sanitizers.gni (18136B)
1 # Copyright 2015 The Chromium Authors 2 # Use of this source code is governed by a BSD-style license that can be 3 # found in the LICENSE file. 4 5 import("//chromium/build/config/cast.gni") 6 import("//chromium/build/config/chrome_build.gni") 7 import("//chromium/build/config/chromeos/args.gni") 8 import("//chromium/build/config/chromeos/ui_mode.gni") 9 import("//chromium/build/config/profiling/profiling.gni") 10 import("//chromium/build/toolchain/toolchain.gni") 11 12 declare_args() { 13 # Compile for Address Sanitizer to find memory bugs. 14 is_asan = false 15 16 # Compile for Hardware-Assisted Address Sanitizer to find memory bugs 17 # (android/arm64 only). 18 # See http://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html 19 is_hwasan = false 20 21 # Compile for Leak Sanitizer to find leaks. 22 is_lsan = false 23 24 # Compile for Memory Sanitizer to find uninitialized reads. 25 is_msan = false 26 27 # Compile for Thread Sanitizer to find threading bugs. 28 is_tsan = false 29 30 # Compile for Undefined Behaviour Sanitizer to find various types of 31 # undefined behaviour (excludes vptr checks). 32 is_ubsan = false 33 34 # Halt the program if a problem is detected. 35 is_ubsan_no_recover = false 36 37 # Track where uninitialized memory originates from. From fastest to slowest: 38 # 0 - no tracking, 1 - track only the initial allocation site, 2 - track the 39 # chain of stores leading from allocation site to use site. 40 msan_track_origins = 2 41 42 # Enables "param-retval" mode, which finds more uses of uninitialized data and 43 # reduces code size. Behind a flag as there are a number of previously 44 # undetected violations that still need to be fixed. 45 # TODO(crbug.com/40240570): Default this to true and remove. 46 msan_eager_checks = true 47 48 # TODO(crbug.com/40222690): Enable everywhere. 49 msan_check_use_after_dtor = is_linux 50 51 # Use dynamic libraries instrumented by one of the sanitizers instead of the 52 # standard system libraries. Set this flag to build the libraries from source. 53 use_locally_built_instrumented_libraries = false 54 55 # Compile with Control Flow Integrity to protect virtual calls and casts. 56 # See http://clang.llvm.org/docs/ControlFlowIntegrity.html 57 # 58 # TODO(pcc): Remove this flag if/when CFI is enabled in all official builds. 59 is_cfi = is_official_build && is_clang && 60 ((target_os == "linux" && target_cpu == "x64") || 61 (is_chromeos && is_chromeos_device)) 62 63 # Enable checks for indirect function calls via a function pointer. 64 # TODO(pcc): remove this when we're ready to add these checks by default. 65 # https://crbug.com/701919 66 use_cfi_icall = 67 target_os == "linux" && target_cpu == "x64" && is_official_build 68 69 # Print detailed diagnostics when Control Flow Integrity detects a violation. 70 use_cfi_diag = false 71 72 # Let Control Flow Integrity continue execution instead of crashing when 73 # printing diagnostics (use_cfi_diag = true). 74 use_cfi_recover = false 75 76 # Compile for fuzzing with LLVM LibFuzzer. 77 # See http://www.chromium.org/developers/testing/libfuzzer 78 use_libfuzzer = false 79 80 # Compile for fuzzing with centipede. 81 # See https://github.com/google/centipede 82 use_centipede = false 83 84 # Compile for fuzzing with AFL. 85 use_afl = false 86 87 # Compile for fuzzing with Fuzzilli. 88 use_fuzzilli = false 89 90 # Compile for fuzzing with an external engine (e.g., Grammarinator). 91 use_external_fuzzing_engine = false 92 93 # Enables core ubsan security features. Will later be removed once it matches 94 # is_ubsan. 95 is_ubsan_security = false 96 97 # Helper variable for testing builds with disabled libfuzzer. 