail.com</a>> wrote:<br>
>>>><br>
>>>> Thanks for the quick replies!<br>
>>>><br>
>>>><br>
>>>> > If you want dynamic detection, then Address Sanitizer (which is built<br>
>>>> > into Clang) or SAFECode<br>
>>>><br>
>>>> Dynamic detection. I tried with Address Sanitizer and no luck<br>
>>><br>
>>><br>
>>> AddressSanitizer does not try to detect stack overflow (not to be mixed with<br>
>>> stack-buffer-overflow).<br>
>>> The reason is simple: when stack overflow happens it is already detected<br>
>>> (you get a SEGV).<br>
>>> However, by default when stack overflow happens the SEGV kills the process<br>
>>> silently because<br>
>>> the signal handler has no stack to run on.<br>
>>> This can be solved with sigaltstack() and AddressSanitizer does this under a<br>
>>> separate<br>
>>> (experimental) flag ASAN_OPTIONS=use_sigaltstack=1<br>
>>><br>
>>> # Running with default 8Mb stack<br>
>>> % clang -g -fsanitize=address -O<br>
>>> ~/llvm/projects/compiler-rt/lib/asan/lit_tests/TestCases/deep_call_stack.cc<br>
>>> ; ./a.out<br>
>>> [40000] ptr: (nil)<br>
>>> ...<br>
>>> [00000] ptr: 0x7fff0b7c4140<br>
>>> # Passed<br>
>>><br>
>>> # Running with a small stack<br>
>>> % (ulimit -s 1000; ./a.out; echo $? )<br>
>>> [40000] ptr: (nil)<br>
>>> ...<br>
>>> [33000] ptr: 0x7fff0e155120<br>
>>> 139 # FAILED<br>
>>><br>
>>> # Running with a small stack and with sigaltstack<br>
>>> % (ulimit -s 1000; ASAN_OPTIONS=use_sigaltstack=1 ./a.out; echo $? ) 2>&1 |<br>
>>> head<br>
>>> ASAN:SIGSEGV<br>
>>> =================================================================<br>
>>> ==1543==ERROR: AddressSanitizer: SEGV on unknown address 0x7fffa383bfe0 (pc<br>
>>> 0x000000456d38 sp 0x7fffa383bfe0 bp 0x7fffa383c050 T0)<br>
>>> AddressSanitizer can not provide additional info.<br>
>>> #0 0x456d37 in RecursiveFunc(int, int*)<br>
>>> /home/kcc/llvm/projects/compiler-rt/lib/asan/lit_tests/TestCases/deep_call_stack.cc:8<br>
>>> #1 0x456dbc in RecursiveFunc(int, int*)<br>
>>> /home/kcc/llvm/projects/compiler-rt/lib/asan/lit_tests/TestCases/deep_call_stack.cc:14<br>
>>><br>
>>><br>
>>> hth,<br>
>>><br>
>>> --kcc<br>
>>><br>
>>><br>
>>><br>
>>>> out-of-the-box. I think it can detect stack-buffer-overflow (aka<br>
>>>> stack corruption), but not stack overflow. I also tried running the<br>
>>>> code with ASan inside a pthread with heap-allocated memory for its<br>
>>>> stack, but since the pthread library itself is not instrumented, it<br>
>>>> did not detect the heap-buffer-overflow when the thread's stack<br>
>>>> overflows.<br>
>>>><br>
>>>><br>
>>>> > or SAFECode<br>
>>>><br>
>>>> Can you point me to an example?<br>
>>>><br>
>>>><br>
>>>> Eli Friedman wrote:<br>
>>>> > No such support exists at the moment.<br>
>>>><br>
>>>> Is anyone aware of another C compiler that adds instrumentation for<br>
>>>> stack overflow detection?<br>
>>>><br>
>>>> Thanks,<br>
>>>> Greg<br>
>>>><br>
>>>> On Tue, Sep 17, 2013 at 3:03 PM, John Criswell <<a href="mailto:criswell@illinois.edu" target="_blank">criswell@illinois.edu</a>><br>
>>>> wrote:<br>
>>>> > On 9/17/13 4:57 PM, Greg Fitzgerald wrote:<br>
>>>> >><br>
>>>> >> Does clang offer any tools for detecting when a program is about to<br>
>>>> >> segfault due to stack overflow?<br>
>>>> ><br>
>>>> ><br>
>>>> > If you want dynamic detection, then Address Sanitizer (which is built<br>
>>>> > into<br>
>>>> > Clang) or SAFECode (which has its own version of Clang into which it is<br>
>>>> > integrated) will do the trick.<br>
>>>> ><br>
>>>> > If you're asking about the Clang static analyzer, then I do not know.<br>
>>>> ><br>
>>>> > -- John T.<br>
>>>> ><br>
>>>> >><br>
>>>> >> Thanks,<br>
>>>> >> Greg<br>
>>>> >> _______________________________________________<br>
>>>> >> cfe-dev mailing list<br>
>>>> >> <a href="mailto:cfe-dev@cs.uiuc.edu" target="_blank">cfe-dev@cs.uiuc.edu</a><br>
>>>> >> <a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br>
>>>> ><br>
>>>> ><br>
>>>> _______________________________________________<br>
>>>> cfe-dev mailing list<br>
>>>> <a href="mailto:cfe-dev@cs.uiuc.edu" target="_blank">cfe-dev@cs.uiuc.edu</a><br>
>>>> <a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br>
>>><br>
>>><br>
</div></div></blockquote></div></div></div><br></div></div>
</blockquote></div><br></div>