diff --git a/libc/Android.bp b/libc/Android.bp
index 4fc3484..44b0b68 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -1265,7 +1265,6 @@
         "bionic/clock_getcpuclockid.cpp",
         "bionic/clock_nanosleep.cpp",
         "bionic/clone.cpp",
-        "bionic/close.cpp",
         "bionic/connect.cpp",
         "bionic/ctype.cpp",
         "bionic/dirent.cpp",
@@ -1278,6 +1277,7 @@
         "bionic/faccessat.cpp",
         "bionic/fchmod.cpp",
         "bionic/fchmodat.cpp",
+        "bionic/fdsan.cpp",
         "bionic/ffs.cpp",
         "bionic/fgetxattr.cpp",
         "bionic/flistxattr.cpp",
diff --git a/libc/async_safe/async_safe_log.cpp b/libc/async_safe/async_safe_log.cpp
index 1018ef5..c6b8b53 100644
--- a/libc/async_safe/async_safe_log.cpp
+++ b/libc/async_safe/async_safe_log.cpp
@@ -37,6 +37,7 @@
 #include <string.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
+#include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/uio.h>
 #include <sys/un.h>
@@ -50,6 +51,12 @@
 #include "private/ErrnoRestorer.h"
 #include "private/ScopedPthreadMutexLocker.h"
 
+// Don't call libc's close, since it might call back into us as a result of fdsan.
+#pragma GCC poison close
+static int __close(int fd) {
+  return syscall(__NR_close, fd);
+}
+
 // Must be kept in sync with frameworks/base/core/java/android/util/EventLog.java.
 enum AndroidEventLogType {
   EVENT_TYPE_INT = 0,
@@ -462,7 +469,7 @@
   strlcpy(u.addrUn.sun_path, "/dev/socket/logdw", sizeof(u.addrUn.sun_path));
 
   if (TEMP_FAILURE_RETRY(connect(log_fd, &u.addr, sizeof(u.addrUn))) != 0) {
-    close(log_fd);
+    __close(log_fd);
     return -1;
   }
 
@@ -504,7 +511,7 @@
   vec[5].iov_len = strlen(msg) + 1;
 
   int result = TEMP_FAILURE_RETRY(writev(main_log_fd, vec, sizeof(vec) / sizeof(vec[0])));
-  close(main_log_fd);
+  __close(main_log_fd);
   return result;
 }
 
diff --git a/libc/bionic/close.cpp b/libc/bionic/close.cpp
deleted file mode 100644
index 18225f0..0000000
--- a/libc/bionic/close.cpp
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2015 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <errno.h>
-#include <unistd.h>
-
-extern "C" int ___close(int);
-
-int close(int fd) {
-  int rc = ___close(fd);
-  if (rc == -1 && errno == EINTR) {
-    // POSIX says that if close returns with EINTR, the fd must not be closed.
-    // Linus disagrees: http://lkml.indiana.edu/hypermail/linux/kernel/0509.1/0877.html
-    // The future POSIX solution is posix_close (http://austingroupbugs.net/view.php?id=529),
-    // with the state after EINTR being undefined, and EINPROGRESS for the case where close
-    // was interrupted by a signal but the file descriptor was actually closed.
-    // My concern with that future behavior is that it breaks existing code that assumes
-    // that close only returns -1 if it failed. Unlike other system calls, I have real
-    // difficulty even imagining a caller that would need to know that close was interrupted
-    // but succeeded. So returning EINTR is wrong (because Linux always closes) and EINPROGRESS
-    // is harmful because callers need to be rewritten to understand that EINPROGRESS isn't
-    // actually a failure, but will be reported as one.
-
-    // We don't restore errno because that would incur a cost (the TLS read) for every caller.
-    // Since callers don't know ahead of time whether close will legitimately fail, they need
-    // to have stashed the old errno value anyway if they plan on using it afterwards, so
-    // us clobbering errno here doesn't change anything in that respect.
-    return 0;
-  }
-  return rc;
-}
diff --git a/libc/bionic/dirent.cpp b/libc/bionic/dirent.cpp
index 37a2fa7..153e56a 100644
--- a/libc/bionic/dirent.cpp
+++ b/libc/bionic/dirent.cpp
@@ -36,6 +36,8 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include <android/fdsan.h>
+
 #include "private/bionic_fortify.h"
 #include "private/ErrnoRestorer.h"
 #include "private/ScopedPthreadMutexLocker.h"
@@ -59,12 +61,18 @@
 
