Port msan and stand-alone lsan to Android

[thurston]

Summary

thread cannot be used for lsan or msan on Android, because its emutls implementation relies on functions that will be intercepted. This revision replaces thread with a struct stored in TLS_SLOT_TSAN.

msan requires corresponding changes (D22550) to LLVM MemorySanitizer.cpp.

[eugenis]

Please reupload with context, see http://llvm.org/docs/Phabricator.html (git diff -U999999).

[thurston]

Reuploaded with context

[eugenis]

This is way too intrusive.
How about something like this:

keep LSan allocator cache thread-local on non-Android, store a pointer to it in TLS_SLOT_TSAN on Android. Implement Cache *getAllocatorCache() function that would do the right thing depending on the platform.

Move the contents of MsanTLSSlotStruct directly into MsanThread so that they can be accessed as, for example, getCurrentThread()->in_interceptor_scope. This might slow down other platforms a little bit, but that's acceptable. Again, no #ifdefs - the same code on all platforms. Change __msan::GetCurrentThread to use TLS_SLOT_TSAN on Android and a usual thread-local var on other platforms.

It would be easier to review if you did one of the tools first (maybe LSan?) and uploaded that as a separate change.

lib/lsan/lsan.cc

16 ↗

(On Diff #64616)

No system headers in this file.
This code should go in sanitizer_common as something similar to InstallDeadlySignalHandlers. We can use it in other sanitizers to dump allocator stats, for example.

Please upload it as a separate change.

111 ↗

(On Diff #64616)

This should be done after the flags are initialized.
Add a flag "handle_sighup" to sanitizer_flags.inc.

133 ↗

(On Diff #64616)

No need for #if / #endif

lib/msan/msan.cc

424 ↗

(On Diff #64616)

I imagine this would be very bad for performance and code size.

Instead, move these arrays to the beginning of MsanThread so that their offsets for TLS_SLOT_TSAN can be hardcoded and compile-time verified. Then make the compiler (MemorySanitizer.cpp) emit the tls access code inline. Search for "getIRStackGuard" for inspiration.

lib/sanitizer_common/sanitizer_platform_limits_posix.cc

238 ↗

(On Diff #64616)

move from under #if

lib/sanitizer_common/sanitizer_platform_limits_posix.h

177 ↗

(On Diff #64616)

There is the same declaration 9 lines below.

[thurston]

In D22549#490474, @eugenis wrote:

This is way too intrusive.
How about something like this:

Move the contents of MsanTLSSlotStruct directly into MsanThread so that they can be accessed as, for example, getCurrentThread()->in_interceptor_scope. This might slow down other platforms a little bit, but that's acceptable. Again, no #ifdefs - the same code on all platforms. Change __msan::GetCurrentThread to use TLS_SLOT_TSAN on Android and a usual thread-local var on other platforms.

For MSan, would it be ok if I:

• changed the compiler instrumentation to the emit the MsanTLSSlot access code inline
• and used a GetTLS()-like abstraction to access MsanTLSSlot variables
• but not move the MsanTLSSlot contents into MsanThread (i.e., keep the current separation of variables between struct MsanTLSSlot and MsanThread)?

There's a few variables (e.g., in_interceptor_scope) that are accessed very early on, before MsanThread::Create() has been (or can be) called. If I moved all TLS variables into MsanThread, I could allocate MsanThread in the TLS_SLOT as soon as in_interceptor_scope is needed, but some of the MsanThread contents are not initialized until MsanThread::Create()+SetCurrentThread(). This means Create and SetCurrentThread would no longer be handling the entire MsanThread state, which is a bit confusing, and difficult for the pthread_create interceptor (which uses Create+SetCurrentThread).

[eugenis]

In D22549#497725, @thurston wrote:

In D22549#490474, @eugenis wrote:

This is way too intrusive.
How about something like this:

Move the contents of MsanTLSSlotStruct directly into MsanThread so that they can be accessed as, for example, getCurrentThread()->in_interceptor_scope. This might slow down other platforms a little bit, but that's acceptable. Again, no #ifdefs - the same code on all platforms. Change __msan::GetCurrentThread to use TLS_SLOT_TSAN on Android and a usual thread-local var on other platforms.

For MSan, would it be ok if I:

• changed the compiler instrumentation to the emit the MsanTLSSlot access code inline
• and used a GetTLS()-like abstraction to access MsanTLSSlot variables
• but not move the MsanTLSSlot contents into MsanThread (i.e., keep the current separation of variables between struct MsanTLSSlot and MsanThread)?

There's a few variables (e.g., in_interceptor_scope) that are accessed very early on, before MsanThread::Create() has been (or can be) called. If I moved all TLS variables into MsanThread, I could allocate MsanThread in the TLS_SLOT as soon as in_interceptor_scope is needed, but some of the MsanThread contents are not initialized until MsanThread::Create()+SetCurrentThread(). This means Create and SetCurrentThread would no longer be handling the entire MsanThread state, which is a bit confusing, and difficult for the pthread_create interceptor (which uses Create+SetCurrentThread).