98 # Not for client use. 99 disable_libfuzzer = false 100 101 # Value for -fsanitize-coverage flag. Setting this causes 102 # use_sanitizer_coverage to be enabled. 103 # This flag is not used for libFuzzer (use_libfuzzer=true). Instead, we use: 104 # -fsanitize=fuzzer-no-link 105 # Default value when unset and use_fuzzing_engine=true: 106 # trace-pc-guard 107 # Default value when unset and use_sanitizer_coverage=true: 108 # trace-pc-guard,indirect-calls 109 sanitizer_coverage_flags = "" 110 111 # A sanitizer coverage allowlist, specifying exactly which 112 # files or symbol names should be instrumented, rather than all of them. 113 sanitizer_coverage_allowlist = "" 114 115 # When enabled, only relevant sanitizer defines are set, but compilation 116 # happens with no extra flags. This is useful when in component build 117 # enabling sanitizers only in some of the components. 118 use_sanitizer_configs_without_instrumentation = false 119 120 # When true, seed corpora archives are built. 121 archive_seed_corpus = true 122 123 # When true, only builds fuzzer targets that require high end machines to run. 124 # Otherwise, builds all the targets. 125 # TODO(paulsemel): once we have everything implemented on the recipe side, we 126 # can change the behaviour for the false case, and only build the non high-end 127 # jobs, so that they do not appear in the zip. As for now, this behaviour 128 # ensures nothing breaks. 129 high_end_fuzzer_targets = false 130 } 131 132 declare_args() { 133 # Enable checks for bad casts: derived cast and unrelated cast. 134 # TODO(krasin): remove this, when we're ready to add these checks by default. 135 # https://crbug.com/626794 136 use_cfi_cast = is_cfi && is_chromeos 137 138 # Compile for Undefined Behaviour Sanitizer's vptr checks. 139 is_ubsan_vptr = is_ubsan_security || is_ubsan 140 141 # These are set for some non-host toolchain which requires to run built binary 142 # from host toolchain with msan config but in non-host toolchain context. 143 host_toolchain_is_msan = is_msan 144 host_toolchain_msan_track_origins = msan_track_origins 145 } 146 147 # Whether we are doing a fuzzer build. Normally this should be checked instead 148 # of checking "use_libfuzzer || use_afl" because often developers forget to 149 # check for "use_afl", and "use_centipede" is new. 150 use_fuzzing_engine = use_libfuzzer || use_afl || use_centipede || 151 use_external_fuzzing_engine || use_fuzzilli 152 153 # Whether any UBSan subset is enabled. 154 # TODO(crbug.com/40248746): Unify these under a single UBSan option. 155 is_ubsan_any = is_ubsan || is_ubsan_vptr || is_ubsan_security 156 157 declare_args() { 158 # Builds fuzztest test executables such that they support the 159 # --fuzz= argument, which requires some sanitizer coverage. 160 # We want to enable this only when we're *NOT* using a fuzzing 161 # engine such as libfuzzer or centipede. It's generally a 162 # useful option, but it requires sanitizer coverage, and that 163 # could conceivably disrupt normal unit testing workflows, so we'll 164 # enable it by default only in sanitizer builds. 165 # Also be sure not to enable this on non-Chromium builds where 166 # the required //third_party/fuzztest dependency may be absent. 167 # TODO(crbug.com/40286621): enable on component builds 168 enable_fuzztest_fuzz = 169 !