build: merge branch 'bg/asan-bgo761429'

https://bugzilla.gnome.org/show_bug.cgi?id=761429

17 files changed, 433 insertions, 32 deletions

diff --git a/configure.ac b/configure.ac
index cad6b4b6f4..c8d72d3cca 100644
--- a/configure.ac
+++ b/configure.ac
@@ -920,6 +920,11 @@ AM_CONDITIONAL(BUILD_NMTUI, test "$build_nmtui" = yes)
 
 NM_COMPILER_WARNINGS
 
+CC_CHECK_FLAGS_APPEND([with_cflags], [CFLAGS], [\
+	-fno-strict-aliasing \
+])
+CFLAGS="$CFLAGS $with_cflags"
+
 AC_ARG_ENABLE(more-asserts,
               AS_HELP_STRING([--enable-more-asserts], [Enable more assertions for debugging (default: no). Deprecated option. Use --with-more-asserts=level]))
 more_asserts=0
@@ -954,15 +959,52 @@ fi
 
 AC_ARG_ENABLE(ld-gc, AS_HELP_STRING([--enable-ld-gc], [Enable garbage collection of unused symbols on linking (default: auto)]))
 if (test "${enable_ld_gc}" != "no"); then
-    NM_COMPILER_FLAG([-fdata-sections -ffunction-sections -Wl,--gc-sections], [enable_ld_gc='yes'], [
-        if (test "${enable_ld_gc}" = "yes"); then
-            AC_MSG_ERROR([Unused symbol eviction requested but not supported.])
-        else
-            enable_ld_gc='no'
-        fi
-    ])
+	CC_CHECK_FLAG_APPEND([ld_gc_flags], [CFLAGS], [-fdata-sections -ffunction-sections -Wl,--gc-sections])
+	if (test -n "${ld_gc_flags}"); then
+		enable_ld_gc="yes"
+		CFLAGS="$CFLAGS $ld_gc_flags"
+	else
+		if (test "${enable_ld_gc}" = "yes"); then
+			AC_MSG_ERROR([Unused symbol eviction requested but not supported.])
+		else
+			enable_ld_gc="no"
+		fi
+	fi
 fi
 
+AC_ARG_ENABLE(address-sanitizer, AS_HELP_STRING([--enable-address-sanitizer],
+	[Compile with address sanitizer (default: no)]))
+if (test "${enable_address_sanitizer}" = "yes"); then
+	CC_CHECK_FLAGS_APPEND([asan_cflags], [CFLAGS], [-fsanitize=address])
+	AS_IF([test -z "$asan_cflags"],
+		[AC_MSG_ERROR([*** -fsanitize=address is not supported])])
+
+	sanitizer_cflags="$sanitizer_cflags -fsanitize=address"
+	sanitizer_ldflags="$sanitizer_ldflags -Wc,-fsanitize=address"
+	sanitizers="${sanitizers}asan "
+fi
+
+AC_ARG_ENABLE(undefined-sanitizer, AS_HELP_STRING([--enable-undefined-sanitizer],
+	[Compile with undefined behavior sanitizer (default: no)]))
+if (test "${enable_undefined_sanitizer}" = "yes"); then
+	CC_CHECK_FLAGS_APPEND([ubsan_cflags], [CFLAGS], [-fsanitize=undefined])
+	AS_IF([test -z "$ubsan_cflags"],
+		[AC_MSG_ERROR([*** -fsanitize=undefined is not supported])])
+
+	sanitizer_cflags="$sanitizer_cflags -fsanitize=undefined"
+	sanitizer_ldflags="$sanitizer_ldflags -Wc,-fsanitize=undefined"
+	sanitizers="${sanitizers}ubsan "
+fi
+
+if test -n "$sanitizers"; then
+	CFLAGS="$CFLAGS $sanitizer_cflags -DVALGRIND=1 -fno-omit-frame-pointer"
+	LDFLAGS="$LDFLAGS $sanitizer_ldflags"
+	sanitizers="${sanitizers% }"
+	AC_SUBST(SANITIZER_ENV, [ASAN_OPTIONS=detect_leaks=0])
+fi
+
+AC_SUBST(SANITIZERS, [$sanitizers])
+
 dnl -------------------------
 dnl Vala bindings
 dnl -------------------------
@@ -1059,7 +1101,6 @@ fi
 AM_CONDITIONAL(BUILD_SETTING_DOCS, test "$build_setting_docs" = "yes")
 AM_CONDITIONAL(SETTING_DOCS_AVAILABLE, test "$build_setting_docs" = "yes" -o "$have_setting_docs" = "yes")
 
