Repository navigation
feat(libSceAddressSanitizer): implement shadow poisoning, access checks and error reports - #13265
PrivacyOnion wants to merge 5 commits into
Conversation
…ks and error reports Implement 100 AddressSanitizer exports following LLVM compiler-rt 18.1.8: shadow fills and queries, stack, alloca, intra-object, array cookie and user poisoning, the load/store access callbacks and their report entry points, error report queries and callbacks, and the default hooks and options. The shadow uses the PlayStation mapping (scale 3, offset 1 << 40) reserved on first use. Remaining gaps are listed in the technical debt.
MarcZX10
left a comment
MarcZX10
left a comment
There was a problem hiding this comment.
Reviewed — changes requested
The fixed-width 16-byte access checker can miss poisoned bytes in the third shadow granule when the access is unaligned.
What I ran
Reviewed head def3d354c92f6b30bed17cbd1b5dcbfff4dc5daa against PR base fae9e483bbbfd05ab0ad2d00df42f59f1da7824d; a merge preview onto current main fae9e483bbbfd05ab0ad2d00df42f59f1da7824d was clean. Environment: Debian 12, x86-64, Python 3.11.2, Git 2.39.5. I did not compile or build AnyPS5.
git diff --check fae9e483bbbfd05ab0ad2d00df42f59f1da7824d...def3d354c92f6b30bed17cbd1b5dcbfff4dc5daa
python3 tools/pr_precheck.py --repo boykopovar/AnyPS5 --pr 13265
python3 tools/pr_abi_audit.py --repo /marc/AnyPS5 --base fae9e483bbbfd05ab0ad2d00df42f59f1da7824d --head def3d354c92f6b30bed17cbd1b5dcbfff4dc5daa --json
python3 /marc/AnyPS5/tools/pr_test_quality.py --root /tmp/AnyPS5-pr13265-review --json core/libs/prx/libSceAddressSanitizer/Export.cpp core/libs/prx/libSceAddressSanitizer/include/Api.hpp core/libs/prx/libSceAddressSanitizer/src/ErrorReport.hpp core/libs/prx/libSceAddressSanitizer/src/Report.hpp core/libs/prx/libSceAddressSanitizer/src/ShadowAddressSpace.hpp core/libs/prx/libSceAddressSanitizer/src/ShadowCheck.hpp core/libs/prx/libSceAddressSanitizer/src/ShadowLinux.cpp core/libs/prx/libSceAddressSanitizer/src/ShadowWindows.cpp core/libs/tests/GuestAddressSanitizerMapping.cpp core/libs/tests/GuestAddressSanitizerShadow.cpp
python3 tools/pr_overlap.py --branch refs/review/pr-13265 --jobs 16
git merge-tree --write-tree fae9e483bbbfd05ab0ad2d00df42f59f1da7824d def3d354c92f6b30bed17cbd1b5dcbfff4dc5daaResults
| Check | Result |
|---|---|
| Patch whitespace | Passed; git diff --check produced no output. |
| Repository conventions and PR template | Passed. |
| No-build precheck | Reported failed because the isolated checkout does not contain the local-only ABI and test-quality helper scripts; both were run manually against the exact head afterward. The precheck confirmed head/base stability. |
| ABI audit | Passed with no findings; this lexical check does not establish runtime ABI or compilation correctness. |
| Test-quality heuristic | Flagged both test source paths as possibly unregistered. Inspection confirms libSceAddressSanitizer/CMakeLists.txt registers both through ${LIBS_INCLUDE_DIR}/tests/...; the warnings are false positives. |
| Open-PR overlap scan | Passed: no overlap with open PRs. |
| Current-main merge preview | Passed; clean tree cd90b23ad63f9ec76cb6242d97201cd06071da92. |
| Hosted CI at review time | Conventions, eligibility, intake, labels and report passed (conventions, eligibility, intake, labels, report). Windows was pending; Linux and specialized jobs were skipped. |
| Tests/build | Not run locally. The PR description reports eight Windows tests on an earlier test tree and a Linux compile-only check; I did not independently run those checks. The intervening main commits did not change the PR’s implementation/test paths. |
Unedited local check output
git diff --check:
Conventions:
All conventions checks passed.
