[GWP-ASan] Add recoverable mode.

[hctim]

Summary

The GWP-ASan recoverable mode allows a process to continue to function
after a GWP-ASan error is detected. The error will continue to be
dumped, but GWP-ASan now has APIs that a signal handler (like the
example optional crash handler) can call in order to allow the
continuation of a process.

When an error occurs with an allocation, the slot used for that
allocation will be permanently disabled. This means that free() of that
pointer is a no-op, and use-after-frees will succeed (writing and
reading the data present in the page).

For heap-buffer-overflow/underflow, the guard page is marked as accessible
and buffer-overflows will succeed (writing and reading the data present
in the now-accessible guard page). This does impact adjacent
allocations, buffer-underflow and buffer-overflows from adjacent
allocations will no longer touch an inaccessible guard page. This could
be improved in future by having two guard pages between each adjacent
allocation, but that's out of scope of this patch.

Each allocation only ever has a single error report generated. It's
whatever came first between invalid-free, double-free, use-after-free or
heap-buffer-overflow, but only one.

[fmayer]

many nits

compiler-rt/lib/gwp_asan/crash_handler.cpp

42

Can we calculate this in some function and share everywhere? E.g. State->getInternalFaultAddress() or something

compiler-rt/lib/gwp_asan/crash_handler.h

49–58

add some paragraphs maybe, this is quite the wall-of-text

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

285

nit

288–289

What is wrong with that though? Please add to this comment.

It's not like crash handling is performance-critical (I hear reentrant locks are _bad_ for that).

295

not in this CL, and random driveby: why the inconsistency between Failure and Error?

304

be more explicit that this code is only reached in recoverable mode, in non-recoverable we would have crashed already. can we make that an assertion? if not please add a very explicit comment to that effect

377

for consistency with above: assert(pointerIsMine(Ptr) && "Pointer is not mine!");

395

move this just in front if the if condition, makes it easier to read. maybe turn into tenary op, up to you

397–399

be consistent about single line statements and braces

419

Can this happen multiple times, or can we break out of this?

compiler-rt/lib/gwp_asan/optional/segv_handler_posix.cpp

186–187

random driveby, not for this CL: AFAICT his is already in namespace {}, so this seems unnecessary

186–191

Why didn't we make this assertion before? What changed?

compiler-rt/lib/gwp_asan/tests/backtrace.cpp

62

EXPECT_TRUE

compiler-rt/lib/gwp_asan/tests/harness.h

107

.clear()?

compiler-rt/lib/gwp_asan/tests/recoverable.cpp

62

ASSERT_TRUE (and everywhere else)?

107

FAIL?

126

ASSERT_SUBSTR potentially (also in other places)?

164

This is a very odd parameter. All threads that are > 4 just trap, if we have < 4 we just don't do some of the jobs.

170

This seems wrong. In that case we never do some jobs above?

[fmayer]

compiler-rt/lib/gwp_asan/tests/harness.h

128

__attribute__ ((format (printf, 1, 2)))?

[eugenis]

It seems like this could become much simpler if we disable gwp-asan on the first report instead of killing slots one-by-one.

[fmayer]

In D140173#4000010, @eugenis wrote:

It seems like this could become much simpler if we disable gwp-asan on the first report instead of killing slots one-by-one.

That sounds quite expensive (and also complicated), as I think that would involve unpoisoning many pages etc.

[eugenis]

It's a single mprotect across the gwp-asan region. Also no need to bother with recursive guards as no new allocations can reach gwp-asan.

[hctim]

In D140173#4000010, @eugenis wrote:

It seems like this could become much simpler if we disable gwp-asan on the first report instead of killing slots one-by-one.

In D140173#4000043, @eugenis wrote:

It's a single mprotect across the gwp-asan region. Also no need to bother with recursive guards as no new allocations can reach gwp-asan.

I think the change might be less LOC, but the semantics might be just as difficult to reason about. If we mprotect the entire region, we still need to do the trick with the special-segv-address to handle an invalid free + use after free happening at the same time, still need to lock/unlock mutexes/recursive guard because we could get a use-after-free while another thread is doing malloc/free. The only thing that would change is the per-allocation "HasCrashed" becomes a whole-gwp-asan "HasCrashed", and we don't need to do the clear-slot-used-by-UaF (in handleRecoverablePostCrashReport).

[hctim]

compiler-rt/lib/gwp_asan/crash_handler.cpp

42

done

compiler-rt/lib/gwp_asan/crash_handler.h

49–58

done. also removed the part about the signal handler's responsibility, as that's opaque. the signal handler is just responsible for calling the PreCrash and PostCrash functions.

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

288–289

added to the text, but basically "let's not force users of gwp-asan..." (where each OS has to provide its own mutex wrapper) "... to implement things that really should be unncessary"

295

sorry, not sure I understand the inconsistency?

304

unfortunately the Recoverable option isn't captured in the GPA class, but I've added a comment and a couple of litmus-test assertions

419

thanks, can break

compiler-rt/lib/gwp_asan/optional/segv_handler_posix.cpp

186–187

roger, can do a pass later on

186–191

previous code was misleading. shouldn't be possible to call this function without GPAForSignalHandler set (as it's installed via. installSignalHandlers, which also has an assert that GPAForSignalHandler is non-null). This is kind of an unnecessary duplicate, so I've removed it.

compiler-rt/lib/gwp_asan/tests/recoverable.cpp

126

unfortunately the gtest that's in the llvm tree doesn't have ASSERT_SUBSTR.

164

sure, remove the param and made it just skip if we don't have enough.

[hctim]

Update from Florian's comments.

[fmayer]

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

295

I meant: Why aren't we consistent in naming this either Failure or Error?

[eugenis]

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

381

why can't disable() call always happen in the crash handler? why special case for internal crashes?

390

Could we pretend like recoverable is the default? Ex. we can always do the nested logic for recursive guards, and the difference in non-recoverable is that we simply never restore it.

[hctim]

Merged paths for pre-crash callbacks for non-recoverable and recoverable mode.

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

381

the mutexes locked by disable() protect State.FailureType and State.FailureAddress (from multiple double-frees/invalid-frees at the same time)

390

sure, i've made those changes.

there was a slight advantage in the non-recoverable mode in that we just tryLock()'d the mutex and then continued ahead, and now we wait to actually lock() the mutexes. I don't think it's a major disadvantage though, if there's a concurrent malloc()/free(), we can just wait. Makes it less likely for us to end up with a garbage report anyway.

[fmayer]

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

396

This is nonstandard, and I think, after some Googling, that this is not supported in MSVC.

[fmayer]

compiler-rt/lib/gwp_asan/common.cpp

109

out of interest, is this an arbitrary value within the page? maybe add a comment

[fmayer]

Seems like your newly added test is broken in the pre-merge checks. PTAL

[eugenis]

Do you have a stress test to exhaust all gwp-asan slots?

[hctim]

Add an all-slots test.

[hctim]

In D140173#4009005, @eugenis wrote:

Do you have a stress test to exhaust all gwp-asan slots?

Added, thanks.

In D140173#4008844, @fmayer wrote:

Seems like your newly added test is broken in the pre-merge checks. PTAL

Hmm, not sure what's going wrong there, running with --gtest_shuffle --gtest_repeat=100 works fine on my end. Let's see if it sticks around after the re-upload/rebase.

[eugenis]

LGTM

[hctim]

Add some extra NFC logging to attempt to figure out what's wrong with the presubmit bot.

[hctim]

clang-format

[hctim]

Update with some fixes discovered from internal testing:

1. Moves some duplicated helper functions to a common definition.
2. Fixes a bug only found in debug mode.

[yingcong-wu]

compiler-rt/lib/gwp_asan/optional/segv_handler_posix.cpp

127

AllocMeta is dereferenced here and then do the null check in LINE 152, I think this is a problem.

