Enable LSAN for Android

    Make use of the newly added thread-properties API (available since 31).

    Differential Revision: https://reviews.llvm.org/D85927

Author: oontvoo

compiler-rt/cmake/config-ix.cmake

@@ -681,7 +681,7 @@ else()
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND LSAN_SUPPORTED_ARCH AND
-    OS_NAME MATCHES "Darwin|Linux|NetBSD|Fuchsia")
+    OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|Fuchsia")
   set(COMPILER_RT_HAS_LSAN TRUE)
 else()
   set(COMPILER_RT_HAS_LSAN FALSE)

compiler-rt/lib/asan/CMakeLists.txt

@@ -86,6 +86,8 @@ append_rtti_flag(OFF ASAN_CFLAGS)
 set(ASAN_DYNAMIC_LINK_FLAGS ${SANITIZER_COMMON_LINK_FLAGS})
 
 if(ANDROID)
+  list(APPEND ASAN_CFLAGS -fno-emulated-tls)
+  list(APPEND ASAN_DYNAMIC_LINK_FLAGS -fuse-ld=lld)
 # Put most Sanitizer shared libraries in the global group. For more details, see
 # android-changes-for-ndk-developers.md#changes-to-library-search-order
   if (COMPILER_RT_HAS_Z_GLOBAL)
@@ -232,7 +234,9 @@ else()
            -Wl,--version-script,${CMAKE_CURRENT_BINARY_DIR}/clang_rt.asan-dynamic-${arch}.vers)
       # The Solaris 11.4 linker supports a subset of GNU ld version scripts,
       # but requires a special option to enable it.
-      if (COMPILER_RT_HAS_GNU_VERSION_SCRIPT_COMPAT)
+      # This is used/compatible with ANDROID because we force `lld` on ANDROID (line 90).
+      # Therefore we don't want to add it for ANDROID.
+      if (COMPILER_RT_HAS_GNU_VERSION_SCRIPT_COMPAT AND NOT ANDROID)
           list(APPEND VERSION_SCRIPT_FLAG -Wl,-z,gnu-version-script-compat)
       endif()
       set_property(SOURCE

compiler-rt/lib/asan/tests/CMakeLists.txt

@@ -91,6 +91,7 @@ if(APPLE)
 endif()
 if(ANDROID)
   list(APPEND ASAN_UNITTEST_COMMON_LINK_FLAGS -pie)
+  list(APPEND ASAN_UNITTEST_COMMON_LINK_FLAGS -fuse-ld=lld)
 endif()
 
 set(ASAN_UNITTEST_INSTRUMENTED_LINK_FLAGS
@@ -288,6 +289,7 @@ if(ANDROID)
       $<TARGET_OBJECTS:RTSanitizerCommonLibc.${arch}>
       $<TARGET_OBJECTS:RTSanitizerCommonCoverage.${arch}>
       $<TARGET_OBJECTS:RTSanitizerCommonSymbolizer.${arch}>
+      $<TARGET_OBJECTS:RTLSanCommon.${arch}>
       $<TARGET_OBJECTS:RTUbsan.${arch}>
       $<TARGET_OBJECTS:RTUbsan_cxx.${arch}>
       ${COMPILER_RT_GTEST_SOURCE}

compiler-rt/lib/lsan/CMakeLists.txt

@@ -1,6 +1,7 @@
 include_directories(..)
 
 set(LSAN_CFLAGS ${SANITIZER_COMMON_CFLAGS})
+set(LSAN_LINK_FLAGS ${SANITIZER_COMMON_LINK_FLAGS})
 append_rtti_flag(OFF LSAN_CFLAGS)
 
 set(LSAN_COMMON_SOURCES
@@ -33,6 +34,11 @@ set(LSAN_HEADERS
 
 set(LSAN_SRC_DIR ${CMAKE_CURRENT_SOURCE_DIR})
 
+if(ANDROID)
+  list(APPEND LSAN_CFLAGS -fno-emulated-tls)
+  list(APPEND LSAN_LINK_FLAGS -fuse-ld=lld)
+endif()
+
 add_compiler_rt_object_libraries(RTLSanCommon
     OS ${SANITIZER_COMMON_SUPPORTED_OS}
     ARCHS ${LSAN_COMMON_SUPPORTED_ARCH}
@@ -61,7 +67,7 @@ if(COMPILER_RT_HAS_LSAN)
                   RTSanitizerCommonCoverage
                   RTSanitizerCommonSymbolizer
       CFLAGS ${LSAN_CFLAGS}
-      LINK_FLAGS ${SANITIZER_COMMON_LINK_FLAGS} ${WEAK_SYMBOL_LINK_FLAGS}
+      LINK_FLAGS ${LSAN_LINK_FLAGS} ${WEAK_SYMBOL_LINK_FLAGS}
       LINK_LIBS ${LSAN_LINK_LIBS}
       PARENT_TARGET lsan)
   else()
@@ -78,6 +84,7 @@ if(COMPILER_RT_HAS_LSAN)
                 $<TARGET_OBJECTS:RTLSanCommon.${arch}>
         ADDITIONAL_HEADERS ${LSAN_HEADERS}
         CFLAGS ${LSAN_CFLAGS}
+        LINK_FLAGS ${LSAN_LINK_FLAGS}
         PARENT_TARGET lsan)
     endforeach()
   endif()

