ASAN false positives due to vfork() with GCC 9

[colesbury]

Older versions of ASAN don't properly support vfork(). Python uses vfork() when available in _posixsubprocess.c. This can lead to false positive reports from ASAN. I believe this issue exists with GCC 9 (and older), but not GCC 10 (and newer). The CPython GitHub actions ASAN runner currently uses GCC 9.4.0, so it does not properly handle vfork().

I've seen these false positives in my nogil-3.12 fork. I'm unsure if you've run into them upstream.

See google/sanitizers#925

cpython/Modules/_posixsubprocess.c

Lines 43 to 49 in 5041c2b

	#if defined(__linux__) && defined(HAVE_VFORK) && defined(HAVE_SIGNAL_H) && \
	defined(HAVE_PTHREAD_SIGMASK) && !defined(HAVE_BROKEN_PTHREAD_SIGMASK)
	/* If this is ever expanded to non-Linux platforms, verify what calls are
	* allowed after vfork(). Ex: setsid() may be disallowed on macOS? */
	# include <signal.h>
	# define VFORK_USABLE 1
	#endif

Linked PRs

• gh-103726: Set up gcc-10 for ASAN #103728
• [3.11] gh-103726: Set up gcc-10 for ASAN (gh-103728) #104794

[corona10]

@colesbury Can I take a look at it?
(Or if you prefer to submit the patch, it will be great)

[gpshead]

bonus points if this can be done only under compiler versions known too old to ASAN the vfork code path so that we retain coverage of what actually gets used when possible.

[corona10]

The CPython GitHub actions ASAN runner currently uses GCC 9.4.0, so it does not properly handle vfork().

But if I understand the issue correctly, what about just upgrading the GCC version by using the apt command for the ASAN tests?

[corona10]

Ah okay, now I understood what the title meant Disable vfork() when running under ASAN.
It will be great if we can only disable vfork() under ASAN for old gcc versions.

[colesbury]

Can I take a look at it?

@corona10 - that would be great.

bonus points if this can be done only under compiler versions known too old to ASAN the vfork code path

We might also want to check the Clang version. I believe that Clang 9.0 and newer support vfork() properly:

But if I understand the issue correctly, what about just upgrading the GCC version by using the apt command for the ASAN tests?

That should work, but that means that if someone is running ASAN with an older compiler locally they may run into false positives. (That might be OK -- we could instruct people to use a newer compiler). I'm not sure which approach is better.

[gpshead]

i'm not too worried about people using old toolchains for modern features such as ASAN. Our advice can simply be "upgrade". In my potentially biased experience people who understand what sanitizers are want the recent features and fixes for those to get more accurate results. So if just upgrading our CI and bot configs to use a more recent version is all it takes, sounds good to me.

[corona10]

So if just upgrading our CI and bot configs to use a more recent version is all it takes, sounds good to me.

+1, I will submit the PR for it

[corona10]

@arhadthedev I think that this is highly related to build rather than extension modules.