Sanitizers

mohitmishra786/low-level-dev-skills/skills/runtimes/sanitizers

作者 mohitmishra786bdc58472fa9f无许可证253 个星标收录于 2026年10月9日更新于 2026年10月9日仓库3个月前更新

Compiler sanitizer skill for runtime bug detection in C/C++. Use when enabling and interpreting AddressSanitizer (ASan), UndefinedBehaviorSanitizer (UBSan), ThreadSanitizer (TSan), MemorySanitizer (MSan), or LeakSanitizer (LSan) with GCC or Clang. Activates on queries about sanitizer flags, sanitizer reports, ASAN_OPTIONS, memory errors, data races, undefined behaviour, uninitialised reads, or choosing which sanitizer to use for a given bug class.

仅含说明Software Development

AI 生成的概览

指导选择、启用和解读 C/C++ 编译器 sanitizer，如 ASan、UBSan、TSan、MSan 和 LSan。

功能: 说明各类缺陷（内存错误、未定义行为、数据竞争、未初始化读取、内存泄漏）应选用哪种 sanitizer，并给出启用所需的编译选项。介绍如何阅读 sanitizer 报告、设置 ASAN_OPTIONS 等运行时选项、编写抑制文件，以及在 CMake 和 CI 中集成 sanitizer。还涵盖 HWASan、MemTagSanitizer、GWP-ASan 以及用于内核模块的 KASAN，并附有编译选项和报告解读的参考文件。
适用场景: 当 C/C++ 程序出现内存错误、崩溃、数据竞争或未定义行为，需要选择并启用合适的 sanitizer 时使用。也适用于解读 sanitizer 报告、抑制误报，或在构建和 CI 流程中运行 sanitizer。
运行要求: 无需脚本，仅含说明文档和两个参考文件。需要 C/C++ 工具链（GCC 或 Clang）；部分 sanitizer 还要求 Clang、支持 TBI/MTE 的 ARM64 硬件或启用 KASAN 的内核。无需凭据或网络访问。

Sanitizers

Purpose

Guide agents through choosing, enabling, and interpreting compiler runtime sanitizers for finding memory errors, undefined behaviour, data races, and memory leaks.

Triggers

"My program has a memory error — which sanitizer do I use?"
"How do I enable ASan?"
"How do I interpret an ASan/UBSan/TSan report?"
"ASan says heap-buffer-overflow — what does that mean?"
"How do I suppress false positives in sanitizers?"
"Can I use sanitizers in CI?"

Workflow

1. Decision tree: which sanitizer?

bash

Bug class?├── Memory OOB, use-after-free, double-free → AddressSanitizer (ASan)├── Stack OOB, global OOB → ASan (all three covered)├── Uninitialised reads → MemorySanitizer (MSan, Clang only, requires all-clang build)├── Undefined behaviour (int overflow, null deref, bad cast) → UBSan├── Data races (multi-thread) → ThreadSanitizer (TSan)├── Memory leaks only → LeakSanitizer (LSan, standalone or via ASan)└── Multiple classes → ASan + UBSan (common combo); cannot combine with TSan or MSan

Bug class?├── Memory OOB, use-after-free, double-free → AddressSanitizer (ASan)├── Stack OOB, global OOB → ASan (all three covered)├── Uninitialised reads → MemorySanitizer (MSan, Clang only, requires all-clang build)├── Undefined behaviour (int overflow, null deref, bad cast) → UBSan├── Data races (multi-thread) → ThreadSanitizer (TSan)├── Memory leaks only → LeakSanitizer (LSan, standalone or via ASan)└── Multiple classes → ASan + UBSan (common combo); cannot combine with TSan or MSan

2. AddressSanitizer (ASan)

bash

# GCC or Clanggcc -fsanitize=address -fno-omit-frame-pointer -g -O1 -o prog main.c# Orclang -fsanitize=address -fno-omit-frame-pointer -g -O1 -o prog main.c

# GCC or Clanggcc -fsanitize=address -fno-omit-frame-pointer -g -O1 -o prog main.c# Orclang -fsanitize=address -fno-omit-frame-pointer -g -O1 -o prog main.c

