LeakSanitizer has encountered a fatal error

[ttaubert]

When trying to build NSPR (the portable runtime lib used by NSS) on a docker machine we see the following:

==21==AddressSanitizer: failed to intercept '__isoc99_printf'
==21==AddressSanitizer: failed to intercept '__isoc99_sprintf'
==21==AddressSanitizer: failed to intercept '__isoc99_snprintf'
==21==AddressSanitizer: failed to intercept '__isoc99_fprintf'
==21==AddressSanitizer: failed to intercept '__isoc99_vprintf'
==21==AddressSanitizer: failed to intercept '__isoc99_vsprintf'
==21==AddressSanitizer: failed to intercept '__isoc99_vsnprintf'
==21==AddressSanitizer: failed to intercept '__isoc99_vfprintf'
==21==AddressSanitizer: failed to intercept '__cxa_throw'
==21==AddressSanitizer: libc interceptors initialized
|| `[0x10007fff8000, 0x7fffffffffff]` || HighMem    ||
|| `[0x02008fff7000, 0x10007fff7fff]` || HighShadow ||
|| `[0x00008fff7000, 0x02008fff6fff]` || ShadowGap  ||
|| `[0x00007fff8000, 0x00008fff6fff]` || LowShadow  ||
|| `[0x000000000000, 0x00007fff7fff]` || LowMem     ||
MemToShadow(shadow): 0x00008fff7000 0x000091ff6dff 0x004091ff6e00 0x02008fff6fff
redzone=16
max_redzone=2048
quarantine_size_mb=256M
malloc_context_size=30
SHADOW_SCALE: 3
SHADOW_GRANULARITY: 8
SHADOW_OFFSET: 0x7fff8000
==21==Installed the sigaction for signal 11
==21==Installed the sigaction for signal 7
==21==Installed the sigaction for signal 8
==21==T0: stack [0x7ffe690b4000,0x7ffe698b4000) size 0x800000; local=0x7ffe698b2a0c
==21==LeakSanitizer: Dynamic linker not found. TLS will not be handled correctly.
==21==AddressSanitizer Init done
==22==Could not attach to thread 21 (errno 1).
==22==Failed suspending threads.
==21==LeakSanitizer has encountered a fatal error.
==21==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
==21==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)

./conftest was compiled with:

clang -o conftest -fsanitize=address conftest.c

This is basically a pre-build config test done by NSPR to check that we can build at all. Our clang version should be recent, we're using the Chromium pre-built binaries:

clang version 4.0.0 (trunk 289944)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/worker/third_party/llvm-build/Release+Asserts/bin

conftest.c looks as follows:

#define PACKAGE_NAME ""
#define PACKAGE_TARNAME ""
#define PACKAGE_VERSION ""
#define PACKAGE_STRING ""
#define PACKAGE_BUGREPORT ""
#define PACKAGE_URL ""
#define DEBUG 1
/* end confdefs.h.  */
#include <stdio.h>
int
main ()
{
FILE *f = fopen ("conftest.out", "w");
 return ferror (f) || fclose (f) != 0;

  ;
  return 0;
}

Any idea what's going on here? Not sure if this is related to #723, but it might be?

[ttaubert]

BTW, it seems to work if I use docker run --privileged. We don't have those problems with clang 3.9 afaik.

[chefmax]

Well, before performing actual leak check, LSan spawns a 'tracer' thread that tries to attach to the program under test via ptrace. It seems that without docker run --privileged ptrace call fails with EPERM (Operation not permitted), see ==22==Could not attach to thread 21 (errno 1). error message.

[ttaubert]

That makes sense. Are you running docker containers in "privileged mode" on CF?

[ttaubert]

Looks like it? Building conftest.c locally on a ossfuzz/base-builder machine yields the same error. So I guess we simply have to look into doing the same thing on our CI then.

[mikea]

We don't run it privileged (lots of capabilities). For LSan it should be enough only to enable ptrace: --cap-add SYS_PTRACE

[ttaubert]

Ok, this is what I'm going to do. Thanks! I'll close this as it's not LSan's fault.