ubsan support

[newjorchen]

hi all, I want to integrate sanitizer tools into android apk to check native code. Currently i can run the app that intergrated ASAN on android Oreo phone. But, for other sanitizer tools, such as USAN or TSAN etc, I can not catch any any crached info that trapped by sanitizer. Besides, the info about android sanitizer are varied on web. So could you pls. tell me is there any other sanitizer tools supported on android? and how to integrate them? Thx!

BRs,
newjor

[eugenis]

You can use UBSan. Surprisingly, it can not be used in combination with ASan, because ASan runtime library in the NDK does not include the necessary code. We will fix this in the future. For now, you can use UBSan on its own, by building with -fsanitize=undefined (or subset of it, see [1]) and then manually adding libclang_rt.ubsan_standalone-${arch}-android.so to the link command line and to the apk native library directory. UBSan does not need wrap.sh.

Other sanitizers won't work out of the box.

[1] https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html#id4

[newjorchen]

Thanks for your help. I already added "LOCAL_CFLAGS += -fsanitize=undefined" and "LOCAL_LDFLAGS += -fsanitze=undefined" in Android.mk, but nothing happened during the apk building. Although I add the ubsan lib dependency at build phase and copy the lib into apk native lib directory. I can't find any log about ubsan when the app run. Could you give me more detailed about how to add ubsan in building phase?

[eugenis]

I'm not sure what's wrong. I took hello-jni sample from https://github.com/googlesamples/android-ndk; it's using cmake, so adding something like this works:

set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fsanitize=undefined")
add_library(ubsan-rt SHARED IMPORTED)
set_property(TARGET ubsan-rt PROPERTY IMPORTED_LOCATION "${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64/lib64/clang/5.0/lib/linux/libclang_rt.ubsan_standalone-aarch64-android.so")

target_link_libraries(hello-jni
android
log
ubsan-rt
)

Then you also need to add the library to the apk, of course. And the snippet above does not work with multiple ABIs.

This is bug in Clang that you need to do most of this. The library should be linked automatically with -fsanitize=undefined in linker flags, we'll fix this some day.

[newjorchen]

Yes, I added your command into hello-jni sample and ubsan can work. However, I added similar command into Android.mk, the linker always showed undefined reference to '__ubsan_handle_type_mismatch'. I tried add the lib name for LOCAL_LDLIBS and LOCAL_SHARED_LIBRARIES, but still failed...

[eugenis]

Sorry, no idea. Must be some quirk of Android.mk. Try checking that the library appears on the link command line.

[newjorchen]

I changed the LOCAL_CFLAGS from '-fsanitize=undifined' to '-fsanitize=sign-integer-overflow,integer-divide-by-zero'，and the linker didn't hint that '__ubsan_handle_type_mismatch' undefined, instead , showed other simbols undefined, as followed:
error: undefined reference to '__ubsan_handle_sub_overflow'
error: undefined reference to '__ubsan_handle_sub_overflow'
error: undefined reference to '__ubsan_handle_add_overflow'
error: undefined reference to '__ubsan_handle_add_overflow'
error: undefined reference to '__ubsan_handle_sub_overflow'
error: undefined reference to '__ubsan_handle_sub_overflow'
error: undefined reference to '__ubsan_handle_type_mismatch'
error: undefined reference to '__ubsan_handle_type_mismatch'
error: undefined reference to '__ubsan_handle_type_mismatch'
error: undefined reference to '__ubsan_handle_type_mismatch'
error: undefined reference to '__ubsan_handle_add_overflow'
error: undefined reference to '__ubsan_handle_add_overflow'
error: undefined reference to '__ubsan_handle_mul_overflow'
error: undefined reference to '__ubsan_handle_mul_overflow'
error: undefined reference to '__ubsan_handle_mul_overflow'
error: undefined reference to '__ubsan_handle_mul_overflow'
error: undefined reference to '__ubsan_handle_load_invalid_value'
error: undefined reference to '__ubsan_handle_divrem_overflow'
error: undefined reference to '__ubsan_handle_divrem_overflow'
error: undefined reference to '__ubsan_handle_load_invalid_value'
error: undefined reference to '__ubsan_handle_load_invalid_value'
error: undefined reference to '__ubsan_handle_out_of_bounds'
error: undefined reference to '__ubsan_handle_out_of_bounds'
error: undefined reference to '__ubsan_handle_out_of_bounds'
error: undefined reference to '__ubsan_handle_out_of_bounds'
error: undefined reference to '__ubsan_handle_vla_bound_not_positive'
error: undefined reference to '__ubsan_handle_vla_bound_not_positive'
error: undefined reference to '__ubsan_handle_vla_bound_not_positive'
error: undefined reference to '__ubsan_handle_load_invalid_value'
error: undefined reference to '__ubsan_handle_vla_bound_not_positive'
error: undefined reference to '__ubsan_handle_float_cast_overflow'
error: undefined reference to '__ubsan_handle_float_cast_overflow'
error: undefined reference to '__ubsan_handle_shift_out_of_bounds'
error: undefined reference to '__ubsan_handle_shift_out_of_bounds'
error: undefined reference to '__ubsan_handle_shift_out_of_bounds'
error: undefined reference to '__ubsan_handle_shift_out_of_bounds'
error: undefined reference to '__ubsan_handle_divrem_overflow'
error: undefined reference to '__ubsan_handle_divrem_overflow'
error: undefined reference to '__ubsan_handle_negate_overflow'