OK, sounds reasonable.

lsan/lsan.cc

 //
 //===----------------------------------------------------------------------===//
 
+#include <signal.h>
+#include <syslog.h>
+
 #include "lsan.h"
 
 #include "sanitizer_common/sanitizer_flags.h"

 
 using namespace __lsan;  // NOLINT
 
+
+#if SANITIZER_ANDROID
+extern "C" {
+    int __lsan_do_recoverable_leak_check();
+}
+
+
+static void mySigHandler (int sig) {
+  Printf ("Performing recoverable leak check ...\n");
+  int result = __lsan_do_recoverable_leak_check ();
+  Printf ("Leak result: %d\n", result);
+}
+
+
+static void SetSIGHUPHandler() {
+  sigset_t set;
+  if (sigfillset (&set) != 0) {
+      Printf ("Failed to fill signal set\n");
+  }
+
+  struct sigaction act;
+  act.sa_handler = &mySigHandler;
+  act.sa_mask = set;
+  act.sa_flags = 0;
+
+  if (sigaction (SIGHUP, &act, NULL) != 0) {
+      Printf ("Failed to set signal handler\n");
+  }
+}
+#endif // SANITIZER_ANDROID
+
+
 static void InitializeFlags() {
   // Set all the default values.
   SetCommonFlagsDefaults();

   if (lsan_inited)
     return;
   lsan_init_is_running = true;
+
+#if SANITIZER_ANDROID
+  EnsureTLSSlotInit();
+  SetSIGHUPHandler();
+#endif // SANITIZER_ANDROID
+
   SanitizerToolName = "LeakSanitizer";
   CacheBinaryName();
   AvoidCVE_2016_2143();

 
   InitializeCoverage(common_flags()->coverage, common_flags()->coverage_dir);
 
+#if SANITIZER_ANDROID
+  AndroidLogInit();
+#endif
+
   lsan_inited = true;
   lsan_init_is_running = false;
 }

lsan/lsan_allocator.h

 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_internal_defs.h"
 
+#include "lsan_common.h"
+
+
+#if SANITIZER_ANDROID
+// Voodoo from tsan
+#if defined(__aarch64__)
+# define __get_tls() ({ void** __val; __asm__("mrs %0, tpidr_el0" : "=r"(__val)); __val; })
+#elif defined(__x86_64__)
+# define __get_tls() ({ void** __val; __asm__("mov %%fs:0, %0" : "=r"(__val)); __val; })
+#else
+#error unsupported architecture
+#endif
+#endif // SANITIZER_ANDROID
+
+
+static const int TLS_SLOT_TSAN = 8;
+
+
+#define LsanTLSSlotBigStruct ((struct LsanTLSSlotBig*)(__get_tls()[TLS_SLOT_TSAN]))
+
+
 namespace __lsan {
 
+
+struct ChunkMetadata {
+  u8 allocated : 8;  // Must be first.
+  ChunkTag tag : 2;
+  uptr requested_size : 54;
+  u32 stack_trace_id;
+};
+
+#if defined(__mips64) || defined(__aarch64__)
+static const uptr kMaxAllowedMallocSize = 4UL << 30;
+static const uptr kRegionSizeLog = 20;
+static const uptr kNumRegions = SANITIZER_MMAP_RANGE_SIZE >> kRegionSizeLog;
+typedef TwoLevelByteMap<(kNumRegions >> 12), 1 << 12> ByteMap;
+typedef CompactSizeClassMap SizeClassMap;
+typedef SizeClassAllocator32<0, SANITIZER_MMAP_RANGE_SIZE,
+    sizeof(ChunkMetadata), SizeClassMap, kRegionSizeLog, ByteMap>
+    PrimaryAllocator;
+#else
+static const uptr kMaxAllowedMallocSize = 8UL << 30;
+static const uptr kAllocatorSpace = 0x600000000000ULL;
+static const uptr kAllocatorSize = 0x40000000000ULL; // 4T.
+typedef SizeClassAllocator64<kAllocatorSpace, kAllocatorSize,
+        sizeof(ChunkMetadata), DefaultSizeClassMap> PrimaryAllocator;
+#endif
+typedef SizeClassAllocatorLocalCache<PrimaryAllocator> AllocatorCache;
+typedef LargeMmapAllocator<> SecondaryAllocator;
+typedef CombinedAllocator<PrimaryAllocator, AllocatorCache,
+          SecondaryAllocator> Allocator;
+
+
+#if SANITIZER_ANDROID
+struct LsanTLSSlotBig {
+  int disable_counter_D;
+  u32 current_thread_tid_D;
+  AllocatorCache cache_D;
+};
+#endif // SANITIZER_ANDROID
+
+
 void *Allocate(const StackTrace &stack, uptr size, uptr alignment,
                bool cleared);
 void Deallocate(void *p);

 void AllocatorThreadFinish();
 void InitializeAllocator();
 
+void EnsureTLSSlotInit(void);
+
 }  // namespace __lsan
 
 #endif  // LSAN_ALLOCATOR_H

lsan/lsan_allocator.cc

 #include "sanitizer_common/sanitizer_internal_defs.h"
 #include "sanitizer_common/sanitizer_stackdepot.h"
 #include "sanitizer_common/sanitizer_stacktrace.h"
-#include "lsan_common.h"
 
 extern "C" void *memset(void *ptr, int value, uptr num);
 
 namespace __lsan {
 
-struct ChunkMetadata {
-  u8 allocated : 8;  // Must be first.
-  ChunkTag tag : 2;
-  uptr requested_size : 54;
-  u32 stack_trace_id;
-};
 
-#if defined(__mips64) || defined(__aarch64__)
-static const uptr kMaxAllowedMallocSize = 4UL << 30;
-static const uptr kRegionSizeLog = 20;
-static const uptr kNumRegions = SANITIZER_MMAP_RANGE_SIZE >> kRegionSizeLog;
-typedef TwoLevelByteMap<(kNumRegions >> 12), 1 << 12> ByteMap;
-typedef CompactSizeClassMap SizeClassMap;
-typedef SizeClassAllocator32<0, SANITIZER_MMAP_RANGE_SIZE,
-    sizeof(ChunkMetadata), SizeClassMap, kRegionSizeLog, ByteMap>
-    PrimaryAllocator;
-#else
-static const uptr kMaxAllowedMallocSize = 8UL << 30;
-static const uptr kAllocatorSpace = 0x600000000000ULL;
-static const uptr kAllocatorSize = 0x40000000000ULL; // 4T.
-typedef SizeClassAllocator64<kAllocatorSpace, kAllocatorSize,
-        sizeof(ChunkMetadata), DefaultSizeClassMap> PrimaryAllocator;
-#endif
-typedef SizeClassAllocatorLocalCache<PrimaryAllocator> AllocatorCache;
-typedef LargeMmapAllocator<> SecondaryAllocator;
-typedef CombinedAllocator<PrimaryAllocator, AllocatorCache,
-          SecondaryAllocator> Allocator;
-
 static Allocator allocator;
+#if !SANITIZER_ANDROID
 static THREADLOCAL AllocatorCache cache;
+#endif // !SANITIZER_ANDROID
 
