From 964b6ad6d98a0570b88f7712e315830dde643bff Mon Sep 17 00:00:00 2001 From: Harvey Tuch Date: Wed, 6 Mar 2019 15:11:29 -0500 Subject: [PATCH 1/7] build: propagate ASAN/TSAN flags down to cmake_external deps. While we await a solution for bazelbuild/rules_foreign_cc#154 (comment), this PR provides a temporary workaround to get full ASAN/TSAN propagation as needed. This continues https://github.com/envoyproxy/envoy/pull/6061, which had accumulated too much complicated merge history to work with after the recent gperftools/LuaJIT migration to rules_foreign_cc. Risk level: Low Testing: --config=clang-{tsan,asan}. This is broken in the latest CI images due to the mismatched linker/compiler flags we previously had been sending to cmake_external builds. Signed-off-by: Harvey Tuch --- .bazelrc | 14 ++++++++++++++ ci/build_setup.sh | 4 ++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/.bazelrc b/.bazelrc index 9fa1b8f511721..19c36c99816c5 100644 --- a/.bazelrc +++ b/.bazelrc @@ -13,6 +13,12 @@ build:asan --define ENVOY_CONFIG_ASAN=1 build:asan --copt -fsanitize=address,undefined build:asan --linkopt -fsanitize=address,undefined build:asan --copt -fno-sanitize=vptr +# TODO(htuch): these are temporary workarounds, remove when +# https://github.com/bazelbuild/rules_foreign_cc/issues/154#issuecomment-466504751 is resolved. +build:asan --action_env=CC +build:asan --action_env=CXX +build:asan --action_env=CFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" +build:asan --action_env=CXXFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" build:asan --linkopt -fno-sanitize=vptr build:asan --linkopt -ldl build:asan --define tcmalloc=disabled @@ -36,6 +42,14 @@ build:macos-asan --copt -D_FORTIFY_SOURCE=0 # Clang TSAN build:clang-tsan --define ENVOY_CONFIG_TSAN=1 build:clang-tsan --copt -fsanitize=thread +# This is needed because of https://github.com/libevent/libevent/issues/777 +build:clang-tsan --copt -DEVENT__DISABLE_DEBUG_MODE +# TODO(htuch): these are temporary workarounds, remove when +# https://github.com/bazelbuild/rules_foreign_cc/issues/154#issuecomment-466504751 is resolved. +build:clang-tsan --action_env=CC +build:clang-tsan --action_env=CXX +build:clang-tsan --action_env=CFLAGS="-fsanitize=thread -DEVENT__DISABLE_DEBUG_MODE" +build:clang-tsan --action_env=CXXFLAGS="-fsanitize=thread" build:clang-tsan --linkopt -fsanitize=thread build:clang-tsan --define tcmalloc=disabled diff --git a/ci/build_setup.sh b/ci/build_setup.sh index 6e969f272c652..562e7968c8230 100755 --- a/ci/build_setup.sh +++ b/ci/build_setup.sh @@ -17,7 +17,6 @@ function setup_gcc_toolchain() { } function setup_clang_toolchain() { - export PATH=/usr/lib/llvm-7/bin:$PATH export CC=clang export CXX=clang++ export ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-7/bin/llvm-symbolizer @@ -64,7 +63,8 @@ if [[ -f "/etc/redhat-release" ]] then export BAZEL_BUILD_EXTRA_OPTIONS="--copt=-DENVOY_IGNORE_GLIBCXX_USE_CXX11_ABI_ERROR=1 --action_env=PATH ${BAZEL_BUILD_EXTRA_OPTIONS}" else - export BAZEL_BUILD_EXTRA_OPTIONS="--action_env=PATH=/bin:/usr/bin:/usr/lib/llvm-7/bin --linkopt=-fuse-ld=lld ${BAZEL_BUILD_EXTRA_OPTIONS}" + export BAZEL_BUILD_EXTRA_OPTIONS="--action_env=PATH=/bin:/usr/bin:/usr/lib/llvm-7/bin --linkopt=-fuse-ld=lld --host_linkopt=-fuse-ld=lld ${BAZEL_BUILD_EXTRA_OPTIONS}" + export PATH=/usr/lib/llvm-7/bin:$PATH fi # Not sandboxing, since non-privileged Docker can't do nested namespaces. From 0ff9e4598022dbe7540b96414b9a0d2a668709ae Mon Sep 17 00:00:00 2001 From: Harvey Tuch Date: Thu, 7 Mar 2019 15:03:26 -0500 Subject: [PATCH 2/7] Blacklist LuaJIT from ASAN. Signed-off-by: Harvey Tuch --- .bazelrc | 16 ++++++++-------- bazel/foreign_cc/luajit.patch | 9 ++++++++- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/.bazelrc b/.bazelrc index 19c36c99816c5..f9321f769b650 100644 --- a/.bazelrc +++ b/.bazelrc @@ -13,12 +13,6 @@ build:asan --define ENVOY_CONFIG_ASAN=1 build:asan --copt -fsanitize=address,undefined build:asan --linkopt -fsanitize=address,undefined build:asan --copt -fno-sanitize=vptr -# TODO(htuch): these are temporary workarounds, remove when -# https://github.com/bazelbuild/rules_foreign_cc/issues/154#issuecomment-466504751 is resolved. -build:asan --action_env=CC -build:asan --action_env=CXX -build:asan --action_env=CFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" -build:asan --action_env=CXXFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" build:asan --linkopt -fno-sanitize=vptr build:asan --linkopt -ldl build:asan --define tcmalloc=disabled @@ -29,6 +23,12 @@ build:asan --copt -DADDRESS_SANITIZER=1 build:asan --copt -D__SANITIZE_ADDRESS__ build:asan --test_env=ASAN_OPTIONS=handle_abort=1:allow_addr2line=true:check_initialization_order=true:strict_init_order=true build:asan --test_env=ASAN_SYMBOLIZER_PATH +# TODO(htuch): these are temporary workarounds, remove when +# https://github.com/bazelbuild/rules_foreign_cc/issues/154#issuecomment-466504751 is resolved. +build:asan --action_env=CC +build:asan --action_env=CXX +build:asan --action_env=CFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" +build:asan --action_env=CXXFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" # Clang ASAN/UBSAN build:clang-asan --config=asan @@ -44,14 +44,14 @@ build:clang-tsan --define ENVOY_CONFIG_TSAN=1 build:clang-tsan --copt -fsanitize=thread # This is needed because of https://github.com/libevent/libevent/issues/777 build:clang-tsan --copt -DEVENT__DISABLE_DEBUG_MODE +build:clang-tsan --linkopt -fsanitize=thread +build:clang-tsan --define tcmalloc=disabled # TODO(htuch): these are temporary workarounds, remove when # https://github.com/bazelbuild/rules_foreign_cc/issues/154#issuecomment-466504751 is resolved. build:clang-tsan --action_env=CC build:clang-tsan --action_env=CXX build:clang-tsan --action_env=CFLAGS="-fsanitize=thread -DEVENT__DISABLE_DEBUG_MODE" build:clang-tsan --action_env=CXXFLAGS="-fsanitize=thread" -build:clang-tsan --linkopt -fsanitize=thread -build:clang-tsan --define tcmalloc=disabled # Clang MSAN - broken today since we need to rebuild lib[std]c++ and external deps with MSAN # support (see https://github.com/envoyproxy/envoy/issues/443). diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch index 15b025595e7e3..e2f7020ea0911 100644 --- a/bazel/foreign_cc/luajit.patch +++ b/bazel/foreign_cc/luajit.patch @@ -48,7 +48,7 @@ new file mode 100755 index 0000000..9c71271 --- /dev/null +++ b/build.py -@@ -0,0 +1,28 @@ +@@ -0,0 +1,35 @@ +#!