[hwasan, asan] Intercept vfork.

[eugenis]

Summary

Intercept vfork on aarch64 and x86_64.

[eugenis]

This is the second attempt. It adds:

• a fix in __asan_handle_vfork
• a fix for win32 build
• a fix for mac build
• fixed .note.GNU-stack syntax that works with arm32 assembler
• x86_64 vfork interceptor

[vitalybuka]

compiler-rt/lib/asan/asan_interceptors.cc

664 ↗

(On Diff #187889)

Why can't this be ASAN_INTERCEPT_FUNC?

Same below for HWSAN

[eugenis]

fixed a bug in x86_64 version
added i386 and arm

[eugenis]

Hmm, this change somehow includes D58532 diff, too.

[eugenis]

...

[pcc]

compiler-rt/lib/hwasan/hwasan_interceptors.cc

273 ↗

(On Diff #188001)

Shouldn't it be only this line that is protected with the defined(__linux__)?

[eugenis]

.

[eugenis]

compiler-rt/lib/asan/asan_interceptors.cc

664 ↗

(On Diff #187889)

Done. I've had to add a new macro to interception.h to declare externally-defined interceptor/wrapper pair.
Wrapper can not be defined in this file because an alias can not target an external symbol.

[vitalybuka]

LGTM

[eugenis]

untabify asm files

[pcc]

LGTM

[phosek]

This broke our builders with the following error:

[630/630] Linking CXX shared library /b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/lib/clang/9.0.0/i386-linux-gnu/lib/libclang_rt.asan.so
FAILED: /b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/lib/clang/9.0.0/i386-linux-gnu/lib/libclang_rt.asan.so 
: && /b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/./bin/clang++ --target=i386-linux-gnu --sysroot=/b/s/w/ir/k/cipd/linux-i386 -fPIC -fPIC -fvisibility-inlines-hidden -Werror=date-time -Werror=unguarded-availability-new -std=c++11 -Wall -Wextra -Wno-unused-parameter -Wwrite-strings -Wcast-qual -Wmissing-field-initializers -Wimplicit-fallthrough -Wcovered-switch-default -Wno-noexcept-type -Wnon-virtual-dtor -Wdelete-non-virtual-dtor -Wstring-conversion -fdiagnostics-color -ffunction-sections -fdata-sections -Wall -std=c++11 -Wno-unused-parameter -O3 -DNDEBUG  -fuse-ld=lld  -Wl,-z,nodelete -Wl,--color-diagnostics   -nodefaultlibs -Wl,--version-script,/b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/runtimes/runtimes-i386-linux-gnu-bins/compiler-rt/lib/asan/clang_rt.asan-dynamic-i386.vers -shared -Wl,-soname,libclang_rt.asan.so -o /b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/lib/clang/9.0.0/i386-linux-gnu/lib/libclang_rt.asan.so compiler-rt/lib/interception/CMakeFiles/RTInterception.i386.dir/interception_linux.cc.o compiler-rt/lib/interception/CMakeFiles/RTInterception.i386.dir/interception_mac.cc.o compiler-rt/lib/interception/CMakeFiles/RTInterception.i386.dir/interception_win.cc.o compiler-rt/lib/interception/CMakeFiles/RTInterception.i386.dir/interception_type_test.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_allocator.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_common.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_deadlock_detector1.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_deadlock_detector2.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_errno.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_file.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_flags.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_flag_parser.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_fuchsia.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_libc.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_libignore.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_linux.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_linux_s390.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_mac.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_netbsd.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_openbsd.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_persistent_allocator.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_platform_limits_freebsd.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_platform_limits_linux.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_platform_limits_netbsd.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_platform_limits_openbsd.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_platform_limits_posix.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_platform_limits_solaris.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_posix.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_printf.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_procmaps_common.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_procmaps_bsd.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_procmaps_linux.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_procmaps_mac.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_procmaps_solaris.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_rtems.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_solaris.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_stoptheworld_mac.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_suppressions.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_tls_get_addr.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_thread_registry.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_type_traits.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_win.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_linux_x86_64.S.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_linux_mips64.S.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.i386.dir/sanitizer_termination.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonLibc.i386.dir/sanitizer_common_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonLibc.i386.dir/sanitizer_allocator_checks.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonLibc.i386.dir/sanitizer_linux_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonLibc.i386.dir/sanitizer_mac_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonLibc.i386.dir/sanitizer_posix_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonLibc.i386.dir/sanitizer_stoptheworld_linux_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonCoverage.i386.dir/sancov_flags.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonCoverage.i386.dir/sanitizer_coverage_fuchsia.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonCoverage.i386.dir/sanitizer_coverage_libcdep_new.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonCoverage.i386.dir/sanitizer_coverage_win_sections.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_allocator_report.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_stackdepot.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_stacktrace.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_stacktrace_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_stacktrace_printer.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_stacktrace_sparc.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_symbolizer.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_symbolizer_libbacktrace.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_symbolizer_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_symbolizer_mac.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_symbolizer_markup.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_symbolizer_posix_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_symbolizer_report.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_symbolizer_win.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_unwind_linux_libcdep.cc.o compiler-rt/lib/sanitizer_common/CMakeFiles/RTSanitizerCommonSymbolizer.i386.dir/sanitizer_unwind_win.cc.o compiler-rt/lib/lsan/CMakeFiles/RTLSanCommon.i386.dir/lsan_common.cc.o compiler-rt/lib/lsan/CMakeFiles/RTLSanCommon.i386.dir/lsan_common_linux.cc.o compiler-rt/lib/lsan/CMakeFiles/RTLSanCommon.i386.dir/lsan_common_mac.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan.i386.dir/ubsan_diag.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan.i386.dir/ubsan_init.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan.i386.dir/ubsan_flags.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan.i386.dir/ubsan_handlers.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan.i386.dir/ubsan_monitor.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan.i386.dir/ubsan_value.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_allocator.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_activation.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_debugging.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_descriptions.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_errors.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_fake_stack.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_flags.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_fuchsia.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_globals.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_globals_win.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_interceptors.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_interceptors_memintrinsics.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_linux.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_mac.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_malloc_linux.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_malloc_mac.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_malloc_win.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_memory_profile.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_poisoning.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_posix.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_premap_shadow.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_report.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_rtems.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_rtl.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_shadow_setup.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_stack.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_stats.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_suppressions.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_thread.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_win.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_interceptors_vfork.S.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_new_delete.cc.o compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic_version_script_dummy.i386.dir/dummy.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan_cxx.i386.dir/ubsan_handlers_cxx.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan_cxx.i386.dir/ubsan_type_hash.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan_cxx.i386.dir/ubsan_type_hash_itanium.cc.o compiler-rt/lib/ubsan/CMakeFiles/RTUbsan_cxx.i386.dir/ubsan_type_hash_win.cc.o -L/b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/lib/clang/9.0.0/i386-linux-gnu/lib  -L/b/s/w/ir/k/cipd/linux-i386/usr/lib/gcc/i586-linux-gnu/4.9  -L/b/s/w/ir/k/cipd/linux-i386/usr/lib/i386-linux-gnu  -L/b/s/w/ir/k/cipd/linux-i386/lib/i386-linux-gnu  -L/b/s/w/ir/k/cipd/linux-i386/usr/lib  -L/b/s/w/ir/k/cipd/linux-i386/lib -Wl,-rpath,"\$ORIGIN/../lib:/b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/./lib" /b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/lib/clang/9.0.0/i386-linux-gnu/lib/libunwind.a /b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/lib/clang/9.0.0/i386-linux-gnu/lib/libc++abi.a /b/s/w/ir/k/recipe_cleanup/clangv6gSby/llvm_build_dir/lib/clang/9.0.0/i386-linux-gnu/lib/libclang_rt.builtins.a -lc -ldl -lrt -lm -lpthread -lc && :
ld.lld: error: can't create dynamic relocation R_386_32 against symbol: __interception::real_vfork in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_interceptors.cc.o
>>> referenced by sanitizer_common_interceptors_vfork_i386.inc.S:17 (/b/s/w/ir/k/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_vfork_i386.inc.S:17)
>>>               compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_interceptors_vfork.S.o:(vfork)

ld.lld: error: relocation R_386_PC32 cannot be used against symbol __asan_handle_vfork; recompile with -fPIC
>>> defined in compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_rtl.cc.o
>>> referenced by sanitizer_common_interceptors_vfork_i386.inc.S:34 (/b/s/w/ir/k/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_vfork_i386.inc.S:34)
>>>               compiler-rt/lib/asan/CMakeFiles/RTAsan_dynamic.i386.dir/asan_interceptors_vfork.S.o:(vfork)
clang-9: error: linker command failed with exit code 1 (use -v to see invocation)
ninja: build stopped: subcommand failed.

The full log can be seen here

[eugenis]

Thanks, I'll fix it in a moment.

[eugenis]

r355064 should do this.