+#if SANITIZER_ANDROID
+void EnsureTLSSlotInit(void) {
+    if (LsanTLSSlotBigStruct == nullptr) {
+        struct LsanTLSSlotBig* tlsSlotBigStruct
+        = (struct LsanTLSSlotBig*) MmapOrDie (sizeof (struct LsanTLSSlotBig), "tlsSlotBigStruct", false);
+        Printf ("%d calloc'ed tls slot big struct %p (size %d)\n",
+                GetTid(), tlsSlotBigStruct, sizeof (struct LsanTLSSlotBig));
+
+        unsigned long i;
+        for (i = 0; i < sizeof (struct LsanTLSSlotBig); i++) {
+            ((char*) tlsSlotBigStruct) [i] = 0;
+        }
+
+        tlsSlotBigStruct->disable_counter_D = 0; // Redundant
+        tlsSlotBigStruct->current_thread_tid_D = -1; // kInvalidTid;
+
+        __get_tls()[TLS_SLOT_TSAN] = tlsSlotBigStruct;
+    }
+}
+#endif // SANITIZER_ANDROID
+
 void InitializeAllocator() {
   allocator.InitLinkerInitialized(common_flags()->allocator_may_return_null);
 }
 
 void AllocatorThreadFinish() {
+#if SANITIZER_ANDROID
+  allocator.SwallowCache(&(LsanTLSSlotBigStruct->cache_D));
+#else
   allocator.SwallowCache(&cache);
+#endif // SANITIZER_ANDROID
 }
 
 static ChunkMetadata *Metadata(const void *p) {

     Report("WARNING: LeakSanitizer failed to allocate %zu bytes\n", size);
     return nullptr;
   }
+#if SANITIZER_ANDROID
+  void *p = allocator.Allocate(&(LsanTLSSlotBigStruct->cache_D), size, alignment, false);
+#else
   void *p = allocator.Allocate(&cache, size, alignment, false);
+#endif // SANITIZER_ANDROID
   // Do not rely on the allocator to clear the memory (it's slow).
   if (cleared && allocator.FromPrimary(p))
     memset(p, 0, size);

   if (&__sanitizer_free_hook) __sanitizer_free_hook(p);
   RunFreeHooks(p);
   RegisterDeallocation(p);
+#if SANITIZER_ANDROID
+  allocator.Deallocate(&(LsanTLSSlotBigStruct->cache_D), p);
+#else
   allocator.Deallocate(&cache, p);
+#endif // SANITIZER_ANDROID
 }
 
 void *Reallocate(const StackTrace &stack, void *p, uptr new_size,

   RegisterDeallocation(p);
   if (new_size > kMaxAllowedMallocSize) {
     Report("WARNING: LeakSanitizer failed to allocate %zu bytes\n", new_size);
+#if SANITIZER_ANDROID
+    allocator.Deallocate(&(LsanTLSSlotBigStruct->cache_D), p);
+#else
     allocator.Deallocate(&cache, p);
+#endif // SANITIZER_ANDROID
     return nullptr;
   }
+#if SANITIZER_ANDROID
+  p = allocator.Reallocate(&(LsanTLSSlotBigStruct->cache_D), p, new_size, alignment);
+#else
   p = allocator.Reallocate(&cache, p, new_size, alignment);
+#endif // SANITIZER_ANDROID
   RegisterAllocation(stack, p, new_size);
   return p;
 }
 
 void GetAllocatorCacheRange(uptr *begin, uptr *end) {
+#if SANITIZER_ANDROID
+  *begin = (uptr)&(LsanTLSSlotBigStruct->cache_D);
+  *end = *begin + sizeof(LsanTLSSlotBigStruct->cache_D);
+#else
   *begin = (uptr)&cache;
   *end = *begin + sizeof(cache);
+#endif // SANITIZER_ANDROID
 }
 
 uptr GetMallocUsableSize(const void *p) {

lsan/lsan_common.h

 #include "sanitizer_common/sanitizer_stoptheworld.h"
 #include "sanitizer_common/sanitizer_symbolizer.h"
 
-#if (SANITIZER_LINUX && !SANITIZER_ANDROID) && (SANITIZER_WORDSIZE == 64) \
+#if (SANITIZER_LINUX) && (SANITIZER_WORDSIZE == 64) \
      && (defined(__x86_64__) ||  defined(__mips64) ||  defined(__aarch64__))
 #define CAN_SANITIZE_LEAKS 1
 #else

lsan/lsan_common.cc

 
 #include "lsan_common.h"
 
+#include "lsan_allocator.h"
+
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_flags.h"
 #include "sanitizer_common/sanitizer_flag_parser.h"

 // also to protect the global list of root regions.
 BlockingMutex global_mutex(LINKER_INITIALIZED);
 