ABI audit summary:
{
"status": "passed",
"findings": []
}Test-quality heuristic:
{
"findings": [
{
"path": "core/libs/tests/GuestAddressSanitizerMapping.cpp",
"line": 1,
"kind": "possible-unregistered-cpp-test",
"message": "Changed C++ test source path was not found literally in CMake files; inspect registration, generated source lists, and workflow coverage."
},
{
"path": "core/libs/tests/GuestAddressSanitizerShadow.cpp",
"line": 1,
"kind": "possible-unregistered-cpp-test",
"message": "Changed C++ test source path was not found literally in CMake files; inspect registration, generated source lists, and workflow coverage."
}
],
"negative_control_candidates": [],
"limits": [
"Heuristics can miss weak assertions and can flag valid tests; inspect every finding.",
"A test that passes against base is not by itself proof that the PR test is inadequate.",
"Negative controls are only candidates until the test actually runs against base and fails by assertion rather than import/setup error."
]
}Precheck command output:
/tmp/anyps5-pr-precheck/boykopovar-AnyPS5-pr-13265-def3d354c92f/report.md
/tmp/anyps5-pr-precheck/boykopovar-AnyPS5-pr-13265-def3d354c92f/report.json
Conclusion: checks failed
Overlap scan:
No overlap with open pull requests.
Merge preview:
cd90b23ad63f9ec76cb6242d97201cd06071da92
Findings
Blocking
CheckAccess_nid_no_patch reads only the first two shadow bytes for accesses larger than eight bytes, then returns when those bytes are both zero. An unaligned 16-byte access can span three 8-byte granules; if only the third granule is poisoned, __asan_load16/__asan_store16 and their variants return without reporting it. The current tests exercise 16-byte checks at an aligned address, so they do not cover this case. Please inspect every shadow granule intersecting the access and add a child-process regression test with an unaligned 16-byte access whose third granule is poisoned.
Non-blocking
No additional confirmed findings.
Sources
CheckAccess_nid_no_patchand the 16-byte load/store wrappers.- Existing 16-byte tests use the aligned
baseaddress.
Not verified
No local build, C++ test execution, native Windows run, Linux runtime test, title/homebrew run, or PS5 console behavior. The hosted Windows check was pending when checked; Linux and specialized jobs were skipped.
To get this to a good state
Update the access checker to cover all granules touched by a fixed-width access, add a regression for the unaligned 16-byte/third-granule case, and provide fresh CI on the new head. I will rerun the same relevant no-build checks and review the new head.
Progress report (a4eca2a → ca0788f)📈 System libraries: 26.31% (+0.27%, +100 implemented functions) ✅ 100 implemented
⚪ 9 behaviourally empty (constant return or throw)
Changed libraries (implemented exports)
|
…e accesses Invalid ranges and a failed shadow reservation throw std::invalid_argument and std::runtime_error instead of NotImplemented_nid_no_patch.
|
Windows run of this head ( 6 of the 8 tests fail here, deterministically: The cause is the 16 TiB shadow reservation colliding with ordinary Windows allocations. A standalone probe with the same toolchain lists what is already mapped in 1–17 TiB at Over 20 fresh processes, the first occupied region was always at Since instrumented code computes the shadow address with the fixed Note: the head moved to AI-assisted: yes (Claude Code). |
…adow range High-entropy ASLR places host allocations between 1 and 17 TiB, so a single 16 TiB reservation fails. The runtime now reserves each free region, records the host allocations as holes, and throws when an export needs shadow inside a hole.
|
Both findings are fixed on 78dc5a8. @MarcZX10 (45ddafe): a misaligned access larger than 8 bytes now also checks its last byte and reports the first poisoned address. Added @JJenkx (78dc5a8): thanks, reproduced. Windows now reserves each free region of the 1–17 TiB shadow range separately and records host allocations already there as holes; an export whose shadow falls in a hole throws instead of writing host memory. Also, guards on invalid ranges now throw 9/9 |
MarcZX10
left a comment
MarcZX10
left a comment
There was a problem hiding this comment.