 #define CHECK_DIR(d) if (d == nullptr) __fortify_fatal("%s: null DIR*", __FUNCTION__)
 
+static uint64_t __get_dir_tag(DIR* dir) {
+  return android_fdsan_create_owner_tag(ANDROID_FDSAN_OWNER_TYPE_DIR,
+                                        reinterpret_cast<uint64_t>(dir));
+}
+
 static DIR* __allocate_DIR(int fd) {
   DIR* d = reinterpret_cast<DIR*>(malloc(sizeof(DIR)));
   if (d == NULL) {
     return NULL;
   }
   d->fd_ = fd;
+  android_fdsan_exchange_owner_tag(fd, 0, __get_dir_tag(d));
   d->available_bytes_ = 0;
   d->next_ = NULL;
   d->current_pos_ = 0L;
@@ -159,8 +167,9 @@
 
   int fd = d->fd_;
   pthread_mutex_destroy(&d->mutex_);
+  int rc = android_fdsan_close_with_tag(fd, __get_dir_tag(d));
   free(d);
-  return close(fd);
+  return rc;
 }
 
 void rewinddir(DIR* d) {
diff --git a/libc/bionic/fdsan.cpp b/libc/bionic/fdsan.cpp
new file mode 100644
index 0000000..df369cc
--- /dev/null
+++ b/libc/bionic/fdsan.cpp
@@ -0,0 +1,275 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <android/fdsan.h>
+
+#include <errno.h>
+#include <inttypes.h>
+#include <stdarg.h>
+#include <stdatomic.h>
+#include <string.h>
+#include <sys/cdefs.h>
+#include <sys/mman.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+#include <async_safe/log.h>
+#include <sys/system_properties.h>
+
+#include "private/bionic_globals.h"
+#include "pthread_internal.h"
+
+extern "C" int ___close(int fd);
+pid_t __get_cached_pid();
+
+static constexpr const char* kFdsanPropertyName = "debug.fdsan";
+
+void __libc_init_fdsan() {
+  const prop_info* pi = __system_property_find(kFdsanPropertyName);
+  if (!pi) {
+    android_fdsan_set_error_level(ANDROID_FDSAN_ERROR_LEVEL_DISABLED);
+    return;
+  }
+  __system_property_read_callback(
+      pi,
+      [](void*, const char*, const char* value, uint32_t) {
+        if (strcasecmp(value, "1") == 0 || strcasecmp(value, "fatal") == 0) {
+          android_fdsan_set_error_level(ANDROID_FDSAN_ERROR_LEVEL_FATAL);
+        } else if (strcasecmp(value, "warn") == 0) {
+          android_fdsan_set_error_level(ANDROID_FDSAN_ERROR_LEVEL_WARN_ALWAYS);
+        } else if (strcasecmp(value, "warn_once") == 0) {
+          android_fdsan_set_error_level(ANDROID_FDSAN_ERROR_LEVEL_WARN_ONCE);
+        } else {
+          if (strlen(value) != 0 && strcasecmp(value, "0") != 0) {
+            async_safe_format_log(ANDROID_LOG_ERROR, "libc",
+                                  "debug.fdsan set to unknown value '%s', disabling", value);
+          }
+          android_fdsan_set_error_level(ANDROID_FDSAN_ERROR_LEVEL_DISABLED);
+        }
+      },
+      nullptr);
+}
+
+static FdTable<128>* GetFdTable() {
+  if (!__libc_shared_globals) {
+    return nullptr;
+  }
+
+  return &__libc_shared_globals->fd_table;
+}
+
+static FdEntry* GetFdEntry(int fd) {
+  if (fd < 0) {
+    return nullptr;
+  }
+
+  auto* fd_table = GetFdTable();
+  if (!fd_table) {
+    return nullptr;
+  }
+
+  return fd_table->at(fd);
+}
+