(use_libfuzzer || use_afl || use_centipede || 170 use_external_fuzzing_engine || use_fuzzilli) && 171 (is_asan || is_hwasan || is_lsan || is_tsan || is_msan || is_ubsan_any) && 172 !is_component_build && is_linux && build_with_chromium 173 174 # Whether FUZZ_TESTs should be registered as gtests in Chromium's mainstream 175 # test suites. This will cause the to run for 1 second in normal testing 176 # environments such as CI. Within Chromium, we want to do this only on 177 # platforms where we have ClusterFuzz support (Windows, Mac, Linux) because 178 # we want ClusterFuzz to find the majority of problems rather than CI. 179 # This gn arg is typically respected by general-purpose test suite 180 # initialization code; targets created specifically for fuzztests alone 181 # would not normally be disabled by a setting of 'false' here. 182 register_fuzztests_in_test_suites = 183 is_linux || is_mac || is_win || use_libfuzzer || use_afl || 184 use_centipede || use_external_fuzzing_engine 185 } 186 187 declare_args() { 188 use_sanitizer_coverage = 189 !use_clang_coverage && (use_fuzzing_engine || enable_fuzztest_fuzz || 190 sanitizer_coverage_flags != "") 191 } 192 193 assert(!is_hwasan || (target_os == "android" && target_cpu == "arm64"), 194 "HWASan only supported on Android ARM64 builds.") 195 196 assert( 197 !(enable_fuzztest_fuzz && use_libfuzzer), 198 "Can't specify enable_fuzztest_fuzz and use_libfuzzer. When libfuzzer is enabled, fuzztest executables automatically support --fuzz but provide output that's libfuzzer compatible.") 199 200 assert( 201 !(enable_fuzztest_fuzz && use_centipede), 202 "Can't specify enable_fuzztest_fuzz and use_centipede. The same binaries are built in a different mode to add centipede support.") 203 204 assert( 205 !(enable_fuzztest_fuzz && is_component_build), 206 "Can't specify enable_fuzztest_fuzz in component builds; fuzztest doesn't yet support it. Consider using use_libfuzzer=true instead which provides superficially similar functionality.") 207 208 # Disable sanitizers for non-target toolchains, and for the toolchain using 209 # the prebuilt Rust stdlib which has no sanitizer support with it. 210 if (!is_a_target_toolchain || toolchain_for_rust_host_build_tools) { 211 is_asan = false 212 is_cfi = false 213 is_hwasan = false 214 is_lsan = false 215 is_msan = false 216 is_tsan = false 217 is_ubsan = false 218 is_ubsan_no_recover = false 219 is_ubsan_security = false 220 is_ubsan_vptr = false 221 is_ubsan_any = false 222 msan_track_origins = 0 223 sanitizer_coverage_flags = "" 224 use_afl = false 225 use_centipede = false 226 use_cfi_diag = false 227 use_cfi_recover = false 228 use_libfuzzer = false 229 use_locally_built_instrumented_libraries = false 230 use_sanitizer_coverage = false 231 enable_fuzztest_fuzz = false 232 } else if (target_cpu != "arm64") { 233 is_hwasan = false 234 } 235 236 # Whether we are linking against a sanitizer runtime library. Among other 237 # things, this changes the default symbol level and other settings in order to 238 # prepare to create stack traces "live" using the sanitizer runtime. 239 using_sanitizer = is_asan || is_hwasan || is_lsan || is_tsan || is_msan || 240 is_ubsan_any || use_sanitizer_coverage || use_cfi_diag 241 242 # Use dynamic libraries instrumented by one of the sanitizers instead of the 243 # standard system libraries. We have instrumented system libraries for msan, 244 # which requires them to prevent false positives. 245 # TODO(thakis): Maybe remove this variable. 246 use_prebuilt_instrumented_libraries = is_msan 247 248 # Whether the current fuzzing engine supports libprotobuf_mutator. 249 use_fuzzing_engine_with_lpm = use_libfuzzer || use_centipede 250 251 # Whether the fuzzing engine supports fuzzers which supply their own 252 # "main" function. 253 fuzzing_engine_supports_custom_main = 254 use_libfuzzer || use_centipede || use_fuzzilli 255 256 # Args that are in turn dependent on other args must be in a separate 257 # declare_args block. User overrides are only applied at the end of a 258 # declare_args block. 259 declare_args() { 260 # When true, sanitizer warnings will cause test case failures. 261 fail_on_san_warnings = using_sanitizer 262 263 # Generates an owners file for each fuzzer test. 264 # TODO(crbug.com/40175535): Remove this arg when finding OWNERS is faster. 