Add optional ASAN toolchain support for musl platforms - #2003

Summary

Add make BOARD=<platform> toolchain-asan that builds a toolchain with AddressSanitizer support. Same toolchain, no separate artifact — just adds libasan.a/libasan.so to the output.

How it works

Buildroot's gcc-final.mk appends BR2_EXTRA_GCC_CONFIG_OPTIONS last, so --enable-libsanitizer overrides the earlier --disable-libsanitizer for musl. No gcc.mk modification needed.

A GCC patch guards musl-incompatible headers in libsanitizer (struct sysinfo, linux/sysctl.h, linux/if_ppp.h). The patch is harmless when libsanitizer is disabled.

Usage

# Build ASAN toolchain
make BOARD=hi3516cv100_lite toolchain-asan

# Compile with ASAN (static libasan to avoid deploying .so)
arm-openipc-linux-musleabi-gcc -fsanitize=address -static-libasan \
  -fno-omit-frame-pointer -g -latomic -o myapp myapp.c

# Run on device (increase osmem for headroom)
fw_setenv osmem 96M
ASAN_OPTIONS="quarantine_size_mb=1:detect_leaks=0:stack_use_after_return=0:symbolize=0" ./myapp

Known limitation: vendor SDK MMZ memory

ASAN's shadow memory does not cover hardware-mapped regions (MMZ/Media Memory Zone used by HiSilicon, Sigmastar, etc). When vendor SDK functions map device memory via /dev/mmz, ASAN's __asan_unpoison_stack_memory receives addresses outside its shadow range, causing:

AddressSanitizer: CHECK failed: asan_poisoning.cpp:37
  "((AddrIsAlignedByGranularity(addr))) != (0)" (0x0, 0x0)

Workaround: exclude vendor SDK interaction files from ASAN instrumentation. For majestic:

# After cmake build, recompile SDK files without ASAN and relink:
python3 -c "
import json, subprocess
with open('build/compile_commands.json') as f:
    cmds = json.load(f)
for c in cmds:
    if c['file'].endswith(('sdk.c', 'hal.c', 'mmap.c')):
        cmd = c['command'].replace('-fsanitize=address', '').replace('-fno-omit-frame-pointer', '')
        subprocess.run(cmd, shell=True, cwd=c['directory'])
"
cmake --build build --target majestic

Or in source code, annotate functions that call vendor SDK mmap:

__attribute__((no_sanitize("address")))
int init_vpss(...) { /* calls HI_MPI_VB_MmapPool etc */ }

Test plan

• make BOARD=hi3516cv100_lite toolchain-asan builds successfully
• libasan.a and libasan.so present in output
• Test program compiles with -fsanitize=address -static-libasan -latomic
• ASAN detects buffer overflow under qemu-arm-static
• Regular make BOARD=hi3516cv100_lite toolchain still works (patch is harmless)
• Used to find real bug: __aeabi_d2iz infinite recursion (uclibc-compat: fix __aeabi_d2iz infinite recursion #2002)
• ASAN majestic on hi3516cv100 hardware: SDK init, sensor load, JPEG serving — zero ASAN errors under k6 load test (100 requests, 5 concurrent users)

Ref: #1992

🤖 Generated with Claude Code