feat: enable msan [memory sanitizer] on CI

.github/workflows/build-container.yml

@@ -23,6 +23,11 @@ on:
         description: "Runner label to use for arm64 jobs"
         required: true
         type: string
+      build-arm64:
+        description: "Whether to also build an arm64 image"
+        required: false
+        type: boolean
+        default: true
     outputs:
       path:
         description: "Path to built container"
@@ -79,6 +84,7 @@ jobs:
 
   build-arm64:
     name: Build container (arm64)
+    if: ${{ inputs.build-arm64 }}
     runs-on: ${{ inputs.runs-on-arm64 }}
     outputs:
       digest: ${{ steps.build.outputs.digest }}
@@ -125,7 +131,12 @@ jobs:
 
   create-manifest:
     name: Create multi-arch manifest
-    runs-on: ${{ inputs.runs-on-arm64 }}
+    # build-arm64 is skipped when the arm64 image is not requested; the
+    # default success() condition would skip this job along with it.
+    if: |
+      !cancelled() && needs.build-amd64.result == 'success' &&
+      (needs.build-arm64.result == 'success' || needs.build-arm64.result == 'skipped')
+    runs-on: ${{ inputs.build-arm64 && inputs.runs-on-arm64 || inputs.runs-on-amd64 }}
     needs: [build-amd64, build-arm64]
     steps:
       - name: Checkout code
@@ -151,15 +162,14 @@ jobs:
           TAG="${{ needs.build-amd64.outputs.tag }}"
           HASH_TAG="${{ hashFiles(inputs.file) }}"
 
+          SOURCES=("${REPO}:${HASH_TAG}-amd64")
+          if [ "${{ inputs.build-arm64 }}" = "true" ]; then
+            SOURCES+=("${REPO}:${HASH_TAG}-arm64")
+          fi
+
           # Create manifest from arch-specific images
-          docker buildx imagetools create -t "${REPO}:${HASH_TAG}" \
-            "${REPO}:${HASH_TAG}-amd64" \
-            "${REPO}:${HASH_TAG}-arm64"
+          docker buildx imagetools create -t "${REPO}:${HASH_TAG}" "${SOURCES[@]}"
 
-          docker buildx imagetools create -t "${REPO}:${TAG}" \
-            "${REPO}:${HASH_TAG}-amd64" \
-            "${REPO}:${HASH_TAG}-arm64"
+          docker buildx imagetools create -t "${REPO}:${TAG}" "${SOURCES[@]}"
 
-          docker buildx imagetools create -t "${REPO}:latest" \
-            "${REPO}:${HASH_TAG}-amd64" \
-            "${REPO}:${HASH_TAG}-arm64"
+          docker buildx imagetools create -t "${REPO}:latest" "${SOURCES[@]}"

.github/workflows/build.yml

@@ -115,6 +115,21 @@ jobs:
       runs-on-amd64: ${{ needs.check-skip.outputs['runner-amd64'] }}
       runs-on-arm64: ${{ needs.check-skip.outputs['runner-arm64'] }}
 
+  container-msan:
+    name: Build msan container
+    needs: [check-skip]
+    if: ${{ needs.check-skip.outputs.skip == 'false' && vars.SKIP_LINUX64_MSAN == '' }}
+    uses: ./.github/workflows/build-container.yml
+    with:
+      context: ./contrib/containers/ci
+      file: ./contrib/containers/ci/ci-msan.Dockerfile
+      name: dashcore-ci-msan
+      runs-on-amd64: ${{ needs.check-skip.outputs['runner-amd64'] }}
+      runs-on-arm64: ${{ needs.check-skip.outputs['runner-arm64'] }}
+      # All linux64_msan jobs are pinned to amd64 runners, so an arm64
+      # image (with its expensive MSan libc++ build) would go unused.
+      build-arm64: false
+
   depends-aarch64-linux:
     name: aarch64-linux-gnu
     uses: ./.github/workflows/build-depends.yml
@@ -141,6 +156,17 @@ jobs:
       base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
 
+  depends-linux64_msan:
+    name: x86_64-pc-linux-gnu_msan
+    uses: ./.github/workflows/build-depends.yml
+    needs: [check-skip, container-msan, cache-sources]
+    if: ${{ vars.SKIP_LINUX64_MSAN == '' }}
+    with:
+      build-target: linux64_msan
+      container-path: ${{ needs.container-msan.outputs.path }}
+      base-image-digest: ${{ needs.check-skip.outputs.base-image-digest }}
+      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+
   depends-linux64_multiprocess:
     name: linux64_multiprocess
     uses: ./.github/workflows/build-depends.yml
@@ -250,6 +276,20 @@ jobs:
       depends-artifact: ${{ needs.depends-linux64.outputs.built-artifact }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
 
