[compiler-rt] [test] Disable ASLR on ASAN/MSAN/TSAN tests on NetBSD

[mgorny]

Summary

Use a new %run wrapper for ASAN/MSAN/TSAN tests that calls paxctl
in order to disable ASLR on the test executables. This makes it
possible to test sanitizers on systems where ASLR is enabled by default.

[eugenis]

Could this go into the common lit config in compiler-rt/test?
What is the problem with ASLR in NetBSD? Is this about fixed shadow location conflicts with the binary & library mappings?

[krytarowski]

In D70958#1767912, @eugenis wrote:

Could this go into the common lit config in compiler-rt/test?

Do you mean to run this for all tests in compiler-rt? We intend to disable it only when needed and prevent leaking regressions that violate ASLR to other components of LLVM.

What is the problem with ASLR in NetBSD? Is this about fixed shadow location conflicts with the binary & library mappings?

PaX ASLR on NetBSD is too aggressive with the layout randomization and we cannot predict ranges of the heap and the stack. Next, we cannot map reliably the memory used into shadow buffer that crashes in a cryptic way. We are fine with disabling ASLR for the sanitizers that need shadow buffers and origins.

compiler-rt/test/sanitizer_common/netbsd_commands/run_noaslr.sh

4

I propose to use /usr/bin/paxctl as it will be PATH and environment independent. We already use this direct path approach in pkgsrc.

[eugenis]

I meant you could define this path in the common lit config as something like "netbsd_noaslr_prefix" and then set up the %run substitution in subdirectories.

PaX ASLR on NetBSD is too aggressive with the layout randomization and we cannot predict ranges of the heap and the stack. Next, we cannot map reliably the memory used into shadow buffer that crashes in a cryptic way. We are fine with disabling ASLR for the sanitizers that need shadow buffers and origins.

Sounds good.

[mgorny]

In D70958#1769589, @eugenis wrote:

I meant you could define this path in the common lit config as something like "netbsd_noaslr_prefix" and then set up the %run substitution in subdirectories.

I take that you mean passing it on the config object?

[mgorny]

Updated to pass the 'prefix' via config object from common, and to use full path for paxctl.

[eugenis]

LGTM

compiler-rt/test/sanitizer_common/netbsd_commands/run_noaslr.sh

4

It this path correct? /usr/sbin in the code vs /usr/bin in the comment.

[krytarowski]

compiler-rt/test/sanitizer_common/netbsd_commands/run_noaslr.sh

4

It is correct. I made a typo.

compiler-rt/test/asan/lit.cfg.py

else:
   config.substitutions.append(('%pie', '-pie'))
 
 # Only run the tests on supported OSs.
 if config.host_os not in ['Linux', 'Darwin', 'FreeBSD', 'SunOS', 'Windows', 'NetBSD']:
   config.unsupported = True
 
 if not config.parallelism_group:
   config.parallelism_group = 'shadow-memory'
+
+if config.host_os == 'NetBSD':
+  nb_commands_dir = os.path.join(config.compiler_rt_src_root,
+                                 "test", "sanitizer_common", "netbsd_commands")
+  config.substitutions.insert(0,
+      ('%run', 'sh ' + os.path.join(nb_commands_dir, 'run_noaslr.sh')))

compiler-rt/test/msan/lit.cfg.py

 
 # For mips64, mips64el we have forced store_context_size to 1 because these
 # archs use slow unwinder which is not async signal safe. Therefore we only
 # check the first frame since store_context size is 1.
 if config.host_arch in ['mips64', 'mips64el']:
   config.substitutions.append( ('CHECK-%short-stack', 'CHECK-SHORT-STACK'))
 else:
   config.substitutions.append( ('CHECK-%short-stack', 'CHECK-FULL-STACK'))
+
+if config.host_os == 'NetBSD':
+  nb_commands_dir = os.path.join(config.compiler_rt_src_root,
+                                 "test", "sanitizer_common", "netbsd_commands")
+  config.substitutions.insert(0,
+      ('%run', 'sh ' + os.path.join(nb_commands_dir, 'run_noaslr.sh')))

compiler-rt/test/sanitizer_common/lit.common.cfg.py

 
 config.suffixes = ['.c', '.cpp']
 
 if config.host_os not in ['Linux', 'Darwin', 'NetBSD', 'FreeBSD']:
   config.unsupported = True
 
 if not config.parallelism_group:
   config.parallelism_group = 'shadow-memory'
+
+if config.host_os == 'NetBSD':
+  nb_commands_dir = os.path.join(config.compiler_rt_src_root,
+                                 "test", "sanitizer_common", "netbsd_commands")
+  config.substitutions.insert(0,
+      ('%run', 'sh ' + os.path.join(nb_commands_dir, 'run_noaslr.sh')))

compiler-rt/test/sanitizer_common/netbsd_commands/run_noaslr.sh

+#!/bin/sh
+# PATH needed for paxctl
+PATH=${PATH}:/usr/sbin
+paxctl +a "${1}"
+exec "${@}"

compiler-rt/test/tsan/lit.cfg.py

 if config.host_os not in ['FreeBSD', 'Linux', 'Darwin', 'NetBSD']:
   config.unsupported = True
 
 if config.android:
   config.unsupported = True
 
 if not config.parallelism_group:
   config.parallelism_group = 'shadow-memory'
+
+if config.host_os == 'NetBSD':
+  nb_commands_dir = os.path.join(config.compiler_rt_src_root,
+                                 "test", "sanitizer_common", "netbsd_commands")
+  config.substitutions.insert(0,
+      ('%run', 'sh ' + os.path.join(nb_commands_dir, 'run_noaslr.sh')))