[hctim]

compiler-rt/lib/gwp_asan/optional/segv_handler_posix.cpp

127

Nice catch! Sent https://reviews.llvm.org/D144973

compiler-rt/lib/gwp_asan/common.h

 struct AllocatorVersionMagic {
   // The values are copied into the structure at runtime, during
   // `GuardedPoolAllocator::init()` so that GWP-ASan remains completely in the
   // `.bss` segment.
   static constexpr uint8_t kAllocatorVersionMagic[4] = {'A', 'S', 'A', 'N'};
   uint8_t Magic[4] = {};
   // Update the version number when the AllocatorState or AllocationMetadata
   // change.
-  static constexpr uint16_t kAllocatorVersion = 1;
+  static constexpr uint16_t kAllocatorVersion = 2;
   uint16_t Version = 0;
   uint16_t Reserved = 0;
 };
 
 enum class Error : uint8_t {
   UNKNOWN,
   USE_AFTER_FREE,
   DOUBLE_FREE,
struct AllocationMetadata {
   // Represents the actual size of the allocation.
   size_t RequestedSize = 0;
 
   CallSiteInfo AllocationTrace;
   CallSiteInfo DeallocationTrace;
 
   // Whether this allocation has been deallocated yet.
   bool IsDeallocated = false;
+
+  // In recoverable mode, whether this allocation has had a crash associated
+  // with it. This has certain side effects, like meaning this allocation will
+  // permanently occupy a slot, and won't ever have another crash reported from
+  // it.
+  bool HasCrashed = false;
 };
 
 // This holds the state that's shared between the GWP-ASan allocator and the
 // crash handler. This, in conjunction with the Metadata array, forms the entire
 // set of information required for understanding a GWP-ASan crash.
 struct AllocatorState {
   constexpr AllocatorState() {}
   AllocatorVersionMagic VersionMagic{};
struct AllocatorState {
 
   // Gets the nearest slot to the provided address.
   size_t getNearestSlot(uintptr_t Ptr) const;
 
   // Returns whether the provided pointer is a guard page or not. The pointer
   // must be within memory owned by this pool, else the result is undefined.
   bool isGuardPage(uintptr_t Ptr) const;
 
+  // Returns the address that's used by __gwp_asan_get_internal_crash_address()
+  // and GPA::raiseInternallyDetectedError() to communicate that the SEGV in
+  // question comes from an internally-detected error.
+  uintptr_t internallyDetectedErrorFaultAddress() const;
+
   // The number of guarded slots that this pool holds.
   size_t MaxSimultaneousAllocations = 0;
 
   // Pointer to the pool of guarded slots. Note that this points to the start of
   // the pool (which is a guard page), not a pointer to the first guarded page.
   uintptr_t GuardedPagePool = 0;
   uintptr_t GuardedPagePoolEnd = 0;
 

compiler-rt/lib/gwp_asan/common.cpp

size_t AllocatorState::getNearestSlot(uintptr_t Ptr) const {
   if (!isGuardPage(Ptr))
     return addrToSlot(this, Ptr);
 
   if (Ptr % PageSize <= PageSize / 2)
     return addrToSlot(this, Ptr - PageSize); // Round down.
   return addrToSlot(this, Ptr + PageSize);   // Round up.
 }
 
+uintptr_t AllocatorState::internallyDetectedErrorFaultAddress() const {
+  return GuardedPagePoolEnd - 0x10;
+}
+
 } // namespace gwp_asan

compiler-rt/lib/gwp_asan/crash_handler.h

 // Diagnose and return the type of error that occurred at `ErrorPtr`. If
 // `ErrorPtr` is unrelated to GWP-ASan, or if the error type cannot be deduced,
 // this function returns Error::UNKNOWN.
 gwp_asan::Error
 __gwp_asan_diagnose_error(const gwp_asan::AllocatorState *State,
                           const gwp_asan::AllocationMetadata *Metadata,
                           uintptr_t ErrorPtr);
 
-// For internally-detected errors (double free, invalid free), this function
-// returns the pointer that the error occurred at. If the error is unrelated to
-// GWP-ASan, or if the error was caused by a non-internally detected failure,
-// this function returns zero.
+// This function, provided the fault address from the signal handler, returns
+// the following values:
+//  1. If the crash was caused by an internally-detected error (invalid free,
+//     double free), this function returns the pointer that was used for the
+//     internally-detected bad operation (i.e. the pointer given to free()).
+//  2. For externally-detected crashes (use-after-free, buffer-overflow), this
+//     function returns zero.
+//  3. If GWP-ASan wasn't responsible for the crash at all, this function also
+//     returns zero.
 uintptr_t
-__gwp_asan_get_internal_crash_address(const gwp_asan::AllocatorState *State);
+__gwp_asan_get_internal_crash_address(const gwp_asan::AllocatorState *State,
+                                      uintptr_t ErrorPtr);
 
 // Returns a pointer to the metadata for the allocation that's responsible for
 // the crash. This metadata should not be dereferenced directly due to API
 // compatibility issues, but should be instead passed to functions below for
 // information retrieval. Returns nullptr if there is no metadata available for
 // this crash.
 const gwp_asan::AllocationMetadata *
 __gwp_asan_get_metadata(const gwp_asan::AllocatorState *State,

compiler-rt/lib/gwp_asan/crash_handler.cpp

bool __gwp_asan_error_is_mine(const gwp_asan::AllocatorState *State,
   if (State->FailureType != Error::UNKNOWN && State->FailureAddress != 0)
     return true;
 
   return ErrorPtr < State->GuardedPagePoolEnd &&
          State->GuardedPagePool <= ErrorPtr;
 }
 
 uintptr_t
-__gwp_asan_get_internal_crash_address(const gwp_asan::AllocatorState *State) {
+__gwp_asan_get_internal_crash_address(const gwp_asan::AllocatorState *State,
+                                      uintptr_t ErrorPtr) {
+  // There can be a race between internally- and externally-raised faults. The
+  // fault address from the signal handler is used to discriminate whether it's
+  // internally- or externally-raised, and the pool maintains a special page at
+  // the end of the GuardedPagePool specifically for the internally-raised
+  // faults.
+  if (ErrorPtr != State->internallyDetectedErrorFaultAddress())
+    return 0u;
   return State->FailureAddress;
 }
 
 static const AllocationMetadata *
 addrToMetadata(const gwp_asan::AllocatorState *State,
                const AllocationMetadata *Metadata, uintptr_t Ptr) {
   // Note - Similar implementation in guarded_pool_allocator.cpp.
   return &Metadata[State->getNearestSlot(Ptr)];

compiler-rt/lib/gwp_asan/guarded_pool_allocator.h

public:
   void enable();
 
   typedef void (*iterate_callback)(uintptr_t base, size_t size, void *arg);
   // Execute the callback Cb for every allocation the lies in [Base, Base +
   // Size). Must be called while the allocator is disabled. The callback can not
   // allocate.
   void iterate(void *Base, size_t Size, iterate_callback Cb, void *Arg);
 
-  // This function is used to signal the allocator to indefinitely stop
-  // functioning, as a crash has occurred. This stops the allocator from
-  // servicing any further allocations permanently.
-  void stop();
-
   // Return whether the allocation should be randomly chosen for sampling.
   GWP_ASAN_ALWAYS_INLINE bool shouldSample() {
     // NextSampleCounter == 0 means we "should regenerate the counter".
     //                   == 1 means we "should sample this allocation".
     // AdjustedSampleRatePlusOne is designed to intentionally underflow. This
     // class must be valid when zero-initialised, and we wish to sample as
     // infrequently as possible when this is the case, hence we underflow to
     // UINT32_MAX.
public:
   size_t getSize(const void *Ptr);
 
   // Returns a pointer to the Metadata region, or nullptr if it doesn't exist.
   const AllocationMetadata *getMetadataRegion() const { return Metadata; }
 
   // Returns a pointer to the AllocatorState region.
   const AllocatorState *getAllocatorState() const { return &State; }
 
+  // Functions that the signal handler is responsible for calling, while
+  // providing the SEGV pointer, prior to dumping the crash, and after dumping
+  // the crash (in recoverable mode only).
+  void preCrashReport(void *Ptr);
+  void postCrashReportRecoverableOnly(void *Ptr);
+
   // Exposed as protected for testing.
 protected:
   // Returns the actual allocation size required to service an allocation with
   // the provided Size and Alignment.
   static size_t getRequiredBackingSize(size_t Size, size_t Alignment,
                                        size_t PageSize);
 
   // Returns the provided pointer that meets the specified alignment, depending
private:
   size_t reserveSlot();
 
   // Unreserve the guarded slot.
   void freeSlot(size_t SlotIndex);
 
   // Raise a SEGV and set the corresponding fields in the Allocator's State in
   // order to tell the crash handler what happened. Used when errors are
   // detected internally (Double Free, Invalid Free).
-  void trapOnAddress(uintptr_t Address, Error E);
+  void raiseInternallyDetectedError(uintptr_t Address, Error E);
 
   static GuardedPoolAllocator *getSingleton();
 