compiler-rt/lib/lsan/lsan_common.cpp

@@ -71,17 +71,17 @@ static const char kSuppressionLeak[] = "leak";
 static const char *kSuppressionTypes[] = { kSuppressionLeak };
 static const char kStdSuppressions[] =
 #if SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT
-  // For more details refer to the SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT
-  // definition.
-  "leak:*pthread_exit*\n"
+    // For more details refer to the SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT
+    // definition.
+    "leak:*pthread_exit*\n"
 #endif  // SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT
 #if SANITIZER_MAC
-  // For Darwin and os_log/os_trace: https://reviews.llvm.org/D35173
-  "leak:*_os_trace*\n"
+    // For Darwin and os_log/os_trace: https://reviews.llvm.org/D35173
+    "leak:*_os_trace*\n"
 #endif
-  // TLS leak in some glibc versions, described in
-  // https://sourceware.org/bugzilla/show_bug.cgi?id=12650.
-  "leak:*tls_get_addr*\n";
+    // TLS leak in some glibc versions, described in
+    // https://sourceware.org/bugzilla/show_bug.cgi?id=12650.
+    "leak:*tls_get_addr*\n";
 
 void InitializeSuppressions() {
   CHECK_EQ(nullptr, suppression_ctx);
@@ -294,6 +294,22 @@ static void ProcessThreads(SuspendedThreadsList const &suspended_threads,
                                  kReachable);
         }
       }
+#if SANITIZER_ANDROID
+      if (HAS_ANDROID_THREAD_PROPERTIES_API) {
+        auto *cb = +[](void *dtls_begin, void *dtls_end, uptr /*dso_idd*/,
+                       void *arg) -> void {
+          ScanRangeForPointers(reinterpret_cast<uptr>(dtls_begin),
+                               reinterpret_cast<uptr>(dtls_end),
+                               reinterpret_cast<Frontier *>(arg), "DTLS",
+                               kReachable);
+        };
+
+        // FIXME: There might be a race-condition here (and in Bionic) if the
+        // thread is suspended in the middle of updating its DTLS. IOWs, we
+        // could scan already freed memory. (probably fine for now)
+        __libc_iterate_dynamic_tls(os_id, cb, frontier);
+      }
+#else
       if (dtls && !DTLSInDestruction(dtls)) {
         for (uptr j = 0; j < dtls->dtv_size; ++j) {
           uptr dtls_beg = dtls->dtv[j].beg;
@@ -309,6 +325,7 @@ static void ProcessThreads(SuspendedThreadsList const &suspended_threads,
         // this and continue.
         LOG_THREADS("Thread %d has DTLS under destruction.\n", os_id);
       }
+#endif
     }
   }
 }
@@ -575,8 +592,16 @@ static void CheckForLeaksCallback(const SuspendedThreadsList &suspended_threads,
 }
 
 static bool CheckForLeaks() {
+#if SANITIZER_ANDROID
+  // Presence of the ThreadProperties API implies the presence of
+  // TLS support, which is required for calling  __lsan_is_turned_off().
+  // Therefore, this check must preceed that.
+  if (!HAS_ANDROID_THREAD_PROPERTIES_API)
+    return false;
+#endif
+
   if (&__lsan_is_turned_off && __lsan_is_turned_off())
-      return false;
+    return false;
   EnsureMainThreadIDIsCorrect();
   CheckForLeaksParam param;
   LockStuffAndStopTheWorld(CheckForLeaksCallback, &param);

compiler-rt/lib/lsan/lsan_common.h

@@ -29,16 +29,13 @@
 // To enable LeakSanitizer on a new architecture, one needs to implement the
 // internal_clone function as well as (probably) adjust the TLS machinery for
 // the new architecture inside the sanitizer library.
-#if (SANITIZER_LINUX && !SANITIZER_ANDROID || SANITIZER_MAC) &&          \
-    (SANITIZER_WORDSIZE == 64) &&                                        \
+#if (SANITIZER_LINUX || SANITIZER_MAC) && (SANITIZER_WORDSIZE == 64) &&  \
     (defined(__x86_64__) || defined(__mips64) || defined(__aarch64__) || \
      defined(__powerpc64__) || defined(__s390x__))
 #define CAN_SANITIZE_LEAKS 1
-#elif defined(__i386__) && \
-    (SANITIZER_LINUX && !SANITIZER_ANDROID || SANITIZER_MAC)
+#elif defined(__i386__) && (SANITIZER_LINUX || SANITIZER_MAC)
 #define CAN_SANITIZE_LEAKS 1
-#elif defined(__arm__) && \
-    SANITIZER_LINUX && !SANITIZER_ANDROID
+#elif defined(__arm__) && SANITIZER_LINUX
 #define CAN_SANITIZE_LEAKS 1
 #elif SANITIZER_NETBSD || SANITIZER_FUCHSIA
 #define CAN_SANITIZE_LEAKS 1

