duckyfuz · duckyfuz · Jan 20, 2026 · Jan 21, 2026 · Jan 21, 2026 · Jan 21, 2026
diff --git a/clang/include/clang/Basic/Sanitizers.def b/clang/include/clang/Basic/Sanitizers.def
@@ -142,6 +142,9 @@ SANITIZER("kcfi", KCFI)
 // Safe Stack
 SANITIZER("safe-stack", SafeStack)
 
+// LowFat Pointer Bounds Checking
+SANITIZER("lowfat", LowFat)
+
 // Shadow Call Stack
 SANITIZER("shadow-call-stack", ShadowCallStack)
 

diff --git a/clang/include/clang/Driver/SanitizerArgs.h b/clang/include/clang/Driver/SanitizerArgs.h
@@ -122,6 +122,7 @@ class SanitizerArgs {
     return Sanitizers.has(SanitizerKind::NumericalStability);
   }
   bool needsRtsanRt() const { return Sanitizers.has(SanitizerKind::Realtime); }
+  bool needsLowFatRt() const { return Sanitizers.has(SanitizerKind::LowFat); }
 
   bool hasMemTag() const {
     return hasMemtagHeap() || hasMemtagStack() || hasMemtagGlobals();

diff --git a/clang/lib/CodeGen/BackendUtil.cpp b/clang/lib/CodeGen/BackendUtil.cpp
@@ -85,6 +85,7 @@
 #include "llvm/Transforms/Instrumentation/SanitizerCoverage.h"
 #include "llvm/Transforms/Instrumentation/ThreadSanitizer.h"
 #include "llvm/Transforms/Instrumentation/TypeSanitizer.h"
+#include "llvm/Transforms/Instrumentation/LowFatSanitizer.h"
 #include "llvm/Transforms/ObjCARC.h"
 #include "llvm/Transforms/Scalar/EarlyCSE.h"
 #include "llvm/Transforms/Scalar/GVN.h"
@@ -107,6 +108,17 @@ static cl::opt<bool> ClSanitizeOnOptimizerEarlyEP(
     "sanitizer-early-opt-ep", cl::Optional,
     cl::desc("Insert sanitizers on OptimizerEarlyEP."));
 
+static cl::opt<LowFatSanitizerOptions::LowFatMode> LowFatMode(
+    "lowfat-mode", cl::init(LowFatSanitizerOptions::LowFatMode::Fast),
+    cl::desc("Controls the placement and strictness of the LowFat pass"),
+    cl::values(
+        clEnumValN(LowFatSanitizerOptions::LowFatMode::Fast, "fast",
+                   "Instrument at OptimizerLastEP (least overhead)"),
+        clEnumValN(LowFatSanitizerOptions::LowFatMode::Safe, "safe",
+                   "Barrier at PipelineStartEP + instrument at OptimizerLastEP"),
+        clEnumValN(LowFatSanitizerOptions::LowFatMode::RightAlign, "right-align",
+                   "Right-align allocations within class slots to catch right-side OOB")));
+
 // Experiment to mark cold functions as optsize/minsize/optnone.
 // TODO: remove once this is exposed as a proper driver flag.
 static cl::opt<PGOOptions::ColdFuncOpt> ClPGOColdFuncAttr(
@@ -767,6 +779,12 @@ static void addSanitizers(const Triple &TargetTriple,
       MPM.addPass(DataFlowSanitizerPass(LangOpts.NoSanitizeFiles,
                                         PB.getVirtualFileSystemPtr()));
     }
+    if (LangOpts.Sanitize.has(SanitizerKind::LowFat)) {
+      LowFatSanitizerOptions LFOpts;
+      LFOpts.Recover = CodeGenOpts.SanitizeRecover.has(SanitizerKind::LowFat);
+      LFOpts.Mode = LowFatMode;
+      MPM.addPass(LowFatSanitizerPass(LFOpts));
+    }
   };
   if (ClSanitizeOnOptimizerEarlyEP) {
     PB.registerOptimizerEarlyEPCallback(
@@ -784,6 +802,23 @@ static void addSanitizers(const Triple &TargetTriple,
     // LastEP does not need GlobalsAA.
     PB.registerOptimizerLastEPCallback(SanitizersCallback);
   }
+
+  if (LangOpts.Sanitize.has(SanitizerKind::LowFat)) {
+    LowFatSanitizerOptions LFOpts;
+    LFOpts.Recover = CodeGenOpts.SanitizeRecover.has(SanitizerKind::LowFat);
+    LFOpts.Mode = LowFatMode;
+
+    if (LFOpts.Mode == LowFatSanitizerOptions::LowFatMode::Safe) {
+      // Safe: insert barrier + fake.use at PipelineStartEP to preserve loads
+      // through Dead Argument Elimination, then instrument at OptimizerLastEP.
+      LowFatSanitizerOptions BarrierOpts = LFOpts;
+      BarrierOpts.InternalBarrierOnly_ = true;
+      PB.registerPipelineStartEPCallback(
+          [BarrierOpts](ModulePassManager &MPM, OptimizationLevel) {
+            MPM.addPass(LowFatSanitizerPass(BarrierOpts));
+          });
+    }
+  }
 }
 