+#if SANITIZER_ANDROID
 THREADLOCAL int disable_counter;
+bool DisabledInThisThread() { return LsanTLSSlotBigStruct->disable_counter_D > 0; }
+void DisableInThisThread() { LsanTLSSlotBigStruct->disable_counter_D++; }
+void EnableInThisThread() {
+  if (!LsanTLSSlotBigStruct->disable_counter_D && common_flags()->detect_leaks) {
+    Report("Unmatched call to __lsan_enable().\n");
+    Die();
+  }
+  LsanTLSSlotBigStruct->disable_counter_D--;
+}
+#else
+THREADLOCAL int disable_counter;
 bool DisabledInThisThread() { return disable_counter > 0; }
 void DisableInThisThread() { disable_counter++; }
 void EnableInThisThread() {

   }
   disable_counter--;
 }
+#endif // SANITIZER_ANDROID
 
+
 Flags lsan_flags;
 
 void Flags::SetDefaults() {

lsan/lsan_flags.inc

           "Root set: include global variables (.data and .bss)")
 LSAN_FLAG(bool, use_stacks, true, "Root set: include thread stacks")
 LSAN_FLAG(bool, use_registers, true, "Root set: include thread registers")
+#if SANITIZER_ANDROID
+LSAN_FLAG(bool, use_tls, false,
+          "Root set: include TLS and thread-specific storage")
+#else
 LSAN_FLAG(bool, use_tls, true,
           "Root set: include TLS and thread-specific storage")
+#endif // SANITIZER_ANDROID
 LSAN_FLAG(bool, use_root_regions, true,
           "Root set: include regions added via __lsan_register_root_region().")
 LSAN_FLAG(bool, use_ld_allocations, true,

lsan/lsan_thread.cc

 const u32 kInvalidTid = (u32) -1;
 
 static ThreadRegistry *thread_registry;
+#if !SANITIZER_ANDROID
 static THREADLOCAL u32 current_thread_tid = kInvalidTid;
+#endif // SANITIZER_ANDROID
 
 static ThreadContextBase *CreateThreadContext(u32 tid) {
   void *mem = MmapOrDie(sizeof(ThreadContext), "ThreadContext");

 }
 
 u32 GetCurrentThread() {
+#if SANITIZER_ANDROID
+  return LsanTLSSlotBigStruct->current_thread_tid_D;
+#else
   return current_thread_tid;
+#endif // SANITIZER_ANDROID
 }
 
 void SetCurrentThread(u32 tid) {
+#if SANITIZER_ANDROID
+  EnsureTLSSlotInit();
+
+  LsanTLSSlotBigStruct->current_thread_tid_D = tid;
+#else
   current_thread_tid = tid;
+#endif // SANITIZER_ANDROID
 }
 
 ThreadContext::ThreadContext(int tid)

msan/msan.h

 #include "msan_flags.h"
 #include "ubsan/ubsan_platform.h"
 
+#if SANITIZER_ANDROID
+#include "msan_thread.h"
+#endif // SANITIZER_ANDROID
+
 #ifndef MSAN_REPLACE_OPERATORS_NEW_AND_DELETE
 # define MSAN_REPLACE_OPERATORS_NEW_AND_DELETE 1
 #endif
 
+#if SANITIZER_ANDROID
+#define MSAN_CONTAINS_UBSAN 0
+#endif // SANITIZER_ANDROID
+
 #ifndef MSAN_CONTAINS_UBSAN
 # define MSAN_CONTAINS_UBSAN CAN_SANITIZE_UB
 #endif

 const int kMsanParamTlsSize = 800;
 const int kMsanRetvalTlsSize = 800;
 
+#if SANITIZER_ANDROID
+
+// Voodoo from tsan
+#if defined(__aarch64__)
+# define __get_tls() ({ void** __val; __asm__("mrs %0, tpidr_el0" : "=r"(__val)); __val; })
+#elif defined(__x86_64__)
+# define __get_tls() ({ void** __val; __asm__("mov %%fs:0, %0" : "=r"(__val)); __val; })
+#else
+#error unsupported architecture
+#endif
+
+static const int TLS_SLOT_TSAN = 8;
+
+
+struct MsanTLSSlot {
+  int dummy;
+
+  __msan::MsanThread* thread_D;
+
+  int in_interceptor_scope_D;
+  int is_in_symbolizer_D;
+
+  int msan_expect_umr_D = 0;
+  int msan_expected_umr_found_D = 0;
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  u64 __msan_param_tls_D[kMsanParamTlsSize / sizeof(u64)];
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  u32 __msan_param_origin_tls_D[kMsanParamTlsSize / sizeof(u32)];
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  u64 __msan_retval_tls_D[kMsanRetvalTlsSize / sizeof(u64)];
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  u32 __msan_retval_origin_tls_D;
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  ALIGNED(16) u64 __msan_va_arg_tls_D[kMsanParamTlsSize / sizeof(u64)];
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  u64 __msan_va_arg_overflow_size_tls_D;
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  u32 __msan_origin_tls_D;
+};
+
+
+#define MsanTLSSlotStruct ((struct MsanTLSSlot*)(__get_tls()[TLS_SLOT_TSAN]))
+
+
+void EnsureTLSSlotInit(void);
+#endif // SANITIZER_ANDROID
+
+
 namespace __msan {
 extern int msan_inited;
 extern bool msan_init_is_running;

msan/msan.cc

 
 using namespace __sanitizer;
 
+#if !SANITIZER_ANDROID
 // Globals.
 static THREADLOCAL int msan_expect_umr = 0;
 static THREADLOCAL int msan_expected_umr_found = 0;