-
 AC_CONFIG_FILES([
 Makefile
 shared/Makefile
@@ -1224,4 +1265,5 @@ echo "  code coverage: $enable_code_coverage"
 echo "  LTO: $enable_lto"
 echo "  linker garbage collection: $enable_ld_gc"
 echo "  JSON validation: $enable_json_validation"
+echo "  sanitizers: $sanitizers"
 echo
diff --git a/contrib/fedora/rpm/NetworkManager.spec b/contrib/fedora/rpm/NetworkManager.spec
index 73cf3704fc..faaa2d5368 100644
--- a/contrib/fedora/rpm/NetworkManager.spec
+++ b/contrib/fedora/rpm/NetworkManager.spec
@@ -375,6 +375,8 @@ intltoolize --automake --copy --force
 %if %{with debug}
 	--with-more-logging \
 	--with-more-asserts=10000 \
+	--enable-address-sanitizer \
+	--enable-undefined-sanitizer \
 %endif
 	--enable-ppp=yes \
 	--with-libaudit=yes-disabled-by-default \
diff --git a/libnm-glib/Makefile.am b/libnm-glib/Makefile.am
index c406847474..6cb3e4b826 100644
--- a/libnm-glib/Makefile.am
+++ b/libnm-glib/Makefile.am
@@ -196,6 +196,10 @@ CLEANFILES = $(BUILT_SOURCES)
 INTROSPECTION_GIRS =
 INTROSPECTION_COMPILER_ARGS = --includedir=$(top_builddir)/libnm-util
 
+# Pass SANITIZER_ENV where a command that uses built libraries is
+# executed, to suppress possible errors
+INTROSPECTION_SCANNER_ENV = $(SANITIZER_ENV)
+
 if HAVE_INTROSPECTION
 introspection_sources = $(libnminclude_HEADERS) $(libnm_glib_la_csources)
 
diff --git a/libnm-util/Makefile.am b/libnm-util/Makefile.am
index 8f51fc37c7..0d5a0d46c1 100644
--- a/libnm-util/Makefile.am
+++ b/libnm-util/Makefile.am
@@ -169,6 +169,10 @@ INTROSPECTION_GIRS =
 INTROSPECTION_SCANNER_ARGS = --add-include-path=$(srcdir)
 INTROSPECTION_COMPILER_ARGS = --includedir=$(srcdir)
 
+# Pass SANITIZER_ENV where a command that uses built libraries is
+# executed, to suppress possible errors
+INTROSPECTION_SCANNER_ENV = $(SANITIZER_ENV)
+
 if HAVE_INTROSPECTION
 introspection_sources = $(libnm_util_include_HEADERS) $(nodist_libnm_util_include_HEADERS) $(libnm_util_la_csources)
 
diff --git a/libnm-util/tests/test-general.c b/libnm-util/tests/test-general.c
index 9299bd5b11..d4a7cd4a90 100644
--- a/libnm-util/tests/test-general.c
+++ b/libnm-util/tests/test-general.c
@@ -2392,6 +2392,13 @@ test_connection_normalize_virtual_iface_name (void)
 	g_object_unref (con);
 }
 
+#if defined (__SANITIZE_ADDRESS__)
+static void
+test_libnm_linking (void)
+{
+	g_test_skip ("Skipping test since address sanitizer is enabled");
+}
+#else /* __SANITIZE_ADDRESS__ */
 static void
 _test_libnm_linking_setup_child_process (gpointer user_data)
 {
@@ -2431,6 +2438,7 @@ test_libnm_linking (void)
 	g_free (out);
 	g_free (err);
 }
+#endif /* __SANITIZE_ADDRESS__ */
 
 /******************************************************************************/
 
diff --git a/libnm/Makefile.am b/libnm/Makefile.am
index e035b3cda2..e1ae02e949 100644
--- a/libnm/Makefile.am
+++ b/libnm/Makefile.am
@@ -141,12 +141,10 @@ libnm_la_LIBADD = \
 	$(UUID_LIBS) \
 	$(GUDEV_LIBS)
 
-libnm_la_LDFLAGS = \
-	$(CODE_COVERAGE_LDFLAGS)
-
 SYMBOL_VIS_FILE=$(srcdir)/libnm.ver
 
 libnm_la_LDFLAGS = -Wl,--version-script=$(SYMBOL_VIS_FILE) \
+	$(CODE_COVERAGE_LDFLAGS) \
 	-version-info "1:0:1"
 
 ###
@@ -170,6 +168,10 @@ INTROSPECTION_COMPILER_ARGS =			\
 	--includedir=$(top_srcdir)/libnm	\
 	--includedir=$(top_builddir)/libnm
 
+# Pass SANITIZER_ENV where a command that uses built libraries is
+# executed, to suppress possible errors
+INTROSPECTION_SCANNER_ENV = $(SANITIZER_ENV)
+
 if HAVE_INTROSPECTION
 introspection_sources =				\
 	$(libnm_core_headers)			\
@@ -213,9 +215,16 @@ docs_sources = $(filter-out %/nm-core-enum-types.c,$(libnm_core_sources))
 nm-setting-docs-overrides.xml: generate-plugin-docs.pl $(docs_sources)
 	$(srcdir)/generate-plugin-docs.pl dbus $(top_srcdir)/libnm-core $@
 