and I added all the other checks listed in undefinedBehaviorSanitizer#Docs, but still showed them.

[DanAlbert]

The Clang driver isn't linking the ubsan runtime. I can't see why it isn't from the driver source.

[eugenis]

Because this:
http://llvm-cs.pcc.me.uk/tools/clang/lib/Driver/ToolChains/CommonArgs.cpp#564

It simply never links shared ubsan runtime. I intend to fix it soon-ish.

[DanAlbert]

/work/src/ndk/out/android-ndk-r17-canary/toolchains/llvm/prebuilt/linux-x86_64/bin/clang++ \
    -Wl,-soname,libfoo.so -shared \
    --sysroot=/work/src/ndk/out/android-ndk-r17-canary/platforms/android-14/arch-arm \
    ./obj/local/armeabi-v7a/objs/foo/foo.o \
    /work/src/ndk/out/android-ndk-r17-canary/sources/cxx-stl/llvm-libc++/libs/armeabi-v7a/libc++_static.a \
    /work/src/ndk/out/android-ndk-r17-canary/sources/cxx-stl/llvm-libc++abi/../llvm-libc++/libs/armeabi-v7a/libc++abi.a \
    /work/src/ndk/out/android-ndk-r17-canary/sources/android/support/../../cxx-stl/llvm-libc++/libs/armeabi-v7a/libandroid_support.a \
    /work/src/ndk/out/android-ndk-r17-canary/sources/cxx-stl/llvm-libc++/libs/armeabi-v7a/libunwind.a \
    -latomic -Wl,--exclude-libs,libatomic.a  \
    -gcc-toolchain /work/src/ndk/out/android-ndk-r17-canary/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64 \
    -no-canonical-prefixes -target armv7-none-linux-androideabi14 -Wl,--fix-cortex-a8 \
    -Wl,--exclude-libs,libunwind.a -Wl,--build-id -Wl,--no-undefined -Wl,-z,noexecstack -Wl,-z,relro \
    -Wl,-z,now -Wl,--warn-shared-textrel -Wl,--fatal-warnings -fsanitize=undefined -v   -lc -lm \
    -o ./obj/local/armeabi-v7a/libfoo.so
Android clang version 5.0.1 (https://us3-mirror-android.googlesource.com/a/toolchain/clang 00e4a5a67eb7d626653c23780ff02367ead74955) (https://us3-mirror-android.googlesource.com/a/toolchain/llvm 9d9041cc83619436c5e212b06509d3f5fbb860d7) (based on LLVM 5.0.1svn)
Target: armv7-none-linux-android14
Thread model: posix
InstalledDir: /work/src/ndk/out/android-ndk-r17-canary/toolchains/llvm/prebuilt/linux-x86_64/bin
Found candidate GCC installation: /work/src/ndk/out/android-ndk-r17-canary/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/lib/gcc/arm-linux-androideabi/4.9.x
Selected GCC installation: /work/src/ndk/out/android-ndk-r17-canary/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/lib/gcc/arm-linux-androideabi/4.9.x
Candidate multilib: thumb;@mthumb
Candidate multilib: armv7-a;@march=armv7-a
Candidate multilib: armv7-a/thumb;@march=armv7-a@mthumb
Candidate multilib: .;
Selected multilib: armv7-a;@march=armv7-a