+__printflike(1, 0) static void fdsan_error(const char* fmt, ...) {
+  auto* fd_table = GetFdTable();
+  if (!fd_table) {
+    return;
+  }
+
+  auto error_level = atomic_load(&fd_table->error_level);
+  if (error_level == ANDROID_FDSAN_ERROR_LEVEL_DISABLED) {
+    return;
+  }
+
+  // Lots of code will (sensibly) fork, blindly call close on all of their fds,
+  // and then exec. Compare our cached pid value against the real one to detect
+  // this scenario and permit it.
+  pid_t cached_pid = __get_cached_pid();
+  if (cached_pid == 0 || cached_pid != syscall(__NR_getpid)) {
+    return;
+  }
+
+  va_list va;
+  va_start(va, fmt);
+  async_safe_fatal_va_list("fdsan", fmt, va);
+  va_end(va);
+
+  switch (error_level) {
+    case ANDROID_FDSAN_ERROR_LEVEL_WARN_ONCE:
+      atomic_compare_exchange_strong(&fd_table->error_level, &error_level,
+                                     ANDROID_FDSAN_ERROR_LEVEL_DISABLED);
+      break;
+
+    case ANDROID_FDSAN_ERROR_LEVEL_FATAL:
+      abort();
+
+    case ANDROID_FDSAN_ERROR_LEVEL_DISABLED:
+    case ANDROID_FDSAN_ERROR_LEVEL_WARN_ALWAYS:
+      break;
+  }
+}
+
+uint64_t android_fdsan_create_owner_tag(android_fdsan_owner_type type, uint64_t tag) {
+  if (tag == 0) {
+    return 0;
+  }
+
+  if (__predict_false((type & 0xff) != type)) {
+    async_safe_fatal("invalid android_fdsan_owner_type value: %x", type);
+  }
+
+  uint64_t result = static_cast<uint64_t>(type) << 56;
+  uint64_t mask = (static_cast<uint64_t>(1) << 56) - 1;
+  result |= tag & mask;
+  return result;
+}
+
+static const char* __tag_to_type(uint64_t tag) {
+  uint64_t type = tag >> 56;
+  switch (type) {
+    case ANDROID_FDSAN_OWNER_TYPE_FILE:
+      return "FILE*";
+    case ANDROID_FDSAN_OWNER_TYPE_DIR:
+      return "DIR*";
+    case ANDROID_FDSAN_OWNER_TYPE_UNIQUE_FD:
+      return "unique_fd";
+    case ANDROID_FDSAN_OWNER_TYPE_FILEINPUTSTREAM:
+      return "FileInputStream";
+    case ANDROID_FDSAN_OWNER_TYPE_FILEOUTPUTSTREAM:
+      return "FileOutputStream";
+    case ANDROID_FDSAN_OWNER_TYPE_RANDOMACCESSFILE:
+      return "RandomAccessFile";
+    case ANDROID_FDSAN_OWNER_TYPE_PARCELFILEDESCRIPTOR:
+      return "ParcelFileDescriptor";
+
+    case ANDROID_FDSAN_OWNER_TYPE_GENERIC_00:
+    default:
+      return "native object of unknown type";
+
+    case ANDROID_FDSAN_OWNER_TYPE_GENERIC_FF:
+      // If bits 48 to 56 are set, this is a sign-extended generic native pointer
+      uint64_t high_bits = tag >> 48;
+      if (high_bits == (1 << 16) - 1) {
+        return "native object of unknown type";
+      }
+
+      return "Java object of unknown type";
+  }
+}
+
+static uint64_t __tag_to_owner(uint64_t tag) {
+  return tag;
+}
+
+int android_fdsan_close_with_tag(int fd, uint64_t expected_tag) {
+  FdEntry* fde = GetFdEntry(fd);
+  if (!fde) {
+    return ___close(fd);
+  }
+
+  uint64_t tag = expected_tag;
+  if (!atomic_compare_exchange_strong(&fde->close_tag, &tag, 0)) {
+    const char* expected_type = __tag_to_type(expected_tag);
