UBSan: runtime undefined behaviours when using `-fsanitize=undefined -fno-sanitize-recover`

[picnixz]

Bug report

Bug description:

We finally managed to fix gh-111178, but this is assuming that Python is compiled with -fsanitize=function. When compiling Python as follows (with clang 18.1.8):

./configure \
	-q --with-pydebug \
	--with-undefined-behavior-sanitizer \
	CC=clang LD=clang \
	CFLAGS="-fsanitize=undefined -fno-sanitize-recover" \
	LDFLAGS="-fsanitize=undefined -fno-sanitize-recover"

we still have some tests failing:

• gh-132097: allow AC to disable fastcall convention to avoid UBSan failures #131605 (comment)
• gh-132097: allow AC to disable fastcall convention to avoid UBSan failures #131605 (comment) (cc @vstinner as the original author to gh-111178: Fix function signature in pyexpat.c #131674).

Others related to the second item above:

Details

0:00:56 load avg: 32.43 [448/486/3] test_xxtestfuzz worker non-zero exit code (Exit code 1) -- running (2): test.test_multiprocessing_spawn.test_processes (54.6 sec), test.test_multiprocessing_forkserver.test_processes (55.2 sec)
Modules/expat/xmlparse.c:6779:5: runtime error: call to function expat_default_handler through pointer to incorrect function type 'void (*)(void *, const char *, int)'
/$HOME/lib/python/cpython/./Modules/_elementtree.c:3212: note: expat_default_handler defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Modules/expat/xmlparse.c:6779:5

Others on fautlhandler, but I'm not sure whether this is the UB that is being reported or something else:

Details

 #0 0x7ff4cf25f76b in raise (/lib64/libpthread.so.0+0x1676b) (BuildId: 938e42b7e407d175ee3ef9a89c038168101d330c)
 #1 0x55776b2dc6f2 in faulthandler_raise_sigsegv /$HOME/lib/python/cpython/./Modules/faulthandler.c:1053:5
 #2 0x55776b2dc6f2 in faulthandler_sigsegv /$HOME/lib/python/cpython/./Modules/faulthandler.c:1069:9
 #3 0x55776b01e13d in cfunction_call /$HOME/lib/python/cpython/Objects/methodobject.c:562:18
 #4 0x55776af71824 in _PyObject_MakeTpCall /$HOME/lib/python/cpython/Objects/call.c:242:18
 #5 0x55776b1a4db0 in _PyEval_EvalFrameDefault /$HOME/lib/python/cpython/Python/generated_cases.c.h:1434:35
 #6 0x55776b174755 in _PyEval_Vector /$HOME/lib/python/cpython/Python/ceval.c:1902:12
 #7 0x55776b1744d9 in PyEval_EvalCode /$HOME/lib/python/cpython/Python/ceval.c:829:21
 #8 0x55776b2956b3 in run_mod /$HOME/lib/python/cpython/Python/pythonrun.c:1436:19
 #9 0x55776b292931 in _PyRun_StringFlagsWithName /$HOME/lib/python/cpython/Python/pythonrun.c:1259:15
 #10 0x55776b292931 in _PyRun_SimpleStringFlagsWithName /$HOME/lib/python/cpython/Python/pythonrun.c:578:15
 #11 0x55776b2d70e5 in pymain_run_command /$HOME/lib/python/cpython/Modules/main.c:255:11
 #12 0x55776b2d70e5 in pymain_run_python /$HOME/lib/python/cpython/Modules/main.c:671:21
 #13 0x55776b2d70e5 in Py_RunMain /$HOME/lib/python/cpython/Modules/main.c:761:5
 #14 0x55776b2d7775 in pymain_main /$HOME/lib/python/cpython/Modules/main.c:791:12
 #15 0x55776b2d7802 in Py_BytesMain /$HOME/lib/python/cpython/Modules/main.c:815:12
 #16 0x7ff4cf03624c in __libc_start_main (/lib64/libc.so.6+0x3524c) (BuildId: 74f77bf013a66413c77197c121955e029c32d259)
 #17 0x55776ae8dd49 in _start /home/abuild/rpmbuild/BUILD/glibc-2.31/csu/../sysdeps/x86_64/start.S:120