+# When the python scripts loads libnm and the address sanitizers is
+# enabled, we must LD_PRELOAD libasan otherwise it will complain that
+# it was not loaded as initial library.
 nm-property-docs.xml: generate-setting-docs.py $(docs_sources) | NM-1.0.gir NM-1.0.typelib libnm.la
 	export GI_TYPELIB_PATH=$(abs_builddir)$${GI_TYPELIB_PATH:+:$$GI_TYPELIB_PATH}; \
 	export LD_LIBRARY_PATH=$(abs_builddir)/.libs$${LD_LIBRARY_PATH:+:$$LD_LIBRARY_PATH}; \
+	if echo $(CFLAGS) | grep -e -fsanitize=address; then \
+		export LD_PRELOAD="$${LD_PRELOAD} $$(ldd $(abs_builddir)/.libs/libnm.so | grep libasan\.so\.. -o | head -n 1)"; \
+	fi; \
+	[ -n "$(SANITIZER_ENV)" ] && export $(SANITIZER_ENV) ; \
 	$(srcdir)/generate-setting-docs.py \
 		--gir $(builddir)/NM-1.0.gir \
 		--output $@
@@ -223,6 +232,10 @@ nm-property-docs.xml: generate-setting-docs.py $(docs_sources) | NM-1.0.gir NM-1
 nm-setting-docs.xml: generate-setting-docs.py $(docs_sources) nm-setting-docs-overrides.xml | NM-1.0.gir NM-1.0.typelib libnm.la
 	export GI_TYPELIB_PATH=$(abs_builddir)$${GI_TYPELIB_PATH:+:$$GI_TYPELIB_PATH}; \
 	export LD_LIBRARY_PATH=$(abs_builddir)/.libs$${LD_LIBRARY_PATH:+:$$LD_LIBRARY_PATH}; \
+	if echo $(CFLAGS) | grep -e -fsanitize=address; then \
+		export LD_PRELOAD="$${LD_PRELOAD} $$(ldd $(abs_builddir)/.libs/libnm.so | grep libasan\.so\.. -o | head -n 1)"; \
+	fi; \
+	[ -n "$(SANITIZER_ENV)" ] && export $(SANITIZER_ENV) ; \
 	$(srcdir)/generate-setting-docs.py \
 		--gir $(builddir)/NM-1.0.gir \
 		--overrides $(builddir)/nm-setting-docs-overrides.xml \
diff --git a/m4/attributes.m4 b/m4/attributes.m4
new file mode 100644
index 0000000000..51ac88be61
--- /dev/null
+++ b/m4/attributes.m4
@@ -0,0 +1,292 @@
+dnl Macros to check the presence of generic (non-typed) symbols.
+dnl Copyright (c) 2006-2008 Diego Pettenò <flameeyes@gmail.com>
+dnl Copyright (c) 2006-2008 xine project
+dnl Copyright (c) 2012 Lucas De Marchi <lucas.de.marchi@gmail.com>
+dnl
+dnl This program is free software; you can redistribute it and/or modify
+dnl it under the terms of the GNU General Public License as published by
+dnl the Free Software Foundation; either version 2, or (at your option)
+dnl any later version.
+dnl
+dnl This program is distributed in the hope that it will be useful,
+dnl but WITHOUT ANY WARRANTY; without even the implied warranty of
+dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+dnl GNU General Public License for more details.
+dnl
+dnl You should have received a copy of the GNU General Public License
+dnl along with this program; if not, write to the Free Software
+dnl Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+dnl 02110-1301, USA.
+dnl
+dnl As a special exception, the copyright owners of the
+dnl macro gives unlimited permission to copy, distribute and modify the
+dnl configure scripts that are the output of Autoconf when processing the
+dnl Macro. You need not follow the terms of the GNU General Public
+dnl License when using or distributing such scripts, even though portions
+dnl of the text of the Macro appear in them. The GNU General Public
+dnl License (GPL) does govern all other use of the material that
+dnl constitutes the Autoconf Macro.
+dnl
+dnl This special exception to the GPL applies to versions of the
+dnl Autoconf Macro released by this project. When you make and
+dnl distribute a modified version of the Autoconf Macro, you may extend
+dnl this special exception to the GPL to apply to your modified version as
+dnl well.
+
+dnl Check if FLAG in ENV-VAR is supported by compiler and append it
+dnl to WHERE-TO-APPEND variable. Note that we invert -Wno-* checks to
+dnl -W* as gcc cannot test for negated warnings. If a C snippet is passed,
+dnl use it, otherwise use a simple main() definition that just returns 0.
+dnl CC_CHECK_FLAG_APPEND([WHERE-TO-APPEND], [ENV-VAR], [FLAG], [C-SNIPPET])
+
+AC_DEFUN([CC_CHECK_FLAG_APPEND], [
+  AC_CACHE_CHECK([if $CC supports flag $3 in envvar $2],
+                 AS_TR_SH([cc_cv_$2_$3]),
+          [eval "AS_TR_SH([cc_save_$2])='${$2}'"
+           eval "AS_TR_SH([$2])='${cc_save_$2} -Werror `echo "$3" | sed 's/^-Wno-/-W/'`'"
+           AC_LINK_IFELSE([AC_LANG_SOURCE(ifelse([$4], [],
+                                                 [int main(void) { return 0; } ],
+                                                 [$4]))],
+                          [eval "AS_TR_SH([cc_cv_$2_$3])='yes'"],
