-
Notifications
You must be signed in to change notification settings - Fork 170
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add autoconf option to enable ASAN #151
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great idea, I've done this manually in the past as well, but having it in autoconf saves us from having to remember how to use it.
By the way, I'm seeing this ASAN report right now when running the unit tests:
==2474301==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b00017c400 at pc 0x7f1d3a37f75c bp 0x7ffc0926f100 sp 0x7ffc0926f0f0
READ of size 8 at 0x61b00017c400 thread T0
#0 0x7f1d3a37f75b in drgn_thread_deinit ../../libdrgn/program.c:717
#1 0x7f1d3a37f75b in drgn_thread_destroy ../../libdrgn/program.c:724
#2 0x7f1d3a37f75b in drgn_thread_destroy ../../libdrgn/program.c:721
#3 0x7f1d3a37f831 in drgn_program_deinit ../../libdrgn/program.c:102
#4 0x7f1d3a2ca3d9 in Program_dealloc ../../libdrgn/python/program.c:102
#5 0x7f1d3e5af42a (/usr/lib/libpython3.10.so.1.0+0x1f642a)
#6 0x7f1d3e56c95f (/usr/lib/libpython3.10.so.1.0+0x1b395f)
#7 0x7f1d3e4e5340 (/usr/lib/libpython3.10.so.1.0+0x12c340)
#8 0x7f1d3e5d8c2b (/usr/lib/libpython3.10.so.1.0+0x21fc2b)
#9 0x7f1d3e5d578c in Py_FinalizeEx (/usr/lib/libpython3.10.so.1.0+0x21c78c)
#10 0x7f1d3e5ce099 in Py_RunMain (/usr/lib/libpython3.10.so.1.0+0x215099)
#11 0x7f1d3e5a169c in Py_BytesMain (/usr/lib/libpython3.10.so.1.0+0x1e869c)
#12 0x7f1d3e214b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#13 0x5584cd1b604d in _start (/usr/bin/python3.10+0x104d)
0x61b00017c400 is located 128 bytes inside of 1408-byte region [0x61b00017c380,0x61b00017c900)
freed by thread T0 here:
#0 0x7f1d3e854f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x7f1d3a37f80a in drgn_thread_set_deinit ../../libdrgn/program.c:37
#2 0x7f1d3a37f80a in drgn_program_deinit ../../libdrgn/program.c:100
#3 0x7f1d3a2ca3d9 in Program_dealloc ../../libdrgn/python/program.c:102
#4 0x7f1d3e5af42a (/usr/lib/libpython3.10.so.1.0+0x1f642a)
previously allocated by thread T0 here:
#0 0x7f1d3e855fd6 in __interceptor_posix_memalign /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:226
#1 0x7f1d3a3800e7 in drgn_thread_set_rehash ../../libdrgn/program.c:37
#2 0x7f1d3a3800e7 in drgn_thread_set_reserve_for_insert ../../libdrgn/program.c:37
#3 0x7f1d3a3800e7 in drgn_thread_set_insert_searched ../../libdrgn/program.c:37
#4 0x7f1d3a3800e7 in drgn_thread_set_insert_hashed ../../libdrgn/program.c:37
#5 0x7f1d3a3800e7 in drgn_thread_set_insert ../../libdrgn/program.c:37
#6 0x7f1d3a3800e7 in drgn_program_cache_prstatus_entry ../../libdrgn/program.c:751
#7 0x7f1d3a3800e7 in drgn_program_cache_prstatus_entry ../../libdrgn/program.c:730
#8 0x7f1d3a381821 in drgn_program_cache_core_dump_notes ../../libdrgn/program.c:827
#9 0x7f1d3a384297 in drgn_program_crashed_thread ../../libdrgn/program.c:1065
#10 0x7f1d3a2c6dd3 in Program_crashed_thread ../../libdrgn/python/program.c:877
#11 0x7f1d3e50c056 (/usr/lib/libpython3.10.so.1.0+0x153056)
SUMMARY: AddressSanitizer: heap-use-after-free ../../libdrgn/program.c:717 in drgn_thread_deinit
Shadow bytes around the buggy address:
0x0c3680027830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680027840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680027850: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x0c3680027860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3680027870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3680027880:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680027890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c36800278a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c36800278b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c36800278c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c36800278d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==2474301==ABORTING
I am also getting the heap-use-after-free error, will investigate. |
Heap-use-after-free resolved in #153. Perhaps it's worth considering if we should run the tests in CI with ASAN enabled to prevent something like this from being merged in the future. |
Looks the failed compilation on |
ASAN is incredibly useful during development, especially when dealing with non-deterministic behavior where re-running the code under a debugger won't necessarily reproduce the bug each time. In order not to break any existing workflows, building with ASAN is opt-in (via --enable-asan). Signed-off-by: Kevin Svetlitski <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A few autotools nitpicks, but I'll just fix those up and merge this rather than rot your brain with any more knowledge of autotools than you need.
Thanks for adding ASAN. In case someone would like to know how to enable building with ASAN now that this PR is merged, this seems to work: $ CONFIGURE_FLAGS='--enable-asan' python3 setup.py build Mentioning here in case this helps anyone. |
AddressSanitizer (a.k.a ASAN) is incredibly useful during development, especially when dealing with non-deterministic behavior where re-running the code under a debugger won't necessarily reproduce the bug each time. In order not to break any existing workflows, building with ASAN is opt-in (via
--enable-asan
).I had originally added this just for myself to make debugging easier, but I figured I may as well upstream it given how useful it's been.