Re-enabling RBE ubsan (#27861)

* Cherry-pick #27439

* Fix StatusGetTime misalignment

* Fix memcpy with nullptr

* Fix boringssl ubsan issue

* Fix slice ubsan issue

* Ignore msan errors for ubsan

* Add upb UBSAN exception

* Add local ubsan run comment

* Revert "Fix StatusGetTime misalignment"

This reverts commit a1d0c34e8ea6933d09386867e8d4836d9e1b4e1c.

* Fix status_helper

* Added alignas

* Fix fuzzer_corpus_test

* Removed binder_transport_test from ubsan

src/core/lib/gprpp/status_helper.cc

@@ -230,7 +230,10 @@ absl::optional<absl::Time> StatusGetTime(const absl::Status& status,
   if (p.has_value()) {
     absl::optional<absl::string_view> sv = p->TryFlat();
     if (sv.has_value()) {
-      return *reinterpret_cast<const absl::Time*>(sv->data());
+      // copy the content before casting to avoid misaligned address access
+      alignas(absl::Time) char buf[sizeof(const absl::Time)];
+      memcpy(buf, sv->data(), sizeof(const absl::Time));
+      return *reinterpret_cast<const absl::Time*>(buf);
     } else {
       std::string s = std::string(*p);
       return *reinterpret_cast<const absl::Time*>(s.c_str());

src/core/lib/security/context/security_context.cc

@@ -235,7 +235,9 @@ void grpc_auth_context::add_property(const char* name, const char* value,
   grpc_auth_property* prop = &properties_.array[properties_.count++];
   prop->name = gpr_strdup(name);
   prop->value = static_cast<char*>(gpr_malloc(value_length + 1));
-  memcpy(prop->value, value, value_length);
+  if (value != nullptr) {
+    memcpy(prop->value, value, value_length);
+  }
   prop->value[value_length] = '\0';
   prop->value_length = value_length;
 }

src/core/lib/slice/slice.cc

@@ -215,7 +215,9 @@ grpc_slice grpc_slice_from_copied_buffer(const char* source, size_t length) {
     slice = grpc_core::UnmanagedMemorySlice(
         length, grpc_core::UnmanagedMemorySlice::ForceHeapAllocation());
   }
-  memcpy(GRPC_SLICE_START_PTR(slice), source, length);
+  if (length > 0) {
+    memcpy(GRPC_SLICE_START_PTR(slice), source, length);
+  }
   return slice;
 }
 

test/core/transport/binder/BUILD

@@ -92,6 +92,10 @@ grpc_cc_test(
         "gtest",
     ],
     language = "C++",
+    tags = [
+        # To avoid `symbolizer buffer too small` warning of UBSAN
+        "noubsan",
+    ],
     uses_polling = False,
     deps = [
         ":mock_objects",

test/core/util/fuzzer_corpus_test.cc

@@ -57,7 +57,9 @@ TEST_P(FuzzerCorpusTest, RunOneExample) {
                                grpc_load_file(GetParam().c_str(), 0, &buffer)));
   size_t length = GRPC_SLICE_LENGTH(buffer);
   void* data = gpr_malloc(length);
-  memcpy(data, GPR_SLICE_START_PTR(buffer), length);
+  if (length > 0) {
+    memcpy(data, GPR_SLICE_START_PTR(buffer), length);
+  }
   grpc_slice_unref(buffer);
   grpc_shutdown();
   LLVMFuzzerTestOneInput(static_cast<uint8_t*>(data), length);

test/core/util/ubsan_suppressions.txt

@@ -26,3 +26,8 @@ enum:api_fuzzer
 # https://github.com/GoogleCloudPlatform/layer-definitions/issues/531 is
 # addressed.
 alignment:grpc_core::XdsPriorityListUpdate::*
+# Benign pointer-overflow error in boringssl
+# (ref: https://github.com/openssl/openssl/issues/16816)
+pointer-overflow:mem_ctrl
+# https://github.com/protocolbuffers/upb/issues/452
+pointer-overflow:_upb_extreg_add

tools/bazel.rc

@@ -80,16 +80,24 @@ build:tsan --test_env=TSAN_OPTIONS=report_atomic_races=0
 build:tsan --action_env=TSAN_OPTIONS=suppressions=test/core/util/tsan_suppressions.txt:halt_on_error=1:second_deadlock_stack=1
 
 build:ubsan --strip=never
+build:ubsan --copt=-fsanitize=undefined
 build:ubsan --copt=-fsanitize-link-c++-runtime
 build:ubsan --copt=-fno-omit-frame-pointer
 build:ubsan --copt=-DGRPC_UBSAN
 build:ubsan --copt=-DNDEBUG
 build:ubsan --copt=-fno-sanitize=function,vptr
+build:ubsan --linkopt=-fsanitize=undefined
+# avoid ubsan build error with int128 by linking against libc++
+# see b/200667821
 build:ubsan --linkopt=-fsanitize-link-c++-runtime
+build:ubsan --linkopt=-lc++
+build:ubsan --linkopt=-lc++abi
+build:ubsan --linkopt=-lm
 build:ubsan --action_env=UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1:suppressions=test/core/util/ubsan_suppressions.txt
-# For some reasons, these two stopped being propagated, so, redeclaring them here.
+# if you want to run ubsan locally, uncomment following three lines
-# That's a hack that needs to be removed once we understand what's going on.
+# build:ubsan --linkopt=-lgcc_s
-build:ubsan --copt=-DGRPC_PORT_ISOLATED_RUNTIME=1
+# build:ubsan --linkopt=-lubsan
+# build:ubsan --linkopt=--rtlib=compiler-rt
 
 build:basicprof --strip=never
 build:basicprof --copt=-DNDEBUG

tools/remote_build/rbe_common.bazelrc

@@ -79,7 +79,6 @@ build:tsan --copt=-gmlt
 # tests tend to be slower
 build:tsan --test_timeout=60,600,1800,3600
 build:tsan --test_tag_filters=-no_linux,-notsan,-qps_json_driver
-build:tsan --extra_execution_platforms=@rbe_default//config:platform
 
 # undefined behavior sanitizer: most settings are already in %workspace%/.bazelrc
 # we only need a few additional ones that are Foundry specific
@@ -87,3 +86,12 @@ build:ubsan --copt=-gmlt
 # use double the default value for "moderate" and "long" timeout as sanitizer
 # tests tend to be slower
 build:ubsan --test_timeout=60,600,1800,3600
+# RBE docker image only has a msan specific version of libc++, so to be able to link against it,
+# we need to involuntarily enable msan as well to be able to build. See b/200667821
+# TODO(jtattermusch): disable memory sanitizer for ubsan build as soon as possible.
+build:ubsan --copt=-fsanitize=memory
+build:ubsan --copt=-fsanitize-recover=memory
+build:ubsan --linkopt=-fsanitize=memory
+build:ubsan --cxxopt=--stdlib=libc++
+build:ubsan --action_env=MSAN_OPTIONS=halt_on_error=0
+build:ubsan --test_tag_filters=-no_linux,-noubsan