Runtime options (via ASAN_OPTIONS):

`ASAN_OPTIONS` key	Effect
`detect_leaks=0/1`	Enable LeakSanitizer (default 1 on Linux)
`abort_on_error=1`	Call `abort()` instead of `_exit()` (for core dumps)
`log_path=path`	Write report to file
`symbolize=1`	Symbolize addresses (needs `llvm-symbolizer` in PATH)
`fast_unwind_on_malloc=0`	More accurate stacks (slower)
`quarantine_size_mb=256`	Delay reuse of freed memory

Interpreting ASan output:

text

==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000050READ of size 4 at 0x602000000050 thread T0    #0 0x401234 in foo /home/user/src/main.c:15    #1 0x401567 in main /home/user/src/main.c:42
0x602000000050 is located 0 bytes after a 40-byte region[0x602000000028, 0x602000000050) allocated at:    #0 0x7f12345 in malloc ...    #1 0x401234 in main /home/user/src/main.c:10

==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000050READ of size 4 at 0x602000000050 thread T0    #0 0x401234 in foo /home/user/src/main.c:15    #1 0x401567 in main /home/user/src/main.c:42
0x602000000050 is located 0 bytes after a 40-byte region[0x602000000028, 0x602000000050) allocated at:    #0 0x7f12345 in malloc ...    #1 0x401234 in main /home/user/src/main.c:10

Reading: the top frame in WRITE/READ is the access site; the allocated at stack shows the allocation. The region is 40 bytes at [start, end) and the access is at end = one byte past the end (classic off-by-one).

3. UndefinedBehaviorSanitizer (UBSan)

bash

gcc -fsanitize=undefined -g -O1 -o prog main.c# More complete: add specific checksgcc -fsanitize=undefined,integer -g -O1 -o prog main.c

gcc -fsanitize=undefined -g -O1 -o prog main.c# More complete: add specific checksgcc -fsanitize=undefined,integer -g -O1 -o prog main.c

Common UBSan checks:

signed-integer-overflow
unsigned-integer-overflow (not in undefined by default)
null — null pointer dereference
bounds — array index OOB (compile-time knowable bounds)
alignment — misaligned pointer access
float-cast-overflow — float-to-int conversion overflow
vptr — C++ vtable type mismatch
shift-exponent — shift >= bit width

bash

# Enable everything including integer overflowgcc -fsanitize=undefined \    -fsanitize=signed-integer-overflow,unsigned-integer-overflow,float-cast-overflow \    -fno-sanitize-recover=all \   # abort instead of continue    -g -O1 -o prog main.c

# Enable everything including integer overflowgcc -fsanitize=undefined \    -fsanitize=signed-integer-overflow,unsigned-integer-overflow,float-cast-overflow \    -fno-sanitize-recover=all \   # abort instead of continue    -g -O1 -o prog main.c

-fno-sanitize-recover=all: makes UBSan abort on first error (important for CI).

Interpreting UBSan output:

text

src/main.c:15:12: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'

src/main.c:15:12: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'

4. ThreadSanitizer (TSan)

bash

# Clang or GCC (GCC ≥ 4.8)clang -fsanitize=thread -g -O1 -o prog main.c
# TSan is incompatible with ASan and MSan

# Clang or GCC (GCC ≥ 4.8)clang -fsanitize=thread -g -O1 -o prog main.c
# TSan is incompatible with ASan and MSan

Interpreting TSan output:

text

WARNING: ThreadSanitizer: data race (pid=12345)  Write of size 4 at 0x7f... by thread T2:    #0 increment /home/user/src/counter.c:8  Previous read of size 4 at 0x7f... by thread T1:    #0 read_counter /home/user/src/counter.c:3

WARNING: ThreadSanitizer: data race (pid=12345)  Write of size 4 at 0x7f... by thread T2:    #0 increment /home/user/src/counter.c:8  Previous read of size 4 at 0x7f... by thread T1:    #0 read_counter /home/user/src/counter.c:3