[eugenis]

And D58755 to make sure this never happens again.

[phosek]

In D58533#1413078, @eugenis wrote:

r355064 should do this.

That did it, thanks for a quick fix!

[Hahnfeld]

lib/hwasan/hwasan.cpp

491

This fails test/hwasan/TestCases/Linux/vfork.c for me with ulimit -s unlimited (or anything larger than ulimit -s 131072). What's the best solution here?

[eugenis]

lib/hwasan/hwasan.cpp

491

Thanks for bringing this up!
I've removed the failing check in https://reviews.llvm.org/rL355137

[Hahnfeld]

lib/hwasan/hwasan.cpp

491

Thanks for your fast fix, it also works for me now :-)

include/sanitizer/hwasan_interface.h

#endif
 
   // Set memory tag from the current SP address to the given address to zero.
   // This is meant to annotate longjmp and other non-local jumps.
   // This function needs to know the (almost) exact destination frame address;
   // clearing shadow for the entire thread stack like __asan_handle_no_return
   // does would cause false reports.
   void __hwasan_handle_longjmp(const void *sp_dst);
 
+  // Set memory tag for the part of the current thread stack below sp_dst to
+  // zero. Call this in vfork() before returning in the parent process.
+  void __hwasan_handle_vfork(const void *sp_dst);
+
   // Libc hook for thread creation. Should be called in the child thread before
   // any instrumented code.
   void __hwasan_thread_enter();
 
   // Libc hook for thread destruction. No instrumented code should run after
   // this call.
   void __hwasan_thread_exit();
 
   // Print shadow and origin for the memory range to stderr in a human-readable
   // format.
   void __hwasan_print_shadow(const volatile void *x, size_t size);
 
   // Print one-line report about the memory usage of the current process.
   void __hwasan_print_memory_usage();
 
+  /* Returns the offset of the first byte in the memory range that can not be
+   * accessed through the pointer in x, or -1 if the whole range is good. */
+  intptr_t __hwasan_test_shadow(const volatile void *x, size_t size);
+
   int __sanitizer_posix_memalign(void **memptr, size_t alignment, size_t size);
   void * __sanitizer_memalign(size_t alignment, size_t size);
   void * __sanitizer_aligned_alloc(size_t alignment, size_t size);
   void * __sanitizer___libc_memalign(size_t alignment, size_t size);
   void * __sanitizer_valloc(size_t size);
   void * __sanitizer_pvalloc(size_t size);
   void __sanitizer_free(void *ptr);
   void __sanitizer_cfree(void *ptr);

lib/asan/CMakeLists.txt

set(ASAN_SOURCES
   asan_rtl.cc
   asan_shadow_setup.cc
   asan_stack.cc
   asan_stats.cc
   asan_suppressions.cc
   asan_thread.cc
   asan_win.cc)
 
+if (NOT WIN32)
+  list(APPEND ASAN_SOURCES asan_interceptors_vfork.S)
+endif()
+
 set(ASAN_CXX_SOURCES
   asan_new_delete.cc)
 
 set(ASAN_PREINIT_SOURCES
   asan_preinit.cc)
 
 SET(ASAN_HEADERS
   asan_activation.h

lib/asan/asan_interceptors.cc

 #endif
   ENSURE_ASAN_INITED();
   int res = REAL(__cxa_atexit)(func, arg, dso_handle);
   REAL(__cxa_atexit)(AtCxaAtexit, nullptr, nullptr);
   return res;
 }
 #endif  // ASAN_INTERCEPT___CXA_ATEXIT
 
+#if defined(__linux__)
+DEFINE_REAL(int, vfork);
+DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(int, vfork);
+#endif
+
 // ---------------------- InitializeAsanInterceptors ---------------- {{{1
 namespace __asan {
 void InitializeAsanInterceptors() {
   static bool was_called_once;
   CHECK(!was_called_once);
   was_called_once = true;
   InitializeCommonInterceptors();
   InitializeSignalInterceptors();
#endif
   ASAN_INTERCEPT_FUNC(pthread_join);
 #endif
 
   // Intercept atexit function.
 #if ASAN_INTERCEPT___CXA_ATEXIT
   ASAN_INTERCEPT_FUNC(__cxa_atexit);
 #endif
 
+#if defined(__linux__)
+  ASAN_INTERCEPT_FUNC(vfork);
+#endif
+
   InitializePlatformInterceptors();
 