Re-checked — new head, verification pending
At head 78dc5a8136054ba2b62a68e0cf83de7b989f1de3, the earlier unaligned 16-byte access gap is addressed in source and covered by a new regression case, but the changed Windows shadow-reservation path still needs an exact-head Windows run before I can approve it.
What I ran
Reviewed PR head 78dc5a8136054ba2b62a68e0cf83de7b989f1de3 against PR base fae9e483bbbfd05ab0ad2d00df42f59f1da7824d. The merge preview onto fetched current main 663832e75756973e10f03518cbd4224829ce6780 was clean (tree 9ce0e33a7eef4ec681d67b05a01afba739ba5c8f). Environment: Debian 12, x86-64, Python 3.11.2, Git 2.39.5, GCC 12.2.0. I did not configure, build, compile, or run C++ tests.
git diff --check fae9e483bbbfd05ab0ad2d00df42f59f1da7824d...78dc5a8136054ba2b62a68e0cf83de7b989f1de3
python3 tools/pr_precheck.py --repo boykopovar/AnyPS5 --pr 13265
python3 tools/check_conventions.py --base fae9e483bbbfd05ab0ad2d00df42f59f1da7824d --head 78dc5a8136054ba2b62a68e0cf83de7b989f1de3 --title 'feat(libSceAddressSanitizer): implement shadow poisoning, access checks and error reports' --body /tmp/anyps5-pr-precheck/boykopovar-AnyPS5-pr-13265-78dc5a813605/pr-body.md
python3 tools/pr_abi_audit.py --repo /marc/AnyPS5 --base fae9e483bbbfd05ab0ad2d00df42f59f1da7824d --head 78dc5a8136054ba2b62a68e0cf83de7b989f1de3 --json
python3 tools/pr_test_quality.py --root /tmp/anyps5-pr-precheck/boykopovar-AnyPS5-pr-13265-78dc5a813605/head-78dc5a813605-efdfde44 --json core/libs/prx/libSceAddressSanitizer/CMakeLists.txt core/libs/prx/libSceAddressSanitizer/Export.cpp core/libs/prx/libSceAddressSanitizer/include/Api.hpp core/libs/prx/libSceAddressSanitizer/src/ErrorReport.hpp core/libs/prx/libSceAddressSanitizer/src/Report.hpp core/libs/prx/libSceAddressSanitizer/src/ShadowAddressSpace.hpp core/libs/prx/libSceAddressSanitizer/src/ShadowCheck.hpp core/libs/prx/libSceAddressSanitizer/src/ShadowLinux.cpp core/libs/prx/libSceAddressSanitizer/src/ShadowWindows.cpp core/libs/tests/GuestAddressSanitizerMapping.cpp core/libs/tests/GuestAddressSanitizerShadow.cpp docs/dev/debt/libSceAddressSanitizer.md
git merge-tree --write-tree 663832e75756973e10f03518cbd4224829ce6780 refs/review/pr-13265-new
gh pr checks 13265 -R boykopovar/AnyPS5Results
| Check | Result |
|---|---|
| Patch whitespace | Passed; git diff --check produced no output. |
| Repository conventions and PR template | Passed. |
| No-build precheck | Completed against the exact head and confirmed head/base stability; overall status was failed only because the isolated PR checkout lacks the workspace-local ABI-audit and test-quality scripts. Both were run manually below. |
| ABI audit | Passed with no findings. This lexical audit does not establish binary ABI or runtime correctness. |
| Test-quality heuristic | Reported possible unregistered C++ tests. Manual inspection confirms the library CMake file registers both test sources; the warning is a heuristic false positive. |
| Current-main merge preview | Passed; clean tree 9ce0e33a7eef4ec681d67b05a01afba739ba5c8f. |
| Hosted CI | At final check, eligibility, conventions and report were pending; a duplicate conventions run was cancelled. No build/test result was available. |
| C++ tests/build | Not run locally; these require building. |
Unedited check output
git diff --check produced no output.