   // Install a pthread_atfork handler.
   void installAtFork();
 
   gwp_asan::AllocatorState State;
 

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

 //===-- guarded_pool_allocator.cpp ------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "gwp_asan/guarded_pool_allocator.h"
 
+#include "gwp_asan/crash_handler.h"
 #include "gwp_asan/options.h"
 #include "gwp_asan/utilities.h"
 
 #include <assert.h>
 #include <stddef.h>
 
 using AllocationMetadata = gwp_asan::AllocationMetadata;
 using Error = gwp_asan::Error;
void GuardedPoolAllocator::init(const options::Options &Opts) {
 
   State.MaxSimultaneousAllocations = Opts.MaxSimultaneousAllocations;
 
   const size_t PageSize = getPlatformPageSize();
   // getPageAddr() and roundUpTo() assume the page size to be a power of 2.
   assert((PageSize & (PageSize - 1)) == 0);
   State.PageSize = PageSize;
 
+  // Number of pages required =
+  //  + MaxSimultaneousAllocations * maximumAllocationSize (N pages per slot)
+  //  + MaxSimultaneousAllocations (one guard on the left side of each slot)
+  //  + 1 (an extra guard page at the end of the pool, on the right side)
+  //  + 1 (an extra page that's used for reporting internally-detected crashes,
+  //       like double free and invalid free, to the signal handler; see
+  //       raiseInternallyDetectedError() for more info)
   size_t PoolBytesRequired =
-      PageSize * (1 + State.MaxSimultaneousAllocations) +
+      PageSize * (2 + State.MaxSimultaneousAllocations) +
       State.MaxSimultaneousAllocations * State.maximumAllocationSize();
   assert(PoolBytesRequired % PageSize == 0);
   void *GuardedPoolMemory = reserveGuardedPool(PoolBytesRequired);
 
   size_t BytesRequired =
       roundUpTo(State.MaxSimultaneousAllocations * sizeof(*Metadata), PageSize);
   Metadata = reinterpret_cast<AllocationMetadata *>(
       map(BytesRequired, kGwpAsanMetadataName));
void *GuardedPoolAllocator::allocate(size_t Size, size_t Alignment) {
   {
     ScopedLock UL(BacktraceMutex);
     Meta->AllocationTrace.RecordBacktrace(Backtrace);
   }
 
   return reinterpret_cast<void *>(UserPtr);
 }
 
-void GuardedPoolAllocator::trapOnAddress(uintptr_t Address, Error E) {
+void GuardedPoolAllocator::raiseInternallyDetectedError(uintptr_t Address,
+                                                        Error E) {
+  // Disable the allocator before setting the internal failure state. In
+  // non-recoverable mode, the allocator will be permanently disabled, and so
+  // things will be accessed without locks.
+  disable();
+
+  // Races between internally- and externally-raised faults can happen. Right
+  // now, in this thread we've locked the allocator in order to raise an
+  // internally-detected fault, and another thread could SIGSEGV to raise an
+  // externally-detected fault. What will happen is that the other thread will
+  // wait in the signal handler, as we hold the allocator's locks from the
+  // disable() above. We'll trigger the signal handler by touching the
+  // internal-signal-raising address below, and the signal handler from our
+  // thread will get to run first as we will continue to hold the allocator
+  // locks until the enable() at the end of this function. Be careful though, if
+  // this thread receives another SIGSEGV after the disable() above, but before
+  // touching the internal-signal-raising address below, then this thread will
+  // get an "externally-raised" SIGSEGV while *also* holding the allocator
+  // locks, which means this thread's signal handler will deadlock. This could
+  // be resolved with a re-entrant lock, but asking platforms to implement this
+  // seems unnecessary given the only way to get a SIGSEGV in this critical
+  // section is either a memory safety bug in the couple lines of code below (be
+  // careful!), or someone outside uses `kill(this_thread, SIGSEGV)`, which
+  // really shouldn't happen.
+
   State.FailureType = E;
   State.FailureAddress = Address;
 
-  // Raise a SEGV by touching first guard page.
-  volatile char *p = reinterpret_cast<char *>(State.GuardedPagePool);
+  // Raise a SEGV by touching a specific address that identifies to the crash
+  // handler that this is an internally-raised fault. Changing this address?
+  // Don't forget to update __gwp_asan_get_internal_crash_address.
+  volatile char *p =
+      reinterpret_cast<char *>(State.internallyDetectedErrorFaultAddress());
   *p = 0;
-  // Normally, would be __builtin_unreachable(), but because of
-  // https://bugs.llvm.org/show_bug.cgi?id=47480, unreachable will DCE the
-  // volatile store above, even though it has side effects.
-  __builtin_trap();
-}
 
-void GuardedPoolAllocator::stop() {
-  getThreadLocals()->RecursiveGuard = true;
-  PoolMutex.tryLock();
+  // This should never be reached in non-recoverable mode. Ensure that the
+  // signal handler called handleRecoverablePostCrashReport(), which was
+  // responsible for re-setting these fields.
+  assert(State.FailureType == Error::UNKNOWN);
+  assert(State.FailureAddress == 0u);
+
+  // In recoverable mode, the signal handler (after dumping the crash) marked
+  // the page containing the InternalFaultSegvAddress as read/writeable, to
+  // allow the second touch to succeed after returning from the signal handler.
+  // Now, we need to mark the page as non-read/write-able again, so future
+  // internal faults can be raised.
+  deallocateInGuardedPool(
+      reinterpret_cast<void *>(getPageAddr(
+          State.internallyDetectedErrorFaultAddress(), State.PageSize)),
+      State.PageSize);
+
+  // And now we're done with patching ourselves back up, enable the allocator.
+  enable();
 }
 
 void GuardedPoolAllocator::deallocate(void *Ptr) {
   assert(pointerIsMine(Ptr) && "Pointer is not mine!");
   uintptr_t UPtr = reinterpret_cast<uintptr_t>(Ptr);
   size_t Slot = State.getNearestSlot(UPtr);
   uintptr_t SlotStart = State.slotToAddr(Slot);
   AllocationMetadata *Meta = addrToMetadata(UPtr);
+
+  // If this allocation is responsible for crash, never recycle it. Turn the
+  // deallocate() call into a no-op.
+  if (Meta->HasCrashed)
+    return;
+
   if (Meta->Addr != UPtr) {
-    // If multiple errors occur at the same time, use the first one.
-    ScopedLock L(PoolMutex);
-    trapOnAddress(UPtr, Error::INVALID_FREE);
+    raiseInternallyDetectedError(UPtr, Error::INVALID_FREE);
+    return;
+  }
+  if (Meta->IsDeallocated) {
+    raiseInternallyDetectedError(UPtr, Error::DOUBLE_FREE);
+    return;
   }
 
   // Intentionally scope the mutex here, so that other threads can access the
   // pool during the expensive markInaccessible() call.
   {
     ScopedLock L(PoolMutex);
-    if (Meta->IsDeallocated) {
-      trapOnAddress(UPtr, Error::DOUBLE_FREE);
-    }
 
     // Ensure that the deallocation is recorded before marking the page as
     // inaccessible. Otherwise, a racy use-after-free will have inconsistent
     // metadata.
     Meta->RecordDeallocation();
 
     // Ensure that the unwinder is not called if the recursive flag is set,
     // otherwise non-reentrant unwinders may deadlock.
     if (!getThreadLocals()->RecursiveGuard) {
       ScopedRecursiveGuard SRG;
       ScopedLock UL(BacktraceMutex);
       Meta->DeallocationTrace.RecordBacktrace(Backtrace);
     }
   }
 
   deallocateInGuardedPool(reinterpret_cast<void *>(SlotStart),
                           State.maximumAllocationSize());
 
   // And finally, lock again to release the slot back into the pool.
   ScopedLock L(PoolMutex);
   freeSlot(Slot);
 }
 