265 generate_fuzzer_owners = use_fuzzing_engine 266 267 # https://crbug.com/1002058: Code coverage works inside the sandbox via the 268 # help of several helper IPCs. Unfortunately, the sandbox-only path does not 269 # work well for fuzzing builds. Since fuzzing builds already disable the 270 # sandbox when dumping coverage, limit the sandbox-only path to non-fuzzing 271 # builds. 272 # Everything is IPC on Fuchsia, so this workaround for code coverage inside 273 # the sandbox does not apply. 274 use_clang_profiling_inside_sandbox = 275 use_clang_profiling && !use_fuzzing_engine && !is_fuchsia 276 } 277 278 if (sanitizer_coverage_flags == "") { 279 if (enable_fuzztest_fuzz) { 280 # ./fuzztest_executable --fuzz= 281 # requires only this single type of coverage 282 sanitizer_coverage_flags = "inline-8bit-counters" 283 } else if (use_fuzzing_engine) { 284 sanitizer_coverage_flags = "trace-pc-guard" 285 if (use_centipede) { 286 # Centipede's minimal flags are listed in //third_party/fuzztest/src/centipede/clang-flags.txt. 287 # But, for users like Chromium using an up-to-date clang, we can also 288 # enable extra optional types of coverage which may make Centipede more 289 # effective. This list is not currently documented and has been derived 290 # from discussion with centipede creators (though one is warned about at 291 # https://github.com/google/centipede/blob/main/centipede_callbacks.cc#L68) 292 sanitizer_coverage_flags = sanitizer_coverage_flags + 293 ",pc-table,trace-cmp,control-flow,trace-loads" 294 } 295 } else if (use_sanitizer_coverage) { 296 sanitizer_coverage_flags = "trace-pc-guard,indirect-calls" 297 } 298 } 299 300 assert(!using_sanitizer || is_clang, 301 "Sanitizers (is_*san) require setting is_clang = true in 'gn args'") 302 303 assert(!is_cfi || is_clang, 304 "is_cfi requires setting is_clang = true in 'gn args'") 305 306 prebuilt_instrumented_libraries_available = 307 is_msan && (msan_track_origins == 0 || msan_track_origins == 2) 308 309 if (use_libfuzzer && (is_linux || is_chromeos)) { 310 if (is_asan) { 311 # We do leak checking with libFuzzer on Linux. Set is_lsan for code that 312 # relies on LEAK_SANITIZER define to avoid false positives. 313 is_lsan = true 314 } 315 } 316 317 # MSan only links Chrome properly in release builds (brettw -- 9/1/2015). The 318 # same is possibly true for the other non-ASan sanitizers. But regardless of 319 # whether it links, one would normally never run a sanitizer in debug mode. 320 # Running in debug mode probably indicates you forgot to set the "is_debug = 321 # false" flag in the build args. ASan seems to run fine in debug mode. 322 # 323 # If you find a use-case where you want to compile a sanitizer in debug mode 324 # and have verified it works, ask brettw and we can consider removing it from 325 # this condition. We may also be able to find another way to enable your case 326 # without having people accidentally get broken builds by compiling an 327 # unsupported or unadvisable configurations. 328 # 329 # For one-off testing, just comment this assertion out. 330 assert(!is_debug || !(is_msan || is_ubsan || is_ubsan_vptr), 331 "Sanitizers should generally be used in release (set is_debug=false).") 332 333 assert(!is_msan || ((is_linux || is_chromeos) && target_cpu == "x64"), 334 "MSan currently only works on 64-bit Linux and ChromeOS builds.") 335 336 assert(!is_lsan || is_asan, "is_lsan = true requires is_asan = true also.") 337 338 # ASAN build on Windows is not working in debug mode. Intercepting memory 339 # allocation functions is hard on Windows and not yet implemented in LLVM. 340 assert(!is_win || !is_debug || !is_asan, 341 "ASan on Windows doesn't work in debug (set is_debug=false).") 