All conventions checks passed.
ABI audit summary from its JSON output:
{
"status": "passed",
"findings": []
}Test-quality heuristic output:
{
"findings": [
{
"path": "core/libs/tests/GuestAddressSanitizerMapping.cpp",
"line": 1,
"kind": "possible-unregistered-cpp-test",
"message": "Changed C++ test source path was not found literally in CMake files; inspect registration, generated source lists, and workflow coverage."
},
{
"path": "core/libs/tests/GuestAddressSanitizerShadow.cpp",
"line": 1,
"kind": "possible-unregistered-cpp-test",
"message": "Changed C++ test source path was not found literally in CMake files; inspect registration, generated source lists, and workflow coverage."
}
],
"negative_control_candidates": [],
"limits": [
"Heuristics can miss weak assertions and can flag valid tests; inspect every finding.",
"A test that passes against base is not by itself proof that the PR test is inadequate.",
"Negative controls are only candidates until the test actually runs against base and fails by assertion rather than import/setup error."
]
}Precheck command output:
/tmp/anyps5-pr-precheck/boykopovar-AnyPS5-pr-13265-78dc5a813605/report.md
/tmp/anyps5-pr-precheck/boykopovar-AnyPS5-pr-13265-78dc5a813605/report.json
Conclusion: checks failed
Merge preview output:
9ce0e33a7eef4ec681d67b05a01afba739ba5c8f
Hosted check output:
conventions fail 0 https://github.com/boykopovar/AnyPS5/actions/runs/41043322043/job/124021179230
eligibility pending 0 https://github.com/boykopovar/AnyPS5/actions/runs/41043324203/job/124021373192
labels pending 0 https://github.com/boykopovar/AnyPS5/actions/runs/41043322948/job/124021884141
report pending 0 https://github.com/boykopovar/AnyPS5/actions/runs/41043324228/job/124021184581
Findings
Blocking
No new source-level blocker was confirmed in this review.
Non-blocking
The previous review's fixed-width unaligned 16-byte access finding is addressed by checking the final access byte when the fast-path shadow bytes are clear; the new guest_addresssanitizer_report_load16 case calls the clean aligned access and then an unaligned 16-byte access whose final granule is poisoned. The new test is registered in CMake. I inspected this source but did not execute it.
Sources
CheckAccess_nid_no_patchand the new third-granule fallback.- Windows shadow range reservation and availability checks and reservation/hole tracking.
- CMake registration for the Windows load16 regression test and its unaligned access case.
Not verified
The new Windows-only implementation reserves discontiguous free shadow ranges and commits pages through a vectored exception handler. No test or build result for head 78dc5a8… was available at review time. The PR discussion reports a Windows test run on the previous head def3d354c92f6b30bed17cbd1b5dcbfff4dc5daa; that result does not verify this head's changed Windows path. Linux runtime, console behavior, and the new Windows guest_addresssanitizer_mapping_collision test were not independently run here.
To get this to a good state
Please run the focused Windows AddressSanitizer tests, including guest_addresssanitizer_mapping_collision and guest_addresssanitizer_report_load16, on head 78dc5a8136054ba2b62a68e0cf83de7b989f1de3 and provide the exact commands and results. I will re-check the same evidence against the updated head.
|
@MarcZX10 Exact-head Windows run of 78dc5a8 (clean worktree, Environment: Windows 11 Pro 10.0.26200, WinLibs MinGW-W64 GCC 16.1.0 UCRT r2, Ninja, Release,
Negative controls on this code, each rebuilt and run, then reverted:
The |
MarcZX10
left a comment
MarcZX10
left a comment
There was a problem hiding this comment.
Re-checked — new head, looks good
The previously reported Windows shadow-reservation and unaligned 16-byte access issues are addressed in head 78dc5a8136054ba2b62a68e0cf83de7b989f1de3, and the author supplied focused exact-head Windows test evidence.