   VReport(1, "AddressSanitizer: libc interceptors initialized\n");
 }
 
 } // namespace __asan
 
 #endif  // !SANITIZER_FUCHSIA

lib/asan/asan_interceptors_vfork.S

+#include "sanitizer_common/sanitizer_asm.h"
+
+#if defined(__linux__)
+#define COMMON_INTERCEPTOR_SPILL_AREA __asan_extra_spill_area
+#define COMMON_INTERCEPTOR_HANDLE_VFORK __asan_handle_vfork
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_aarch64.inc.S"
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_arm.inc.S"
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_x86_64.inc.S"
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_i386.inc.S"
+#endif
+
+NO_EXEC_STACK_DIRECTIVE

lib/asan/asan_interface.inc

 INTERFACE_FUNCTION(__asan_get_report_access_type)
 INTERFACE_FUNCTION(__asan_get_report_address)
 INTERFACE_FUNCTION(__asan_get_report_bp)
 INTERFACE_FUNCTION(__asan_get_report_description)
 INTERFACE_FUNCTION(__asan_get_report_pc)
 INTERFACE_FUNCTION(__asan_get_report_sp)
 INTERFACE_FUNCTION(__asan_get_shadow_mapping)
 INTERFACE_FUNCTION(__asan_handle_no_return)
+INTERFACE_FUNCTION(__asan_handle_vfork)
 INTERFACE_FUNCTION(__asan_init)
 INTERFACE_FUNCTION(__asan_load_cxx_array_cookie)
 INTERFACE_FUNCTION(__asan_load1)
 INTERFACE_FUNCTION(__asan_load2)
 INTERFACE_FUNCTION(__asan_load4)
 INTERFACE_FUNCTION(__asan_load8)
 INTERFACE_FUNCTION(__asan_load16)
 INTERFACE_FUNCTION(__asan_loadN)

lib/asan/asan_interface_internal.h

extern "C" {
   void __asan_unpoison_intra_object_redzone(uptr p, uptr size);
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_alloca_poison(uptr addr, uptr size);
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_allocas_unpoison(uptr top, uptr bottom);
 
   SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
   const char* __asan_default_suppressions();
+
+  SANITIZER_INTERFACE_ATTRIBUTE void __asan_handle_vfork(void *sp);
 }  // extern "C"
 
 #endif  // ASAN_INTERFACE_INTERNAL_H

lib/asan/asan_rtl.cc

Report("WARNING: ASan is ignoring requested __asan_handle_no_return: "
            top, bottom, top - bottom, top - bottom);
     return;
   }
   PoisonShadow(bottom, top - bottom, 0);
   if (curr_thread && curr_thread->has_fake_stack())
     curr_thread->fake_stack()->HandleNoReturn();
 }
 
+extern "C" void *__asan_extra_spill_area() {
+  AsanThread *t = GetCurrentThread();
+  CHECK(t);
+  return t->extra_spill_area();
+}
+
+void __asan_handle_vfork(void *sp) {
+  AsanThread *t = GetCurrentThread();
+  CHECK(t);
+  uptr bottom = t->stack_bottom();
+  PoisonShadow(bottom, (uptr)sp - bottom, 0);
+}
+
 void NOINLINE __asan_set_death_callback(void (*callback)(void)) {
   SetUserDieCallback(callback);
 }
 
 // Initialize as requested from instrumented application code.
 // We use this call as a trigger to wake up ASan from deactivated state.
 void __asan_init() {
   AsanActivate();
   AsanInitInternal();
 }
 
 void __asan_version_mismatch_check() {
   // Do nothing.
 }

lib/asan/asan_thread.h

public:
   // trace). Used to prevent deadlocks on platforms where libc unwinder calls
   // malloc internally. See PR17116 for more details.
   bool isUnwinding() const { return unwinding_; }
   void setUnwinding(bool b) { unwinding_ = b; }
 
   AsanThreadLocalMallocStorage &malloc_storage() { return malloc_storage_; }
   AsanStats &stats() { return stats_; }
 
+  void *extra_spill_area() { return &extra_spill_area_; }
+
  private:
   // NOTE: There is no AsanThread constructor. It is allocated
   // via mmap() and *must* be valid in zero-initialized state.
 
   void SetThreadStackAndTls(const InitOptions *options);
 
   void ClearShadowForThreadStackAndTLS();
   FakeStack *AsyncSignalSafeLazyInitFakeStack();
private:
   uptr tls_begin_;
   uptr tls_end_;
   DTLS *dtls_;
 
   FakeStack *fake_stack_;
   AsanThreadLocalMallocStorage malloc_storage_;
   AsanStats stats_;
   bool unwinding_;
+  uptr extra_spill_area_;
 };
 
 // ScopedUnwinding is a scope for stacktracing member of a context
 class ScopedUnwinding {
  public:
   explicit ScopedUnwinding(AsanThread *t) : thread(t) {
     t->setUnwinding(true);
   }

lib/hwasan/CMakeLists.txt

 include_directories(..)
 