 THREADLOCAL u32 __msan_origin_tls;
 
 static THREADLOCAL int is_in_symbolizer;
+#endif // SANITIZER_ANDROID
 
 extern "C" SANITIZER_WEAK_ATTRIBUTE const int __msan_track_origins;
 

 
 namespace __msan {
 
+#if SANITIZER_ANDROID
+void EnterSymbolizer() { ++(MsanTLSSlotStruct->is_in_symbolizer_D); }
+void ExitSymbolizer()  { --(MsanTLSSlotStruct->is_in_symbolizer_D); }
+bool IsInSymbolizer() { return MsanTLSSlotStruct->is_in_symbolizer_D; }
+#else
 void EnterSymbolizer() { ++is_in_symbolizer; }
 void ExitSymbolizer()  { --is_in_symbolizer; }
 bool IsInSymbolizer() { return is_in_symbolizer; }
+#endif // SANITIZER_ANDROID
 
 static Flags msan_flags;
 

 }
 
 void PrintWarning(uptr pc, uptr bp) {
+#if SANITIZER_ANDROID
+  PrintWarningWithOrigin(pc, bp, MsanTLSSlotStruct->__msan_origin_tls_D);
+#else
   PrintWarningWithOrigin(pc, bp, __msan_origin_tls);
+#endif // SANITIZER_ANDROID
 }
 
 void PrintWarningWithOrigin(uptr pc, uptr bp, u32 origin) {
+#if SANITIZER_ANDROID
+  if (MsanTLSSlotStruct->msan_expect_umr_D) {
+    // Printf("Expected UMR\n");
+    MsanTLSSlotStruct->__msan_origin_tls_D = origin;
+    MsanTLSSlotStruct->msan_expected_umr_found_D = 1;
+    return;
+  }
+#else
   if (msan_expect_umr) {
     // Printf("Expected UMR\n");
     __msan_origin_tls = origin;

     msan_expected_umr_found = 1;
     return;
   }
+#endif // SANITIZER_ANDROID
 
   ++msan_report_count;
 

 }
 
 void UnpoisonParam(uptr n) {
+#if SANITIZER_ANDROID
+  internal_memset(MsanTLSSlotStruct->__msan_param_tls_D, 0, n * sizeof(*MsanTLSSlotStruct->__msan_param_tls_D));
+#else
   internal_memset(__msan_param_tls, 0, n * sizeof(*__msan_param_tls));
+#endif // SANITIZER_ANDROID
 }
 
+#if SANITIZER_ANDROID
 // Backup MSan runtime TLS state.
 // Implementation must be async-signal-safe.
 // Instances of this class may live on the signal handler stack, and data size
 // may be an issue.
 void ScopedThreadLocalStateBackup::Backup() {
+  va_arg_overflow_size_tls = MsanTLSSlotStruct->__msan_va_arg_overflow_size_tls_D;
+}
+
+void ScopedThreadLocalStateBackup::Restore() {
+  // A lame implementation that only keeps essential state and resets the rest.
+  MsanTLSSlotStruct->__msan_va_arg_overflow_size_tls_D = va_arg_overflow_size_tls;
+
+  internal_memset(MsanTLSSlotStruct->__msan_param_tls_D, 0, sizeof(MsanTLSSlotStruct->__msan_param_tls_D));
+  internal_memset(MsanTLSSlotStruct->__msan_retval_tls_D, 0, sizeof(MsanTLSSlotStruct->__msan_retval_tls_D));
+  internal_memset(MsanTLSSlotStruct->__msan_va_arg_tls_D, 0, sizeof(MsanTLSSlotStruct->__msan_va_arg_tls_D));
+
+  if (__msan_get_track_origins()) {
+    internal_memset(&MsanTLSSlotStruct->__msan_retval_origin_tls_D, 0,
+                    sizeof(MsanTLSSlotStruct->__msan_retval_origin_tls_D));
+    internal_memset(MsanTLSSlotStruct->__msan_param_origin_tls_D, 0,
+                    sizeof(MsanTLSSlotStruct->__msan_param_origin_tls_D));
+  }
+}
+#else
+// Backup MSan runtime TLS state.
+// Implementation must be async-signal-safe.
+// Instances of this class may live on the signal handler stack, and data size
+// may be an issue.
+void ScopedThreadLocalStateBackup::Backup() {
   va_arg_overflow_size_tls = __msan_va_arg_overflow_size_tls;
 }
 

                     sizeof(__msan_param_origin_tls));
   }
 }
+#endif // SANITIZER_ANDROID
 
 void UnpoisonThreadLocalState() {
 }

   Die();
 }
 
+#if SANITIZER_ANDROID
+u64* get__msan_param_tls0(void) {
+  return &(MsanTLSSlotStruct->__msan_param_tls_D [0]);
+}
+
+u32* get__msan_param_origin_tls0(void) {
+  return &(MsanTLSSlotStruct->__msan_param_origin_tls_D [0]);
+}
+
+u64* get__msan_retval_tls0(void) {
+  return &(MsanTLSSlotStruct->__msan_retval_tls_D [0]);
+}
+
+u32* get__msan_retval_origin_tls0(void) {
+  return &(MsanTLSSlotStruct->__msan_retval_origin_tls_D);
+}
+
+u64* get__msan_va_arg_tls0(void) {
+  return &(MsanTLSSlotStruct->__msan_va_arg_tls_D [0]);
+}
+
+u64* get__msan_va_arg_overflow_size_tls0(void) {
+  return &(MsanTLSSlotStruct->__msan_va_arg_overflow_size_tls_D);
+}
+
+u32* get__msan_origin_tls0(void) {
+  return &(MsanTLSSlotStruct->__msan_origin_tls_D);
+}
+
+void EnsureTLSSlotInit(void) {
+  if (__get_tls()[TLS_SLOT_TSAN] == nullptr) {
+    struct MsanTLSSlot* slot \
+      = (struct MsanTLSSlot*)MmapOrDie(sizeof (struct MsanTLSSlot), __func__);
+    CHECK_NE (slot, nullptr);
+    slot->dummy = 42;
+    slot->in_interceptor_scope_D = 0;
+    slot->is_in_symbolizer_D = 0;
+    slot->thread_D = nullptr;
+
+    __get_tls()[TLS_SLOT_TSAN] = slot;
+    VPrintf (0, "[EnsureTLSSlotInit] blah is at %p\n", slot);
+  }
+}
+#endif // SANITIZER_ANDROID
+
 void __msan_init() {
   CHECK(!msan_init_is_running);
   if (msan_inited) return;

   msan_init_is_running = 1;
   SanitizerToolName = "MemorySanitizer";
 