342 343 # libFuzzer targets can fail to build or behave incorrectly when built without 344 # ASAN on Windows. 345 assert(!is_win || !use_libfuzzer || is_asan, 346 "use_libfuzzer on Windows requires setting is_asan = true") 347 348 # Make sure that if we recover on detection (i.e. not crash), diagnostics are 349 # printed. 350 assert(!use_cfi_recover || use_cfi_diag, 351 "Only use CFI recovery together with diagnostics.") 352 353 # TODO(crbug.com/40534102): the use_sanitizer_coverage arg is currently 354 # not supported by the Chromium mac_clang_x64 toolchain on iOS distribution. 355 # The coverage works with iOS toolchain but it is broken when the mac 356 # toolchain is used as a secondary one on iOS distribution. E.g., it should be 357 # possible to build the "net" target for iOS with the sanitizer coverage 358 # enabled. 359 assert( 360 !(use_sanitizer_coverage && is_mac && target_os == "ios"), 361 "crbug.com/753445: use_sanitizer_coverage=true is not supported by the " + 362 "Chromium mac_clang_x64 toolchain on iOS distribution. Please set " + 363 "the argument value to false.") 364 365 assert( 366 sanitizer_coverage_allowlist == "" || use_sanitizer_coverage, 367 "Can't specify a sanitizer coverage allowlist without using sanitizer coverage.") 368 369 # Use these lists of configs to disable instrumenting code that is part of a 370 # fuzzer, but which isn't being targeted (such as libprotobuf-mutator, *.pb.cc 371 # and libprotobuf when they are built as part of a proto fuzzer). Adding or 372 # removing these lists does not have any effect if use_libfuzzer or use_afl are 373 # not passed as arguments to gn. 374 not_fuzzed_remove_configs = [] 375 not_fuzzed_remove_nonasan_configs = [] 376 377 if (use_fuzzing_engine) { 378 # Removing coverage should always just work. 379 not_fuzzed_remove_configs += [ "//chromium/build/config/coverage:default_coverage" ] 380 not_fuzzed_remove_nonasan_configs += 381 [ "//chromium/build/config/coverage:default_coverage" ] 382 383 if (!is_msan) { 384 # Allow sanitizer instrumentation to be removed if we are not using MSan 385 # since binaries cannot be partially instrumented with MSan. 386 not_fuzzed_remove_configs += 387 [ "//chromium/build/config/sanitizers:default_sanitizer_flags" ] 388 389 # Certain parts of binaries must be instrumented with ASan if the rest of 390 # the binary is. For these, only remove non-ASan sanitizer instrumentation. 391 if (!is_asan) { 392 not_fuzzed_remove_nonasan_configs += 393 [ "//chromium/build/config/sanitizers:default_sanitizer_flags" ] 394 395 assert(not_fuzzed_remove_nonasan_configs == not_fuzzed_remove_configs) 396 } 397 } 398 } 399 400 # Options common to different fuzzer engines. 401 # Engine should be compiled without coverage (infinite loop in trace_cmp). 402 fuzzing_engine_remove_configs = [ 403 "//chromium/build/config/coverage:default_coverage", 404 "//chromium/build/config/sanitizers:default_sanitizer_flags", 405 ] 406 407 # Add any sanitizer flags back. In MSAN builds, instrumenting libfuzzer with 408 # MSAN is necessary since all parts of the binary need to be instrumented for it 409 # to work. ASAN builds are more subtle: libfuzzer depends on features from the 410 # C++ STL. If it were not instrumented, templates would be insantiated without 411 # ASAN from libfuzzer and with ASAN in other TUs. The linker might merge 412 # instrumented template instantiations with non-instrumented ones (which could 413 # have a different ABI) in the final binary, which is problematic for TUs 414 # expecting one particular ABI (https://crbug.com/915422). The other sanitizers 415 # are added back for the same reason. 416 fuzzing_engine_add_configs = 417 [ "//chromium/build/config/sanitizers:default_sanitizer_flags_but_coverage" ]