What I ran
I re-read the current PR discussion, refreshed the head and hosted checks, and reviewed the exact-head test report. The PR is based on main at fae9e483bbbfd05ab0ad2d00df42f59f1da7824d; the prior local merge preview onto fetched main 663832e75756973e10f03518cbd4224829ce6780 was clean. Local environment for the earlier no-build review: Debian 12 x86-64, Python 3.11.2, Git 2.39.5, GCC 12.2.0. I did not build or run C++ tests locally. The Windows test run below was reported by the PR author, not run by me.
git diff --check fae9e483bbbfd05ab0ad2d00df42f59f1da7824d...78dc5a8136054ba2b62a68e0cf83de7b989f1de3
python3 tools/check_conventions.py --base fae9e483bbbfd05ab0ad2d00df42f59f1da7824d --head 78dc5a8136054ba2b62a68e0cf83de7b989f1de3 --title 'feat(libSceAddressSanitizer): implement shadow poisoning, access checks and error reports' --body /tmp/anyps5-pr-precheck/boykopovar-AnyPS5-pr-13265-78dc5a813605/pr-body.md
python3 tools/pr_abi_audit.py --repo /marc/AnyPS5 --base fae9e483bbbfd05ab0ad2d00df42f59f1da7824d --head 78dc5a8136054ba2b62a68e0cf83de7b989f1de3 --json
ctest --test-dir build -R guest_addresssanitizer --output-on-failure # author-reported Windows runResults
| Check | Result |
|---|---|
| Local diff whitespace, conventions, ABI audit, test registration/source review | Passed in the previous review; ABI audit had no findings. |
| Author-reported Windows exact-head tests | 9/9 guest_addresssanitizer_* tests passed after rebuilding the library and test executables from this SHA. |
| Author-reported negative controls | Both targeted mutations caused their regression tests to fail as expected; additional occupied host pages did not break mapping/report tests. |
| Hosted CI | Conventions, eligibility, and progress report passed; Windows was pending at recheck; Linux and specialized jobs were skipped. |
The exact commands and unedited Windows output are in the author’s exact-head test report.
Negative control
| Assertion | Change reported in the test code | Result |
|---|---|---|
| Unaligned 16-byte load checks the final poisoned granule | Disabled the final-byte check in CheckAccess_nid_no_patch |
guest_addresssanitizer_report_load16 failed as expected. |
| Shadow mapping preserves host allocations in reserved-range holes | Disabled the hole check in ShadowRangeAvailable_nid_no_patch |
The collision test exited 5 as expected. |
Findings
Blocking
None found in the reviewed head.
Non-blocking
The Windows evidence is author-reported. I did not independently run the Windows tests, and hosted Windows CI was still pending when checked.
Sources
- Fixed-width access check and final-byte fallback.
- Windows shadow-range reservations and hole checks.
- Registered unaligned load16 regression.
Not verified
I did not independently build or run the Windows tests. Linux runtime, console behavior, and the pending hosted Windows job were not verified in this recheck.
THEMANnt
left a comment
THEMANnt
left a comment
There was a problem hiding this comment.
Reviewed 78dc5a8136054ba2b62a68e0cf83de7b989f1de3. No new actionable issue found in the shadow runtime and its documented limits. Reviewed the free-region reservation/hole guard and unaligned 16-byte access fix; the latter checks the final granule instead of stopping after two shadow bytes.
Independently built the pinned library and passed all nine registered Windows sanitizer tests, including the occupied-shadow collision control and third-granule load16 regression, using MSYS2 GCC 16.2 Release in an isolated DLL-linked harness. Whitespace passes. The hosted Windows job compiled the library but selected no guest tests, so its success is not counted as execution of these regressions. Local support forwards termination to the host and throws for unimplemented calls; this does not establish full guest libc, Linux, inline accesses through shadow holes, or console/game behavior.
|
@PrivacyOnion two things on
|
… shadow on every non-Windows host Export.cpp, ShadowCheck.hpp, Report.hpp and ErrorReport.hpp follow compiler-rt and now start with the LLVM Apache-2.0 WITH LLVM-exception notice. ShadowLinux.cpp is built on every host but Windows; without MAP_FIXED_NOREPLACE (macOS) it reserves no shadow, so the library links and the exports that need shadow throw. The shadow test is registered only where a shadow can be reserved.