+#if SANITIZER_ANDROID
+  EnsureTLSSlotInit();
+#endif // SANITIZER_ANDROID
+
   AvoidCVE_2016_2143();
   InitTlsSize();
 

 
   VPrintf(1, "MemorySanitizer init done\n");
 
+#if SANITIZER_ANDROID
+  AndroidLogInit();
+#endif
+
   msan_init_is_running = 0;
   msan_inited = 1;
 }

 
 void __msan_set_expect_umr(int expect_umr) {
   if (expect_umr) {
+#if SANITIZER_ANDROID
+    MsanTLSSlotStruct->msan_expected_umr_found_D = 0;
+  } else if (!MsanTLSSlotStruct->msan_expected_umr_found_D) {
+#else
     msan_expected_umr_found = 0;
   } else if (!msan_expected_umr_found) {
+#endif // SANITIZER_ANDROID
     GET_CALLER_PC_BP_SP;
     (void)sp;
     GET_FATAL_STACK_TRACE_PC_BP(pc, bp);

     ReportExpectedUMRNotFound(&stack);
     Die();
   }
+#if SANITIZER_ANDROID
+  MsanTLSSlotStruct->msan_expect_umr_D = expect_umr;
+#else
   msan_expect_umr = expect_umr;
+#endif // SANITIZER_ANDROID
 }
 
 void __msan_print_shadow(const void *x, uptr size) {

 
 NOINLINE
 void __msan_clear_on_return() {
+#if SANITIZER_ANDROID
+  MsanTLSSlotStruct->__msan_param_tls_D[0] = 0;
+#else
   __msan_param_tls[0] = 0;
+#endif // SANITIZER_ANDROID
 }
 
 void __msan_partial_poison(const void* data, void* shadow, uptr size) {

   return o.raw_id() == prev_id;
 }
 
+#if SANITIZER_ANDROID
 u32 __msan_get_umr_origin() {
+  return MsanTLSSlotStruct->__msan_origin_tls_D;
+}
+
+u16 __sanitizer_unaligned_load16(const uu16 *p) {
+  MsanTLSSlotStruct->__msan_retval_tls_D[0] = *(uu16 *)MEM_TO_SHADOW((uptr)p);
+  if (__msan_get_track_origins())
+    MsanTLSSlotStruct->__msan_retval_origin_tls_D = GetOriginIfPoisoned((uptr)p, sizeof(*p));
+  return *p;
+}
+u32 __sanitizer_unaligned_load32(const uu32 *p) {
+  MsanTLSSlotStruct->__msan_retval_tls_D[0] = *(uu32 *)MEM_TO_SHADOW((uptr)p);
+  if (__msan_get_track_origins())
+    MsanTLSSlotStruct->__msan_retval_origin_tls_D = GetOriginIfPoisoned((uptr)p, sizeof(*p));
+  return *p;
+}
+u64 __sanitizer_unaligned_load64(const uu64 *p) {
+  MsanTLSSlotStruct->__msan_retval_tls_D[0] = *(uu64 *)MEM_TO_SHADOW((uptr)p);
+  if (__msan_get_track_origins())
+    MsanTLSSlotStruct->__msan_retval_origin_tls_D = GetOriginIfPoisoned((uptr)p, sizeof(*p));
+  return *p;
+}
+void __sanitizer_unaligned_store16(uu16 *p, u16 x) {
+  u16 s = MsanTLSSlotStruct->__msan_param_tls_D[1];
+  *(uu16 *)MEM_TO_SHADOW((uptr)p) = s;
+  if (s && __msan_get_track_origins())
+    if (uu32 o = MsanTLSSlotStruct->__msan_param_origin_tls_D[2])
+      SetOriginIfPoisoned((uptr)p, (uptr)&s, sizeof(s), o);
+  *p = x;
+}
+void __sanitizer_unaligned_store32(uu32 *p, u32 x) {
+  u32 s = MsanTLSSlotStruct->__msan_param_tls_D[1];
+  *(uu32 *)MEM_TO_SHADOW((uptr)p) = s;
+  if (s && __msan_get_track_origins())
+    if (uu32 o = MsanTLSSlotStruct->__msan_param_origin_tls_D[2])
+      SetOriginIfPoisoned((uptr)p, (uptr)&s, sizeof(s), o);
+  *p = x;
+}
+void __sanitizer_unaligned_store64(uu64 *p, u64 x) {
+  u64 s = MsanTLSSlotStruct->__msan_param_tls_D[1];
+  *(uu64 *)MEM_TO_SHADOW((uptr)p) = s;
+  if (s && __msan_get_track_origins())
+    if (uu32 o = MsanTLSSlotStruct->__msan_param_origin_tls_D[2])
+      SetOriginIfPoisoned((uptr)p, (uptr)&s, sizeof(s), o);
+  *p = x;
+}
+#else
+u32 __msan_get_umr_origin() {
   return __msan_origin_tls;
 }
 

       SetOriginIfPoisoned((uptr)p, (uptr)&s, sizeof(s), o);
   *p = x;
 }
+#endif // SANITIZER_ANDROID
 
