############################################## ## Perform configuration steps for sanitizers. ############################################## my_sanitize := $(strip $(LOCAL_SANITIZE)) my_sanitize_diag := $(strip $(LOCAL_SANITIZE_DIAG)) my_global_sanitize := my_global_sanitize_diag := ifdef LOCAL_IS_HOST_MODULE ifneq ($($(my_prefix)OS),windows) my_global_sanitize := $(strip $(SANITIZE_HOST)) # SANITIZE_HOST=true is a deprecated way to say SANITIZE_HOST=address. my_global_sanitize := $(subst true,address,$(my_global_sanitize)) endif else my_global_sanitize := $(strip $(SANITIZE_TARGET)) my_global_sanitize_diag := $(strip $(SANITIZE_TARGET_DIAG)) endif # Disable global integer_overflow in excluded paths. ifneq ($(filter integer_overflow, $(my_global_sanitize)),) combined_exclude_paths := $(INTEGER_OVERFLOW_EXCLUDE_PATHS) \ $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS) ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\ $(filter $(dir)%,$(LOCAL_PATH)))),) my_global_sanitize := $(filter-out integer_overflow,$(my_global_sanitize)) my_global_sanitize_diag := $(filter-out integer_overflow,$(my_global_sanitize_diag)) endif endif # Global integer sanitization doesn't support static modules. ifeq ($(filter SHARED_LIBRARIES EXECUTABLES,$(LOCAL_MODULE_CLASS)),) my_global_sanitize := $(filter-out integer_overflow,$(my_global_sanitize)) my_global_sanitize_diag := $(filter-out integer_overflow,$(my_global_sanitize_diag)) endif ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true) my_global_sanitize := $(filter-out integer_overflow,$(my_global_sanitize)) my_global_sanitize_diag := $(filter-out integer_overflow,$(my_global_sanitize_diag)) endif # Disable global CFI in excluded paths ifneq ($(filter cfi, $(my_global_sanitize)),) combined_exclude_paths := $(CFI_EXCLUDE_PATHS) \ $(PRODUCT_CFI_EXCLUDE_PATHS) ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\ $(filter $(dir)%,$(LOCAL_PATH)))),) my_global_sanitize := $(filter-out cfi,$(my_global_sanitize)) my_global_sanitize_diag := $(filter-out cfi,$(my_global_sanitize_diag)) endif endif ifneq ($(my_global_sanitize),) my_sanitize := $(my_global_sanitize) $(my_sanitize) endif ifneq ($(my_global_sanitize_diag),) my_sanitize_diag := $(my_global_sanitize_diag) $(my_sanitize_diag) endif # The sanitizer specified in the product configuration wins over the previous. ifneq ($(SANITIZER.$(TARGET_PRODUCT).$(LOCAL_MODULE).CONFIG),) my_sanitize := $(SANITIZER.$(TARGET_PRODUCT).$(LOCAL_MODULE).CONFIG) ifeq ($(my_sanitize),never) my_sanitize := my_sanitize_diag := endif endif ifndef LOCAL_IS_HOST_MODULE # Add a filter point for 32-bit vs 64-bit sanitization (to lighten the burden) SANITIZE_TARGET_ARCH ?= $(TARGET_ARCH) $(TARGET_2ND_ARCH) ifeq ($(filter $(SANITIZE_TARGET_ARCH),$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),) my_sanitize := my_sanitize_diag := endif endif # Add a filter point based on module owner (to lighten the burden). The format is a space- or # colon-separated list of owner names. ifneq (,$(SANITIZE_NEVER_BY_OWNER)) ifneq (,$(LOCAL_MODULE_OWNER)) ifneq (,$(filter $(LOCAL_MODULE_OWNER),$(subst :, ,$(SANITIZE_NEVER_BY_OWNER)))) $(warning Not sanitizing $(LOCAL_MODULE) based on module owner.) my_sanitize := my_sanitize_diag := endif endif endif # Don't apply sanitizers to NDK code. ifdef LOCAL_SDK_VERSION my_sanitize := my_global_sanitize := my_sanitize_diag := endif # Never always wins. ifeq ($(LOCAL_SANITIZE),never) my_sanitize := my_sanitize_diag := endif # Enable CFI in included paths (for Arm64 only). ifeq ($(filter cfi, $(my_sanitize)),) ifneq ($(filter arm64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),) combined_include_paths := $(CFI_INCLUDE_PATHS) \ $(PRODUCT_CFI_INCLUDE_PATHS) ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_include_paths)),\ $(filter $(dir)%,$(LOCAL_PATH)))),) my_sanitize := cfi $(my_sanitize) my_sanitize_diag := cfi $(my_sanitize_diag) endif endif endif # If CFI is disabled