…ovar#13265 The compiler-rt port gitlink moves to 040178683306 (POSIX shadow and module lookup on every non-Windows host); the in-tree adapters keep no copied runtime code, so the notice stays in the port. Sanitizer tests are registered on Windows and Linux only.
|
@oneandonlydean thanks, both addressed in dfb095e. Licence notice.
Other hosts. #13331 is updated the same way, in 0363753:
|
|
The failing
This PR changes only I can't rerun the job from a fork. Could a maintainer rerun the failed Windows job? |
THEMANnt
left a comment
THEMANnt
left a comment
There was a problem hiding this comment.
Re-reviewed dfb095e1d08c5470cb97e70f2bbff04b2f50e04c. No new actionable issue found in the follow-up. The LLVM notices are present, the non-Windows backend is included, and hosts without MAP_FIXED_NOREPLACE return shadow-unavailable instead of leaving unresolved backend symbols.
Windows/MSYS2 GCC 16.2 Release: rebuilt the pinned library in the existing isolated DLL-linked harness; all nine registered sanitizer tests pass, including occupied-shadow and unaligned load16 controls. Hosted Windows is red: its log reports one failure, guest_filesystem, out of 2,594 tests. I have not independently reproduced that filesystem failure or proved its cause. This approval covers the sanitizer change; it does not clear the red check. No macOS/Linux runtime or console execution was performed.
|
More evidence that the red
So it looks intermittent or runner-dependent, not caused by this change. Could a maintainer rerun the failed Windows job? Both approvals are on this exact head, so I'd rather not push a new commit just to retrigger CI. |
There was a problem hiding this comment.
Withdrawn on the title-ID point; Unblocks: none is allowed. The reservation question stands: is the 16 TiB shadow reservation made only when an export is called, or can merely linking the library trigger it? A test showing nothing is reserved when no sanitizer export is called would settle it.
…rst use, not when the library loads
|
@CnRJay the shadow is reserved only when an export first needs it. Loading or linking the library reserves nothing.
ca0788f adds |
✅ AMD GPU test: passedPR head
Unstable on main (3, these also failed in recent main runs on this machine; not counted against this PR)Failing on main too (5, not counted against this PR)Passed on retry (5, failed in the parallel run, passed when re-run with a 360 s timeout; not counted against this PR)Validated but not compared (1, not in the main baseline's validation pass)Validation IDs already present on main (5 IDs in 606 tests)Skipped (7)ReproduceAutomated build and test on a contributor's AMD machine; it does not replace upstream CI. A new comment is posted for each new push. Full logs. |
What
Implements 100 of the 301
libSceAddressSanitizerexports. The other 201 still throw and stay under Unknown function info.The export names are the LLVM compiler-rt AddressSanitizer interface. Signatures come from the LLVM 18.1.8 public headers (
asan_interface.h,common_interface_defs.h) and from the callbacks the compiler emits. Behaviour follows the LLVM 18.1.8 runtime sources linked below.AddressSanitizer.cpp(kPS_ShadowOffset64 = 1ULL << 40, scale 3). The first export that touches the shadow reserves it. Windows reserves every free region between 1 and 17 TiB separately and commits pages on access through a vectored handler; host allocations already there (high-entropy ASLR places some in this range) become holes, and an export whose shadow falls in a hole throws instead of writing host memory. Linux usesmmapwithMAP_FIXED_NOREPLACE | MAP_NORESERVE. After the first call the check is a single atomic load.