+    uint64_t expected_owner = __tag_to_owner(expected_tag);
+    const char* actual_type = __tag_to_type(tag);
+    uint64_t actual_owner = __tag_to_owner(tag);
+    if (expected_tag && tag) {
+      fdsan_error("attempted to close file descriptor %d, expected to be owned by %s 0x%" PRIx64
+                  ", actually owned by %s 0x%" PRIx64,
+                  fd, expected_type, expected_owner, actual_type, actual_owner);
+    } else if (expected_tag && !tag) {
+      fdsan_error("attempted to close file descriptor %d, expected to be owned by %s 0x%" PRIx64
+                  ", actually unowned",
+                  fd, expected_type, expected_owner);
+    } else if (!expected_tag && tag) {
+      fdsan_error(
+          "attempted to close file descriptor %d, expected to be unowned, actually owned by %s "
+          "0x%" PRIx64,
+          fd, actual_type, actual_owner);
+    } else if (!expected_tag && !tag) {
+      // This should never happen: our CAS failed, but expected == actual?
+      async_safe_fatal("fdsan atomic_compare_exchange_strong failed unexpectedly");
+    }
+  }
+
+  int rc = ___close(fd);
+  // If we were expecting to close with a tag, abort on EBADF.
+  if (expected_tag && rc == -1 && errno == EBADF) {
+    fdsan_error("double-close of file descriptor %d detected", fd);
+  }
+  return rc;
+}
+
+void android_fdsan_exchange_owner_tag(int fd, uint64_t expected_tag, uint64_t new_tag) {
+  FdEntry* fde = GetFdEntry(fd);
+  if (!fde) {
+    return;
+  }
+
+  uint64_t tag = expected_tag;
+  if (!atomic_compare_exchange_strong(&fde->close_tag, &tag, new_tag)) {
+    if (expected_tag == 0) {
+      fdsan_error(
+          "failed to take ownership of already-owned file descriptor: fd %d is owned by %s "
+          "%" PRIx64,
+          fd, __tag_to_type(tag), __tag_to_owner(tag));
+    } else {
+      fdsan_error(
+          "failed to exchange ownership of unowned file descriptor: expected fd %d to be owned "
+          "by %s %" PRIx64,
+          fd, __tag_to_type(expected_tag), __tag_to_owner(expected_tag));
+    }
+  }
+}
+
+android_fdsan_error_level android_fdsan_get_error_level() {
+  auto* fd_table = GetFdTable();
+  if (!fd_table) {
+    async_safe_fatal("attempted to get fdsan error level before libc initialization?");
+  }
+
+  return fd_table->error_level;
+}
+
+android_fdsan_error_level android_fdsan_set_error_level(android_fdsan_error_level new_level) {
+  auto* fd_table = GetFdTable();
+  if (!fd_table) {
+    async_safe_fatal("attempted to get fdsan error level before libc initialization?");
+  }
+
+  return atomic_exchange(&fd_table->error_level, new_level);
+}
+
+int close(int fd) {
+  int rc = android_fdsan_close_with_tag(fd, 0);
+  if (rc == -1 && errno == EINTR) {
+    return 0;
+  }
+  return rc;
+}
diff --git a/libc/bionic/fork.cpp b/libc/bionic/fork.cpp
index 33b7343..fc00207 100644
--- a/libc/bionic/fork.cpp
+++ b/libc/bionic/fork.cpp
@@ -28,6 +28,8 @@
 