+  src-linux64_msan:
+    name: linux64_msan-build
+    uses: ./.github/workflows/build-src.yml
+    needs: [check-skip, container-msan, depends-linux64_msan]
+    if: ${{ vars.SKIP_LINUX64_MSAN == '' }}
+    with:
+      build-target: linux64_msan
+      container-path: ${{ needs.container-msan.outputs.path }}
+      depends-key: ${{ needs.depends-linux64_msan.outputs.key }}
+      depends-host: ${{ needs.depends-linux64_msan.outputs.host }}
+      depends-dep-opts: ${{ needs.depends-linux64_msan.outputs.dep-opts }}
+      depends-artifact: ${{ needs.depends-linux64_msan.outputs.built-artifact }}
+      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+
   src-linux64_multiprocess:
     name: linux64_multiprocess-build
     uses: ./.github/workflows/build-src.yml
@@ -352,6 +392,16 @@ jobs:
       container-path: ${{ needs.container-slim.outputs.path }}
       runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
 
+  test-linux64_msan:
+    name: linux64_msan-test
+    uses: ./.github/workflows/test-src.yml
+    needs: [check-skip, container-msan, src-linux64_msan, lint]
+    with:
+      bundle-key: ${{ needs.src-linux64_msan.outputs.key }}
+      build-target: linux64_msan
+      container-path: ${{ needs.container-msan.outputs.path }}
+      runs-on: ${{ needs.check-skip.outputs['runner-amd64'] }}
+
   test-linux64_multiprocess:
     name: linux64_multiprocess-test
     uses: ./.github/workflows/test-src.yml

ci/dash/matrix.sh

@@ -22,6 +22,8 @@ elif [ "$BUILD_TARGET" = "linux64" ]; then
   source ./ci/test/00_setup_env_native_qt5.sh
 elif [ "$BUILD_TARGET" = "linux64_asan" ]; then
   source ./ci/test/00_setup_env_native_asan.sh
+elif [ "$BUILD_TARGET" = "linux64_msan" ]; then
+  source ./ci/test/00_setup_env_native_msan.sh
 elif [ "$BUILD_TARGET" = "linux64_fuzz" ]; then
   source ./ci/test/00_setup_env_native_fuzz.sh
 elif [ "$BUILD_TARGET" = "linux64_multiprocess" ]; then

ci/test/00_setup_env_native_fuzz_with_msan.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2020-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="docker.io/ubuntu:24.04"
+LIBCXX_DIR="/msan/cxx_build/"
+export MSAN_FLAGS="-fsanitize=memory -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer -g -O1 -fno-optimize-sibling-calls"
+LIBCXX_FLAGS="-nostdinc++ -nostdlib++ -isystem ${LIBCXX_DIR}include/c++/v1 -L${LIBCXX_DIR}lib -Wl,-rpath,${LIBCXX_DIR}lib -lc++ -lc++abi -lpthread -Wno-unused-command-line-argument"
+export MSAN_AND_LIBCXX_FLAGS="${MSAN_FLAGS} ${LIBCXX_FLAGS}"
+
+export CONTAINER_NAME="ci_native_fuzz_msan"
+export PACKAGES="ninja-build"
+# BDB generates false-positives and will be removed in future
+export DEP_OPTS="DEBUG=1 NO_BDB=1 NO_QT=1 CC=clang CXX=clang++ CFLAGS='${MSAN_FLAGS}' CXXFLAGS='${MSAN_AND_LIBCXX_FLAGS}'"
+export GOAL="install"
+# _FORTIFY_SOURCE is not compatible with MSAN.
+export BITCOIN_CONFIG="--enable-fuzz --with-sanitizers=fuzzer,memory CPPFLAGS='-DBOOST_MULTI_INDEX_ENABLE_SAFE_MODE -U_FORTIFY_SOURCE'"
+export USE_MEMORY_SANITIZER="true"
+export RUN_UNIT_TESTS="false"
+export RUN_FUNCTIONAL_TESTS="false"
+export RUN_FUZZ_TESTS=true
+export CCACHE_MAXSIZE=250M

