"CHECK failed: sanitizer_allocator_primary32.h:292" when running on RISC-V 64 systems using SV48

[Kazurin-775]

• Clang version: 16.0.6 (15)
• Linux distribution: Ubuntu 23.10
• Linux kernel version: Linux ubuntu 6.5.0-9-generic #9.1-Ubuntu
• Machine: QEMU version 7.2.6, qemu-system-riscv64 -machine virt

---

On any RISC-V 64 Linux systems using SV48 virtual address scheme (for example, with sufficiently recent versions of QEMU and Linux kernel), build and run any C program with ASAN enabled, for example:

echo 'int main() {}' > test.c
clang -fsanitize=address test.c
./a.out

This results in the following error when running ./a.out:

kazurin@ubuntu:~$ ./a.out
AddressSanitizer: CHECK failed: sanitizer_allocator_primary32.h:292 "((res)) < ((kNumPossibleRegions))" (0x7fff842, 0x40000) (tid=1315)
    <empty stack>

Note that in the error message, the first argument value 0x7fff842 resembles the upper half of a 47-bit virtual memory address in the target program, while the second argument value 0x40000 resembles the upper limit of a 38-bit address space. This clearly indicates lack of support for 48-bit virtual address space (aka. SV48) on RISC-V (i.e. only the plain-old SV39 is supported).

---

As a temporary workaround for this problem, I had to manually disable SV48 support in QEMU by modifying qemu/target/riscv/csr.c and recompiling qemu-system-riscv64:

 static const char valid_vm_1_10_64[16] = {
     [VM_1_10_MBARE] = 1,
     [VM_1_10_SV39] = 1,
-    [VM_1_10_SV48] = 1,
-    [VM_1_10_SV57] = 1
+    [VM_1_10_SV48] = 0,
+    [VM_1_10_SV57] = 0
 };
 
 /* Machine Information Registers */

This would solve my problem and make programs compiled with ASAN work as expected.

[spacemonkeydelivers]

Hi,

Indeed ASAN was ported to RISC-V when Sv39 was the default addressing mode, and changes to run it in Sv48/Sv57 must be made.
The issue is related to the way how the address space is split between stack, heap and shadow versions of them.

[cyyself]

Mark.

Currently, the mainline Linux kernel from v6.6-6.8rc3 uses sv39 for mmap by default. Although the commit message says it uses sv48 by default, it's a bug and I have submitted patches to solve it. However, if the ASAN only works on sv39, it will be a regression for ASAN if it uses sv48 by default. I will keep an eye on this.