 #include <unistd.h>
 
+#include <android/fdsan.h>
+
 #include "private/bionic_defs.h"
 #include "pthread_internal.h"
 
@@ -48,6 +50,11 @@
     // Update the cached pid, since clone() will not set it directly (as
     // self->tid is updated by the kernel).
     self->set_cached_pid(gettid());
+
+    // Disable fdsan post-fork, so we don't falsely trigger on processes that
+    // fork, close all of their fds blindly, and then exec.
+    android_fdsan_set_error_level(ANDROID_FDSAN_ERROR_LEVEL_DISABLED);
+
     __bionic_atfork_run_child();
   } else {
     __bionic_atfork_run_parent();
diff --git a/libc/bionic/getpid.cpp b/libc/bionic/getpid.cpp
index 779b147..c6eb586 100644
--- a/libc/bionic/getpid.cpp
+++ b/libc/bionic/getpid.cpp
@@ -32,16 +32,22 @@
 
 extern "C" pid_t __getpid();
 
-pid_t getpid() {
+pid_t __get_cached_pid() {
   pthread_internal_t* self = __get_thread();
-
   if (__predict_true(self)) {
-    // Do we have a valid cached pid?
     pid_t cached_pid;
     if (__predict_true(self->get_cached_pid(&cached_pid))) {
       return cached_pid;
     }
   }
+  return 0;
+}
+
+pid_t getpid() {
+  pid_t cached_pid = __get_cached_pid();
+  if (__predict_true(cached_pid != 0)) {
+    return cached_pid;
+  }
 
   // We're still in the dynamic linker or we're in the middle of forking, so ask the kernel.
   // We don't know whether it's safe to update the cached value, so don't try.
diff --git a/libc/bionic/libc_init_common.cpp b/libc/bionic/libc_init_common.cpp
index 1ff6603..5c54341 100644
--- a/libc/bionic/libc_init_common.cpp
+++ b/libc/bionic/libc_init_common.cpp
@@ -56,6 +56,7 @@
 extern "C" int __system_properties_init(void);
 
 __LIBC_HIDDEN__ WriteProtected<libc_globals> __libc_globals;
+__LIBC_HIDDEN__ libc_shared_globals* __libc_shared_globals;
 
 // Not public, but well-known in the BSDs.
 const char* __progname;
@@ -75,6 +76,9 @@
   });
 }
 
+void __libc_init_shared_globals(libc_shared_globals*) {
+}
+
 #if !defined(__LP64__)
 static void __check_max_thread_id() {
   if (gettid() > 65535) {
@@ -113,6 +117,7 @@
   pthread_atfork(arc4random_fork_handler, _thread_arc4_unlock, _thread_arc4_unlock);
 
   __system_properties_init(); // Requires 'environ'.
+  __libc_init_fdsan(); // Requires system properties (for debug.fdsan).
 }
 
 __noreturn static void __early_abort(int line) {
diff --git a/libc/bionic/libc_init_dynamic.cpp b/libc/bionic/libc_init_dynamic.cpp
index 05b5535..c5606fb 100644
--- a/libc/bionic/libc_init_dynamic.cpp
+++ b/libc/bionic/libc_init_dynamic.cpp
@@ -78,6 +78,8 @@
 // protector.
 __attribute__((noinline))
 static void __libc_preinit_impl(KernelArgumentBlock& args) {
+  __libc_shared_globals = args.shared_globals;
+
   __libc_init_globals(args);
   __libc_init_common(args);
 
diff --git a/libc/bionic/libc_init_static.cpp b/libc/bionic/libc_init_static.cpp
index 038f6a7..3828def 100644
--- a/libc/bionic/libc_init_static.cpp
+++ b/libc/bionic/libc_init_static.cpp
@@ -96,6 +96,11 @@
 