compiler-rt/lib/lsan/lsan_common_linux.cpp

@@ -41,9 +41,28 @@ static bool IsLinker(const LoadedModule& module) {
 
 __attribute__((tls_model("initial-exec")))
 THREADLOCAL int disable_counter;
-bool DisabledInThisThread() { return disable_counter > 0; }
-void DisableInThisThread() { disable_counter++; }
+bool DisabledInThisThread() {
+#if SANITIZER_ANDROID
+  // LSAN is only enabled with Android-S and up.
+  if (!HAS_ANDROID_THREAD_PROPERTIES_API)
+    return true;
+#endif
+  return disable_counter > 0;
+}
+void DisableInThisThread() {
+#if SANITIZER_ANDROID
+  // LSAN is only enabled with Android-S and up.
+  if (!HAS_ANDROID_THREAD_PROPERTIES_API)
+    return;
+#endif
+  disable_counter++;
+}
 void EnableInThisThread() {
+#if SANITIZER_ANDROID
+  // LSAN is only enabled with Android-S and up.
+  if (!HAS_ANDROID_THREAD_PROPERTIES_API)
+    return;
+#endif
   if (disable_counter == 0) {
     DisableCounterUnderflow();
   }
@@ -95,7 +114,15 @@ static int ProcessGlobalRegionsCallback(struct dl_phdr_info *info, size_t size,
 
 // Scans global variables for heap pointers.
 void ProcessGlobalRegions(Frontier *frontier) {
-  if (!flags()->use_globals) return;
+  if (!flags()->use_globals) {
+#if SANITIZER_ANDROID
+    // There are known malloc'ed global variables from libc[++] on Android.
+    // If use_globals is turnt off, we could see leaks.
+    // Issue a warning in case users turn it off by accident.
+    Report("use_globals=0 on Android could lead to false reports.");
+#endif
+    return;
+  }
   dl_iterate_phdr(ProcessGlobalRegionsCallback, frontier);
 }
 

compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h

@@ -104,8 +104,9 @@
 //
 // FIXME: do we have anything like this on Mac?
 #ifndef SANITIZER_CAN_USE_PREINIT_ARRAY
-#if ((SANITIZER_LINUX && !SANITIZER_ANDROID) || SANITIZER_OPENBSD || \
-     SANITIZER_FUCHSIA || SANITIZER_NETBSD) && !defined(PIC)
+#if (SANITIZER_LINUX || SANITIZER_OPENBSD || SANITIZER_FUCHSIA || \
+     SANITIZER_NETBSD) &&                                         \
+    !defined(PIC)
 #define SANITIZER_CAN_USE_PREINIT_ARRAY 1
 // Before Solaris 11.4, .preinit_array is fully supported only with GNU ld.
 // FIXME: Check for those conditions.

compiler-rt/lib/sanitizer_common/sanitizer_linux.h

@@ -154,6 +154,16 @@ ALWAYS_INLINE uptr *get_android_tls_ptr() {
   return reinterpret_cast<uptr *>(&__get_tls()[TLS_SLOT_SANITIZER]);
 }
 
+// Bionic provides this API since 31.
+extern "C" SANITIZER_WEAK_ATTRIBUTE void __libc_get_static_tls_bounds(void **,
+                                                                      void **);
+extern "C" SANITIZER_WEAK_ATTRIBUTE void __libc_iterate_dynamic_tls(
+    pid_t, void (*cb)(void *, void *, uptr, void *), void *);
+
+#define HAS_ANDROID_THREAD_PROPERTIES_API (&__libc_iterate_dynamic_tls != 0)
+
+#else
+#define HAS_ANDROID_THREAD_PROPERTIES_API (0)
 #endif  // SANITIZER_ANDROID
 
 }  // namespace __sanitizer

compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cpp

@@ -460,7 +460,19 @@ int GetSizeFromHdr(struct dl_phdr_info *info, size_t size, void *data) {
 
 #if !SANITIZER_GO
 static void GetTls(uptr *addr, uptr *size) {
-#if SANITIZER_LINUX && !SANITIZER_ANDROID
+#if SANITIZER_ANDROID
+  if (HAS_ANDROID_THREAD_PROPERTIES_API) {
+    void *start_addr;
+    void *end_addr;
+    __libc_get_static_tls_bounds(&start_addr, &end_addr);
+    *addr = reinterpret_cast<uptr>(start_addr);
+    *size =
+        reinterpret_cast<uptr>(end_addr) - reinterpret_cast<uptr>(start_addr);
+  } else {
+    *addr = 0;
+    *size = 0;
+  }
+#elif SANITIZER_LINUX && !SANITIZER_ANDROID
 #if defined(__x86_64__) || defined(__i386__) || defined(__s390__)
   *addr = ThreadSelf();
   *size = GetTlsSize();
@@ -504,9 +516,6 @@ static void GetTls(uptr *addr, uptr *size) {
 #elif SANITIZER_OPENBSD
   *addr = 0;
   *size = 0;
-#elif SANITIZER_ANDROID
-  *addr = 0;
-  *size = 0;
 #elif SANITIZER_SOLARIS
   // FIXME
   *addr = 0;