 void addLowerAllowCheckPass(const CodeGenOptions &CodeGenOpts,

diff --git a/clang/lib/Driver/SanitizerArgs.cpp b/clang/lib/Driver/SanitizerArgs.cpp
@@ -672,6 +672,9 @@ SanitizerArgs::SanitizerArgs(const ToolChain &TC,
                      SanitizerKind::Address | SanitizerKind::HWAddress |
                          SanitizerKind::KernelAddress |
                          SanitizerKind::KernelHWAddress |
+                         SanitizerKind::Memory),
+      std::make_pair(SanitizerKind::LowFat,
+                     SanitizerKind::Address | SanitizerKind::HWAddress |
                          SanitizerKind::Memory)};
 
   // Enable toolchain specific default sanitizers if not explicitly disabled.

diff --git a/clang/lib/Driver/ToolChains/CommonArgs.cpp b/clang/lib/Driver/ToolChains/CommonArgs.cpp
@@ -1728,6 +1728,8 @@ collectSanitizerRuntimes(const ToolChain &TC, const ArgList &Args,
     if (SanArgs.linkCXXRuntimes())
       StaticRuntimes.push_back("scudo_standalone_cxx");
   }
+  if (SanArgs.needsLowFatRt())
+    StaticRuntimes.push_back("lowfat");
   if (SanArgs.needsUbsanLoopDetectRt())
     NonWholeStaticRuntimes.push_back("ubsan_loop_detect");
 }

diff --git a/clang/lib/Driver/ToolChains/Darwin.cpp b/clang/lib/Driver/ToolChains/Darwin.cpp
@@ -1670,6 +1670,9 @@ void DarwinClang::AddLinkRuntimeLibArgs(const ArgList &Args,
       AddLinkRuntimeLib(Args, CmdArgs, "stats_client", RLO_AlwaysLink);
       AddLinkSanitizerLibArgs(Args, CmdArgs, "stats");
     }
+    if (Sanitize.needsLowFatRt()) {
+      AddLinkSanitizerLibArgs(Args, CmdArgs, "lowfat");
+    }
   }
 
   if (Sanitize.needsMemProfRt())
@@ -3917,6 +3920,9 @@ SanitizerMask Darwin::getSupportedSanitizers() const {
   if (IsX86_64)
     Res |= SanitizerKind::NumericalStability;
 