   // Initializing the globals requires TLS to be available for errno.
   __libc_init_main_thread(args);
+
+  static libc_shared_globals shared_globals;
+  __libc_shared_globals = &shared_globals;
+  __libc_init_shared_globals(&shared_globals);
+
   __libc_init_globals(args);
 
   __libc_init_AT_SECURE(args);
diff --git a/libc/bionic/spawn.cpp b/libc/bionic/spawn.cpp
index fde102c..e73828f 100644
--- a/libc/bionic/spawn.cpp
+++ b/libc/bionic/spawn.cpp
@@ -35,6 +35,8 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <android/fdsan.h>
+
 #include "private/ScopedSignalBlocker.h"
 #include "private/SigSetConverter.h"
 
diff --git a/libc/include/android/fdsan.h b/libc/include/android/fdsan.h
new file mode 100644
index 0000000..908619e
--- /dev/null
+++ b/libc/include/android/fdsan.h
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <sys/cdefs.h>
+
+__BEGIN_DECLS
+
+/*
+ * Error checking for close(2).
+ *
+ * Mishandling of file descriptor ownership is a common source of errors that
+ * can be extremely difficult to diagnose. Mistakes like the following can
+ * result in seemingly 'impossible' failures showing up on other threads that
+ * happened to try to open a file descriptor between the buggy code's close and
+ * fclose:
+ *
+ *     int print(int fd) {
+ *         int rc;
+ *         char buf[128];
+ *         while ((rc = read(fd, buf, sizeof(buf))) > 0) {
+ *             printf("%.*s", rc);
+ *         }
+ *         close(fd);
+ *     }
+ *
+ *     int bug() {
+ *         FILE* f = fopen("foo", "r");
+ *         print(fileno(f));
+ *         fclose(f);
+ *     }
+ *
+ * To make it easier to find this class of bugs, bionic provides a method to
+ * require that file descriptors are closed by their owners. File descriptors
+ * can be associated with tags with which they must be closed. This allows
+ * objects that conceptually own an fd (FILE*, unique_fd, etc.) to use their
+ * own address at the tag, to enforce that closure of the fd must come as a
+ * result of their own destruction (fclose, ~unique_fd, etc.)
+ *
+ * By default, a file descriptor's tag is 0, and close(fd) is equivalent to
+ * closing fd with the tag 0.
+ */
+
+/*
+ * For improved diagnostics, the type of a file descriptors owner can be
+ * encoded in the most significant byte of the owner tag. Values of 0 and 0xff
+ * are ignored, which allows for raw pointers to be used as owner tags without
+ * modification.
+ */
+enum android_fdsan_owner_type {
+  /*
+   * Generic Java or native owners.
+   *
+   * Generic Java objects always use 255 as their type, using identityHashCode
+   * as the value of the tag, leaving bits 33-56 unset. Native pointers are sign
+   * extended from 48-bits of virtual address space, and so can have the MSB
+   * set to 255 as well. Use the value of bits 49-56 to distinguish between
+   * these cases.
+   */