ci/test/00_setup_env_native_msan.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2020-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME="ci_native_msan"
+export HOST=x86_64-pc-linux-gnu
+# Built into the CI image by contrib/containers/ci/ci-msan.Dockerfile so that it
+# lands in a cached layer instead of being rebuilt on every run. Upstream does
+# the equivalent in ci/test/01_base_install.sh, which Dash does not have.
+LIBCXX_DIR="/cxx_build/"
+export MSAN_FLAGS="-fsanitize=memory -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer -g -O1 -fno-optimize-sibling-calls"
+LIBCXX_FLAGS="-nostdinc++ -nostdlib++ -isystem ${LIBCXX_DIR}include/c++/v1 -L${LIBCXX_DIR}lib -Wl,-rpath,${LIBCXX_DIR}lib -lc++ -lc++abi -lpthread -Wno-unused-command-line-argument"
+export MSAN_AND_LIBCXX_FLAGS="${MSAN_FLAGS} ${LIBCXX_FLAGS}"
+
+# BDB generates false-positives and will be removed in future
+export DEP_OPTS="DEBUG=1 NO_BDB=1 NO_QT=1 NO_UPNP=1 NO_NATPMP=1 CC=clang-19 CXX=clang++-19 CFLAGS='${MSAN_FLAGS}' CXXFLAGS='${MSAN_AND_LIBCXX_FLAGS}'"
+export GOAL="install"
+# CC/CXX/CFLAGS/CXXFLAGS are repeated here rather than left to depends'
+# config.site. Upstream dropped them in bitcoin#29800 because its
+# ci/test/03_test_script.sh sets CONFIG_SITE explicitly (bitcoin#26683);
+# ci/dash/build_src.sh still uses the older --prefix form, and this is the only
+# target whose compiler differs from the system default, so nothing else in
+# Dash's CI exercises that hand-off.
+# _FORTIFY_SOURCE is not compatible with MSAN.
+# --with-asm=no and --with-backend=easy keep secp256k1 and relic off
+# hand-written assembly, which MSan cannot see through.
+# --disable-mimalloc selects the plain malloc secure allocator; mimalloc seeds
+# itself with a raw getrandom syscall before main(), which MSan cannot track.
+export BITCOIN_CONFIG="--with-sanitizers=memory --with-gui=no --without-bdb --with-sqlite \
+--with-asm=no --with-backend=easy --disable-mimalloc \
+CC=clang-19 CXX=clang++-19 CFLAGS='${MSAN_FLAGS}' CXXFLAGS='${MSAN_AND_LIBCXX_FLAGS}' \
+CPPFLAGS='-U_FORTIFY_SOURCE'"
+export USE_MEMORY_SANITIZER="true"
+export TEST_RUNNER_TIMEOUT_FACTOR=40

ci/test/04_install.sh

@@ -10,10 +10,6 @@ if [[ $QEMU_USER_CMD == qemu-s390* ]]; then
   export LC_ALL=C
 fi
 
-# Create folders that are mounted into the docker
-mkdir -p "${CCACHE_DIR}"
-mkdir -p "${PREVIOUS_RELEASES_DIR}"
-
 export ASAN_OPTIONS="detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1"
 export LSAN_OPTIONS="suppressions=${BASE_BUILD_DIR}/test/sanitizer_suppressions/lsan:print_suppressions=0"
 export TSAN_OPTIONS="suppressions=${BASE_BUILD_DIR}/test/sanitizer_suppressions/tsan:halt_on_error=1"
@@ -37,7 +33,7 @@ if [ -z "$DANGER_RUN_CI_ON_HOST" ]; then
 
   # shellcheck disable=SC2086
   DOCKER_ID=$(docker run $DOCKER_ADMIN -idt \
-                  --mount type=bind,src=$BASE_ROOT_DIR,dst=/ro_base,readonly \
+                  --mount type=bind,src=$BASE_READ_ONLY_DIR,dst=/ro_base,readonly \
                   --mount type=bind,src=$CCACHE_DIR,dst=$CCACHE_DIR \
                   --mount type=bind,src=$DEPENDS_DIR,dst=$DEPENDS_DIR \
                   --mount type=bind,src=$PREVIOUS_RELEASES_DIR,dst=$PREVIOUS_RELEASES_DIR \
@@ -60,6 +56,9 @@ if [ -z "$DANGER_RUN_CI_ON_HOST" ]; then
   $DOCKER_CI_CMD_PREFIX_ROOT git config --global --add safe.directory "*"
 else
   echo "Running on host system without docker wrapper"
+  echo "Create missing folders"
+  mkdir -p "${CCACHE_DIR}"
+  mkdir -p "${PREVIOUS_RELEASES_DIR}"
 fi
 
 CI_EXEC () {
@@ -130,6 +129,15 @@ fi
 
 CI_EXEC mkdir -p "${BASE_SCRATCH_DIR}/sanitizer-output/"
 
