AddressSanitizer Clang 7 - ostash/sanitizer-docs GitHub Wiki

AddressSanitizer options in Clang

Based on:

  • include/clang/Driver/Options.td
  • include/clang/Basic/LangOptions.def
  • include/clang/Driver/SanitizerArgs.h and lib/Driver/SanitizerArgs.cpp
Type Name Default value Description Notes
int -fsanitize-address-field-padding 0 Level of field padding Controls how aggressive is ASan field padding (0: none, 1:least aggressive, 2: more aggressive)
bool -f[no]sanitize-address-use-after-scope true Enable use-after-scope detection
bool -fsanitize-address-globals-dead-stripping false Enable linker dead stripping of globals
bool -f[no]sanitize-address-poison-class-member-array-new-cookie false Enable poisoning array cookies when using class member operator new[] in AddressSanitizer

AddressSanitizer options in LLVM

This is taken from lib/Transforms/Instrumentation/AddressSanitizier.cpp

Command line options

Type Name Default value Description Notes
bool asan-kernel false Enable KernelAddressSanitizer instrumentation Driver sets this when -fsanitize=kernel-address used
bool asan-recover false Enable recovery mode (continue-after-error) Driver sets this when -fsanitize-recover=address is used
bool asan-instrument-reads true instrument read instructions This flag may need to be replaced with -f[no-]asan-reads
bool asan-instrument-writes true instrument write instructions
bool asan-instrument-atomics true instrument atomic instructions (rmw, cmpxchg)
bool asan-always-slow-path false use instrumentation with slow path for all accesses
bool asan-force-dynamic-shadow false Load shadow address into a local variable for each function
bool asan-with-ifunc true Access dynamic shadow through an ifunc global on "platforms that support this
bool asan-with-ifunc-suppress-remat true Suppress rematerialization of dynamic shadow address by passing it through inline asm in prologue
int asan-max-ins-per-bb 10000 maximal number of instructions to instrument in any given BB This flag limits the number of instructions to be instrumented in any given BB. Normally this should be set to unlimited (INT_MAX), but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary set it to 10000.
bool asan-stack true Handle stack memory This flag may need to be replaced with -f[no]asan-stack
uint32_t asan-max-inline-poisoning-size 64 Inline shadow poisoning for blocks up to the given size in bytes
bool asan-use-after-return true Check stack-use-after-return
bool asan-redzone-byval-args true Create redzones for byval arguments (extra copy required)
bool asan-use-after-scope false Check stack-use-after-scope Driver sets this based on -f[no]sanitize-address-use-after-scope. Enabled by default in driver
bool asan-globals true Handle global objects This flag may need to be replaced with -f[no]asan-globals.
bool asan-initialization-order true Handle C++ initializer order
bool asan-detect-invalid-pointer-pair false Instrument <, <=, >, >=, - with pointer operands Not handled by driver
unsigned asan-realign-stack 32 Realign stack to the value of this flag (power of two)
int asan-instrumentation-with-call-threshold 7000 If the function being instrumented contains more than this number of memory accesses use callbacks instead of inline checks (-1 means never use callbacks)
std::string asan-memory-access-callback-prefix __asan_ Prefix for memory access callbacks
bool asan-instrument-dynamic-allocas true instrument dynamic allocas
bool asan-skip-promotable-allocas true Do not instrument promotable allocas
int asan-mapping-scale 0 scale of asan shadow mapping These flags allow to change the shadow mapping. The shadow mapping looks like: Shadow = (Mem >> scale) + offset
unsigned long long asan-mapping-offset 0 offset of asan shadow mapping [EXPERIMENTAL]

Optimization flags

Not user visible, used mostly for testing and benchmarking the tool

Type Name Description Default value Notes
bool asan-opt true Optimize instrumentation
bool asan-opt-same-temp true Instrument the same temp just once
bool asan-opt-globals true Don't instrument scalar globals
bool asan-opt-stack false Don't instrument scalar stack variables
bool asan-stack-dynamic-alloca true Use dynamic alloca to represent stack variables
uint32_t asan-force-experiment 0 Force optimization experiment (for testing)
bool asan-use-private-alias false Use private aliases for global variables
bool asan-globals-live-support true Use linker features to support dead code stripping of globals Driver sets this based on -fsanitize-address-globals-dead-stripping. Disabled by default in driver
bool asan-with-comdat true Place ASan constructors in comdat sections This is on by default even though there is a bug in gold: https://sourceware.org/bugzilla/show_bug.cgi?id=19002

Debug flags

Type Name Description Default value
int asan-debug 0 debug
int asan-debug-stack 0 debug stack
std::string asan-debug-func Debug func
int asan-debug-min -1 Debug min inst
int asan-debug-max -1 Debug max inst
⚠️ **GitHub.com Fallback** ⚠️