From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Thu, 12 Mar 2020 22:46:11 +0000 (+0100)
Subject: toolchain: Allow building with ASAN and UBSAN
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=refs%2Fheads%2Fsanitizer;p=openwrt%2Fstaging%2Fhauke.git

toolchain: Allow building with ASAN and UBSAN

This allows to build all user space with Address sanitizer and undefined
behavior sanitizer. It will automatically add this to the TRAGET_CFLAGS
and TARGET_LDFLAGS of every user space component.

This is only working with gcc 10.X, because the system init process will
mount /proc after it was started and ASAN needs it already earlier and
fails in the versions provided by older compilers.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---

diff --git a/config/Config-build.in b/config/Config-build.in
index 0aaf6b31c3..7ecef38832 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -388,4 +388,26 @@ menu "Global build settings"
 
 	endchoice
 
+	config PKG_SANITIZER_ADDRESS
+		bool "Enable Address Sanitizer"
+		depends on USE_GLIBC
+		select PACKAGE_libasan
+		select USE_SANITIZER_ADDRESS
+		help
+		  This will build all user space applications with the Address Sanitizer enabled
+
+	config PKG_SANITIZER_UNDEFINED_BEHAVIOR
+		bool "Enable undefined behavior Sanitizer"
+		depends on USE_GLIBC
+		select PACKAGE_libubsan
+		select USE_SANITIZER_UNDEFINED_BEHAVIOR
+		help
+		  This will build all user space applications with the undefined behavior Sanitizer enabled
+
+	config USE_SANITIZER_ADDRESS
+		bool
+
+	config USE_SANITIZER_UNDEFINED_BEHAVIOR
+		bool
+
 endmenu
diff --git a/include/hardening.mk b/include/hardening.mk
index 4e49e6b1b9..be2271bd89 100644
--- a/include/hardening.mk
+++ b/include/hardening.mk
@@ -11,6 +11,8 @@ PKG_ASLR_PIE_REGULAR ?= 0
 PKG_SSP ?= 1
 PKG_FORTIFY_SOURCE ?= 1
 PKG_RELRO ?= 1
+PKG_SANITIZER_ADDRESS ?= 1
+PKG_SANITIZER_UNDEFINED_BEHAVIOR ?= 1
 
 ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY
   ifeq ($(strip $(PKG_CHECK_FORMAT_SECURITY)),1)
@@ -61,4 +63,16 @@ ifdef CONFIG_PKG_RELRO_FULL
     TARGET_LDFLAGS += -znow -zrelro
   endif
 endif
+ifdef CONFIG_PKG_SANITIZER_ADDRESS
+  ifeq ($(strip $(PKG_SANITIZER_ADDRESS)),1)
+    TARGET_CFLAGS += -fsanitize=address
+    TARGET_LDFLAGS += -fsanitize=address
+  endif
+endif
+ifdef CONFIG_PKG_SANITIZER_UNDEFINED_BEHAVIOR
+  ifeq ($(strip $(PKG_SANITIZER_UNDEFINED_BEHAVIOR)),1)
+    TARGET_CFLAGS += -fsanitize=undefined
+    TARGET_LDFLAGS += -fsanitize=undefined
+  endif
+endif
 
diff --git a/include/package-defaults.mk b/include/package-defaults.mk
index 2a04bc17e9..1e261db4eb 100644
--- a/include/package-defaults.mk
+++ b/include/package-defaults.mk
@@ -5,7 +5,7 @@
 # See /LICENSE for more information.
 #
 
-PKG_DEFAULT_DEPENDS = +libc +USE_GLIBC:librt +USE_GLIBC:libpthread
+PKG_DEFAULT_DEPENDS = +libc +USE_GLIBC:librt +USE_GLIBC:libpthread +USE_SANITIZER_ADDRESS:libasan +USE_SANITIZER_UNDEFINED_BEHAVIOR:libubsan
 
 ifneq ($(PKG_NAME),toolchain)
   PKG_FIXUP_DEPENDS = $(if $(filter kmod-%,$(1)),$(2),$(PKG_DEFAULT_DEPENDS) $(filter-out $(PKG_DEFAULT_DEPENDS),$(2)))
diff --git a/include/toolchain-build.mk b/include/toolchain-build.mk
index 35d8c9380e..92f618a28d 100644
--- a/include/toolchain-build.mk
+++ b/include/toolchain-build.mk
@@ -10,6 +10,8 @@ override CONFIG_AUTOREMOVE=
 
 HOST_BUILD_PREFIX:=$(TOOLCHAIN_DIR)
 BUILD_DIR_HOST:=$(BUILD_DIR_TOOLCHAIN)
+PKG_SANITIZER_ADDRESS:=0
+PKG_SANITIZER_UNDEFINED_BEHAVIOR:=0
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/hardening.mk
diff --git a/package/boot/grub2/Makefile b/package/boot/grub2/Makefile
index 46e3597cc2..59a3e7ee58 100644
--- a/package/boot/grub2/Makefile
+++ b/package/boot/grub2/Makefile
@@ -22,6 +22,8 @@ PKG_BUILD_DEPENDS:=grub2/host
 
 PKG_ASLR_PIE:=0
 PKG_SSP:=0
+PKG_SANITIZER_ADDRESS:=0
+PKG_SANITIZER_UNDEFINED_BEHAVIOR:=0
 
 PKG_FLAGS:=nonshared
 
diff --git a/package/libs/toolchain/Makefile b/package/libs/toolchain/Makefile
index 52a4cda19f..4f97df65a8 100644
--- a/package/libs/toolchain/Makefile
+++ b/package/libs/toolchain/Makefile
@@ -13,6 +13,8 @@ PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=GPL-3.0-with-GCC-exception
 
 PKG_FLAGS:=hold essential nonshared
+PKG_SANITIZER_ADDRESS:=0
+PKG_SANITIZER_UNDEFINED_BEHAVIOR:=0
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 8bbb26f829..171860e67a 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -23,6 +23,8 @@ PKG_CPE_ID:=cpe:/a:matt_johnston:dropbear_ssh_server
 
 PKG_BUILD_PARALLEL:=1
 PKG_ASLR_PIE_REGULAR:=1
+PKG_SANITIZER_ADDRESS:=0
+PKG_SANITIZER_UNDEFINED_BEHAVIOR:=0
 PKG_USE_MIPS16:=0
 PKG_FIXUP:=autoreconf
 PKG_FLAGS:=nonshared
diff --git a/package/utils/busybox/Makefile b/package/utils/busybox/Makefile
index e62cef0713..8a9d1a1662 100644
--- a/package/utils/busybox/Makefile
+++ b/package/utils/busybox/Makefile
@@ -20,6 +20,8 @@ PKG_HASH:=d0f940a72f648943c1f2211e0e3117387c31d765137d92bd8284a3fb9752a998
 PKG_BUILD_DEPENDS:=BUSYBOX_CONFIG_PAM:libpam
 PKG_BUILD_PARALLEL:=1
 PKG_CHECK_FORMAT_SECURITY:=0
+PKG_SANITIZER_ADDRESS:=0
+PKG_SANITIZER_UNDEFINED_BEHAVIOR:=0
 
 #Busybox use it's own PIE config flag and LDFLAGS are used with ld, not gcc.
 PKG_ASLR_PIE:=0