__asan_set_shadow_00,_01to_07and_f1,_f2,_f3,_f5,_f8;__asan_address_is_poisoned,__asan_region_is_poisoned,__asan_get_shadow_mapping.asan_poisoning.cpp,asan_fake_stack.cpp):__asan_poison_memory_regionand__asan_unpoison_memory_region;__asan_poison_stack_memoryand__asan_unpoison_stack_memory; the intra-object redzones;__asan_alloca_poisonand__asan_allocas_unpoison;__asan_poison_cxx_array_cookieand__asan_load_cxx_array_cookie.asan_rtl.cpp):__asan_load*and__asan_store*for sizes 1, 2, 4, 8, 16 and N, with their_noabortvariants. The six__sanitizer_unaligned_*accesses followCHECK_SMALL_REGION. A misaligned access larger than 8 bytes also checks its last byte, so a poisoned third granule is reported at the first bad address; the LLVM fast path reads only two shadow bytes and skips it.asan_report.cpp,asan_errors.cpp):__asan_report_load*,__asan_report_store*and__asan_report_error.ErrorGenericclassification. A report prints the separator, the header, the access line, the shadow dump and the legend.__asan_set_error_report_callbackcallback, printsABORTING, calls the__sanitizer_set_death_callbackcallback and exits with code 1 through_Exit.__asan_report_presentand__asan_get_report_*read the report in progress.__ubsan_default_options,__sancov_default_options,__sanitizer_malloc_hookand__sanitizer_free_hook,__sanitizer_get_estimated_allocated_size,__sanitizer_get_unmapped_bytes, and the__asan_version_mismatch_check_v6,_v7and_v8checks, as in LLVM 18.1.8.Recorded in
docs/dev/debt/libSceAddressSanitizer.md:__asan_init, the allocator, global registration, fake stacks and the thread registry are still missing, so a clean shadow does not prove an address is valid.allow_user_poisoning,poison_array_cookie,poison_partialandhalt_on_errorare all true, so the_noabortvariants also exit.Ranges outside guest memory or overlapping the shadow, misaligned arguments that LLVM
CHECKs, and shadow that falls in a hole throwstd::invalid_argumentorstd::runtime_error; only the 201 unimplemented exports callNotImplemented_nid_no_patch.Tested
Windows 11, MinGW-W64 GCC 16.1.0, Release. No title or homebrew; no dumped title uses the sanitizer runtime.
ctestruns 9 tests:guest_addresssanitizer_shadow,guest_addresssanitizer_mapping,guest_addresssanitizer_mapping_collision, andguest_addresssanitizer_report_{load4,load16,storeN,unaligned,partial,report_error}.ABORTINGand the death callback. The exit code is 1.mapping_collisioncommits a host page at1 << 40before the first call: initialization succeeds, poisoning and checking a guest address whose shadow is in that page throw and leave it intact, and addresses elsewhere work. It fails without the hole check. Themappingandreporttests also pass with host pages committed at 0x1f5…, 0x250… and 0x29f… before they start.report_load16calls__asan_load16at offset 4 of a buffer whose third granule is poisoned; it fails without the last-byte check.-G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON). The 9 tests pass there on the current head; the tree was configured one5186e88a6, and none of the 27 commits up tofae9e483bbtouch the files changed here.nid_patcher libSceAddressSanitizergives 100 patched NIDs that matchtools/nid_names.pycompute_nid. Theextern "C"helpers exported unpatched areInitializeShadow,ShadowRangeAvailable,CurrentErrorReportandLoadErrorReportCallback.Export.cpp,src/ShadowLinux.cppandGuestAddressSanitizerShadow.cppcompile asx86_64-linux-gnuobjects (clang 21,-Wall -Wextra) with no warnings from this library. Nothing was run on Linux.tools/progress.pycounts 100 implementedlibSceAddressSanitizerexports (9 behaviourally empty: the default options, hooks, unmapped bytes and version checks) and 201 unimplemented.python3 core/libs/tests/test_public_headers.py --audit-onlypasses, andpython3 tools/check_conventions.py --base upstream/mainpasses with no warnings.python3 tools/pr_overlap.py --branch feat/addresssanitizer-runtime: no overlap with the 1474 open pull requests.Checklist
main; no other open PR implements the same functionsNotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file.mdfiles or images added to the repository (attach them to this PR)