+// Thread-compatible, protected by PoolMutex.
+static bool PreviousRecursiveGuard;
+
+void GuardedPoolAllocator::preCrashReport(void *Ptr) {
+  assert(pointerIsMine(Ptr) && "Pointer is not mine!");
+  uintptr_t InternalCrashAddr = __gwp_asan_get_internal_crash_address(
+      &State, reinterpret_cast<uintptr_t>(Ptr));
+  if (!InternalCrashAddr)
+    disable();
+
+  // If something in the signal handler calls malloc() while dumping the
+  // GWP-ASan report (e.g. backtrace_symbols()), make sure that GWP-ASan doesn't
+  // service that allocation. `PreviousRecursiveGuard` is protected by the
+  // allocator locks taken in disable(), either explicitly above for
+  // externally-raised errors, or implicitly in raiseInternallyDetectedError()
+  // for internally-detected errors.
+  PreviousRecursiveGuard = getThreadLocals()->RecursiveGuard;
+  getThreadLocals()->RecursiveGuard = true;
+}
+
+void GuardedPoolAllocator::postCrashReportRecoverableOnly(void *SignalPtr) {
+  uintptr_t SignalUPtr = reinterpret_cast<uintptr_t>(SignalPtr);
+  uintptr_t InternalCrashAddr =
+      __gwp_asan_get_internal_crash_address(&State, SignalUPtr);
+  uintptr_t ErrorUptr = InternalCrashAddr ?: SignalUPtr;
+
+  AllocationMetadata *Metadata = addrToMetadata(ErrorUptr);
+  Metadata->HasCrashed = true;
+
+  allocateInGuardedPool(
+      reinterpret_cast<void *>(getPageAddr(SignalUPtr, State.PageSize)),
+      State.PageSize);
+
+  // Clear the internal state in order to not confuse the crash handler if a
+  // use-after-free or buffer-overflow comes from a different allocation in the
+  // future.
+  if (InternalCrashAddr) {
+    State.FailureType = Error::UNKNOWN;
+    State.FailureAddress = 0;
+  }
+
+  size_t Slot = State.getNearestSlot(ErrorUptr);
+  // If the slot is available, remove it permanently.
+  for (size_t i = 0; i < FreeSlotsLength; ++i) {
+    if (FreeSlots[i] == Slot) {
+      FreeSlots[i] = FreeSlots[FreeSlotsLength - 1];
+      FreeSlotsLength -= 1;
+      break;
+    }
+  }
+
+  getThreadLocals()->RecursiveGuard = PreviousRecursiveGuard;
+  if (!InternalCrashAddr)
+    enable();
+}
+
 size_t GuardedPoolAllocator::getSize(const void *Ptr) {
   assert(pointerIsMine(Ptr));
   ScopedLock L(PoolMutex);
   AllocationMetadata *Meta = addrToMetadata(reinterpret_cast<uintptr_t>(Ptr));
   assert(Meta->Addr == reinterpret_cast<uintptr_t>(Ptr));
   return Meta->RequestedSize;
 }
 

compiler-rt/lib/gwp_asan/optional/segv_handler.h

 // Install the SIGSEGV crash handler for printing use-after-free and heap-
 // buffer-{under|over}flow exceptions if the user asked for it. This is platform
 // specific as even though POSIX and Windows both support registering handlers
 // through signal(), we have to use platform-specific signal handlers to obtain
 // the address that caused the SIGSEGV exception. GPA->init() must be called
 // before this function.
 void installSignalHandlers(gwp_asan::GuardedPoolAllocator *GPA, Printf_t Printf,
                            gwp_asan::backtrace::PrintBacktrace_t PrintBacktrace,
-                           gwp_asan::backtrace::SegvBacktrace_t SegvBacktrace);
+                           gwp_asan::backtrace::SegvBacktrace_t SegvBacktrace,
+                           bool Recoverable = false);
 
 // Uninistall the signal handlers, test-only.
 void uninstallSignalHandlers();
 } // namespace segv_handler
 } // namespace gwp_asan
 
 #endif // GWP_ASAN_OPTIONAL_SEGV_HANDLER_H_

compiler-rt/lib/gwp_asan/optional/segv_handler_fuchsia.cpp

 
 // GWP-ASan on Fuchsia doesn't currently support signal handlers.
 
 namespace gwp_asan {
 namespace segv_handler {
 void installSignalHandlers(gwp_asan::GuardedPoolAllocator * /* GPA */,
                            Printf_t /* Printf */,
                            backtrace::PrintBacktrace_t /* PrintBacktrace */,
-                           backtrace::SegvBacktrace_t /* SegvBacktrace */) {}
+                           backtrace::SegvBacktrace_t /* SegvBacktrace */,
+                           bool /* Recoverable */) {}
 
 void uninstallSignalHandlers() {}
 } // namespace segv_handler
 } // namespace gwp_asan

compiler-rt/lib/gwp_asan/optional/segv_handler_posix.cpp

 
 void dumpReport(uintptr_t ErrorPtr, const gwp_asan::AllocatorState *State,
                 const gwp_asan::AllocationMetadata *Metadata,
                 SegvBacktrace_t SegvBacktrace, Printf_t Printf,
                 PrintBacktrace_t PrintBacktrace, void *Context) {
   assert(State && "dumpReport missing Allocator State.");
   assert(Metadata && "dumpReport missing Metadata.");
   assert(Printf && "dumpReport missing Printf.");
+  assert(__gwp_asan_error_is_mine(State, ErrorPtr) &&
+         "dumpReport() called on a non-GWP-ASan error.");
 
-  if (!__gwp_asan_error_is_mine(State, ErrorPtr))
+  uintptr_t InternalErrorPtr =
+      __gwp_asan_get_internal_crash_address(State, ErrorPtr);
+  if (InternalErrorPtr)
+    ErrorPtr = InternalErrorPtr;
+
+  const gwp_asan::AllocationMetadata *AllocMeta =
+      __gwp_asan_get_metadata(State, Metadata, ErrorPtr);
+
+  // It's unusual for a signal handler to be invoked multiple times for the same
+  // allocation, but it's possible in various scenarios, like:
+  //  1. A double-free or invalid-free was invoked in one thread at the same
+  //     time as a buffer-overflow or use-after-free in another thread, or
+  //  2. Two threads do a use-after-free or buffer-overflow at the same time.
+  // In these instances, we've already dumped a report for this allocation, so
+  // skip dumping this issue as well.
+  if (AllocMeta->HasCrashed)
     return;
 
   Printf("*** GWP-ASan detected a memory error ***\n");
   ScopedEndOfReportDecorator Decorator(Printf);
 
-  uintptr_t InternalErrorPtr = __gwp_asan_get_internal_crash_address(State);
-  if (InternalErrorPtr != 0u)
-    ErrorPtr = InternalErrorPtr;
-
   Error E = __gwp_asan_diagnose_error(State, Metadata, ErrorPtr);
-
   if (E == Error::UNKNOWN) {
     Printf("GWP-ASan cannot provide any more information about this error. "
            "This may occur due to a wild memory access into the GWP-ASan pool, "
            "or an overflow/underflow that is > 512B in length.\n");
     return;
   }
 
-  const gwp_asan::AllocationMetadata *AllocMeta =
-      __gwp_asan_get_metadata(State, Metadata, ErrorPtr);
-
   // Print the error header.
   printHeader(E, ErrorPtr, AllocMeta, Printf);
 
   // Print the fault backtrace.
   static constexpr unsigned kMaximumStackFramesForCrashTrace = 512;
   uintptr_t Trace[kMaximumStackFramesForCrashTrace];
   size_t TraceLength =
       SegvBacktrace(Trace, kMaximumStackFramesForCrashTrace, Context);
else
     Printf("0x%zx was allocated by thread %zu here:\n", ErrorPtr, ThreadID);
   TraceLength = __gwp_asan_get_allocation_trace(
       AllocMeta, Trace, kMaximumStackFramesForCrashTrace);
   PrintBacktrace(Trace, TraceLength, Printf);
 }
 
 struct sigaction PreviousHandler;
 bool SignalHandlerInstalled;
+bool RecoverableSignal;
 gwp_asan::GuardedPoolAllocator *GPAForSignalHandler;
 Printf_t PrintfForSignalHandler;
 PrintBacktrace_t PrintBacktraceForSignalHandler;
 SegvBacktrace_t BacktraceForSignalHandler;
 
 static void sigSegvHandler(int sig, siginfo_t *info, void *ucontext) {
-  if (GPAForSignalHandler) {
-    GPAForSignalHandler->stop();
+  const gwp_asan::AllocatorState *State =
+      GPAForSignalHandler->getAllocatorState();
+  void *FaultAddr = info->si_addr;
+  uintptr_t FaultAddrUPtr = reinterpret_cast<uintptr_t>(FaultAddr);
+
+  if (__gwp_asan_error_is_mine(State, FaultAddrUPtr)) {
+    GPAForSignalHandler->preCrashReport(FaultAddr);
 