globally, remove it from my_sanitize. ifeq ($(strip $(ENABLE_CFI)),false) my_sanitize := $(filter-out cfi,$(my_sanitize)) my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag)) endif # Disable CFI for arm32 (b/35157333). ifneq ($(filter arm,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),) my_sanitize := $(filter-out cfi,$(my_sanitize)) my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag)) endif # Also disable CFI if ASAN is enabled. ifneq ($(filter address,$(my_sanitize)),) my_sanitize := $(filter-out cfi,$(my_sanitize)) my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag)) endif # CFI needs gold linker, and mips toolchain does not have one. ifneq ($(filter mips mips64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),) my_sanitize := $(filter-out cfi,$(my_sanitize)) my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag)) endif # Disable sanitizers which need the UBSan runtime for host targets. ifdef LOCAL_IS_HOST_MODULE my_sanitize := $(filter-out cfi,$(my_sanitize)) my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag)) my_sanitize := $(filter-out signed-integer-overflow unsigned-integer-overflow integer_overflow,$(my_sanitize)) my_sanitize_diag := $(filter-out signed-integer-overflow unsigned-integer-overflow integer_overflow,$(my_sanitize_diag)) endif # Support for local sanitize blacklist paths. ifneq ($(my_sanitize)$(my_global_sanitize),) ifneq ($(LOCAL_SANITIZE_BLACKLIST),) my_cflags += -fsanitize-blacklist=$(LOCAL_PATH)/$(LOCAL_SANITIZE_BLACKLIST) endif endif # Disable integer_overflow if LOCAL_NOSANITIZE=integer. ifneq ($(filter integer_overflow, $(my_global_sanitize) $(my_sanitize)),) ifneq ($(filter integer, $(strip $(LOCAL_NOSANITIZE))),) my_sanitize := $(filter-out integer_overflow,$(my_sanitize)) my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag)) endif endif my_nosanitize = $(strip $(LOCAL_NOSANITIZE)) ifneq ($(my_nosanitize),) my_sanitize := $(filter-out $(my_nosanitize),$(my_sanitize)) endif ifneq ($(filter arm x86 x86_64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),) my_sanitize := $(filter-out hwaddress,$(my_sanitize)) endif ifneq ($(filter hwaddress,$(my_sanitize)),) my_sanitize := $(filter-out address,$(my_sanitize)) my_sanitize := $(filter-out thread,$(my_sanitize)) my_sanitize := $(filter-out cfi,$(my_sanitize)) endif ifneq ($(filter hwaddress,$(my_sanitize)),) my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)HWADDRESS_SANITIZER_RUNTIME_LIBRARY) ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),) ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true) my_static_libraries := $(my_static_libraries) $($(LOCAL_2ND_ARCH_VAR_PREFIX)HWADDRESS_SANITIZER_STATIC_LIBRARY) endif endif endif # TSAN is not supported on 32-bit architectures. For non-multilib cases, make # its use an error. For multilib cases, don't use it for the 32-bit case. ifneq ($(filter thread,$(my_sanitize)),) ifeq ($(my_32_64_bit_suffix),32) ifeq ($(my_module_multilib),both) my_sanitize := $(filter-out thread,$(my_sanitize)) else $(error $(LOCAL_PATH): $(LOCAL_MODULE): TSAN cannot be used for 32-bit modules.) endif else my_shared_libraries += $(TSAN_RUNTIME_LIBRARY) endif endif ifneq ($(filter safe-stack,$(my_sanitize)),) ifeq ($(my_32_64_bit_suffix),32) my_sanitize := $(filter-out safe-stack,$(my_sanitize)) endif endif # Disable Scudo if ASan or TSan is enabled. ifneq ($(filter address thread hwaddress,$(my_sanitize)),) my_sanitize := $(filter-out scudo,$(my_sanitize)) endif # Undefined symbols can occur if a non-sanitized library links # sanitized static libraries. That's OK, because the executable # always depends on the ASan runtime library, which defines these # symbols. ifneq ($(filter address thread,$(strip $(SANITIZE_TARGET))),) ifndef LOCAL_IS_HOST_MODULE ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES) ifeq ($(my_sanitize),) my_allow_undefined_symbols := true endif endif endif endif ifneq ($(filter