+if [[ ${USE_MEMORY_SANITIZER} == "true" ]]; then
+  CI_EXEC_ROOT "update-alternatives --install /usr/bin/clang++ clang++ \$(which clang++-12) 100"
+  CI_EXEC_ROOT "update-alternatives --install /usr/bin/clang clang \$(which clang-12) 100"
+  DOCKER_EXEC "mkdir -p ${BASE_SCRATCH_DIR}/msan/build/"
+  DOCKER_EXEC "git clone --depth=1 https://github.com/llvm/llvm-project -b llvmorg-12.0.0 ${BASE_SCRATCH_DIR}/msan/llvm-project"
+  DOCKER_EXEC "cd ${BASE_SCRATCH_DIR}/msan/build/ && cmake -DLLVM_ENABLE_PROJECTS='libcxx;libcxxabi' -DCMAKE_BUILD_TYPE=Release -DLLVM_USE_SANITIZER=MemoryWithOrigins -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DLLVM_TARGETS_TO_BUILD=X86 ../llvm-project/llvm/"
+  DOCKER_EXEC "cd ${BASE_SCRATCH_DIR}/msan/build/ && make $MAKEJOBS cxx"
+fi
+
 if [ -z "$DANGER_RUN_CI_ON_HOST" ]; then
   echo "Create $BASE_ROOT_DIR"
   CI_EXEC rsync -a /ro_base/ "$BASE_ROOT_DIR"

ci/test/05_before_script.sh

@@ -19,6 +19,7 @@ CI_EXEC mkdir -p "${DEPENDS_DIR}/SDKs" "${DEPENDS_DIR}/sdk-sources"
 if [ -n "$XCODE_VERSION" ] && [ ! -f "$OSX_SDK_PATH" ]; then
   CI_EXEC curl --location --fail "${SDK_URL}/${OSX_SDK_BASENAME}" -o "$OSX_SDK_PATH"
 fi
+
 if [ -n "$XCODE_VERSION" ] && [ -f "$OSX_SDK_PATH" ]; then
   CI_EXEC tar -C "${DEPENDS_DIR}/SDKs" -xf "$OSX_SDK_PATH"
 fi

configure.ac

@@ -1276,17 +1276,16 @@ if test "$LINK_WRAP_SUPPORTED" = "yes"; then
 fi
 
 dnl Check for different ways of gathering OS randomness
-AC_MSG_CHECKING([for Linux getrandom syscall])
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <unistd.h>
-  #include <sys/syscall.h>
-  #include <linux/random.h>]],
- [[ syscall(SYS_getrandom, nullptr, 32, 0); ]])],
- [ AC_MSG_RESULT([yes]); AC_DEFINE([HAVE_SYS_GETRANDOM], [1], [Define this symbol if the Linux getrandom system call is available]) ],
+AC_MSG_CHECKING([for Linux getrandom function])
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+  #include <sys/random.h>]],
+ [[ getrandom(nullptr, 32, 0); ]])],
+ [ AC_MSG_RESULT([yes]); AC_DEFINE([HAVE_GETRANDOM], [1], [Define this symbol if the Linux getrandom function call is available]) ],
  [ AC_MSG_RESULT([no])]
 )
 
-AC_MSG_CHECKING([for getentropy via random.h])
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <unistd.h>
+AC_MSG_CHECKING([for getentropy via sys/random.h])
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
  #include <sys/random.h>]],
  [[ getentropy(nullptr, 32) ]])],
  [ AC_MSG_RESULT([yes]); AC_DEFINE([HAVE_GETENTROPY_RAND], [1], [Define this symbol if the BSD getentropy system call is available with sys/random.h]) ],

contrib/containers/ci/ci-msan.Dockerfile

@@ -0,0 +1,37 @@
+# syntax = devthefuture/dockerfile-x
+
+FROM ./ci.Dockerfile
+
+# MemorySanitizer reports any read of memory it did not watch being written,
+# so the C++ standard library has to be instrumented too. A stock libstdc++ or
+# libc++ produces a flood of reports that cannot be told apart from real ones.
+#
+# Upstream builds this in ci/test/01_base_install.sh, which runs inside its
+# docker build. Dash has no such script, so it lives here instead, which keeps
+# the result in a cached image layer rather than rebuilding it on every run.
+
+USER root
+
+ARG LLVM_VERSION=19
+ARG LLVM_TAG=llvmorg-19.1.7
+
+RUN set -ex; \
+    apt-get update && apt-get install ${APT_ARGS} ninja-build; \
+    rm -rf /var/lib/apt/lists/*; \
+    git clone --depth=1 -b "${LLVM_TAG}" https://github.com/llvm/llvm-project /llvm-project; \
+    cmake -G Ninja -B /cxx_build/ \
+      -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
+      -DCMAKE_BUILD_TYPE=Release \
+      -DLLVM_USE_SANITIZER=MemoryWithOrigins \
+      -DCMAKE_C_COMPILER=clang-${LLVM_VERSION} \
+      -DCMAKE_CXX_COMPILER=clang++-${LLVM_VERSION} \
+      -DLLVM_TARGETS_TO_BUILD=Native \
+      -DLLVM_ENABLE_PER_TARGET_RUNTIME_DIR=OFF \
+      -DLIBCXXABI_USE_LLVM_UNWINDER=OFF \
+      -DLIBCXX_HARDENING_MODE=debug \
+      -S /llvm-project/runtimes; \
+    ninja -C /cxx_build/; \
+    du -sh /llvm-project; \
+    rm -rf /llvm-project;
+
+USER dash