+
 void __msan_set_death_callback(void (*callback)(void)) {
   SetUserDieCallback(callback);
 }

msan/msan_flags.inc

 MSAN_FLAG(bool, report_umrs, true, "")
 MSAN_FLAG(bool, wrap_signals, true, "")
 MSAN_FLAG(bool, print_stats, false, "")
+#if SANITIZER_ANDROID
+MSAN_FLAG(bool, halt_on_error, false, "")
+#else
 MSAN_FLAG(bool, halt_on_error, !&__msan_keep_going, "")
+#endif // SANITIZER_ANDROID
 MSAN_FLAG(bool, atexit, false, "")
 MSAN_FLAG(int, store_context_size, 20,
           "Like malloc_context_size, but for uninit stores.")

msan/msan_interceptors.cc

 #define __errno_location __error
 #endif
 
+#if SANITIZER_ANDROID
+// From bionic/libc/include/errno.h:
+// "internal function returning the address of the thread-specific errno"
+extern "C" volatile int* __errno(void);
+#define __errno_location (int*)__errno
+
+
+struct InterceptorScope {
+  InterceptorScope() {
+    EnsureTLSSlotInit();
+    ++(MsanTLSSlotStruct->in_interceptor_scope_D);
+  }
+
+  ~InterceptorScope() {
+    --(MsanTLSSlotStruct->in_interceptor_scope_D);
+  }
+};
+
+bool IsInInterceptorScope() {
+  EnsureTLSSlotInit();
+  return MsanTLSSlotStruct->in_interceptor_scope_D;
+}
+#else
 // True if this is a nested interceptor.
 static THREADLOCAL int in_interceptor_scope;
 

 bool IsInInterceptorScope() {
   return in_interceptor_scope;
 }
+#endif // SANITIZER_ANDROID
 
 #define ENSURE_MSAN_INITED() do { \
   CHECK(!msan_init_is_running); \

 extern "C" int pthread_attr_destroy(void *attr);
 
 static void *MsanThreadStartFunc(void *arg) {
+#if SANITIZER_ANDROID
+  EnsureTLSSlotInit();
+#endif // SANITIZER_ANDROID
+
   MsanThread *t = (MsanThread *)arg;
   SetCurrentThread(t);
   return t->ThreadStart();

 
 DECLARE_REAL(int, shmctl, int shmid, int cmd, void *buf)
 
+#if !SANITIZER_ANDROID
 INTERCEPTOR(void *, shmat, int shmid, const void *shmaddr, int shmflg) {
   ENSURE_MSAN_INITED();
   void *p = REAL(shmat)(shmid, shmaddr, shmflg);

   }
   return p;
 }
+#define MSAN_MAYBE_INTERCEPT_SHMAT INTERCEPT_FUNCTION(shmat)
+#else
+#define MSAN_MAYBE_INTERCEPT_SHMAT
+#endif // !SANITIZER_ANDROID
 
 static void BeforeFork() {
   StackDepotLockAll();

 #define COMMON_SYSCALL_POST_WRITE_RANGE(p, s) __msan_unpoison(p, s)
 #include "sanitizer_common/sanitizer_common_syscalls.inc"
 
+#if !SANITIZER_ANDROID
 struct dlinfo {
   char *dli_fname;
   void *dli_fbase;

   int res = REAL(dl_iterate_phdr)(msan_dl_iterate_phdr_cb, (void *)&cbdata);
   return res;
 }
+#endif // !SANITIZER_ANDROID
 
 // These interface functions reside here so that they can use
 // REAL(memset), etc.

   INTERCEPT_FUNCTION(gethostname);
   MSAN_MAYBE_INTERCEPT_EPOLL_WAIT;
   MSAN_MAYBE_INTERCEPT_EPOLL_PWAIT;
+#if !SANITIZER_ANDROID
   INTERCEPT_FUNCTION(dladdr);
   INTERCEPT_FUNCTION(dlerror);
   INTERCEPT_FUNCTION(dl_iterate_phdr);
+#endif // !SANITIZER_ANDROID
   INTERCEPT_FUNCTION(getrusage);
   INTERCEPT_FUNCTION(sigaction);
   INTERCEPT_FUNCTION(signal);

   INTERCEPT_FUNCTION(pthread_join);
   INTERCEPT_FUNCTION(tzset);
   INTERCEPT_FUNCTION(__cxa_atexit);
-  INTERCEPT_FUNCTION(shmat);
+  MSAN_MAYBE_INTERCEPT_SHMAT;
   INTERCEPT_FUNCTION(fork);
   INTERCEPT_FUNCTION(openpty);
   INTERCEPT_FUNCTION(forkpty);

msan/msan_interface_internal.h

 
 SANITIZER_INTERFACE_ATTRIBUTE
 void __msan_copy_shadow(void *dst, const void *src, uptr size);
+
+#if SANITIZER_ANDROID
+SANITIZER_INTERFACE_ATTRIBUTE
+u64* get__msan_param_tls0(void);
+
+SANITIZER_INTERFACE_ATTRIBUTE
+u32* get__msan_param_origin_tls0(void);
+
+SANITIZER_INTERFACE_ATTRIBUTE
+u64* get__msan_retval_tls0(void);
+
+SANITIZER_INTERFACE_ATTRIBUTE
+u32* get__msan_retval_origin_tls0(void);
+
+SANITIZER_INTERFACE_ATTRIBUTE
+u64* get__msan_va_arg_tls0(void);
+
+SANITIZER_INTERFACE_ATTRIBUTE
+u64* get__msan_va_arg_overflow_size_tls0(void);
+
+SANITIZER_INTERFACE_ATTRIBUTE
+u32* get__msan_origin_tls0(void);
+#endif // SANITIZER_ANDROID
+
 }  // extern "C"
 