5. MemorySanitizer (MSan)

MSan detects reads of uninitialised memory. Clang only. Requires all-instrumented build (no mixing of MSan and non-MSan objects).

bash

clang -fsanitize=memory -fno-omit-frame-pointer -g -O1 -o prog main.c# With origin tracking (slower but shows where uninit value came from)clang -fsanitize=memory -fsanitize-memory-track-origins=2 -g -O1 -o prog main.c

clang -fsanitize=memory -fno-omit-frame-pointer -g -O1 -o prog main.c# With origin tracking (slower but shows where uninit value came from)clang -fsanitize=memory -fsanitize-memory-track-origins=2 -g -O1 -o prog main.c

System libraries must be rebuilt with MSan or substituted with MSan-instrumented wrappers. Use msan-libs toolchain from LLVM.

6. ASan + UBSan combined

bash

gcc -fsanitize=address,undefined -fno-sanitize-recover=all \    -fno-omit-frame-pointer -g -O1 -o prog main.c

gcc -fsanitize=address,undefined -fno-sanitize-recover=all \    -fno-omit-frame-pointer -g -O1 -o prog main.c

Do not combine with TSan or MSan.

7. Suppressions

bash

# ASan suppression filecat > asan.supp << 'EOF'# Suppress leaks from OpenSSL initleak:CRYPTO_mallocEOF
LSAN_OPTIONS=suppressions=asan.supp ./prog
# UBSan suppressioncat > ubsan.supp << 'EOF'signed-integer-overflow:third_party/fast_math.cEOFUBSAN_OPTIONS=suppressions=ubsan.supp:print_stacktrace=1 ./prog

# ASan suppression filecat > asan.supp << 'EOF'# Suppress leaks from OpenSSL initleak:CRYPTO_mallocEOF
LSAN_OPTIONS=suppressions=asan.supp ./prog
# UBSan suppressioncat > ubsan.supp << 'EOF'signed-integer-overflow:third_party/fast_math.cEOFUBSAN_OPTIONS=suppressions=ubsan.supp:print_stacktrace=1 ./prog

8. CMake integration

cmake

option(SANITIZE "Enable sanitizers" OFF)if(SANITIZE)    set(san_flags -fsanitize=address,undefined -fno-sanitize-recover=all                  -fno-omit-frame-pointer -g -O1)    add_compile_options(${san_flags})    add_link_options(${san_flags})endif()

option(SANITIZE "Enable sanitizers" OFF)if(SANITIZE)    set(san_flags -fsanitize=address,undefined -fno-sanitize-recover=all                  -fno-omit-frame-pointer -g -O1)    add_compile_options(${san_flags})    add_link_options(${san_flags})endif()

9. CI integration

yaml

# GitHub Actions example- name: Build with ASan+UBSan  run: |    cmake -S . -B build -DSANITIZE=ON    cmake --build build -j$(nproc)
- name: Run tests under sanitizers  run: |    ASAN_OPTIONS=abort_on_error=1:detect_leaks=1 \    UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 \    ctest --test-dir build -j$(nproc) --output-on-failure

# GitHub Actions example- name: Build with ASan+UBSan  run: |    cmake -S . -B build -DSANITIZE=ON    cmake --build build -j$(nproc)
- name: Run tests under sanitizers  run: |    ASAN_OPTIONS=abort_on_error=1:detect_leaks=1 \    UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 \    ctest --test-dir build -j$(nproc) --output-on-failure

10. HWASan (Hardware-Assisted AddressSanitizer)

Lower overhead than ASan on supported ARM64 hardware with TBI (Top Byte Ignore) or MTE.

bash

# Clang/LLVM HWASan (userspace)clang -fsanitize=hwaddress -g -O1 -o app app.c
# Requires ARM64 with TBI (most Android/arm64 servers) or HWASan tagging support# Cannot combine with ASan on same build

# Clang/LLVM HWASan (userspace)clang -fsanitize=hwaddress -g -O1 -o app app.c
# Requires ARM64 with TBI (most Android/arm64 servers) or HWASan tagging support# Cannot combine with ASan on same build

11. MemTagSanitizer (ARM MTE)

Uses ARM Memory Tagging Extension hardware tags for heap/stack/memory safety.

bash

# Experimental — LLVM with MTE-capable hardware (arm64)clang -fsanitize=memtag -g -O1 -o app app.c
# Kernel MTE (separate from userspace MemTagSanitizer)# CONFIG_ARM64_MTE=y — hardware tagging in kernel allocator

# Experimental — LLVM with MTE-capable hardware (arm64)clang -fsanitize=memtag -g -O1 -o app app.c
# Kernel MTE (separate from userspace MemTagSanitizer)# CONFIG_ARM64_MTE=y — hardware tagging in kernel allocator

12. GWP-ASan (production sampling)

Sampled guard-page ASan suitable for production (used in Android; upstream glibc integration is ongoing).

bash

# LLVM GWP-ASan (link-time, sampled allocations)clang -fsanitize=gwp-asan -O2 -o app app.c
# Android: enabled in some system components for sampled crash detection# glibc: experimental GWP-ASan allocator integration (check distro release notes)

# LLVM GWP-ASan (link-time, sampled allocations)clang -fsanitize=gwp-asan -O2 -o app app.c
# Android: enabled in some system components for sampled crash detection# glibc: experimental GWP-ASan allocator integration (check distro release notes)

Catches heap OOB/UAF probabilistically with near-zero steady-state overhead.

13. KASAN for kernel modules

bash

# Build test kernel with KASAN# CONFIG_KASAN=y CONFIG_KASAN_INLINE=y or CONFIG_KASAN_OUTLINE=y
# Boot KASAN kernel in QEMU for module developmentqemu-system-x86_64 -kernel bzImage -append "kasan=on" ...
# Load module — KASAN reports appear in dmesgsudo insmod mymod.kodmesg | tail -30

# Build test kernel with KASAN# CONFIG_KASAN=y CONFIG_KASAN_INLINE=y or CONFIG_KASAN_OUTLINE=y
# Boot KASAN kernel in QEMU for module developmentqemu-system-x86_64 -kernel bzImage -append "kasan=on" ...
# Load module — KASAN reports appear in dmesgsudo insmod mymod.kodmesg | tail -30

Pair with skills/kernel/kernel-testing for KUnit tests under KASAN. See skills/security/kernel-security for KASAN report triage.

For a quick flag reference, see references/flags.md [blocked]. For report interpretation examples, see references/reports.md [blocked].

Related skills

Use skills/profilers/valgrind for Memcheck when ASan is unavailable
Use skills/runtimes/fuzzing to auto-generate inputs that trigger sanitizer errors
Use skills/compilers/gcc or skills/compilers/clang for build flag context

来源与署名

来源：mohitmishra786/low-level-dev-skills位于skills/runtimes/sanitizers提交bdc5847

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Sanitizer	Overhead	Platform
ASan	~2x	x86, arm64
HWASan	~1.2–1.5x	arm64 with TBI/MTE
MSan	~3x	LLVM only

Sanitizers

Sanitizers

Purpose

Triggers

Workflow

1. Decision tree: which sanitizer?

2. AddressSanitizer (ASan)

3. UndefinedBehaviorSanitizer (UBSan)

4. ThreadSanitizer (TSan)

5. MemorySanitizer (MSan)

6. ASan + UBSan combined

7. Suppressions

8. CMake integration

9. CI integration

10. HWASan (Hardware-Assisted AddressSanitizer)

11. MemTagSanitizer (ARM MTE)

12. GWP-ASan (production sampling)

13. KASAN for kernel modules

Related skills

来源与署名

更多来自 mohitmishra786/low-level-dev-skills 的技能

Zig Debugging

Simd Intrinsics

Zig Cross

Rustc Basics

Zig Cinterop

Zig Build System

更多Software Development技能

Playground

M5 Onboard

Cardputer Buddy

Web Design Guidelines

Vercel React Native Skills

Vercel React Best Practices