/usr/bin/env python + +import argparse @@ -73,6 +73,13 @@ index 0000000..9c71271 + # fail on it. + os.environ["LSAN_OPTIONS"] = "exitcode=0" + ++ # Blacklist LuaJIT from ASAN for now. ++ # TODO(htuch): Remove this when https://github.com/envoyproxy/envoy/issues/6084 is resolved. ++ print("foo") ++ with open("clang-asan-blacklist.txt", "w") as f: ++ f.write("fun:lj_*\n") ++ os.environ["TARGET_CFLAGS"] += " -fsanitize-blacklist=%s/com_github_luajit_luajit/clang-asan-blacklist.txt" % os.environ["PWD"] ++ + os.system('make V=1 PREFIX="{}" install'.format(args.prefix)) + +main() From e91b85f474179fd954319fac75f1a694023c7386 Mon Sep 17 00:00:00 2001 From: Harvey Tuch Date: Thu, 7 Mar 2019 15:20:14 -0500 Subject: [PATCH 3/7] Remove debug print. Signed-off-by: Harvey Tuch --- bazel/foreign_cc/luajit.patch | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch index e2f7020ea0911..8a07ef1c812f8 100644 --- a/bazel/foreign_cc/luajit.patch +++ b/bazel/foreign_cc/luajit.patch @@ -48,7 +48,7 @@ new file mode 100755 index 0000000..9c71271 --- /dev/null +++ b/build.py -@@ -0,0 +1,35 @@ +@@ -0,0 +1,34 @@ +#!/usr/bin/env python + +import argparse @@ -75,7 +75,6 @@ index 0000000..9c71271 + + # Blacklist LuaJIT from ASAN for now. + # TODO(htuch): Remove this when https://github.com/envoyproxy/envoy/issues/6084 is resolved. -+ print("foo") + with open("clang-asan-blacklist.txt", "w") as f: + f.write("fun:lj_*\n") + os.environ["TARGET_CFLAGS"] += " -fsanitize-blacklist=%s/com_github_luajit_luajit/clang-asan-blacklist.txt" % os.environ["PWD"] From 53330265d432ab9fc9ecd33fcb5c82b751282dbb Mon Sep 17 00:00:00 2001 From: Harvey Tuch Date: Thu, 7 Mar 2019 16:09:23 -0500 Subject: [PATCH 4/7] Only blacklist on ASAN builds. Signed-off-by: Harvey Tuch --- bazel/foreign_cc/luajit.patch | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch index 8a07ef1c812f8..f38c3650ca21b 100644 --- a/bazel/foreign_cc/luajit.patch +++ b/bazel/foreign_cc/luajit.patch @@ -48,7 +48,7 @@ new file mode 100755 index 0000000..9c71271 --- /dev/null +++ b/build.py -@@ -0,0 +1,34 @@ +@@ -0,0 +1,35 @@ +#!/usr/bin/env python + +import argparse @@ -77,7 +77,8 @@ index 0000000..9c71271 + # TODO(htuch): Remove this when https://github.com/envoyproxy/envoy/issues/6084 is resolved. + with open("clang-asan-blacklist.txt", "w") as f: + f.write("fun:lj_*\n") -+ os.environ["TARGET_CFLAGS"] += " -fsanitize-blacklist=%s/com_github_luajit_luajit/clang-asan-blacklist.txt" % os.environ["PWD"] ++ if "sanitize=address" in os.environ["TARGET_CFLAGS"]: ++ os.environ["TARGET_CFLAGS"] += " -fsanitize-blacklist=%s/com_github_luajit_luajit/clang-asan-blacklist.txt" % os.environ["PWD"] + + os.system('make V=1 PREFIX="{}" install'.format(args.prefix)) + From 559526ebc815a073173c3f5ae86b4504206ebc9d Mon Sep 17 00:00:00 2001 From: Harvey Tuch Date: Thu, 7 Mar 2019 16:46:48 -0500 Subject: [PATCH 5/7] Fix gcc builds. Signed-off-by: Harvey Tuch --- bazel/BUILD | 5 +++++ bazel/foreign_cc/BUILD | 7 +++++++ bazel/foreign_cc/luajit.patch | 6 +++--- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/bazel/BUILD b/bazel/BUILD index 34315c825bab8..a15c49e25132e 100644 --- a/bazel/BUILD +++ b/bazel/BUILD @@ -85,6 +85,11 @@ config_setting( values = {"compilation_mode": "dbg"}, ) +config_setting( + name = "asan_build", + values = {"define": "ENVOY_CONFIG_ASAN=1"}, +) + config_setting( name = "coverage_build", values = {"define": "ENVOY_CONFIG_COVERAGE=1"}, diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD index 3791c8f3adbdf..28c34462d4a81 100644 --- a/bazel/foreign_cc/BUILD +++ b/bazel/foreign_cc/BUILD @@ -32,6 +32,13 @@ cc_library( configure_make( name = "luajit", configure_command = "build.py", + configure_env_vars = select({ + # This shouldn't be needed! See + # https://github.com/bazelbuild/rules_foreign_cc/issues/154#issuecomment-470704365 + # TODO(htuch): Remove when the rules_foreign_cc issue is fixed + "//bazel:asan_build": {"ENVOY_CONFIG_ASAN": "1"}, + "//conditions:default": {}, + }), lib_source = "@com_github_luajit_luajit//:all", make_commands = [], static_libraries = [ diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch index f38c3650ca21b..2ff010f02f803 100644 --- a/bazel/foreign_cc/luajit.patch +++ b/bazel/foreign_cc/luajit.patch @@ -75,10 +75,10 @@ index 0000000..9c71271 + + # Blacklist LuaJIT from ASAN for now. + # TODO(htuch): Remove this when https://github.com/envoyproxy/envoy/issues/6084 is resolved. -+ with open("clang-asan-blacklist.txt", "w") as f: -+ f.write("fun:lj_*\n") -+ if "sanitize=address" in os.environ["TARGET_CFLAGS"]: ++ if "ENVOY_CONFIG_ASAN" in os.environ: + os.environ["TARGET_CFLAGS"] += " -fsanitize-blacklist=%s/com_github_luajit_luajit/clang-asan-blacklist.txt" % os.environ["PWD"] ++ with open("clang-asan-blacklist.txt", "w") as f: ++ f.write("fun:lj_*\n") + + os.system('make V=1 PREFIX="{}" install'.format(args.prefix)) + From 07c6710f38794441e7a431d57e6989306a26acc3 Mon Sep 17 00:00:00 2001 From: Harvey Tuch Date: Thu, 7 Mar 2019 18:20:00 -0500 Subject: [PATCH 6/7] Workaround for host protoc and LSAN. Signed-off-by: Harvey Tuch --- .bazelrc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.bazelrc b/.bazelrc index f9321f769b650..1239c08ce7082 100644 --- a/.bazelrc +++ b/.bazelrc @@ -29,6 +29,9 @@ build:asan --action_env=CC build:asan --action_env=CXX build:asan --action_env=CFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" build:asan --action_env=CXXFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" +# This is needed for host protoc. TODO(htuch): Figure out why.. +build:asan --action_env=LSAN_OPTIONS=exitcode=0 +build:asan --test_env=LSAN_OPTIONS= # Clang ASAN/UBSAN build:clang-asan --config=asan From 6b8ccb84bfee649a4d7a113c7ba8e3fa19cb35e7 Mon Sep 17 00:00:00 2001 From: Harvey Tuch Date: Thu, 7 Mar 2019 22:07:02 -0500 Subject: [PATCH 7/7] Some more logging. Signed-off-by: Harvey Tuch --- .bazelrc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.bazelrc b/.bazelrc index 1239c08ce7082..8b9ae06134ffd 100644 --- a/.bazelrc +++ b/.bazelrc @@ -30,8 +30,8 @@ build:asan --action_env=CXX build:asan --action_env=CFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" build:asan --action_env=CXXFLAGS="-fsanitize=address,undefined -fno-sanitize=vptr" # This is needed for host protoc. TODO(htuch): Figure out why.. -build:asan --action_env=LSAN_OPTIONS=exitcode=0 -build:asan --test_env=LSAN_OPTIONS= +build:asan --action_env=LSAN_OPTIONS=verbosity=1:log_threads=1 +build:asan --test_env=LSAN_OPTIONS=verbosity=1:log_threads=1 # Clang ASAN/UBSAN build:clang-asan --config=asan