-    dumpReport(reinterpret_cast<uintptr_t>(info->si_addr),
-               GPAForSignalHandler->getAllocatorState(),
-               GPAForSignalHandler->getMetadataRegion(),
+    dumpReport(FaultAddrUPtr, State, GPAForSignalHandler->getMetadataRegion(),
                BacktraceForSignalHandler, PrintfForSignalHandler,
                PrintBacktraceForSignalHandler, ucontext);
+
+    if (RecoverableSignal) {
+      GPAForSignalHandler->postCrashReportRecoverableOnly(FaultAddr);
+      return;
+    }
   }
 
-  // Process any previous handlers.
+  // Process any previous handlers as long as the crash wasn't a GWP-ASan crash
+  // in recoverable mode.
   if (PreviousHandler.sa_flags & SA_SIGINFO) {
     PreviousHandler.sa_sigaction(sig, info, ucontext);
   } else if (PreviousHandler.sa_handler == SIG_DFL) {
     // If the previous handler was the default handler, cause a core dump.
     signal(SIGSEGV, SIG_DFL);
     raise(SIGSEGV);
   } else if (PreviousHandler.sa_handler == SIG_IGN) {
     // If the previous segv handler was SIGIGN, crash iff we were responsible

 }
 } // anonymous namespace
 
 namespace gwp_asan {
 namespace segv_handler {
 
 void installSignalHandlers(gwp_asan::GuardedPoolAllocator *GPA, Printf_t Printf,
                            PrintBacktrace_t PrintBacktrace,
-                           SegvBacktrace_t SegvBacktrace) {
+                           SegvBacktrace_t SegvBacktrace, bool Recoverable) {
   assert(GPA && "GPA wasn't provided to installSignalHandlers.");
   assert(Printf && "Printf wasn't provided to installSignalHandlers.");
   assert(PrintBacktrace &&
          "PrintBacktrace wasn't provided to installSignalHandlers.");
   assert(SegvBacktrace &&
          "SegvBacktrace wasn't provided to installSignalHandlers.");
   GPAForSignalHandler = GPA;
   PrintfForSignalHandler = Printf;
   PrintBacktraceForSignalHandler = PrintBacktrace;
   BacktraceForSignalHandler = SegvBacktrace;
+  RecoverableSignal = Recoverable;
 
   struct sigaction Action = {};
   Action.sa_sigaction = sigSegvHandler;
   Action.sa_flags = SA_SIGINFO;
   sigaction(SIGSEGV, &Action, &PreviousHandler);
   SignalHandlerInstalled = true;
 }
 
 void uninstallSignalHandlers() {
   if (SignalHandlerInstalled) {
     sigaction(SIGSEGV, &PreviousHandler, nullptr);
     SignalHandlerInstalled = false;
   }
 }
 } // namespace segv_handler
 } // namespace gwp_asan

compiler-rt/lib/gwp_asan/options.inc

GWP_ASAN_OPTION(
     "Install GWP-ASan signal handlers for SIGSEGV during dynamic loading. This "
     "allows better error reports by providing stack traces for allocation and "
     "deallocation when reporting a memory error. GWP-ASan's signal handler "
     "will forward the signal to any previously-installed handler, and user "
     "programs that install further signal handlers should make sure they do "
     "the same. Note, if the previously installed SIGSEGV handler is SIG_IGN, "
     "we terminate the process after dumping the error report.")
 
+GWP_ASAN_OPTION(
+    bool, Recoverable, false,
+    "Install GWP-ASan's signal handler in recoverable mode. This means that "
+    "upon GWP-ASan detecting an error, it'll print the error report, but *not* "
+    "crash. Only one crash per sampled allocation will ever be recorded, and "
+    "if a sampled allocation does actually cause a crash, it'll permanently "
+    "occupy a slot in the pool. The recoverable mode also means that "
+    "previously-installed signal handlers will only be triggered for "
+    "non-GWP-ASan errors, as all GWP-ASan errors won't be forwarded.")
+
 GWP_ASAN_OPTION(bool, InstallForkHandlers, true,
                 "Install GWP-ASan atfork handlers to acquire internal locks "
                 "before fork and release them after.")
 
 GWP_ASAN_OPTION(bool, help, false, "Print a summary of the available options.")
 
 // =============================================================================
 // ==== WARNING

compiler-rt/lib/gwp_asan/tests/CMakeLists.txt

set(GWP_ASAN_UNITTESTS
   crash_handler_api.cpp
   driver.cpp
   mutex_test.cpp
   slot_reuse.cpp
   thread_contention.cpp
   harness.cpp
   enable_disable.cpp
   late_init.cpp
-  options.cpp)
+  options.cpp
+  recoverable.cpp)
 
 set(GWP_ASAN_UNIT_TEST_HEADERS
   ${GWP_ASAN_HEADERS}
   harness.h)
 
 add_custom_target(GwpAsanUnitTests)
 set_target_properties(GwpAsanUnitTests PROPERTIES FOLDER "Compiler-RT Tests")
 

compiler-rt/lib/gwp_asan/tests/backtrace.cpp

 //===-- backtrace.cpp -------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
+#include <regex>
 #include <string>
 
 #include "gwp_asan/common.h"
 #include "gwp_asan/crash_handler.h"
 #include "gwp_asan/tests/harness.h"
 
-// Optnone to ensure that the calls to these functions are not optimized away,
-// as we're looking for them in the backtraces.
-__attribute((optnone)) void *
-AllocateMemory(gwp_asan::GuardedPoolAllocator &GPA) {
-  return GPA.allocate(1);
-}
-__attribute((optnone)) void
-DeallocateMemory(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr) {
-  GPA.deallocate(Ptr);
-}
-__attribute((optnone)) void
-DeallocateMemory2(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr) {
-  GPA.deallocate(Ptr);
-}
-__attribute__((optnone)) void TouchMemory(void *Ptr) {
-  *(reinterpret_cast<volatile char *>(Ptr)) = 7;
-}
-
-TEST_F(BacktraceGuardedPoolAllocatorDeathTest, DoubleFree) {
+TEST_P(BacktraceGuardedPoolAllocatorDeathTest, DoubleFree) {
   void *Ptr = AllocateMemory(GPA);
   DeallocateMemory(GPA, Ptr);
 
-  std::string DeathRegex = "Double Free.*";
-  DeathRegex.append("DeallocateMemory2.*");
-
-  DeathRegex.append("was deallocated.*");
-  DeathRegex.append("DeallocateMemory.*");
-
-  DeathRegex.append("was allocated.*");
-  DeathRegex.append("AllocateMemory.*");
+  std::string DeathRegex = "Double Free.*DeallocateMemory2.*";
+  DeathRegex.append("was deallocated.*DeallocateMemory[^2].*");
+  DeathRegex.append("was allocated.*AllocateMemory");
+  if (!Recoverable) {
     ASSERT_DEATH(DeallocateMemory2(GPA, Ptr), DeathRegex);
+    return;
+  }
+
+  // For recoverable, assert that DeallocateMemory2() doesn't crash.
+  DeallocateMemory2(GPA, Ptr);
+  // Fuchsia's zxtest doesn't have an EXPECT_THAT(testing::MatchesRegex(), ...),
+  // so check the regex manually.
+  EXPECT_TRUE(std::regex_search(
+      GetOutputBuffer(),
+      std::basic_regex(DeathRegex, std::regex_constants::extended)))
+      << "Regex \"" << DeathRegex
+      << "\" was not found in input:\n============\n"
+      << GetOutputBuffer() << "\n============";
 }
 
-TEST_F(BacktraceGuardedPoolAllocatorDeathTest, UseAfterFree) {
+TEST_P(BacktraceGuardedPoolAllocatorDeathTest, UseAfterFree) {
 #if defined(__linux__) && __ARM_ARCH == 7
   // Incomplete backtrace on Armv7 Linux
   GTEST_SKIP();
 #endif
 
   void *Ptr = AllocateMemory(GPA);
   DeallocateMemory(GPA, Ptr);
 
-  std::string DeathRegex = "Use After Free.*";
-  DeathRegex.append("TouchMemory.*");
+  std::string DeathRegex = "Use After Free.*TouchMemory.*";
+  DeathRegex.append("was deallocated.*DeallocateMemory[^2].*");
+  DeathRegex.append("was allocated.*AllocateMemory");
 