+  ANDROID_FDSAN_OWNER_TYPE_GENERIC_00 = 0,
+  ANDROID_FDSAN_OWNER_TYPE_GENERIC_FF = 255,
+
+  /* FILE* */
+  ANDROID_FDSAN_OWNER_TYPE_FILE = 1,
+
+  /* DIR* */
+  ANDROID_FDSAN_OWNER_TYPE_DIR = 2,
+
+  /* android::base::unique_fd */
+  ANDROID_FDSAN_OWNER_TYPE_UNIQUE_FD = 3,
+
+  /* java.io.FileInputStream */
+  ANDROID_FDSAN_OWNER_TYPE_FILEINPUTSTREAM = 251,
+
+  /* java.io.FileOutputStream */
+  ANDROID_FDSAN_OWNER_TYPE_FILEOUTPUTSTREAM = 252,
+
+  /* java.io.RandomAccessFile */
+  ANDROID_FDSAN_OWNER_TYPE_RANDOMACCESSFILE = 253,
+
+  /* android.os.ParcelFileDescriptor */
+  ANDROID_FDSAN_OWNER_TYPE_PARCELFILEDESCRIPTOR = 254,
+};
+
+/*
+ * Create an owner tag with the specified type and least significant 56 bits of tag.
+ */
+uint64_t android_fdsan_create_owner_tag(enum android_fdsan_owner_type type, uint64_t tag) __INTRODUCED_IN_FUTURE;
+
+/*
+ * Exchange a file descriptor's tag.
+ *
+ * Logs and aborts if the fd's tag does not match expected_tag.
+ */
+void android_fdsan_exchange_owner_tag(int fd, uint64_t expected_tag, uint64_t new_tag) __INTRODUCED_IN_FUTURE;
+
+/*
+ * Close a file descriptor with a tag, and resets the tag to 0.
+ *
+ * Logs and aborts if the tag is incorrect.
+ */
+int android_fdsan_close_with_tag(int fd, uint64_t tag) __INTRODUCED_IN_FUTURE;
+
+enum android_fdsan_error_level {
+  // No errors.
+  ANDROID_FDSAN_ERROR_LEVEL_DISABLED,
+
+  // Warn once(ish) on error, and then downgrade to ANDROID_FDSAN_ERROR_LEVEL_DISABLED.
+  ANDROID_FDSAN_ERROR_LEVEL_WARN_ONCE,
+
+  // Warn always on error.
+  ANDROID_FDSAN_ERROR_LEVEL_WARN_ALWAYS,
+
+  // Abort on error.
+  ANDROID_FDSAN_ERROR_LEVEL_FATAL,
+};
+
+/*
+ * Get the error level.
+ */
+enum android_fdsan_error_level android_fdsan_get_error_level() __INTRODUCED_IN_FUTURE;
+
+/*
+ * Set the error level and return the previous state.
+ *
+ * Error checking is automatically disabled in the child of a fork, to maintain
+ * compatibility with code that forks, blindly closes FDs, and then execs.
+ *
+ * In cases such as the zygote, where the child has no intention of calling
+ * exec, call this function to reenable fdsan checks.
+ *
+ * This function is not thread-safe and does not synchronize with checks of the
+ * value, and so should probably only be called in single-threaded contexts
+ * (e.g. postfork).
+ */
+enum android_fdsan_error_level android_fdsan_set_error_level(enum android_fdsan_error_level new_level) __INTRODUCED_IN_FUTURE;
+
+__END_DECLS
diff --git a/libc/libc.arm.map b/libc/libc.arm.map
index 43c6093..14e5784 100644
--- a/libc/libc.arm.map
+++ b/libc/libc.arm.map
@@ -1423,6 +1423,11 @@
 LIBC_Q { # introduced=Q
   global:
     __res_randomid;
+    android_fdsan_close_with_tag;
+    android_fdsan_create_owner_tag;
+    android_fdsan_exchange_owner_tag;
+    android_fdsan_get_error_level;
+    android_fdsan_set_error_level;
     timespec_get;
 } LIBC_P;
 