 #endif  // MSAN_INTERFACE_INTERNAL_H

msan/msan_linux.cc

 #include <signal.h>
 #include <unistd.h>
 #include <unwind.h>
+
+#if !SANITIZER_ANDROID
 #include <execinfo.h>
+#endif // !SANITIZER_ANDROID
+
 #include <sys/time.h>
 #include <sys/resource.h>
 

 
 // ---------------------- TSD ---------------- {{{1
 
+#if !SANITIZER_ANDROID
 static pthread_key_t tsd_key;
+#endif // !SANITIZER_ANDROID
 static bool tsd_key_inited = false;
 
 void MsanTSDInit(void (*destructor)(void *tsd)) {
   CHECK(!tsd_key_inited);
   tsd_key_inited = true;
+#if !SANITIZER_ANDROID
   CHECK_EQ(0, pthread_key_create(&tsd_key, destructor));
+#endif // SANITIZER_ANDROID
 }
 
+#if !SANITIZER_ANDROID
 static THREADLOCAL MsanThread* msan_current_thread;
+#endif // SANITIZER_ANDROID
 
 MsanThread *GetCurrentThread() {
+#if SANITIZER_ANDROID
+  return MsanTLSSlotStruct->thread_D;
+#else
   return msan_current_thread;
+#endif // SANITIZER_ANDROID
 }
 
 void SetCurrentThread(MsanThread *t) {
   // Make sure we do not reset the current MsanThread.
+#if SANITIZER_ANDROID
+  CHECK_EQ(0, MsanTLSSlotStruct->thread_D);
+  MsanTLSSlotStruct->thread_D = t;
+#else
   CHECK_EQ(0, msan_current_thread);
   msan_current_thread = t;
+#endif // SANITIZER_ANDROID
   // Make sure that MsanTSDDtor gets called at the end.
   CHECK(tsd_key_inited);
+
+#if !SANITIZER_ANDROID
   pthread_setspecific(tsd_key, (void *)t);
+#endif // !SANITIZER_ANDROID
 }
 
 void MsanTSDDtor(void *tsd) {

   MsanThread *t = (MsanThread*)tsd;
   if (t->destructor_iterations_ > 1) {
     t->destructor_iterations_--;
+#if !SANITIZER_ANDROID
     CHECK_EQ(0, pthread_setspecific(tsd_key, tsd));
+#endif // SANITIZER_ANDROID
     return;
   }
+#if SANITIZER_ANDROID
+  MsanTLSSlotStruct->thread_D = nullptr;
+#else
   msan_current_thread = nullptr;
+#endif // SANITIZER_ANDROID
   // Make sure that signal handler can not see a stale current thread pointer.
   atomic_signal_fence(memory_order_seq_cst);
   MsanThread::TSDDtor(tsd);

msan/msan_poisoning.cc

 }
 
 void SetShadow(const void *ptr, uptr size, u8 value) {
+#if SANITIZER_ANDROID
+  if (msan_init_is_running || (!msan_inited)) {
+    return;
+  }
+#endif
+
   uptr PageSize = GetPageSizeCached();
   uptr shadow_beg = MEM_TO_SHADOW(ptr);
   uptr shadow_end = shadow_beg + size;

msan/msan_thread.cc

   __msan_unpoison((void *)stack_bottom_, stack_top_ - stack_bottom_);
   if (tls_begin_ != tls_end_)
     __msan_unpoison((void *)tls_begin_, tls_end_ - tls_begin_);
+#if !SANITIZER_ANDROID
   DTLS *dtls = DTLS_Get();
   CHECK_NE(dtls, 0);
   for (uptr i = 0; i < dtls->dtv_size; ++i)
     __msan_unpoison((void *)(dtls->dtv[i].beg), dtls->dtv[i].size);
+#endif // !SANITIZER_ANDROID
 }
 
 void MsanThread::Init() {

sanitizer_common/sanitizer_platform_limits_posix.h

 #if !SANITIZER_ANDROID
   extern unsigned struct_statfs_sz;
   extern unsigned struct_sockaddr_sz;
-  extern unsigned ucontext_t_sz;
 #endif // !SANITIZER_ANDROID
 
+  extern unsigned ucontext_t_sz;
+
 #if SANITIZER_LINUX
 
 #if defined(__x86_64__)

   struct __sanitizer_mallinfo {
     uptr v[10];
   };
+
+  extern unsigned struct_rlimit64_sz;
 #endif
 
 #if SANITIZER_LINUX && !SANITIZER_ANDROID

sanitizer_common/sanitizer_platform_limits_posix.cc

   unsigned struct_statfs_sz = sizeof(struct statfs);
   unsigned struct_sockaddr_sz = sizeof(struct sockaddr);
   unsigned ucontext_t_sz = sizeof(ucontext_t);
+#else
+  // Needed by msan for SignalAction()
+  unsigned ucontext_t_sz = sizeof(ucontext_t);
 #endif // !SANITIZER_ANDROID
 
 #if SANITIZER_LINUX

   unsigned struct_statvfs64_sz = sizeof(struct statvfs64);
 #endif // SANITIZER_LINUX && !SANITIZER_ANDROID
 
+#if SANITIZER_ANDROID
+  // Needed by msan for getrlimit64()
+  unsigned struct_rlimit64_sz = sizeof(struct rlimit64);
+#endif // SANITIZER_ANDROID
+
 #if (SANITIZER_LINUX || SANITIZER_FREEBSD) && !SANITIZER_ANDROID
   unsigned struct_timex_sz = sizeof(struct timex);
   unsigned struct_msqid_ds_sz = sizeof(struct msqid_ds);