-  DeathRegex.append("was deallocated.*");
-  DeathRegex.append("DeallocateMemory.*");
-
-  DeathRegex.append("was allocated.*");
-  DeathRegex.append("AllocateMemory.*");
+  if (!Recoverable) {
     ASSERT_DEATH(TouchMemory(Ptr), DeathRegex);
+    return;
   }
 
+  // For recoverable, assert that TouchMemory() doesn't crash.
+  TouchMemory(Ptr);
+  // Fuchsia's zxtest doesn't have an EXPECT_THAT(testing::MatchesRegex(), ...),
+  // so check the regex manually.
+  EXPECT_TRUE(std::regex_search(
+      GetOutputBuffer(),
+      std::basic_regex(DeathRegex, std::regex_constants::extended)))
+      << "Regex \"" << DeathRegex
+      << "\" was not found in input:\n============\n"
+      << GetOutputBuffer() << "\n============";
+  ;
+}
+
+INSTANTIATE_TEST_SUITE_P(RecoverableSignalDeathTest,
+                         BacktraceGuardedPoolAllocatorDeathTest,
+                         /* Recoverable */ testing::Bool());
+
 TEST(Backtrace, Short) {
   gwp_asan::AllocationMetadata Meta;
   Meta.AllocationTrace.RecordBacktrace(
       [](uintptr_t *TraceBuffer, size_t /* Size */) -> size_t {
         TraceBuffer[0] = 123u;
         TraceBuffer[1] = 321u;
         return 2u;
       });

compiler-rt/lib/gwp_asan/tests/crash_handler_api.cpp

size_t metadata(uintptr_t Addr, uintptr_t Size, bool IsDeallocated) {
     Metadata[Slot].DeallocationTrace.ThreadID = 321;
     setupBacktraces(&Metadata[Slot]);
 
     return Slot;
   }
 
   void setupState() {
     State.GuardedPagePool = 0x2000;
-    State.GuardedPagePoolEnd = 0xb000;
+    State.GuardedPagePoolEnd = 0xc000;
+    InternalFaultAddr = State.GuardedPagePoolEnd - 0x10;
     State.MaxSimultaneousAllocations = 4; // 0x3000, 0x5000, 0x7000, 0x9000.
     State.PageSize = 0x1000;
   }
 
   void setupBacktraces(AllocationMetadata *Meta) {
     Meta->AllocationTrace.TraceSize = gwp_asan::compression::pack(
         BacktraceConstants, kNumBacktraceConstants,
         Meta->AllocationTrace.CompressedTrace,
void checkMetadata(size_t Index, uintptr_t ErrorPtr) {
     EXPECT_EQ(Metadata[Index].DeallocationTrace.ThreadID,
               __gwp_asan_get_deallocation_thread_id(Meta));
   }
 
   static constexpr size_t kNumBacktraceConstants = 4;
   static uintptr_t BacktraceConstants[kNumBacktraceConstants];
   AllocatorState State = {};
   AllocationMetadata Metadata[4] = {};
+  uintptr_t InternalFaultAddr;
 };
 
 uintptr_t CrashHandlerAPITest::BacktraceConstants[kNumBacktraceConstants] = {
     0xdeadbeef, 0xdeadc0de, 0xbadc0ffe, 0xcafef00d};
 
 TEST_F(CrashHandlerAPITest, PointerNotMine) {
   uintptr_t UnknownPtr = reinterpret_cast<uintptr_t>(&State);
 

 }
 
 TEST_F(CrashHandlerAPITest, PointerNotAllocated) {
   uintptr_t FailureAddress = 0x9000;
 
   EXPECT_TRUE(__gwp_asan_error_is_mine(&State, FailureAddress));
   EXPECT_EQ(Error::UNKNOWN,
             __gwp_asan_diagnose_error(&State, Metadata, FailureAddress));
-  EXPECT_EQ(0u, __gwp_asan_get_internal_crash_address(&State));
+  EXPECT_EQ(0u, __gwp_asan_get_internal_crash_address(&State, FailureAddress));
   EXPECT_EQ(nullptr, __gwp_asan_get_metadata(&State, Metadata, FailureAddress));
 }
 
 TEST_F(CrashHandlerAPITest, DoubleFree) {
   size_t Index =
       metadata(/* Addr */ 0x7000, /* Size */ 0x20, /* IsDeallocated */ true);
   uintptr_t FailureAddress = 0x7000;
 
   State.FailureType = Error::DOUBLE_FREE;
   State.FailureAddress = FailureAddress;
 
   EXPECT_TRUE(__gwp_asan_error_is_mine(&State));
   EXPECT_EQ(Error::DOUBLE_FREE,
             __gwp_asan_diagnose_error(&State, Metadata, 0x0));
-  EXPECT_EQ(FailureAddress, __gwp_asan_get_internal_crash_address(&State));
+  EXPECT_EQ(FailureAddress,
+            __gwp_asan_get_internal_crash_address(&State, InternalFaultAddr));
   checkMetadata(Index, FailureAddress);
 }
 
 TEST_F(CrashHandlerAPITest, InvalidFree) {
   size_t Index =
       metadata(/* Addr */ 0x7000, /* Size */ 0x20, /* IsDeallocated */ false);
   uintptr_t FailureAddress = 0x7001;
 
   State.FailureType = Error::INVALID_FREE;
   State.FailureAddress = FailureAddress;
 
   EXPECT_TRUE(__gwp_asan_error_is_mine(&State));
   EXPECT_EQ(Error::INVALID_FREE,
             __gwp_asan_diagnose_error(&State, Metadata, 0x0));
-  EXPECT_EQ(FailureAddress, __gwp_asan_get_internal_crash_address(&State));
+  EXPECT_EQ(FailureAddress,
+            __gwp_asan_get_internal_crash_address(&State, InternalFaultAddr));
   checkMetadata(Index, FailureAddress);
 }
 
 TEST_F(CrashHandlerAPITest, InvalidFreeNoMetadata) {
   uintptr_t FailureAddress = 0x7001;
 
   State.FailureType = Error::INVALID_FREE;
   State.FailureAddress = FailureAddress;
 
   EXPECT_TRUE(__gwp_asan_error_is_mine(&State));
   EXPECT_EQ(Error::INVALID_FREE,
             __gwp_asan_diagnose_error(&State, Metadata, 0x0));
-  EXPECT_EQ(FailureAddress, __gwp_asan_get_internal_crash_address(&State));
+  EXPECT_EQ(FailureAddress,
+            __gwp_asan_get_internal_crash_address(&State, InternalFaultAddr));
   EXPECT_EQ(nullptr, __gwp_asan_get_metadata(&State, Metadata, FailureAddress));
 }
 
 TEST_F(CrashHandlerAPITest, UseAfterFree) {
   size_t Index =
       metadata(/* Addr */ 0x7000, /* Size */ 0x20, /* IsDeallocated */ true);
   uintptr_t FailureAddress = 0x7001;
 
   EXPECT_TRUE(__gwp_asan_error_is_mine(&State, FailureAddress));
   EXPECT_EQ(Error::USE_AFTER_FREE,
             __gwp_asan_diagnose_error(&State, Metadata, FailureAddress));
-  EXPECT_EQ(0u, __gwp_asan_get_internal_crash_address(&State));
+  EXPECT_EQ(0u, __gwp_asan_get_internal_crash_address(&State, FailureAddress));
   checkMetadata(Index, FailureAddress);
 }
 
 TEST_F(CrashHandlerAPITest, BufferOverflow) {
   size_t Index =
       metadata(/* Addr */ 0x5f00, /* Size */ 0x100, /* IsDeallocated */ false);
   uintptr_t FailureAddress = 0x6000;
 
   EXPECT_TRUE(__gwp_asan_error_is_mine(&State, FailureAddress));
   EXPECT_EQ(Error::BUFFER_OVERFLOW,
             __gwp_asan_diagnose_error(&State, Metadata, FailureAddress));
-  EXPECT_EQ(0u, __gwp_asan_get_internal_crash_address(&State));
+  EXPECT_EQ(0u, __gwp_asan_get_internal_crash_address(&State, FailureAddress));
   checkMetadata(Index, FailureAddress);
 }
 
 TEST_F(CrashHandlerAPITest, BufferUnderflow) {
   size_t Index =
       metadata(/* Addr */ 0x3000, /* Size */ 0x10, /* IsDeallocated*/ false);
   uintptr_t FailureAddress = 0x2fff;
 