+  if (IsX86_64 || IsAArch64)
+    Res |= SanitizerKind::LowFat;
+
   return Res;
 }
 

diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
@@ -975,6 +975,8 @@ SanitizerMask Linux::getSupportedSanitizers() const {
   }
   if (IsX86_64)
     Res |= SanitizerKind::NumericalStability;
+  if (IsX86_64 || IsAArch64)
+    Res |= SanitizerKind::LowFat;
   if (!IsAndroid)
     Res |= SanitizerKind::Memory;
 

diff --git a/compiler-rt/cmake/Modules/AllSupportedArchDefs.cmake b/compiler-rt/cmake/Modules/AllSupportedArchDefs.cmake
@@ -122,6 +122,7 @@ set(ALL_XRAY_SUPPORTED_ARCH ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64}
 endif()
 set(ALL_XRAY_DSO_SUPPORTED_ARCH ${X86_64} ${ARM64})
 set(ALL_SHADOWCALLSTACK_SUPPORTED_ARCH ${ARM64})
+set(ALL_LOWFAT_SUPPORTED_ARCH ${X86_64} ${ARM64})
 
 if (UNIX)
   if (OS_NAME MATCHES "Linux")

diff --git a/compiler-rt/cmake/Modules/CompilerRTDarwinUtils.cmake b/compiler-rt/cmake/Modules/CompilerRTDarwinUtils.cmake
@@ -144,6 +144,13 @@ function(darwin_test_archs os valid_archs)
     endif()
   endif()
 
+  # x86_64h maps to the same lipo architecture tag as x86_64, causing fat
+  # binary creation to fail when both are present. Sanitizer runtimes gain
+  # no benefit from Haswell-specific codegen, so drop it for macOS as well.
+  if(${os} STREQUAL "osx")
+    list(REMOVE_ITEM archs "x86_64h")
+  endif()
+
   if(${os} MATCHES "^ios$")
     message(STATUS "Disabling sanitizers armv7* slice for ios")
     list(FILTER archs EXCLUDE REGEX "armv7.*")

diff --git a/compiler-rt/cmake/config-ix.cmake b/compiler-rt/cmake/config-ix.cmake
@@ -689,6 +689,9 @@ if(APPLE)
   list_intersect(SHADOWCALLSTACK_SUPPORTED_ARCH
     ALL_SHADOWCALLSTACK_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
+  list_intersect(LOWFAT_SUPPORTED_ARCH
+    ALL_LOWFAT_SUPPORTED_ARCH
+    SANITIZER_COMMON_SUPPORTED_ARCH)
   list_intersect(ORC_SUPPORTED_ARCH
     ALL_ORC_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
@@ -724,6 +727,7 @@ else()
   filter_available_targets(XRAY_DSO_SUPPORTED_ARCH ${ALL_XRAY_DSO_SUPPORTED_ARCH})
   filter_available_targets(SHADOWCALLSTACK_SUPPORTED_ARCH
     ${ALL_SHADOWCALLSTACK_SUPPORTED_ARCH})
+  filter_available_targets(LOWFAT_SUPPORTED_ARCH ${ALL_LOWFAT_SUPPORTED_ARCH})
   filter_available_targets(GWP_ASAN_SUPPORTED_ARCH ${ALL_GWP_ASAN_SUPPORTED_ARCH})
   filter_available_targets(NSAN_SUPPORTED_ARCH ${ALL_NSAN_SUPPORTED_ARCH})
   filter_available_targets(ORC_SUPPORTED_ARCH ${ALL_ORC_SUPPORTED_ARCH})
@@ -760,7 +764,7 @@ if(COMPILER_RT_SUPPORTED_ARCH)
 endif()
 message(STATUS "Compiler-RT supported architectures: ${COMPILER_RT_SUPPORTED_ARCH}")
 
-set(ALL_SANITIZERS asan;rtsan;dfsan;msan;hwasan;tsan;tysan;safestack;cfi;scudo_standalone;ubsan_minimal;gwp_asan;nsan;asan_abi)
+set(ALL_SANITIZERS asan;rtsan;dfsan;msan;hwasan;tsan;tysan;safestack;cfi;scudo_standalone;ubsan_minimal;gwp_asan;nsan;asan_abi;lowfat)
 set(COMPILER_RT_SANITIZERS_TO_BUILD all CACHE STRING
     "sanitizers to build if supported on the target (all;${ALL_SANITIZERS})")
 list_replace(COMPILER_RT_SANITIZERS_TO_BUILD all "${ALL_SANITIZERS}")
@@ -902,6 +906,13 @@ else()
   set(COMPILER_RT_HAS_SAFESTACK FALSE)
 endif()
 