+                          [eval "AS_TR_SH([cc_cv_$2_$3])='no'"])
+           eval "AS_TR_SH([$2])='$cc_save_$2'"])
+
+  AS_IF([eval test x$]AS_TR_SH([cc_cv_$2_$3])[ = xyes],
+        [eval "$1='${$1} $3'"])
+])
+
+dnl CC_CHECK_FLAGS_APPEND([WHERE-TO-APPEND], [ENV-VAR], [FLAG1 FLAG2], [C-SNIPPET])
+AC_DEFUN([CC_CHECK_FLAGS_APPEND], [
+  for flag in [$3]; do
+    CC_CHECK_FLAG_APPEND([$1], [$2], $flag, [$4])
+  done
+])
+
+dnl Check if the flag is supported by linker (cacheable)
+dnl CC_CHECK_LDFLAGS([FLAG], [ACTION-IF-FOUND],[ACTION-IF-NOT-FOUND])
+
+AC_DEFUN([CC_CHECK_LDFLAGS], [
+  AC_CACHE_CHECK([if $CC supports $1 flag],
+    AS_TR_SH([cc_cv_ldflags_$1]),
+    [ac_save_LDFLAGS="$LDFLAGS"
+     LDFLAGS="$LDFLAGS $1"
+     AC_LINK_IFELSE([int main() { return 1; }],
+       [eval "AS_TR_SH([cc_cv_ldflags_$1])='yes'"],
+       [eval "AS_TR_SH([cc_cv_ldflags_$1])="])
+     LDFLAGS="$ac_save_LDFLAGS"
+    ])
+
+  AS_IF([eval test x$]AS_TR_SH([cc_cv_ldflags_$1])[ = xyes],
+    [$2], [$3])
+])
+
+dnl define the LDFLAGS_NOUNDEFINED variable with the correct value for
+dnl the current linker to avoid undefined references in a shared object.
+AC_DEFUN([CC_NOUNDEFINED], [
+  dnl We check $host for which systems to enable this for.
+  AC_REQUIRE([AC_CANONICAL_HOST])
+
+  case $host in
+     dnl FreeBSD (et al.) does not complete linking for shared objects when pthreads
+     dnl are requested, as different implementations are present; to avoid problems
+     dnl use -Wl,-z,defs only for those platform not behaving this way.
+     *-freebsd* | *-openbsd*) ;;
+     *)
+        dnl First of all check for the --no-undefined variant of GNU ld. This allows
+        dnl for a much more readable command line, so that people can understand what
+        dnl it does without going to look for what the heck -z defs does.
+        for possible_flags in "-Wl,--no-undefined" "-Wl,-z,defs"; do
+           CC_CHECK_LDFLAGS([$possible_flags], [LDFLAGS_NOUNDEFINED="$possible_flags"])
+           break
+        done
+     ;;
+  esac
+
+  AC_SUBST([LDFLAGS_NOUNDEFINED])
+])
+
+dnl Check for a -Werror flag or equivalent. -Werror is the GCC
+dnl and ICC flag that tells the compiler to treat all the warnings
+dnl as fatal. We usually need this option to make sure that some
+dnl constructs (like attributes) are not simply ignored.
+dnl
+dnl Other compilers don't support -Werror per se, but they support
+dnl an equivalent flag:
+dnl  - Sun Studio compiler supports -errwarn=%all
+AC_DEFUN([CC_CHECK_WERROR], [
+  AC_CACHE_CHECK(
+    [for $CC way to treat warnings as errors],
+    [cc_cv_werror],
+    [CC_CHECK_CFLAGS_SILENT([-Werror], [cc_cv_werror=-Werror],
+      [CC_CHECK_CFLAGS_SILENT([-errwarn=%all], [cc_cv_werror=-errwarn=%all])])
+    ])
+])
+
+AC_DEFUN([CC_CHECK_ATTRIBUTE], [
+  AC_REQUIRE([CC_CHECK_WERROR])
+  AC_CACHE_CHECK([if $CC supports __attribute__(( ifelse([$2], , [$1], [$2]) ))],
+    AS_TR_SH([cc_cv_attribute_$1]),
+    [ac_save_CFLAGS="$CFLAGS"
+     CFLAGS="$CFLAGS $cc_cv_werror"
+     AC_COMPILE_IFELSE([AC_LANG_SOURCE([$3])],
+       [eval "AS_TR_SH([cc_cv_attribute_$1])='yes'"],
+       [eval "AS_TR_SH([cc_cv_attribute_$1])='no'"])
+     CFLAGS="$ac_save_CFLAGS"
+    ])
+
+  AS_IF([eval test x$]AS_TR_SH([cc_cv_attribute_$1])[ = xyes],
+    [AC_DEFINE(
+       AS_TR_CPP([SUPPORT_ATTRIBUTE_$1]), 1,
+         [Define this if the compiler supports __attribute__(( ifelse([$2], , [$1], [$2]) ))]
+         )
+     $4],
+    [$5])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_CONSTRUCTOR], [
+  CC_CHECK_ATTRIBUTE(
+    [constructor],,
+    [void __attribute__((constructor)) ctor() { int a; }],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_FORMAT], [
+  CC_CHECK_ATTRIBUTE(
+    [format], [format(printf, n, n)],
+    [void __attribute__((format(printf, 1, 2))) printflike(const char *fmt, ...) { fmt = (void *)0; }],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_FORMAT_ARG], [
+  CC_CHECK_ATTRIBUTE(
+    [format_arg], [format_arg(printf)],
+    [char *__attribute__((format_arg(1))) gettextlike(const char *fmt) { fmt = (void *)0; }],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_VISIBILITY], [
+  CC_CHECK_ATTRIBUTE(
+    [visibility_$1], [visibility("$1")],
+    [void __attribute__((visibility("$1"))) $1_function() { }],
+    [$2], [$3])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_NONNULL], [
+  CC_CHECK_ATTRIBUTE(