 # Runtime library sources and build flags.
 set(HWASAN_RTL_SOURCES
   hwasan.cpp
   hwasan_allocator.cpp
   hwasan_dynamic_shadow.cpp
   hwasan_interceptors.cpp
+  hwasan_interceptors_vfork.S
   hwasan_linux.cpp
   hwasan_memintrinsics.cpp
   hwasan_poisoning.cpp
   hwasan_report.cpp
   hwasan_thread.cpp
   hwasan_thread_list.cpp
   )
 

lib/hwasan/hwasan.cpp

Report(
         "stack top: %p; target %p; distance: %p (%zd)\n"
         "False positive error reports may follow\n",
         (void *)sp, (void *)dst, dst - sp);
     return;
   }
   TagMemory(sp, dst - sp, 0);
 }
 
+void __hwasan_handle_vfork(const void *sp_dst) {
+  uptr sp = (uptr)sp_dst;
+  Thread *t = GetCurrentThread();
+  CHECK(t);
+  uptr top = t->stack_top();
+  uptr bottom = t->stack_bottom();
+  static const uptr kMaxExpectedCleanupSize = 64 << 20;  // 64M
+  if (top == 0 || bottom == 0 || sp < bottom || sp >= top ||
+      sp - bottom > kMaxExpectedCleanupSize) {
+    Report(
+        "WARNING: HWASan is ignoring requested __hwasan_handle_vfork: "
+        "stack top: %zx; current %zx; bottom: %zx \n"
+        "False positive error reports may follow\n",
+        top, sp, bottom);
+    return;
+  }
+  TagMemory(bottom, sp - bottom, 0);
+}
+
+extern "C" void *__hwasan_extra_spill_area() {
+  Thread *t = GetCurrentThread();
+  return &t->vfork_spill();
+}
+
 void __hwasan_print_memory_usage() {
   InternalScopedString s(kMemoryUsageBufferSize);
   HwasanFormatMemoryUsage(s);
   Printf("%s\n", s.data());
 }
 
 static const u8 kFallbackTag = 0xBB;
 

lib/hwasan/hwasan_interceptors.cpp

INTERCEPTOR(int, pthread_create, void *th, void *attr,
             void *(*callback)(void *), void *param) {
   ScopedTaggingDisabler disabler;
   int res = REAL(pthread_create)(UntagPtr(th), UntagPtr(attr),
                                  callback, param);
   return res;
 }
 #endif
 
+#if HWASAN_WITH_INTERCEPTORS
+DEFINE_REAL(int, vfork);
+DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(int, vfork);
+#endif
+
 static void BeforeFork() {
   StackDepotLockAll();
 }
 
 static void AfterFork() {
   StackDepotUnlockAll();
 }
 

 
 void InitializeInterceptors() {
   static int inited = 0;
   CHECK_EQ(inited, 0);
 
   INTERCEPT_FUNCTION(fork);
 
 #if HWASAN_WITH_INTERCEPTORS
+#if defined(__linux__)
+  INTERCEPT_FUNCTION(vfork);
+#endif  // __linux__
 #if !defined(__aarch64__)
   INTERCEPT_FUNCTION(pthread_create);
-#endif
+#endif  // __aarch64__
   INTERCEPT_FUNCTION(realloc);
   INTERCEPT_FUNCTION(free);
 #endif
 
   inited = 1;
 }
 } // namespace __hwasan

lib/hwasan/hwasan_interceptors_vfork.S

+#include "sanitizer_common/sanitizer_asm.h"
+
+#if defined(__linux__)
+#define COMMON_INTERCEPTOR_SPILL_AREA __hwasan_extra_spill_area
+#define COMMON_INTERCEPTOR_HANDLE_VFORK __hwasan_handle_vfork
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_aarch64.inc.S"
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_x86_64.inc.S"
+#endif
+
+NO_EXEC_STACK_DIRECTIVE

lib/hwasan/hwasan_interface_internal.h

 
 SANITIZER_INTERFACE_ATTRIBUTE
 void __hwasan_print_shadow(const void *x, uptr size);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void __hwasan_handle_longjmp(const void *sp_dst);
 
