Commit Graph

3 Commits

Author SHA1 Message Date
Bartosz Nitka
0ae3f861af Run linux tests with UBSAN (#1664)
Undefined Behavior Sanitizer (UBSAN) [1] is a similar tool to ASAN,
useful for catching bugs related to undefined behavior.

All the problems it detects seem related to the bitshifts related to
flags. Here's a sample:

```
src/new_pins.c:2437:8: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
	#0 0x55a1b51011c1 in PIN_get_Relay_PWM_Count src/new_pins.c:2437
	#1 0x55a1b500389b in NewLED_InitCommands src/cmnds/cmd_newLEDDriver.c:1627
	#2 0x55a1b5150208 in Main_Init_BeforeDelay_Unsafe src/user_main.c:1151
	#3 0x55a1b51506e7 in Main_Init_Before_Delay src/user_main.c:1290
	#4 0x55a1b5150a05 in Main_Init src/user_main.c:1428
	#5 0x55a1b515902c in SIM_ClearOBK src/win_main.c:166
	#6 0x55a1b515a0fd in main src/win_main.c:534
	#7 0x7f1acfdabd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
	#8 0x7f1acfdabe3f in __libc_start_main_impl ../csu/libc-start.c:392
	#9 0x55a1b4fd8eb4 in _start (/home/niteria/tmp/broken-realloc/OpenBK7231T_App/build/win_main+0x10ceb4)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/new_pins.c:2437:8 in
```

```
src/new_cfg.c:591:9: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
	#0 0x5629450eb803 in CFG_HasFlag src/new_cfg.c:591
	#1 0x562944ffdb53 in CMD_Init_Early src/cmnds/cmd_main.c:1007
	#2 0x562945153230 in Main_Init_BeforeDelay_Unsafe src/user_main.c:1162
	#3 0x5629451536e7 in Main_Init_Before_Delay src/user_main.c:1290
	#4 0x562945153a05 in Main_Init src/user_main.c:1428
	#5 0x56294515c02c in SIM_ClearOBK src/win_main.c:166
	#6 0x56294515d0fd in main src/win_main.c:534
	#7 0x7f9f5e12bd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
	#8 0x7f9f5e12be3f in __libc_start_main_impl ../csu/libc-start.c:392
	#9 0x562944fdbeb4 in _start (/home/niteria/tmp/broken-realloc/OpenBK7231T_App/build/win_main+0x10ceb4)
```

```
src/httpserver/http_fns.c:369:8: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
	#0 0x560135601d44 in http_fn_index src/httpserver/http_fns.c:369
	#1 0x5601356185cb in HTTP_ProcessPacket src/httpserver/new_http.c:826
	#2 0x5601356a1e93 in Test_FakeHTTPClientPacket_Generic src/selftest/selftest_http.c:86
	#3 0x5601356a2002 in Test_FakeHTTPClientPacket_GET src/selftest/selftest_http.c:102
	#4 0x5601356b773f in Test_PIR src/selftest/selftest_pir.c:27
	#5 0x5601356d204b in Win_DoUnitTests src/win_main.c:171
	#6 0x5601356d3116 in main src/win_main.c:538
	#7 0x7f6911b2ad8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
	#8 0x7f6911b2ae3f in __libc_start_main_impl ../csu/libc-start.c:392
	#9 0x560135551eb4 in _start (/home/niteria/tmp/broken-realloc/OpenBK7231T_App/build/win_main+0x10ceb4)
```

Preexisting problems are suppressed in `platforms/linux/ubsan.suppressions`

[1] https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html
2025-06-18 22:52:22 +02:00
openshwprojects
1e201d6be4 fix mem leaks in sim (#1665)
* Update drv_spiLED.c

* Update drv_spiLED.c

* Update drv_spiLED.c

* Update asan.suppressions

* Update drv_spiLED.c

* try

* mcu clear

* return cmd

* free alias leak
2025-06-01 10:06:09 +02:00
Bartosz Nitka
92ea9cd8ab Ability to run linux tests with AddressSanitizer (#1651)
* Ability to run linux tests with AddressSanitizer

This makes it possible to compile and run the tests with Address
Sanitizer (ASAN) [1].

The command is:
```
make -f custom.mk clean; ASAN=1 make -f custom.mk && ./build/win_main -runUnitTests 2
```

Building without ASAN works without change.

Address Sanitizer saves a lot of time debugging memory issues, for
example for a bug where we index in an array with negative index it
gives this nice error message:
```
=================================================================
==2532658==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5642389c5e37 at pc 0x564237e67492 bp 0x7fff17726e50 sp 0x7fff17726e40
READ of size 1 at 0x5642389c5e37 thread T0
    #0 0x564237e67491 in CHANNEL_GetType src/new_cfg.c:427
    #1 0x564237dfc933 in TuyaMCU_ApplyMapping src/driver/drv_tuyaMCU.c:1126
    #2 0x564237dff92f in TuyaMCU_ParseStateMessage src/driver/drv_tuyaMCU.c:1632
    #3 0x564237e019fa in TuyaMCU_ProcessIncoming src/driver/drv_tuyaMCU.c:1977
    #4 0x564237e027ee in TuyaMCU_RunReceive src/driver/drv_tuyaMCU.c:2178
    #5 0x564237e02dc2 in TuyaMCU_RunFrame src/driver/drv_tuyaMCU.c:2335
    #6 0x564237dd2ce6 in DRV_RunQuickTick src/driver/drv_main.c:536
    #7 0x564237ec4037 in QuickTick src/user_main.c:946
    #8 0x564237eca8a5 in Sim_RunFrame src/win_main.c:106
    #9 0x564237eca993 in Sim_RunFrames src/win_main.c:134
    #10 0x564237ebce4a in Test_TuyaMCU_Basic src/selftest/selftest_tuyaMCU.c:369
    #11 0x564237ecab1f in Win_DoUnitTests src/win_main.c:194
    #12 0x564237ecba57 in main src/win_main.c:535
    #13 0x7fb55312ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #14 0x7fb55312ee3f in __libc_start_main_impl ../csu/libc-start.c:392
    #15 0x564237cb16b4 in _start (/home/niteria/tmp/broken-realloc/OpenBK7231T_App/build/win_main+0xcf6b4)

0x5642389c5e37 is located 51 bytes to the right of global variable 'stat_deduper_culled_tooFast' defined in 'src/mqtt/new_mqtt_deduper.c:40:12' (0x5642389c5e00) of size 4
0x5642389c5e37 is located 9 bytes to the left of global variable 'g_mutex' defined in 'src/mqtt/new_mqtt_deduper.c:42:26' (0x5642389c5e40) of size 4
SUMMARY: AddressSanitizer: global-buffer-overflow src/new_cfg.c:427 in CHANNEL_GetType
Shadow bytes around the buggy address:
  0x0ac8c7130b70: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0ac8c7130b80: 00 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0ac8c7130b90: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0ac8c7130ba0: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
  0x0ac8c7130bb0: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
=>0x0ac8c7130bc0: 04 f9 f9 f9 f9 f9[f9]f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0ac8c7130bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac8c7130be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac8c7130bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac8c7130c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac8c7130c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2532658==ABORTING
```

[1] https://github.com/google/sanitizers/wiki/addresssanitizer

* disable tests broken on linux

* add a suppression file for known leaks

* attempt at adding an ASAN workflow

* fix autogen

* Update workflow.yaml

---------

Co-authored-by: openshwprojects <85486843+openshwprojects@users.noreply.github.com>
2025-05-31 14:27:02 +02:00