+    [nonnull], [nonnull()],
+    [void __attribute__((nonnull())) some_function(void *foo, void *bar) { foo = (void*)0; bar = (void*)0; }],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_UNUSED], [
+  CC_CHECK_ATTRIBUTE(
+    [unused], ,
+    [void some_function(void *foo, __attribute__((unused)) void *bar);],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_SENTINEL], [
+  CC_CHECK_ATTRIBUTE(
+    [sentinel], ,
+    [void some_function(void *foo, ...) __attribute__((sentinel));],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_DEPRECATED], [
+  CC_CHECK_ATTRIBUTE(
+    [deprecated], ,
+    [void some_function(void *foo, ...) __attribute__((deprecated));],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_ALIAS], [
+  CC_CHECK_ATTRIBUTE(
+    [alias], [weak, alias],
+    [void other_function(void *foo) { }
+     void some_function(void *foo) __attribute__((weak, alias("other_function")));],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_MALLOC], [
+  CC_CHECK_ATTRIBUTE(
+    [malloc], ,
+    [void * __attribute__((malloc)) my_alloc(int n);],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_PACKED], [
+  CC_CHECK_ATTRIBUTE(
+    [packed], ,
+    [struct astructure { char a; int b; long c; void *d; } __attribute__((packed));],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_CONST], [
+  CC_CHECK_ATTRIBUTE(
+    [const], ,
+    [int __attribute__((const)) twopow(int n) { return 1 << n; } ],
+    [$1], [$2])
+])
+
+AC_DEFUN([CC_FLAG_VISIBILITY], [
+  AC_REQUIRE([CC_CHECK_WERROR])
+  AC_CACHE_CHECK([if $CC supports -fvisibility=hidden],
+    [cc_cv_flag_visibility],
+    [cc_flag_visibility_save_CFLAGS="$CFLAGS"
+     CFLAGS="$CFLAGS $cc_cv_werror"
+     CC_CHECK_CFLAGS_SILENT([-fvisibility=hidden],
+     cc_cv_flag_visibility='yes',
+     cc_cv_flag_visibility='no')
+     CFLAGS="$cc_flag_visibility_save_CFLAGS"])
+
+  AS_IF([test "x$cc_cv_flag_visibility" = "xyes"],
+    [AC_DEFINE([SUPPORT_FLAG_VISIBILITY], 1,
+       [Define this if the compiler supports the -fvisibility flag])
+     $1],
+    [$2])
+])
+
+AC_DEFUN([CC_FUNC_EXPECT], [
+  AC_REQUIRE([CC_CHECK_WERROR])
+  AC_CACHE_CHECK([if compiler has __builtin_expect function],
+    [cc_cv_func_expect],
+    [ac_save_CFLAGS="$CFLAGS"
+     CFLAGS="$CFLAGS $cc_cv_werror"
+     AC_COMPILE_IFELSE([AC_LANG_SOURCE(
+       [int some_function() {
+        int a = 3;
+        return (int)__builtin_expect(a, 3);
+     }])],
+       [cc_cv_func_expect=yes],
+       [cc_cv_func_expect=no])
+     CFLAGS="$ac_save_CFLAGS"
+    ])
+
+  AS_IF([test "x$cc_cv_func_expect" = "xyes"],
+    [AC_DEFINE([SUPPORT__BUILTIN_EXPECT], 1,
+     [Define this if the compiler supports __builtin_expect() function])
+     $1],
+    [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_ALIGNED], [
+  AC_REQUIRE([CC_CHECK_WERROR])
+  AC_CACHE_CHECK([highest __attribute__ ((aligned ())) supported],
+    [cc_cv_attribute_aligned],
+    [ac_save_CFLAGS="$CFLAGS"
+     CFLAGS="$CFLAGS $cc_cv_werror"
+     for cc_attribute_align_try in 64 32 16 8 4 2; do
+        AC_COMPILE_IFELSE([AC_LANG_SOURCE([
+          int main() {
+            static char c __attribute__ ((aligned($cc_attribute_align_try))) = 0;
+            return c;
+          }])], [cc_cv_attribute_aligned=$cc_attribute_align_try; break])
+     done
+     CFLAGS="$ac_save_CFLAGS"
+  ])
+
+  if test "x$cc_cv_attribute_aligned" != "x"; then
+     AC_DEFINE_UNQUOTED([ATTRIBUTE_ALIGNED_MAX], [$cc_cv_attribute_aligned],
+       [Define the highest alignment supported])
+  fi
+])
diff --git a/m4/compiler_options.m4 b/m4/compiler_options.m4
index b2472ab81e..496873ea8a 100644
--- a/m4/compiler_options.m4
+++ b/m4/compiler_options.m4
@@ -66,7 +66,7 @@ if test "$GCC" = "yes" -a "$set_more_warnings" != "no"; then
 		      -Wfloat-equal -Wno-unused-parameter -Wno-sign-compare \
 		      -Wno-duplicate-decl-specifier \
 		      -Wstrict-prototypes \
-		      -fno-strict-aliasing -Wno-unused-but-set-variable \
+		      -Wno-unused-but-set-variable \
 		      -Wundef -Wimplicit-function-declaration \
 		      -Wpointer-arith -Winit-self -Wformat-nonliteral \
 		      -Wmissing-include-dirs -Wno-pragmas; do
diff --git a/src/platform/tests/test-link.c b/src/platform/tests/test-link.c
index db8ad5a2e1..bb09111eac 100644
--- a/src/platform/tests/test-link.c
+++ b/src/platform/tests/test-link.c
@@ -1919,6 +1919,14 @@ _test_netns_check_skip (void)
 
