Opened 5 months ago

Closed 4 months ago

#2588 closed defect (invalid)

Unable to compile Nginx with both dynamic module and ASAN at the same time

Reported by: Ivan Shaverskyi Owned by:
Priority: minor Milestone:
Component: nginx-core Version: 1.23.x
Keywords: ASAN, Address Sanitizer, Dynamic Module Cc:
uname -a: Linux ca01ad098466 3.10.0-1160.102.1.el7.x86_64 #1 SMP Tue Oct 17 15:42:21 UTC 2023 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.23.2
built by gcc 10.2.1 20210110 (Debian 10.2.1-6)
built with OpenSSL 1.1.1w 11 Sep 2023
TLS SNI support enabled
configure arguments: --with-cc-opt='-fsanitize=address -DNGX_DEBUG_PALLOC=1' --with-ld-opt=-fsanitize=address --with-compat --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/ --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module


We have Nginx module we'd like to test with ASAN. When trying to both add the keys needed for ASAN (per Development guide) and --add-dynamic-module once Nginx starts we get an error like so

==1==ASan runtime does not come first in initial library list; you should either link runtime to your application or manually preload it with LD_PRELOAD.

When we only add keys for ASAN everything seems fine. Is there something we're missing to build Nginx ASAN and dynamic module all at once or it is not supported yet?

Attaching slightly obfuscated Dockerfile for this issue (it's not the prettiest one, we quickly made it for testing)

Also, I know it's supposed to be a different ticket but for some reason even when assembling Nginx with ASAN without dynamic module, when ASAN_OPTIONS=detect_leaks=1 is set, we fail on checking int stage in configure like so

checking for int size ...==784==LeakSanitizer has encountered a fatal error.

Attachments (1)

Dockerfile_ubuntu (2.8 KB ) - added by Ivan Shaverskyi 5 months ago.

Download all attachments as: .zip

Change History (4)

by Ivan Shaverskyi, 5 months ago

Attachment: Dockerfile_ubuntu added

comment:1 by Maxim Dounin, 5 months ago

Could you please clarify what makes you think this is an issue in nginx?

comment:2 by Ivan Shaverskyi, 5 months ago

Hi, we'd expect that just running build with keys from this section of your development guide will be enough to build Nginx with ASAN. That'd be our starting point of our own investigation. But there are no disclaimers that dynamic modules are of any issue.

Our dynamic module doesn't use any external dependencies other that those used by Nginx itself.

comment:3 by Maxim Dounin, 4 months ago

Resolution: invalid
Status: newclosed

Thank you for explanation.

Indeed, development guide recommends usage of Address Sanitizer and gives some basic instructions on how to build nginx with Address Sanitizer enabled. It is merely a recommendation to use it though, and it does not try to be a comprehensive guide on how to use address sanitizers in different environments. Sanitizers are complex beasts, and might not be compatible with many things out there, including various platforms, or even complex enough libraries. If something does not work for you, it's up to you as a developer to debug what goes wrong and find out how to fix things. Please avoid opening tickets here merely because you've tried something and it does not work for you. If you need help, consider asking for it in nginx-devel@ mailing list instead.

As for the original question: Address Sanitizer works fine with dynamic modules. My best guess is that your Dockerfile screws up --with-cc-opts / --with-ld-opts arguments (highly likely you'll end up with more than one, so the last one will be used). Try starting with clean nginx build with only explicitly supplied arguments being used.

Note: See TracTickets for help on using tickets.