default-ub,$(my_sanitize)),) my_sanitize := $(CLANG_DEFAULT_UB_CHECKS) endif ifneq ($(filter coverage,$(my_sanitize)),) ifeq ($(filter address,$(my_sanitize)),) $(error $(LOCAL_PATH): $(LOCAL_MODULE): Use of 'coverage' also requires 'address') endif my_cflags += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp my_sanitize := $(filter-out coverage,$(my_sanitize)) endif ifneq ($(filter integer_overflow,$(my_sanitize)),) # Respect LOCAL_NOSANITIZE for integer-overflow flags. ifeq ($(filter signed-integer-overflow, $(strip $(LOCAL_NOSANITIZE))),) my_sanitize += signed-integer-overflow endif ifeq ($(filter unsigned-integer-overflow, $(strip $(LOCAL_NOSANITIZE))),) my_sanitize += unsigned-integer-overflow endif my_cflags += $(INTEGER_OVERFLOW_EXTRA_CFLAGS) # Check for diagnostics mode. ifneq ($(filter integer_overflow,$(my_sanitize_diag)),) ifneq ($(filter SHARED_LIBRARIES EXECUTABLES,$(LOCAL_MODULE_CLASS)),) ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true) my_sanitize_diag += signed-integer-overflow my_sanitize_diag += unsigned-integer-overflow else $(call pretty-error,Make cannot apply integer overflow diagnostics to static binary.) endif else $(call pretty-error,Make cannot apply integer overflow diagnostics to static library.) endif endif my_sanitize := $(filter-out integer_overflow,$(my_sanitize)) endif # Makes sure integer_overflow diagnostics is removed from the diagnostics list # even if integer_overflow is not set for some reason. ifneq ($(filter integer_overflow,$(my_sanitize_diag)),) my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag)) endif ifneq ($(my_sanitize),) fsanitize_arg := $(subst $(space),$(comma),$(my_sanitize)) my_cflags += -fsanitize=$(fsanitize_arg) my_asflags += -fsanitize=$(fsanitize_arg) ifdef LOCAL_IS_HOST_MODULE my_cflags += -fno-sanitize-recover=all my_ldflags += -fsanitize=$(fsanitize_arg) else my_cflags += -fsanitize-trap=all my_cflags += -ftrap-function=abort ifneq ($(filter address thread,$(my_sanitize)),) my_cflags += -fno-sanitize-trap=address,thread my_shared_libraries += libdl endif endif endif ifneq ($(filter cfi,$(my_sanitize)),) # __cfi_check needs to be built as Thumb (see the code in linker_cfi.cpp). # LLVM is not set up to do this on a function basis, so force Thumb on the # entire module. LOCAL_ARM_MODE := thumb my_cflags += $(CFI_EXTRA_CFLAGS) my_asflags += $(CFI_EXTRA_ASFLAGS) # Only append the default visibility flag if -fvisibility has not already been # set to hidden. ifeq ($(filter -fvisibility=hidden,$(LOCAL_CFLAGS)),) my_cflags += -fvisibility=default endif my_ldflags += $(CFI_EXTRA_LDFLAGS) my_arflags += --plugin $(LLVM_PREBUILTS_PATH)/../lib64/LLVMgold.so ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true) my_ldflags := $(filter-out -fsanitize-cfi-cross-dso,$(my_ldflags)) my_cflags := $(filter-out -fsanitize-cfi-cross-dso,$(my_cflags)) else # Apply the version script to non-static executables my_ldflags += -Wl,--version-script,build/soong/cc/config/cfi_exports.map LOCAL_ADDITIONAL_DEPENDENCIES += build/soong/cc/config/cfi_exports.map endif endif # If local or global modules need ASAN, add linker flags. ifneq ($(filter address,$(my_global_sanitize) $(my_sanitize)),) my_ldflags += $(ADDRESS_SANITIZER_CONFIG_EXTRA_LDFLAGS) ifdef LOCAL_IS_HOST_MODULE # -nodefaultlibs (provided with libc++) prevents the driver from linking # libraries needed with -fsanitize=address. http://b/18650275 (WAI) my_ldflags += -Wl,--no-as-needed else # Add asan libraries unless LOCAL_MODULE is the asan library. # ASan runtime library must be the first in the link order. ifeq (,$(filter $(LOCAL_MODULE),$($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_RUNTIME_LIBRARY))) my_shared_libraries := $($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_RUNTIME_LIBRARY) \ $(my_shared_libraries) endif ifeq (,$(filter $(LOCAL_MODULE),$(ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES))) my_static_libraries += $(ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES) endif # Do not add unnecessary dependency in shared libraries. ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES) my_ldflags += -Wl,--as-needed endif ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),) ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true) my_linker := $($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_LINKER) # Make sure linker_asan get installed. $(LOCAL_INSTALLED_MODULE) : | $(PRODUCT_OUT)$($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_LINKER) endif endif endif endif # If local module needs ASAN, add compiler flags. ifneq ($(filter address,$(my_sanitize)),) # Frame pointer based unwinder in ASan requires ARM frame setup. LOCAL_ARM_MODE := arm my_cflags += $(ADDRESS_SANITIZER_CONFIG_EXTRA_CFLAGS) ifndef LOCAL_IS_HOST_MODULE my_cflags += -mllvm -asan-globals=0 endif endif # If local module needs HWASAN, add compiler flags. ifneq ($(filter hwaddress,$(my_sanitize)),) my_cflags += $(HWADDRESS_SANITIZER_CONFIG_EXTRA_CFLAGS) endif # Use minimal diagnostics when integer overflow is enabled; never do it for HOST or AUX modules ifeq ($(LOCAL_IS_HOST_MODULE)$(LOCAL_IS_AUX_MODULE),) # Pre-emptively add UBSAN minimal runtime incase a static library dependency requires it ifeq ($(filter STATIC_LIBRARIES,$(LOCAL_MODULE_CLASS)),) ifndef LOCAL_SDK_VERSION my_static_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_MINIMAL_RUNTIME_LIBRARY) my_ldflags += -Wl,--exclude-libs,$($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_MINIMAL_RUNTIME_LIBRARY).a endif endif ifneq ($(filter unsigned-integer-overflow signed-integer-overflow integer,$(my_sanitize)),) ifeq ($(filter unsigned-integer-overflow signed-integer-overflow integer,$(my_sanitize_diag)),) ifeq ($(filter cfi,$(my_sanitize_diag)),) ifeq ($(filter address hwaddress,$(my_sanitize)),) my_cflags += -fsanitize-minimal-runtime my_cflags += -fno-sanitize-trap=integer my_cflags += -fno-sanitize-recover=integer endif endif endif endif endif # For Scudo, we opt for the minimal runtime, unless some diagnostics are enabled. ifneq ($(filter scudo,$(my_sanitize)),) ifeq ($(filter unsigned-integer-overflow signed-integer-overflow integer cfi,$(my_sanitize_diag)),) my_cflags += -fsanitize-minimal-runtime endif ifneq ($(filter -fsanitize-minimal-runtime,$(my_cflags)),) my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)SCUDO_MINIMAL_RUNTIME_LIBRARY) else my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)SCUDO_RUNTIME_LIBRARY) endif endif ifneq ($(strip $(LOCAL_SANITIZE_RECOVER)),) recover_arg := $(subst $(space),$(comma),$(LOCAL_SANITIZE_RECOVER)), my_cflags += -fsanitize-recover=$(recover_arg) endif ifneq ($(strip $(LOCAL_SANITIZE_NO_RECOVER)),) no_recover_arg := $(subst $(space),$(comma),$(LOCAL_SANITIZE_NO_RECOVER)), my_cflags += -fno-sanitize-recover=$(no_recover_arg) endif ifneq ($(my_sanitize_diag),) # TODO(vishwath): Add diagnostic support for static executables once # we switch to clang-4393122 (which adds the static ubsan runtime # that this depends on) ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true) notrap_arg := $(subst $(space),$(comma),$(my_sanitize_diag)), my_cflags += -fno-sanitize-trap=$(notrap_arg) # Diagnostic requires a runtime library, unless ASan or TSan are also enabled. ifeq ($(filter address thread scudo hwaddress,$(my_sanitize)),) # Does not have to be the first DT_NEEDED unlike ASan. my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY) endif endif endif # http://b/119329758, Android core does not boot up with this sanitizer yet. # Previously sanitized modules might not pass new implicit-integer-sign-change check. # Disable this check unless it has been explicitly specified. ifneq ($(findstring fsanitize,$(my_cflags)),) ifneq ($(findstring integer,$(my_cflags)),) ifeq ($(findstring sanitize=implicit-integer-sign-change,$(my_cflags)),) my_cflags += -fno-sanitize=implicit-integer-sign-change endif endif endif