   EXPECT_TRUE(__gwp_asan_error_is_mine(&State, FailureAddress));
   EXPECT_EQ(Error::BUFFER_UNDERFLOW,
             __gwp_asan_diagnose_error(&State, Metadata, FailureAddress));
-  EXPECT_EQ(0u, __gwp_asan_get_internal_crash_address(&State));
+  EXPECT_EQ(0u, __gwp_asan_get_internal_crash_address(&State, FailureAddress));
   checkMetadata(Index, FailureAddress);
 }

compiler-rt/lib/gwp_asan/tests/harness.h

 //===-- harness.h -----------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef GWP_ASAN_TESTS_HARNESS_H_
 #define GWP_ASAN_TESTS_HARNESS_H_
 
 #include <stdarg.h>
 
 #if defined(__Fuchsia__)
 #include <zxtest/zxtest.h>
 using Test = ::zxtest::Test;
+template <typename T> using TestWithParam = ::zxtest::TestWithParam<T>;
 #else
 #include "gtest/gtest.h"
 using Test = ::testing::Test;
+template <typename T> using TestWithParam = ::testing::TestWithParam<T>;
 #endif
 
 #include "gwp_asan/guarded_pool_allocator.h"
 #include "gwp_asan/optional/backtrace.h"
 #include "gwp_asan/optional/printf.h"
 #include "gwp_asan/optional/segv_handler.h"
 #include "gwp_asan/options.h"
 
 namespace gwp_asan {
 namespace test {
 // This printf-function getter allows other platforms (e.g. Android) to define
 // their own signal-safe Printf function. In LLVM, we use
 // `optional/printf_sanitizer_common.cpp` which supplies the __sanitizer::Printf
 // for this purpose.
 Printf_t getPrintfFunction();
 
 // First call returns true, all the following calls return false.
 bool OnlyOnce();
 
 }; // namespace test
 }; // namespace gwp_asan
 
+char *AllocateMemory(gwp_asan::GuardedPoolAllocator &GPA);
+void DeallocateMemory(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr);
+void DeallocateMemory2(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr);
+void TouchMemory(void *Ptr);
+
 class DefaultGuardedPoolAllocator : public Test {
 public:
   void SetUp() override {
     gwp_asan::options::Options Opts;
     Opts.setDefaults();
     MaxSimultaneousAllocations = Opts.MaxSimultaneousAllocations;
 
     Opts.InstallForkHandlers = gwp_asan::test::OnlyOnce();
public:
   void TearDown() override { GPA.uninitTestOnly(); }
 
 protected:
   gwp_asan::GuardedPoolAllocator GPA;
   decltype(gwp_asan::options::Options::MaxSimultaneousAllocations)
       MaxSimultaneousAllocations;
 };
 
-class BacktraceGuardedPoolAllocator : public Test {
+class BacktraceGuardedPoolAllocator
+    : public TestWithParam</* Recoverable */ bool> {
 public:
   void SetUp() override {
     gwp_asan::options::Options Opts;
     Opts.setDefaults();
 
     Opts.Backtrace = gwp_asan::backtrace::getBacktraceFunction();
     Opts.InstallForkHandlers = gwp_asan::test::OnlyOnce();
     GPA.init(Opts);
 
+    // In recoverable mode, capture GWP-ASan logs to an internal buffer so that
+    // we can search it in unit tests. For non-recoverable tests, the default
+    // buffer is fine, as any tests should be EXPECT_DEATH()'d.
+    Recoverable = GetParam();
+    gwp_asan::Printf_t PrintfFunction = PrintfToBuffer;
+    GetOutputBuffer().clear();
+    if (!Recoverable)
+      PrintfFunction = gwp_asan::test::getPrintfFunction();
+
     gwp_asan::segv_handler::installSignalHandlers(
-        &GPA, gwp_asan::test::getPrintfFunction(),
-        gwp_asan::backtrace::getPrintBacktraceFunction(),
-        gwp_asan::backtrace::getSegvBacktraceFunction());
+        &GPA, PrintfFunction, gwp_asan::backtrace::getPrintBacktraceFunction(),
+        gwp_asan::backtrace::getSegvBacktraceFunction(),
+        /* Recoverable */ Recoverable);
   }
 
   void TearDown() override {
     GPA.uninitTestOnly();
     gwp_asan::segv_handler::uninstallSignalHandlers();
   }
 
 protected:
+  static std::string &GetOutputBuffer() {
+    static std::string Buffer;
+    return Buffer;
+  }
+
+  __attribute__((format(printf, 1, 2))) static void
+  PrintfToBuffer(const char *Format, ...) {
+    va_list AP;
+    va_start(AP, Format);
+    char Buffer[8192];
+    vsnprintf(Buffer, sizeof(Buffer), Format, AP);
+    GetOutputBuffer() += Buffer;
+    va_end(AP);
+  }
+
   gwp_asan::GuardedPoolAllocator GPA;
+  bool Recoverable;
 };
 
 // https://github.com/google/googletest/blob/master/docs/advanced.md#death-tests-and-threads
 using DefaultGuardedPoolAllocatorDeathTest = DefaultGuardedPoolAllocator;
 using CustomGuardedPoolAllocatorDeathTest = CustomGuardedPoolAllocator;
 using BacktraceGuardedPoolAllocatorDeathTest = BacktraceGuardedPoolAllocator;
 
 #endif // GWP_ASAN_TESTS_HARNESS_H_

compiler-rt/lib/gwp_asan/tests/harness.cpp

 namespace gwp_asan {
 namespace test {
 bool OnlyOnce() {
   static int x = 0;
   return !x++;
 }
 } // namespace test
 } // namespace gwp_asan
+
+// Optnone to ensure that the calls to these functions are not optimized away,
+// as we're looking for them in the backtraces.
+__attribute__((optnone)) char *
+AllocateMemory(gwp_asan::GuardedPoolAllocator &GPA) {
+  return static_cast<char *>(GPA.allocate(1));
+}
+__attribute__((optnone)) void
+DeallocateMemory(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr) {
+  GPA.deallocate(Ptr);
+}
+__attribute__((optnone)) void
+DeallocateMemory2(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr) {
+  GPA.deallocate(Ptr);
+}
+__attribute__((optnone)) void TouchMemory(void *Ptr) {
+  *(reinterpret_cast<volatile char *>(Ptr)) = 7;
+}