 SANITIZER_INTERFACE_ATTRIBUTE
+void __hwasan_handle_vfork(const void *sp_dst);
+
+SANITIZER_INTERFACE_ATTRIBUTE
 u16 __sanitizer_unaligned_load16(const uu16 *p);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 u32 __sanitizer_unaligned_load32(const uu32 *p);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 u64 __sanitizer_unaligned_load64(const uu64 *p);
 

lib/hwasan/hwasan_thread.h

public:
 
   u64 unique_id() const { return unique_id_; }
   void Announce() {
     if (announced_) return;
     announced_ = true;
     Print("Thread: ");
   }
 
+  uptr &vfork_spill() { return vfork_spill_; }
+
  private:
   // NOTE: There is no Thread constructor. It is allocated
   // via mmap() and *must* be valid in zero-initialized state.
   void ClearShadowForThreadStackAndTLS();
   void Print(const char *prefix);
+  uptr vfork_spill_;
   uptr stack_top_;
   uptr stack_bottom_;
   uptr tls_begin_;
   uptr tls_end_;
 
   unsigned in_signal_handler_;
   unsigned in_symbolizer_;
   unsigned in_interceptor_scope_;

lib/interception/interception.h

 #else  // SANITIZER_MAC
 # define REAL(x) x
 # define DECLARE_REAL(ret_type, func, ...) \
     extern "C" ret_type func(__VA_ARGS__);
 # define ASSIGN_REAL(x, y)
 #endif  // SANITIZER_MAC
 
 #if !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
-#define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \
+# define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \
   DECLARE_REAL(ret_type, func, __VA_ARGS__) \
   extern "C" ret_type WRAP(func)(__VA_ARGS__);
+// Declare an interceptor and its wrapper defined in a different translation
+// unit (ex. asm).
+# define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...)    \
+  extern "C" ret_type WRAP(func)(__VA_ARGS__); \
+  extern "C" ret_type func(__VA_ARGS__);
 #else
-#define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...)
+# define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...)
+# define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...)
 #endif
 
 // Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR
 // macros does its job. In exceptional cases you may need to call REAL(foo)
 // without defining INTERCEPTOR(..., foo, ...). For example, if you override
 // foo with an interceptor for other function.
 #if !SANITIZER_MAC && !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
 # define DEFINE_REAL(ret_type, func, ...) \

lib/sanitizer_common/CMakeLists.txt

set(SANITIZER_IMPL_HEADERS
   sanitizer_atomic_clang_x86.h
   sanitizer_atomic_msvc.h
   sanitizer_bitvector.h
   sanitizer_bvgraph.h
   sanitizer_common.h
   sanitizer_common_interceptors.inc
   sanitizer_common_interceptors_format.inc
   sanitizer_common_interceptors_ioctl.inc
+  sanitizer_common_interceptors_vfork_aarch64.inc.S
   sanitizer_common_interface.inc
   sanitizer_common_interface_posix.inc
   sanitizer_common_syscalls.inc
   sanitizer_coverage_interface.inc
   sanitizer_dbghelp.h
   sanitizer_deadlock_detector.h
   sanitizer_deadlock_detector_interface.h
   sanitizer_errno.h

lib/sanitizer_common/sanitizer_asm.h

 # define CFI_OFFSET(reg, n)
 # define CFI_DEF_CFA_REGISTER(reg)
 # define CFI_DEF_CFA(reg, n)
 # define CFI_RESTORE(reg)
 #endif
 
 #if !defined(__APPLE__)
 # define ASM_HIDDEN(symbol) .hidden symbol
-# define ASM_TYPE_FUNCTION(symbol) .type symbol, @function
+# define ASM_TYPE_FUNCTION(symbol) .type symbol, %function
 # define ASM_SIZE(symbol) .size symbol, .-symbol
 # define ASM_SYMBOL(symbol) symbol
 # define ASM_SYMBOL_INTERCEPTOR(symbol) symbol
+# define ASM_WRAPPER_NAME(symbol) __interceptor_##symbol
 #else
 # define ASM_HIDDEN(symbol)
 # define ASM_TYPE_FUNCTION(symbol)
 # define ASM_SIZE(symbol)
 # define ASM_SYMBOL(symbol) _##symbol
 # define ASM_SYMBOL_INTERCEPTOR(symbol) _wrap_##symbol
+# define ASM_WRAPPER_NAME(symbol) __interceptor_##symbol
 #endif
 