doc/dependencies.md

@@ -20,6 +20,7 @@ You can find installation instructions in the `build-*.md` file for your platfor
 | [Boost](../depends/packages/boost.mk) | [link](https://www.boost.org/users/download/) | 1.81.0 | [1.73.0](https://github.com/bitcoin/bitcoin/pull/29066) | No |
 | [libevent](../depends/packages/libevent.mk) | [link](https://github.com/libevent/libevent/releases) | [2.1.12-stable](https://github.com/bitcoin/bitcoin/pull/21991) | [2.1.8](https://github.com/bitcoin/bitcoin/pull/24681) | No |
 | glibc | [link](https://www.gnu.org/software/libc/) | N/A | [2.31](https://github.com/bitcoin/bitcoin/pull/29987) | Yes |
+| Linux Kernel | [link](https://www.kernel.org/) | N/A | [3.17.0](https://github.com/bitcoin/bitcoin/pull/27699) | Yes |
 
 ## Optional
 

src/dashbls/Makefile.bls.include

@@ -5,7 +5,11 @@
 
 LIBDASHBLS = libdashbls.la
 
+if USE_MIMALLOC
 DASHBLS_CPPFLAGS = -DBLSALLOC_MIMALLOC=1
+else
+DASHBLS_CPPFLAGS =
+endif
 
 DASHBLS_INCLUDES = \
 	-I$(builddir) \
@@ -43,6 +47,12 @@ libdashbls_la_SOURCES += \
 	$(MIMALLOC_H) \
 	$(RELIC_H)
 
+# LIBMIMALLOC and MIMALLOC_H expand to nothing when Makefile.mimalloc.include
+# is not pulled in, so these stay unconditional. Listing LIBMIMALLOC anywhere
+# other than first changes static link order, which decides whether an object
+# resolves malloc to mimalloc or to libc; mixing the two aborts the process
+# with "free(): invalid size" as soon as anything allocated by one is released
+# by the other.
 libdashbls_la_LIBADD = \
 	$(LIBMIMALLOC) \
 	$(LIBRELIC) \
@@ -52,7 +62,10 @@ libdashbls_la_CPPFLAGS = $(AM_CPPFLAGS) $(RELIC_INCLUDES) $(MIMALLOC_INCLUDES) $
 libdashbls_la_CXXFLAGS = $(AM_CXXFLAGS)
 libdashbls_la_LDFLAGS  = $(AM_LDFLAGS)
 
+if USE_MIMALLOC
 include Makefile.mimalloc.include
+endif
+
 include Makefile.relic.include
 
 if USE_TESTS

src/dashbls/configure.ac

@@ -71,6 +71,12 @@ AC_ARG_ENABLE([bench],
   [use_bench=$enableval],
   [use_bench=yes])
 
+AC_ARG_ENABLE([mimalloc],
+  [AS_HELP_STRING([--enable-mimalloc],
+  [Use mimalloc as the secure allocator [default=yes]])],
+  [use_mimalloc=$enableval],
+  [use_mimalloc=yes])
+
 AC_ARG_ENABLE([hardening],
   [AS_HELP_STRING([--enable-hardening],
   [Enable hardening flags and arguments [default=auto]])],
@@ -863,6 +869,7 @@ AM_CONDITIONAL(WITH_FBX, test 1 -eq 1)
 
 AM_CONDITIONAL([USE_TESTS], [test x"$use_tests" = x"yes"])
 AM_CONDITIONAL([USE_BENCH], [test x"$use_bench" = x"yes"])
+AM_CONDITIONAL([USE_MIMALLOC], [test x"$use_mimalloc" = x"yes"])
 AM_CONDITIONAL([HARDEN], [test "$use_hardening" = "yes"])
 AM_CONDITIONAL([OPTIMIZE], [test "$use_optimizations" = "yes"])