 /******************************************************************/
 
+#define _sysctl_assert_eq(plat, path, value) \
+	G_STMT_START { \
+		gs_free char *_val = NULL; \
+		\
+		_val = nm_platform_sysctl_get (plat, path); \
+		g_assert_cmpstr (_val, ==, value); \
+	} G_STMT_END
+
 static void
 test_netns_general (gpointer fixture, gconstpointer test_data)
 {
@@ -1954,13 +1962,19 @@ test_netns_general (gpointer fixture, gconstpointer test_data)
 			_ADD_DUMMY (p, nm_sprintf_buf (sbuf, "other-c-%s-%02d", id, i));
 	}
 
-	g_assert_cmpstr (nm_platform_sysctl_get (platform_1, "/sys/devices/virtual/net/dummy1_/ifindex"), ==, nm_sprintf_buf (sbuf, "%d", nmtstp_link_get_typed (platform_1, 0, "dummy1_", NM_LINK_TYPE_DUMMY)->ifindex));
-	g_assert_cmpstr (nm_platform_sysctl_get (platform_1, "/sys/devices/virtual/net/dummy2a/ifindex"), ==, nm_sprintf_buf (sbuf, "%d", nmtstp_link_get_typed (platform_1, 0, "dummy2a", NM_LINK_TYPE_DUMMY)->ifindex));
-	g_assert_cmpstr (nm_platform_sysctl_get (platform_1, "/sys/devices/virtual/net/dummy2b/ifindex"), ==, NULL);
+	_sysctl_assert_eq (platform_1,"/sys/devices/virtual/net/dummy1_/ifindex",
+	                   nm_sprintf_buf (sbuf, "%d", nmtstp_link_get_typed (platform_1, 0, "dummy1_", NM_LINK_TYPE_DUMMY)->ifindex));
+	_sysctl_assert_eq (platform_1, "/sys/devices/virtual/net/dummy2a/ifindex",
+	                   nm_sprintf_buf (sbuf, "%d", nmtstp_link_get_typed (platform_1, 0, "dummy2a", NM_LINK_TYPE_DUMMY)->ifindex));
+	_sysctl_assert_eq (platform_1, "/sys/devices/virtual/net/dummy2b/ifindex",
+	                   NULL);
 
-	g_assert_cmpstr (nm_platform_sysctl_get (platform_2, "/sys/devices/virtual/net/dummy1_/ifindex"), ==, nm_sprintf_buf (sbuf, "%d", nmtstp_link_get_typed (platform_2, 0, "dummy1_", NM_LINK_TYPE_DUMMY)->ifindex));
-	g_assert_cmpstr (nm_platform_sysctl_get (platform_2, "/sys/devices/virtual/net/dummy2a/ifindex"), ==, NULL);
-	g_assert_cmpstr (nm_platform_sysctl_get (platform_2, "/sys/devices/virtual/net/dummy2b/ifindex"), ==, nm_sprintf_buf (sbuf, "%d", nmtstp_link_get_typed (platform_2, 0, "dummy2b", NM_LINK_TYPE_DUMMY)->ifindex));
+	_sysctl_assert_eq (platform_2, "/sys/devices/virtual/net/dummy1_/ifindex",
+	                   nm_sprintf_buf (sbuf, "%d", nmtstp_link_get_typed (platform_2, 0, "dummy1_", NM_LINK_TYPE_DUMMY)->ifindex));
+	_sysctl_assert_eq (platform_2, "/sys/devices/virtual/net/dummy2a/ifindex",
+	                   NULL);
+	_sysctl_assert_eq (platform_2, "/sys/devices/virtual/net/dummy2b/ifindex",
+	                   nm_sprintf_buf (sbuf, "%d", nmtstp_link_get_typed (platform_2, 0, "dummy2b", NM_LINK_TYPE_DUMMY)->ifindex));
 
 	for (i = 0; i < 10; i++) {
 		NMPlatform *pl;
@@ -1982,10 +1996,11 @@ test_netns_general (gpointer fixture, gconstpointer test_data)
 				path = "/proc/sys/net/ipv6/conf/dummy2b/disable_ipv6";
 		}
 		g_assert (nm_platform_sysctl_set (pl, path, nm_sprintf_buf (sbuf, "%d", j)));
-		g_assert_cmpstr (nm_platform_sysctl_get (pl, path), ==, nm_sprintf_buf (sbuf, "%d", j));
+		_sysctl_assert_eq (pl, path, nm_sprintf_buf (sbuf, "%d", j));
 	}
-	g_assert_cmpstr (nm_platform_sysctl_get (platform_1, "/proc/sys/net/ipv6/conf/dummy2b/disable_ipv6"), ==, NULL);
-	g_assert_cmpstr (nm_platform_sysctl_get (platform_2, "/proc/sys/net/ipv6/conf/dummy2a/disable_ipv6"), ==, NULL);
+
+	_sysctl_assert_eq (platform_1, "/proc/sys/net/ipv6/conf/dummy2b/disable_ipv6", NULL);
+	_sysctl_assert_eq (platform_2, "/proc/sys/net/ipv6/conf/dummy2a/disable_ipv6", NULL);
 
 	/* older kernels (Ubuntu 12.04) don't support ethtool -i for dummy devices. Work around that and
 	 * skip asserts that are known to fail. */
diff --git a/src/settings/plugins/ifnet/connection_parser.c b/src/settings/plugins/ifnet/connection_parser.c
index 80b8253561..9917463f98 100644
--- a/src/settings/plugins/ifnet/connection_parser.c
+++ b/src/settings/plugins/ifnet/connection_parser.c
@@ -679,7 +679,7 @@ make_ip4_setting (NMConnection *connection,
 	/* DNS searches */
 	value = ifnet_get_data (conn_name, "dns_search");
 	if (value) {
-		char *stripped = g_strdup (value);
+		gs_free char *stripped = g_strdup (value);
 		char **searches = NULL;
 
 		strip_string (stripped, '"');
diff --git a/src/settings/plugins/ifnet/net_parser.c b/src/settings/plugins/ifnet/net_parser.c
index 6e1061c673..db5e7a13e7 100644
--- a/src/settings/plugins/ifnet/net_parser.c
+++ b/src/settings/plugins/ifnet/net_parser.c
@@ -501,13 +501,13 @@ GList *
 ifnet_get_connection_names (void)
 {
 	GList *names = g_hash_table_get_keys (conn_table);
-	GList *result = NULL;
+	GList *iter, *result = NULL;
 
-	while (names) {
-		if (!ignore_connection_name (names->data))
-			result = g_list_prepend (result, names->data);
-		names = names->next;
+	for (iter = names; iter; iter = iter->next) {
+		if (!ignore_connection_name (iter->data))
+			result = g_list_prepend (result, iter->data);
 	}
+
 	g_list_free (names);
 	return g_list_reverse (result);
 }
diff --git a/src/settings/plugins/ifnet/tests/Makefile.am b/src/settings/plugins/ifnet/tests/Makefile.am
index 6590d4ae4c..eb813ab29d 100644
--- a/src/settings/plugins/ifnet/tests/Makefile.am
+++ b/src/settings/plugins/ifnet/tests/Makefile.am
@@ -34,7 +34,7 @@ test_ifnet_LDFLAGS = \
 
 test_ifnet_LDADD = $(top_builddir)/src/libNetworkManager.la
 
-#@VALGRIND_RULES@
+@VALGRIND_RULES@
 TESTS = test-ifnet
 
 endif
diff --git a/src/settings/plugins/ifnet/tests/test-ifnet.c b/src/settings/plugins/ifnet/tests/test-ifnet.c
index 89df9af806..49f88f1c1c 100644
--- a/src/settings/plugins/ifnet/tests/test-ifnet.c
+++ b/src/settings/plugins/ifnet/tests/test-ifnet.c
@@ -346,7 +346,7 @@ test_delete_connection (void)
 static void
 test_missing_config (void)
 {
-	GError *error = NULL;
+	gs_free_error GError *error = NULL;
 	NMConnection *connection;
 