 #if defined(__ELF__) && (defined(__GNU__) || defined(__FreeBSD__) || \
                          defined(__Fuchsia__) || defined(__linux__))
 #define NO_EXEC_STACK_DIRECTIVE .section .note.GNU-stack,"",%progbits // NOLINT
 #else
 #define NO_EXEC_STACK_DIRECTIVE
 #endif

lib/sanitizer_common/sanitizer_common_interceptors_vfork_aarch64.inc.S

+#if defined(__aarch64__) && defined(__linux__)
+
+#include "sanitizer_common/sanitizer_asm.h"
+
+ASM_HIDDEN(COMMON_INTERCEPTOR_SPILL_AREA)
+
+.comm _ZN14__interception10real_vforkE,8,8
+.globl ASM_WRAPPER_NAME(vfork)
+ASM_TYPE_FUNCTION(ASM_WRAPPER_NAME(vfork))
+ASM_WRAPPER_NAME(vfork):
+        // Save x30 in the off-stack spill area.
+        stp     xzr, x30, [sp, #-16]!
+        bl      COMMON_INTERCEPTOR_SPILL_AREA
+        ldp     xzr, x30, [sp], 16
+        str     x30, [x0]
+
+        // Call real vfork. This may return twice. User code that runs between the first and the second return
+        // may clobber the stack frame of the interceptor; that's why it does not have a frame.
+        adrp    x0, _ZN14__interception10real_vforkE
+        ldr     x0, [x0, :lo12:_ZN14__interception10real_vforkE]
+        blr     x0
+
+        stp     x0, xzr, [sp, #-16]!
+        cmp     x0, #0
+        b.eq   .L_exit
+
+        // x0 != 0 => parent process. Clear stack shadow.
+        add    x0, sp, #16
+        bl     COMMON_INTERCEPTOR_HANDLE_VFORK
+
+.L_exit:
+        // Restore x30.
+        bl     COMMON_INTERCEPTOR_SPILL_AREA
+        ldr    x30, [x0]
+        ldp    x0, xzr, [sp], 16
+
+        ret
+ASM_SIZE(vfork)
+
+.weak vfork
+.set vfork, ASM_WRAPPER_NAME(vfork)
+
+#endif

lib/sanitizer_common/sanitizer_common_interceptors_vfork_arm.inc.S

+#if defined(__arm__) && defined(__linux__)
+
+#include "sanitizer_common/sanitizer_asm.h"
+
+ASM_HIDDEN(COMMON_INTERCEPTOR_SPILL_AREA)
+
+.comm _ZN14__interception10real_vforkE,4,4
+.globl ASM_WRAPPER_NAME(vfork)
+ASM_TYPE_FUNCTION(ASM_WRAPPER_NAME(vfork))
+ASM_WRAPPER_NAME(vfork):
+        // Save LR in the off-stack spill area.
+        push    {r4, lr}
+        bl      COMMON_INTERCEPTOR_SPILL_AREA
+        pop     {r4, lr}
+        str     lr, [r0]
+
+        // Call real vfork. This may return twice. User code that runs between the first and the second return
+        // may clobber the stack frame of the interceptor; that's why it does not have a frame.
+        ldr     r0, .LCPI0_0
+.LPC0_0:
+        ldr     r0, [pc, r0]
+        mov     lr, pc
+        bx      r0
+
+        push    {r0, r4}
+        cmp     r0, #0
+        beq     .L_exit
+
+        // r0 != 0 => parent process. Clear stack shadow.
+        add     r0, sp, #8
+        bl      COMMON_INTERCEPTOR_HANDLE_VFORK
+
+.L_exit:
+        // Restore LR.
+        bl      COMMON_INTERCEPTOR_SPILL_AREA
+        ldr     lr, [r0]
+        pop     {r0, r4}
+
+        mov     pc, lr
+
+.LCPI0_0:
+        .long   _ZN14__interception10real_vforkE - (.LPC0_0+8)
+
+ASM_SIZE(vfork)
+
+.weak vfork
+.set vfork, ASM_WRAPPER_NAME(vfork)
+
+#endif