compiler-rt/lib/gwp_asan/tests/recoverable.cpp

+//===-- recoverable.cpp -----------------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include <atomic>
+#include <mutex>
+#include <regex>
+#include <string>
+#include <thread>
+#include <vector>
+
+#include "gwp_asan/common.h"
+#include "gwp_asan/crash_handler.h"
+#include "gwp_asan/tests/harness.h"
+
+void CheckOnlyOneGwpAsanCrash(const std::string &OutputBuffer) {
+  const char *kGwpAsanErrorString = "GWP-ASan detected a memory error";
+  size_t FirstIndex = OutputBuffer.find(kGwpAsanErrorString);
+  ASSERT_NE(FirstIndex, std::string::npos) << "Didn't detect a GWP-ASan crash";
+  ASSERT_EQ(OutputBuffer.find(kGwpAsanErrorString, FirstIndex + 1),
+            std::string::npos)
+      << "Detected more than one GWP-ASan crash:\n"
+      << OutputBuffer;
+}
+
+TEST_P(BacktraceGuardedPoolAllocator, MultipleDoubleFreeOnlyOneOutput) {
+  SCOPED_TRACE("");
+  void *Ptr = AllocateMemory(GPA);
+  DeallocateMemory(GPA, Ptr);
+  // First time should generate a crash report.
+  DeallocateMemory(GPA, Ptr);
+  CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
+  ASSERT_NE(std::string::npos, GetOutputBuffer().find("Double Free"));
+
+  // Ensure the crash is only reported once.
+  GetOutputBuffer().clear();
+  for (size_t i = 0; i < 100; ++i) {
+    DeallocateMemory(GPA, Ptr);
+    ASSERT_TRUE(GetOutputBuffer().empty());
+  }
+}
+
+TEST_P(BacktraceGuardedPoolAllocator, MultipleInvalidFreeOnlyOneOutput) {
+  SCOPED_TRACE("");
+  char *Ptr = static_cast<char *>(AllocateMemory(GPA));
+  // First time should generate a crash report.
+  DeallocateMemory(GPA, Ptr + 1);
+  CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
+  ASSERT_NE(std::string::npos, GetOutputBuffer().find("Invalid (Wild) Free"));
+
+  // Ensure the crash is only reported once.
+  GetOutputBuffer().clear();
+  for (size_t i = 0; i < 100; ++i) {
+    DeallocateMemory(GPA, Ptr + 1);
+    ASSERT_TRUE(GetOutputBuffer().empty());
+  }
+}
+
+TEST_P(BacktraceGuardedPoolAllocator, MultipleUseAfterFreeOnlyOneOutput) {
+  SCOPED_TRACE("");
+  void *Ptr = AllocateMemory(GPA);
+  DeallocateMemory(GPA, Ptr);
+  // First time should generate a crash report.
+  TouchMemory(Ptr);
+  ASSERT_NE(std::string::npos, GetOutputBuffer().find("Use After Free"));
+
+  // Ensure the crash is only reported once.
+  GetOutputBuffer().clear();
+  for (size_t i = 0; i < 100; ++i) {
+    TouchMemory(Ptr);
+    ASSERT_TRUE(GetOutputBuffer().empty());
+  }
+}
+
+TEST_P(BacktraceGuardedPoolAllocator, MultipleBufferOverflowOnlyOneOutput) {
+  SCOPED_TRACE("");
+  char *Ptr = static_cast<char *>(AllocateMemory(GPA));
+  // First time should generate a crash report.
+  TouchMemory(Ptr - 16);
+  TouchMemory(Ptr + 16);
+  CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
+  if (GetOutputBuffer().find("Buffer Overflow") == std::string::npos &&
+      GetOutputBuffer().find("Buffer Underflow") == std::string::npos)
+    FAIL() << "Failed to detect buffer underflow/overflow:\n"
+           << GetOutputBuffer();
+
+  // Ensure the crash is only reported once.
+  GetOutputBuffer().clear();
+  for (size_t i = 0; i < 100; ++i) {
+    TouchMemory(Ptr - 16);
+    TouchMemory(Ptr + 16);
+    ASSERT_TRUE(GetOutputBuffer().empty()) << GetOutputBuffer();
+  }
+}
+
+TEST_P(BacktraceGuardedPoolAllocator, OneDoubleFreeOneUseAfterFree) {
+  SCOPED_TRACE("");
+  void *Ptr = AllocateMemory(GPA);
+  DeallocateMemory(GPA, Ptr);
+  // First time should generate a crash report.
+  DeallocateMemory(GPA, Ptr);
+  CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
+  ASSERT_NE(std::string::npos, GetOutputBuffer().find("Double Free"));
+
+  // Ensure the crash is only reported once.
+  GetOutputBuffer().clear();
+  for (size_t i = 0; i < 100; ++i) {
+    DeallocateMemory(GPA, Ptr);
+    ASSERT_TRUE(GetOutputBuffer().empty());
+  }
+}
+
+// We use double-free to detect that each slot can generate as single error.
+// Use-after-free would also be acceptable, but buffer-overflow wouldn't be, as
+// the random left/right alignment means that one right-overflow can disable
+// page protections, and a subsequent left-overflow of a slot that's on the
+// right hand side may not trap.
+TEST_P(BacktraceGuardedPoolAllocator, OneErrorReportPerSlot) {
+  SCOPED_TRACE("");
+  std::vector<void *> Ptrs;
+  for (size_t i = 0; i < GPA.getAllocatorState()->MaxSimultaneousAllocations;
+       ++i) {
+    void *Ptr = AllocateMemory(GPA);
+    ASSERT_NE(Ptr, nullptr);
+    Ptrs.push_back(Ptr);
+    DeallocateMemory(GPA, Ptr);
+    DeallocateMemory(GPA, Ptr);
+    CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
+    ASSERT_NE(std::string::npos, GetOutputBuffer().find("Double Free"));
+    // Ensure the crash from this slot is only reported once.
+    GetOutputBuffer().clear();
+    DeallocateMemory(GPA, Ptr);
+    ASSERT_TRUE(GetOutputBuffer().empty());
+    // Reset the buffer, as we're gonna move to the next allocation.
+    GetOutputBuffer().clear();
+  }
+
+  // All slots should have been used. No further errors should occur.
+  for (size_t i = 0; i < 100; ++i)
+    ASSERT_EQ(AllocateMemory(GPA), nullptr);
+  for (void *Ptr : Ptrs) {
+    DeallocateMemory(GPA, Ptr);
+    TouchMemory(Ptr);
+  }
+  ASSERT_TRUE(GetOutputBuffer().empty());
+}
+
+void singleAllocThrashTask(gwp_asan::GuardedPoolAllocator *GPA,
+                           std::atomic<bool> *StartingGun,
+                           unsigned NumIterations, unsigned Job, char *Ptr) {
+  while (!*StartingGun) {
+    // Wait for starting gun.
+  }
+
+  for (unsigned i = 0; i < NumIterations; ++i) {
+    switch (Job) {
+    case 0:
+      DeallocateMemory(*GPA, Ptr);
+      break;
+    case 1:
+      DeallocateMemory(*GPA, Ptr + 1);
+      break;
+    case 2:
+      TouchMemory(Ptr);
+      break;
+    case 3:
+      TouchMemory(Ptr - 16);
+      TouchMemory(Ptr + 16);
+      break;
+    default:
+      __builtin_trap();
+    }
+  }
+}
+
+void runInterThreadThrashingSingleAlloc(unsigned NumIterations,
+                                        gwp_asan::GuardedPoolAllocator *GPA) {
+  std::atomic<bool> StartingGun{false};
+  std::vector<std::thread> Threads;
+  constexpr unsigned kNumThreads = 4;
+  if (std::thread::hardware_concurrency() < kNumThreads) {
+    GTEST_SKIP() << "Not enough threads to run this test";
+  }
+
+  char *Ptr = static_cast<char *>(AllocateMemory(*GPA));
+
+  for (unsigned i = 0; i < kNumThreads; ++i) {
+    Threads.emplace_back(singleAllocThrashTask, GPA, &StartingGun,
+                         NumIterations, i, Ptr);
+  }
+
+  StartingGun = true;
+
+  for (auto &T : Threads)
+    T.join();
+}
+
+TEST_P(BacktraceGuardedPoolAllocator, InterThreadThrashingSingleAlloc) {
+  SCOPED_TRACE("");
+  constexpr unsigned kNumIterations = 100000;
+  runInterThreadThrashingSingleAlloc(kNumIterations, &GPA);
+  CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
+}
+
+INSTANTIATE_TEST_SUITE_P(RecoverableTests, BacktraceGuardedPoolAllocator,
+                         /* Recoverable */ testing::Values(true));

compiler-rt/lib/scudo/standalone/combined.h

public:
   void initGwpAsan() {
 #ifdef GWP_ASAN_HOOKS
     gwp_asan::options::Options Opt;
     Opt.Enabled = getFlags()->GWP_ASAN_Enabled;
     Opt.MaxSimultaneousAllocations =
         getFlags()->GWP_ASAN_MaxSimultaneousAllocations;
     Opt.SampleRate = getFlags()->GWP_ASAN_SampleRate;
     Opt.InstallSignalHandlers = getFlags()->GWP_ASAN_InstallSignalHandlers;
+    Opt.Recoverable = getFlags()->GWP_ASAN_Recoverable;
     // Embedded GWP-ASan is locked through the Scudo atfork handler (via
     // Allocator::disable calling GWPASan.disable). Disable GWP-ASan's atfork
     // handler.
     Opt.InstallForkHandlers = false;
     Opt.Backtrace = gwp_asan::backtrace::getBacktraceFunction();
     GuardedAlloc.init(Opt);
 
     if (Opt.InstallSignalHandlers)
       gwp_asan::segv_handler::installSignalHandlers(
           &GuardedAlloc, Printf,
           gwp_asan::backtrace::getPrintBacktraceFunction(),
-          gwp_asan::backtrace::getSegvBacktraceFunction());
+          gwp_asan::backtrace::getSegvBacktraceFunction(),
+          Opt.Recoverable);
 
     GuardedAllocSlotSize =
         GuardedAlloc.getAllocatorState()->maximumAllocationSize();
     Stats.add(StatFree, static_cast<uptr>(Opt.MaxSimultaneousAllocations) *
                             GuardedAllocSlotSize);
 #endif // GWP_ASAN_HOOKS
   }