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV (/lib64/libpthread.so.0+0x1676b) (BuildId: 938e42b7e407d175ee3ef9a89c038168101d330c) in raise
==9369==ABORTING

Finally, test_regrtest also fails but the test suite just hangs after crashing (but the UB seems to happen in a test related to XML so it's probably the same thing):

Details

0:01:16 load avg: 26.11 [485/486/5] test_regrtest failed (1 failure) (38.8 sec) -- running (1): test_socket (35.7 sec)
test test_regrtest failed -- Traceback (most recent call last):
 File "/$HOME/lib/python/cpython/Lib/test/test_regrtest.py", line 2289, in test_xml
 output = self.run_tests(testname, "--junit-xml", filename,
 exitcode=EXITCODE_BAD_TEST)
 File "/$HOME/lib/python/cpython/Lib/test/test_regrtest.py", line 927, in run_tests
 return self.run_python(cmdargs, **kw)
 ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
 File "/$HOME/lib/python/cpython/Lib/test/test_regrtest.py", line 777, in run_python
 proc = self.run_command(args, **kw)
 File "/$HOME/lib/python/cpython/Lib/test/test_regrtest.py", line 768, in run_command
 self.fail(msg)
 ~~~~~~~~~^^^^^
AssertionError: Command ['/$HOME/lib/python/cpython/python', '-X', 'faulthandler', '-I', '-m', 'test', '--testdir=/tmp/test_python_3mwd8cdm/tmpsfkk6fdz', 'test_regrtest_noop51', '--junit-xml', '@test_12395_tmpæ'] failed with exit code 1, but exit code 2 expected!

stdout:
---
Using random seed: 777580575
0:00:00 load avg: 26.11 Run 1 test sequentially in a single process
0:00:00 load avg: 26.11 [1/1] test_regrtest_noop51
test test_regrtest_noop51 failed -- Traceback (most recent call last):
 File "/tmp/test_python_3mwd8cdm/tmpsfkk6fdz/test_regrtest_noop51.py", line 8, in test_failed
 self.fail()
 ~~~~~~~~~^^
AssertionError: None

Stdout:
abc ef


Stdout:
abc ef
Modules/expat/xmlparse.c:3162:9: runtime error: call to function expat_start_handler through pointer to incorrect function type 'void (*)(void *, const char *, const char **)'
/$HOME/lib/python/cpython/./Modules/_elementtree.c:3259: note: expat_start_handler defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Modules/expat/xmlparse.c:3162:9

---

0:01:46 load avg: 16.11 running (1): test_socket (1 min 5 sec)
^C

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-132097: allow AC to disable fastcall convention to avoid UBSan failures #131605
• gh-132097: remove unnecessary clinic casts to PyCFunction and others #131665
• gh-132097: fix runtime UB when calling expat handlers #132265
• gh-132097: skip tests raising an explicit SIGSEV when UB sanitizer is on #132398
• gh-132097: use a macro for semantically casting function pointers #132406

[picnixz]

After the two main PRs (not the cosmetic one) the full test suite should be free of undefined behaviors:

== Tests result: FAILURE ==

15 tests skipped:
 test.test_asyncio.test_windows_events
 test.test_asyncio.test_windows_utils test_android test_apple
 test_devpoll test_free_threading test_kqueue test_launcher
 test_msvcrt test_perf_profiler test_startfile test_winapi
 test_winconsoleio test_winreg test_wmi

11 tests skipped (resource denied):
 test_curses test_peg_generator test_pyrepl test_smtpnet
 test_socketserver test_tkinter test_ttk test_urllib2net
 test_urllibnet test_winsound test_zipfile64

1 test failed:
 test_clinic

459 tests OK.

Note that there are still probably undefined behaviors but the paths are not checked at all. For instance, I haven't checked the UBs on the free-threaded build (maybe there are some paths that are affected) or on the JIT.