+if (COMPILER_RT_HAS_SANITIZER_COMMON AND LOWFAT_SUPPORTED_ARCH AND
+    OS_NAME MATCHES "Darwin|Linux")
+  set(COMPILER_RT_HAS_LOWFAT TRUE)
+else()
+  set(COMPILER_RT_HAS_LOWFAT FALSE)
+endif()
+
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND CFI_SUPPORTED_ARCH)
   set(COMPILER_RT_HAS_CFI TRUE)
 else()

diff --git a/compiler-rt/lib/lowfat/CMakeLists.txt b/compiler-rt/lib/lowfat/CMakeLists.txt
@@ -0,0 +1,113 @@
+include_directories(..)
+
+set(LOWFAT_COMMON_DEFINITIONS)
+
+#===------------------------------------------------------------------------===
+# Custom size-class configuration (non-POW2 support)
+#
+# Set -DLOWFAT_SIZES_CFG=/path/to/sizes.cfg at cmake time to enable.
+# This builds the lf_config_gen host tool, runs it to produce
+# lf_config_generated.h, and compiles the runtime with LOWFAT_CUSTOM_CONFIG.
+#===------------------------------------------------------------------------===
+set(LOWFAT_SIZES_CFG "" CACHE FILEPATH
+  "Path to sizes.cfg for non-POW2 LowFat size class generation. Empty = POW2-only mode.")
+
+if(LOWFAT_SIZES_CFG)
+  # ---- Build the generator tool (host compiler, no LLVM deps) ----
+  # Use add_custom_target / add_custom_command rather than add_executable so
+  # this host tool is never cross-compiled.
+  set(LOWFAT_CONFIG_GEN_SRC
+      ${CMAKE_CURRENT_SOURCE_DIR}/tools/lf_config_gen.c)
+  set(LOWFAT_CONFIG_GEN_BIN
+      ${CMAKE_CURRENT_BINARY_DIR}/lf_config_gen${CMAKE_EXECUTABLE_SUFFIX})
+  set(LOWFAT_GENERATED_HEADER
+      ${CMAKE_CURRENT_BINARY_DIR}/lf_config_generated.h)
+
+  add_custom_command(
+    OUTPUT  ${LOWFAT_CONFIG_GEN_BIN}
+    COMMAND ${CMAKE_C_COMPILER} -std=c11 -O2
+            ${LOWFAT_CONFIG_GEN_SRC}
+            -o ${LOWFAT_CONFIG_GEN_BIN}
+    DEPENDS ${LOWFAT_CONFIG_GEN_SRC}
+    COMMENT "Compiling lf_config_gen host tool"
+    VERBATIM
+  )
+
+  add_custom_command(
+    OUTPUT  ${LOWFAT_GENERATED_HEADER}
+    COMMAND ${LOWFAT_CONFIG_GEN_BIN} ${LOWFAT_SIZES_CFG} ${LOWFAT_GENERATED_HEADER}
+    DEPENDS ${LOWFAT_CONFIG_GEN_BIN} ${LOWFAT_SIZES_CFG}
+    COMMENT "Generating LowFat size tables from ${LOWFAT_SIZES_CFG}"
+    VERBATIM
+  )
+
+  add_custom_target(lowfat_config_generated DEPENDS ${LOWFAT_GENERATED_HEADER})
+  set(LOWFAT_DEPS lowfat_config_generated)
+
+  # Make the generated header visible to all sources in this directory.
+  include_directories(${CMAKE_CURRENT_BINARY_DIR})
+
+  # Activate the custom-config code paths in the runtime AND the LLVM pass.
+  list(APPEND LOWFAT_COMMON_DEFINITIONS LOWFAT_CUSTOM_CONFIG=1)
+
+  message(STATUS "LowFat: custom config enabled: ${LOWFAT_SIZES_CFG}")
