Sanitizers for NetBSD
# Current status
Summary of the current status of sanitizers on a NetBSD host.
# What are sanitizers?
Sanitizer is a programming tool that detects computer program bugs such as buffer overflows, signed integer overflow, uninitialized memory read etc.
Sanitizers are developed in LLVM, and a downstream port exists to GCC.
# Types of sanitizers
There are various types of sanitizers.
A sanitizer is composed of an instrumentation part builtin into a compiler's code generation part.
The instrumentation part emitted by a compiler requires a runtime library, that is shipped with compiler-rt.
* Undefined Behavior Sanitizer (UBSan)
* Undefined Behavior with minimal runtime (UBSan_minimal)
* Address Sanitizer (ASan)
* Hardware Assisted Address Sanitizer (HWASan)
* Thread Sanitizer (TSan)
* Memory Sanitizer (MSan)
* Efficiency Sanitizer (ESan)
* Data Flow Sanitizer (DFSan)
* Leak Sanitizer (LSan)
Additionally there are the following features shipped together with sanitizers:
* profile
* SafeStack
* Control Flow Integrity
* Scudo Hardened Allocator
* XRay
* libFuzzer
* ShadowCallStack
The compiler-rt package ships with libBlocksRuntime, builtins etc.
As a NetBSD specific extension, there is a micro-UBSan runtime developed and maintained in the NetBSD source code.
It is designed to function inside libc (uUBSan - usermode-UBSan) and inside the kernel (kUBSan - kernel-UBSan).
# Sanitizers in NetBSD
Sanitizers in NetBSD are shipped with the following options:
* together with the toolchain with the default compiler runtime (default),
* together with the MKSANITIZER option (build the userland with the default compiler sanitizer),
* together with the MKLIBCSANITIZER option (build the userland with a homegrown sanitizer runtime),
* together with the NetBSD kernel (build the kernel with a homegrown kernel sanitizer runtime).
MKSANITIZER blog entry:
http://blog.netbsd.org/tnf/entry/mksanitizer_bug_detector_software_integration
MKLIBCSANITIZER and kernel sanitizer blog entry:
http://blog.netbsd.org/tnf/entry/introduction_to_%C2%B5ubsan_a_clean
# Support in NetBSD
Currently the main focus is with LLVM and GCC.
Generic TODO:
* switch syscall(2)/__syscall(2) to libc calls
* upstream local patches / rebase to newly developed support in LLVM available in GCC 8.x and newer
* develop missing interceptors such as fts(3) (mostly MSan-centric)
* FILE and DIR sanitization (needed by at least: ESan, MSan)
* improve the framework for ioctl(2) database and handle special cases when a part of a struct can be uninitialized and passed to the kernel (MSan)
* finish StopTheWorld() and upstream to LLVM
* port to !x86
* fixes with the signal code
* pkgsrc integration
* finish the support of float128 for Clang/LLVM/libstdc++/libgcc
* LLVM fixes for shared (dlopen(3)-powered) runtime
* fix other bugs.
## GCC
The GCC compiler assumed the version in distribution.
### GCC with the default runtime
Name | NetBSD status
----------|---------------------------------
UBSan | mostly works with all ports
ASan | mostly works with amd64 and i386
LSan | might work with amd64 and i386
### GCC with MKSANITIZER
Untested.
### GCC with MKLIBCSANITIZER
Name | NetBSD status
----------|---------------------------------
UBSan | works with micro-UBSan
### GCC with kernel sanitizers
Name | NetBSD status
----------|---------------------------------
UBSan | works with micro-UBSan
## LLVM
The LLVM support is available only with the HEAD version of the toolchain and not shipped in the base distribution.
### LLVM with the default runtime
Name | NetBSD status
----------|---------------------------------
UBSan | mostly works with all LLVM ports
ASan | mostly works with amd64 and i386
MSan | mostly works with amd64
TSan | mostly works with amd64
### LLVM with MKSANITIZER
Name | NetBSD status
----------|---------------------------------
UBSan | mostly works with all LLVM ports
ASan | mostly works with amd64 and i386
### LLVM with MKLIBCSANITIZER
Name | NetBSD status
----------|---------------------------------
UBSan | works with micro-UBSan
### LLVM with kernel sanitizers
Name | NetBSD status
----------|---------------------------------
UBSan | works with micro-UBSan
CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb