{"record":{"id":"103c76908a10e16e","repo":"golang/go","slug":"fips-140-3-mode-is-incompatible-with-asan","errorCode":null,"errorMessage":"FIPS 140-3 mode is incompatible with ASAN","messagePattern":"FIPS 140-3 mode is incompatible with ASAN","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/fips140.go","lineNumber":47,"sourceCode":"}\n\n// Supported returns an error if FIPS 140-3 mode can't be enabled.\nfunc Supported() error {\n\t// Keep this in sync with fipsSupported in cmd/dist/test.go.\n\n\t// The purego tag changes too much of the implementation to claim the\n\t// validation still applies.\n\tif puregoEnabled {\n\t\treturn errors.New(\"FIPS 140-3 mode is incompatible with the purego build tag\")\n\t}\n\n\t// ASAN disapproves of reading swaths of global memory in fips140/check.\n\t// One option would be to expose runtime.asanunpoison through\n\t// crypto/internal/fips140deps and then call it to unpoison the range\n\t// before reading it, but it is unclear whether that would then cause\n\t// false negatives. For now, FIPS+ASAN doesn't need to work.\n\tif asanEnabled {\n\t\treturn errors.New(\"FIPS 140-3 mode is incompatible with ASAN\")\n\t}\n\n\t// See EnableFIPS in cmd/internal/obj/fips.go for commentary.\n\t// Also, js/wasm and windows/386 don't have good enough timers\n\t// for the CPU jitter entropy source.\n\tswitch {\n\tcase runtime.GOARCH == \"wasm\",\n\t\truntime.GOOS == \"windows\" && runtime.GOARCH == \"386\",\n\t\truntime.GOOS == \"openbsd\", // due to -fexecute-only, see #70880\n\t\truntime.GOOS == \"aix\":\n\t\treturn errors.New(\"FIPS 140-3 mode is not supported on \" + runtime.GOOS + \"-\" + runtime.GOARCH)\n\t}\n\n\tif boringEnabled {\n\t\treturn errors.New(\"FIPS 140-3 mode is incompatible with GOEXPERIMENT=boringcrypto\")\n\t}\n\n\treturn nil","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/fips140.go#L29-L65","documentation":"Returned by fips140.Supported() when the build was compiled with the ASAN sanitizer (-asan). The FIPS module reads large swaths of global memory in its integrity check (fips140/check), and ASAN flags this as out-of-bounds reads, producing false positives. FIPS+ASAN is not supported.","triggerScenarios":"Building with go build -asan (or GOEXPERIMENT=asan / equivalent) and then calling fips140.Supported() or enabling GOFIPS140=1.","commonSituations":"CI sanitizer jobs that enable ASAN globally; security-fuzzing harnesses; locally debugging memory issues with -asan and then attempting to also test FIPS mode.","solutions":["Disable ASAN for the FIPS build — FIPS and ASAN are mutually exclusive by design.","Run ASAN and FIPS test configurations as separate CI jobs.","If you need to debug a FIPS-only memory issue, use other tooling (manual inspection, MSAN on unrelated paths) rather than forcing FIPS+ASAN."],"exampleFix":"# before\ngo build -asan -tags=fips140 ./...\n\n# after\ngo build -tags=fips140 ./...","handlingStrategy":"validation","validationCode":"if err := fips140.Supported(); err != nil {\n    if strings.Contains(err.Error(), \"ASAN\") {\n        log.Fatal(\"FIPS mode and ASAN are mutually exclusive; rebuild without -asan\")\n    }\n    log.Fatalf(\"FIPS unsupported: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := fips140.Supported(); err != nil {\n    return fmt.Errorf(\"FIPS startup check failed: %w\", err)\n}","preventionTips":["Run ASAN and FIPS test jobs separately; never together.","Check supported() before enabling GOFIPS140=1 in CI.","Document the exclusion in the build matrix."],"tags":["fips140","asan","sanitizer","config","compatibility"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}