+  message(STATUS "LowFat: generated header:      ${LOWFAT_GENERATED_HEADER}")
+else()
+  message(STATUS "LowFat: using default POW2-only mode (no LOWFAT_SIZES_CFG set)")
+  set(LOWFAT_DEPS)
+endif()
+set(LOWFAT_SOURCES
+  lf_rtl.cpp
+  lf_interceptors.cpp
+  lf_stack.cpp
+)
+
+set(LOWFAT_HEADERS
+  lf_allocator.h
+  lf_config.h
+  lf_interface.h
+  lf_stack.h
+)
+
+set(LOWFAT_CFLAGS ${SANITIZER_COMMON_CFLAGS})
+append_rtti_flag(OFF LOWFAT_CFLAGS)
+
+# Static runtime library.
+add_compiler_rt_component(lowfat)
+
+if(COMPILER_RT_HAS_LOWFAT)
+  if(APPLE)
+    add_weak_symbols("sanitizer_common" WEAK_SYMBOL_LINK_FLAGS)
+
+    add_compiler_rt_runtime(clang_rt.lowfat
+      SHARED
+      OS ${SANITIZER_COMMON_SUPPORTED_OS}
+      ARCHS ${LOWFAT_SUPPORTED_ARCH}
+      SOURCES ${LOWFAT_SOURCES}
+      ADDITIONAL_HEADERS ${LOWFAT_HEADERS}
+      OBJECT_LIBS RTInterception
+                  RTSanitizerCommon
+                  RTSanitizerCommonLibc
+                  RTSanitizerCommonSymbolizer
+      CFLAGS ${LOWFAT_CFLAGS}
+      LINK_FLAGS ${WEAK_SYMBOL_LINK_FLAGS}
+      DEFS ${LOWFAT_COMMON_DEFINITIONS}
+      DEPS ${LOWFAT_DEPS}
+      PARENT_TARGET lowfat)
+  else()
+    add_compiler_rt_runtime(clang_rt.lowfat
+      STATIC
+      ARCHS ${LOWFAT_SUPPORTED_ARCH}
+      SOURCES ${LOWFAT_SOURCES}
+      ADDITIONAL_HEADERS ${LOWFAT_HEADERS}
+      OBJECT_LIBS RTInterception
+                  RTSanitizerCommon
+                  RTSanitizerCommonLibc
+                  RTSanitizerCommonSymbolizer
+                  RTSanitizerCommonSymbolizerInternal
+      CFLAGS ${LOWFAT_CFLAGS}
+      DEFS ${LOWFAT_COMMON_DEFINITIONS}
+      DEPS ${LOWFAT_DEPS}
+      PARENT_TARGET lowfat)
+  endif()
+endif()
diff --git a/compiler-rt/lib/lowfat/lf_allocator.h b/compiler-rt/lib/lowfat/lf_allocator.h
@@ -0,0 +1,33 @@
+//===-- lf_allocator.h - LowFat Allocator Internal Interface ----*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Internal allocator interface shared between lf_rtl.cpp and
+// lf_interceptors.cpp.
+//
+//===----------------------------------------------------------------------===//
+#ifndef LF_ALLOCATOR_H
+#define LF_ALLOCATOR_H
+
+#include "sanitizer_common/sanitizer_internal_defs.h"
+
+namespace __lowfat {
+
+using __sanitizer::uptr;
+
+// Allocate from a LowFat region. Returns nullptr if size exceeds max.
+void *Allocate(uptr size);
+
+// Free a LowFat allocation.
+void Deallocate(void *ptr);
+
+// Initialize interceptors (called from __lf_init).
+void InitializeInterceptors();
+
+} // namespace __lowfat
+
+#endif // LF_ALLOCATOR_H