 	connection = ifnet_update_connection_from_config_block ("eth8", NULL, &error);
diff --git a/src/settings/plugins/ifnet/wpa_parser.c b/src/settings/plugins/ifnet/wpa_parser.c
index 8e2559b300..505222ab51 100644
--- a/src/settings/plugins/ifnet/wpa_parser.c
+++ b/src/settings/plugins/ifnet/wpa_parser.c
@@ -77,8 +77,10 @@ add_security (GHashTable *security)
 	/* Hex format begins with " */
 	is_hex_ssid = (ssid[0] != '"');
 	if ((value = g_hash_table_lookup (security, "disabled")) != NULL) {
-		if (strcmp (value, "1") == 0)
+		if (strcmp (value, "1") == 0) {
+			destroy_security (security);
 			return NULL;
+		}
 	}
 
 	/* Default priority is 1 */
@@ -111,6 +113,7 @@ add_security (GHashTable *security)
 static void
 add_key_value (GHashTable * network, gchar * line)
 {
+	gpointer orig_key, orig_value;
 	gchar **key_value;
 
 	if (g_str_has_prefix (line, "network={"))
@@ -133,6 +136,14 @@ add_key_value (GHashTable * network, gchar * line)
 	    && !g_str_has_prefix (key_value[0], "wep_key")
 	    && strcmp (key_value[0], "ssid") != 0)
 		strip_string (key_value[1], '"');
+
+	/* This sucks */
+	if (g_hash_table_lookup_extended (network, key_value[0], &orig_key, &orig_value)) {
+		g_hash_table_remove (network, orig_key);
+		g_free (orig_key);
+		g_free (orig_value);
+	}
+
 	g_hash_table_insert (network, g_strdup (key_value[0]),
 			     g_strdup (key_value[1]));
 	g_strfreev (key_value);
diff --git a/src/settings/plugins/ifupdown/tests/Makefile.am b/src/settings/plugins/ifupdown/tests/Makefile.am
index e12c01813b..4f01fc0c9b 100644
--- a/src/settings/plugins/ifupdown/tests/Makefile.am
+++ b/src/settings/plugins/ifupdown/tests/Makefile.am
@@ -23,8 +23,7 @@ test_ifupdown_SOURCES = \
 test_ifupdown_LDADD = \
 	$(top_builddir)/src/libNetworkManager.la
 
-# TODO: enable valgrind for ifupdown. Currently it fails.
-#@VALGRIND_RULES@
+@VALGRIND_RULES@
 TESTS = test-ifupdown
 
 endif
diff --git a/src/settings/plugins/ifupdown/tests/test-ifupdown.c b/src/settings/plugins/ifupdown/tests/test-ifupdown.c
index ad483fa856..7ce08aee24 100644
--- a/src/settings/plugins/ifupdown/tests/test-ifupdown.c
+++ b/src/settings/plugins/ifupdown/tests/test-ifupdown.c
@@ -506,6 +506,7 @@ test17_read_static_ipv4 (const char *path)
 	g_assert_cmpstr (nm_setting_ip_config_get_dns_search (s_ip4, 0), ==, "example.com");
 	g_assert_cmpstr (nm_setting_ip_config_get_dns_search (s_ip4, 1), ==, "foo.example.com");
 
+	ifparser_destroy ();
 	g_object_unref (connection);
 }
 
@@ -560,6 +561,7 @@ test18_read_static_ipv6 (const char *path)
 	g_assert_cmpstr (nm_setting_ip_config_get_dns_search (s_ip6, 0), ==, "example.com");
 	g_assert_cmpstr (nm_setting_ip_config_get_dns_search (s_ip6, 1), ==, "foo.example.com");
 
+	ifparser_destroy ();
 	g_object_unref (connection);
 }
 
@@ -594,6 +596,7 @@ test19_read_static_ipv4_plen (const char *path)
 	g_assert_cmpstr (nm_ip_address_get_address (ip4_addr), ==, "10.0.0.3");
 	g_assert_cmpint (nm_ip_address_get_prefix (ip4_addr), ==, 8);
 
+	ifparser_destroy ();
 	g_object_unref (connection);
 }
 
diff --git a/valgrind.suppressions b/valgrind.suppressions
index 46b4a5ba76..596d5611fc 100644
--- a/valgrind.suppressions
+++ b/valgrind.suppressions
@@ -440,3 +440,11 @@
    fun:start_thread
    fun:clone
 }
+{
+   _btrfs_io_clone
+   Memcheck:Param
+   ioctl(generic)
+   fun:ioctl
+   fun:btrfs_reflink_with_progress
+   ...
+}