 "/work/src/ndk/out/android-ndk-r17-canary/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/lib/gcc/arm-linux-androideabi/4.9.x/../../../../arm-linux-androideabi/bin/ld" --sysroot=/work/src/ndk/out/android-ndk-r17-canary/platforms/android-14/arch-arm -z relro -X --eh-frame-hdr -m armelf_linux_eabi -shared -o ./obj/local/armeabi-v7a/libfoo.so /work/src/ndk/out/android-ndk-r17-canary/platforms/android-14/arch-arm/usr/lib/../lib/crtbegin_so.o -L/work/src/ndk/out/android-ndk-r17-canary/toolchains/llvm/prebuilt/linux-x86_64/lib64/clang/5.0.1/lib/linux/arm -L/work/src/ndk/out/android-ndk-r17-canary/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/lib/gcc/arm-linux-androideabi/4.9.x/armv7-a -L/work/src/ndk/out/android-ndk-r17-canary/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/lib/gcc/arm-linux-androideabi/4.9.x/../../../../arm-linux-androideabi/lib/../lib/armv7-a -L/work/src/ndk/out/android-ndk-r17-canary/platforms/android-14/arch-arm/usr/lib/../lib -L/work/src/ndk/out/android-ndk-r17-canary/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/lib/gcc/arm-linux-androideabi/4.9.x/../../../../arm-linux-androideabi/lib/armv7-a -L/work/src/ndk/out/android-ndk-r17-canary/platforms/android-14/arch-arm/usr/lib -soname libfoo.so ./obj/local/armeabi-v7a/objs/foo/foo.o /work/src/ndk/out/android-ndk-r17-canary/sources/cxx-stl/llvm-libc++/libs/armeabi-v7a/libc++_static.a /work/src/ndk/out/android-ndk-r17-canary/sources/cxx-stl/llvm-libc++abi/../llvm-libc++/libs/armeabi-v7a/libc++abi.a /work/src/ndk/out/android-ndk-r17-canary/sources/android/support/../../cxx-stl/llvm-libc++/libs/armeabi-v7a/libandroid_support.a /work/src/ndk/out/android-ndk-r17-canary/sources/cxx-stl/llvm-libc++/libs/armeabi-v7a/libunwind.a -latomic --exclude-libs libatomic.a --fix-cortex-a8 --exclude-libs libunwind.a --build-id --no-undefined -z noexecstack -z relro -z now --warn-shared-textrel --fatal-warnings -lc -lm -lstdc++ -lm -lgcc -ldl -lc -lgcc -ldl /work/src/ndk/out/android-ndk-r17-canary/platforms/android-14/arch-arm/usr/lib/../lib/crtend_so.o
jni/foo.cpp:2: error: undefined reference to '__ubsan_handle_add_overflow'
clang++: error: linker command failed with exit code 1 (use -v to see invocation)

[DanAlbert]

Retitling this bug to cover just ubsan. If there are other tools people want, please open separate bugs.

[DanAlbert]

Looks like this is working once we get the next clang update. The compiler team found a miscompile in the one we thought we'd have in time for r17 beta 1 and I don't know the status of the respin. I'll check up on that, but I usually don't like taking compiler updates after beta 1.

I should note that "working" means that ubsan works if you pass -fsanitize=undefined and then manually copy the runtime library into your app. #540 covers bundling the runtimes in your app.

[DanAlbert]

Made it into r17 beta 1 after all.