lib/sanitizer_common/sanitizer_common_interceptors_vfork_i386.inc.S

+#if defined(__i386__) && defined(__linux__)
+
+#include "sanitizer_common/sanitizer_asm.h"
+
+.comm _ZN14__interception10real_vforkE,4,4
+.globl ASM_WRAPPER_NAME(vfork)
+ASM_TYPE_FUNCTION(ASM_WRAPPER_NAME(vfork))
+ASM_WRAPPER_NAME(vfork):
+        // Store return address in the spill area and tear down the stack frame.
+        sub     $12, %esp
+        call    COMMON_INTERCEPTOR_SPILL_AREA
+        mov     12(%esp), %ecx
+        mov     %ecx, (%eax)
+        add     $16, %esp
+
+
+        call    *_ZN14__interception10real_vforkE
+
+        // Restore return address from the spill area.
+        sub     $16, %esp
+        mov     %eax, 4(%esp)
+        call    COMMON_INTERCEPTOR_SPILL_AREA
+        mov     (%eax), %ecx
+        mov     %ecx, 12(%esp)
+        mov     4(%esp), %eax
+
+
+        // Call handle_vfork in the parent process (%rax != 0).
+        test    %eax, %eax
+        je      .L_exit
+
+        lea     16(%esp), %ecx
+        mov     %ecx, (%esp)
+        call    COMMON_INTERCEPTOR_HANDLE_VFORK
+
+.L_exit:
+        mov     4(%esp), %eax
+        add     $12, %esp
+        ret
+ASM_SIZE(vfork)
+
+.weak vfork
+.set vfork, ASM_WRAPPER_NAME(vfork)
+
+#endif

lib/sanitizer_common/sanitizer_common_interceptors_vfork_x86_64.inc.S

+#if defined(__x86_64__) && defined(__linux__)
+
+#include "sanitizer_common/sanitizer_asm.h"
+
+.comm _ZN14__interception10real_vforkE,8,8
+.globl ASM_WRAPPER_NAME(vfork)
+ASM_TYPE_FUNCTION(ASM_WRAPPER_NAME(vfork))
+ASM_WRAPPER_NAME(vfork):
+        // Store return address in the spill area and tear down the stack frame.
+        push    %rcx
+        call    COMMON_INTERCEPTOR_SPILL_AREA
+        pop     %rcx
+        pop     %rdi
+        mov     %rdi, (%rax)
+
+        call    *_ZN14__interception10real_vforkE(%rip)
+
+        // Restore return address from the spill area.
+        push    %rcx
+        push    %rax
+        call    COMMON_INTERCEPTOR_SPILL_AREA
+        mov     (%rax), %rdx
+        mov     %rdx, 8(%rsp)
+        mov     (%rsp), %rax
+
+        // Call handle_vfork in the parent process (%rax != 0).
+        test    %rax, %rax
+        je      .L_exit
+
+        lea     16(%rsp), %rdi
+        call    COMMON_INTERCEPTOR_HANDLE_VFORK
+
+.L_exit:
+        pop     %rax
+        ret
+ASM_SIZE(vfork)
+
+.weak vfork
+.set vfork, ASM_WRAPPER_NAME(vfork)
+
+#endif

test/asan/TestCases/Linux/vfork.cc

+// https://github.com/google/sanitizers/issues/925
+// RUN: %clang_asan -O0 %s -o %t && %run %t 2>&1
+
+// REQUIRES: aarch64-target-arch || x86_64-target-arch || i386-target-arch || arm-target-arch
+
+#include <assert.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <sanitizer/asan_interface.h>
+
+__attribute__((noinline, no_sanitize("address"))) void child() {
+  alignas(8) char x[100000];
+  __asan_poison_memory_region(x, sizeof(x));
+  _exit(0);
+}
+
+__attribute__((noinline, no_sanitize("address"))) void parent() {
+  alignas(8) char x[100000];
+  assert(__asan_address_is_poisoned(x + 5000) == 0);
+}
+
+int main(int argc, char **argv) {
+  if (vfork())
+    parent();
+  else
+    child();
+
+  return 0;
+}

test/hwasan/TestCases/Linux/vfork.c

+// https://github.com/google/sanitizers/issues/925
+// RUN: %clang_hwasan -O0 %s -o %t && %run %t 2>&1
+
+// REQUIRES: aarch64-target-arch || x86_64-target-arch
+
+#include <assert.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <sanitizer/hwasan_interface.h>
+
+__attribute__((noinline, no_sanitize("hwaddress"))) void child() {
+  char x[10000];
+  __hwasan_tag_memory(x, 0xAA, sizeof(x));
+  _exit(0);
+}
+
+__attribute__((noinline, no_sanitize("hwaddress"))) void parent() {
+  char x[10000];
+  __hwasan_print_shadow(&x, sizeof(x));
+  assert(__hwasan_test_shadow(x, sizeof(x)) == -1);
+}
+
+int main(int argc, char **argv) {
+  if (vfork())
+    parent();
+  else
+    child();
+
+  return 0;
+}