diff --git a/libc/libc.arm64.map b/libc/libc.arm64.map
index 3e20d7e..2f5c4ab 100644
--- a/libc/libc.arm64.map
+++ b/libc/libc.arm64.map
@@ -1344,6 +1344,11 @@
 LIBC_Q { # introduced=Q
   global:
     __res_randomid;
+    android_fdsan_close_with_tag;
+    android_fdsan_create_owner_tag;
+    android_fdsan_exchange_owner_tag;
+    android_fdsan_get_error_level;
+    android_fdsan_set_error_level;
     timespec_get;
 } LIBC_P;
 
diff --git a/libc/libc.map.txt b/libc/libc.map.txt
index d6b35fd..b4262da 100644
--- a/libc/libc.map.txt
+++ b/libc/libc.map.txt
@@ -1448,6 +1448,11 @@
 LIBC_Q { # introduced=Q
   global:
     __res_randomid;
+    android_fdsan_close_with_tag;
+    android_fdsan_create_owner_tag;
+    android_fdsan_exchange_owner_tag;
+    android_fdsan_get_error_level;
+    android_fdsan_set_error_level;
     timespec_get;
 } LIBC_P;
 
diff --git a/libc/libc.mips.map b/libc/libc.mips.map
index d163991..5e0b13f 100644
--- a/libc/libc.mips.map
+++ b/libc/libc.mips.map
@@ -1407,6 +1407,11 @@
 LIBC_Q { # introduced=Q
   global:
     __res_randomid;
+    android_fdsan_close_with_tag;
+    android_fdsan_create_owner_tag;
+    android_fdsan_exchange_owner_tag;
+    android_fdsan_get_error_level;
+    android_fdsan_set_error_level;
     timespec_get;
 } LIBC_P;
 
diff --git a/libc/libc.mips64.map b/libc/libc.mips64.map
index 3e20d7e..2f5c4ab 100644
--- a/libc/libc.mips64.map
+++ b/libc/libc.mips64.map
@@ -1344,6 +1344,11 @@
 LIBC_Q { # introduced=Q
   global:
     __res_randomid;
+    android_fdsan_close_with_tag;
+    android_fdsan_create_owner_tag;
+    android_fdsan_exchange_owner_tag;
+    android_fdsan_get_error_level;
+    android_fdsan_set_error_level;
     timespec_get;
 } LIBC_P;
 
diff --git a/libc/libc.x86.map b/libc/libc.x86.map
index ef4da9e..243af5b 100644
--- a/libc/libc.x86.map
+++ b/libc/libc.x86.map
@@ -1405,6 +1405,11 @@
 LIBC_Q { # introduced=Q
   global:
     __res_randomid;
+    android_fdsan_close_with_tag;
+    android_fdsan_create_owner_tag;
+    android_fdsan_exchange_owner_tag;
+    android_fdsan_get_error_level;
+    android_fdsan_set_error_level;
     timespec_get;
 } LIBC_P;
 
diff --git a/libc/libc.x86_64.map b/libc/libc.x86_64.map
index 3e20d7e..2f5c4ab 100644
--- a/libc/libc.x86_64.map
+++ b/libc/libc.x86_64.map
@@ -1344,6 +1344,11 @@
 LIBC_Q { # introduced=Q
   global:
     __res_randomid;
+    android_fdsan_close_with_tag;
+    android_fdsan_create_owner_tag;
+    android_fdsan_exchange_owner_tag;
+    android_fdsan_get_error_level;
+    android_fdsan_set_error_level;
     timespec_get;
 } LIBC_P;
 
diff --git a/libc/private/KernelArgumentBlock.h b/libc/private/KernelArgumentBlock.h
index 747186c..5b6b77f 100644
--- a/libc/private/KernelArgumentBlock.h
+++ b/libc/private/KernelArgumentBlock.h
@@ -25,6 +25,7 @@
 #include "private/bionic_macros.h"
 
 struct abort_msg_t;
+struct libc_shared_globals;
 
 // When the kernel starts the dynamic linker, it passes a pointer to a block
 // of memory containing argc, the argv array, the environment variable array,
@@ -65,7 +66,9 @@
   char** envp;
   ElfW(auxv_t)* auxv;
 
+  // Other data that we want to pass from the dynamic linker to libc.so.
   abort_msg_t** abort_message_ptr;
+  libc_shared_globals* shared_globals;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(KernelArgumentBlock);
diff --git a/libc/private/bionic_fdsan.h b/libc/private/bionic_fdsan.h
new file mode 100644
index 0000000..b93260b
--- /dev/null
+++ b/libc/private/bionic_fdsan.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <android/fdsan.h>
+
+#include <errno.h>
+#include <stdatomic.h>
+#include <string.h>
+#include <sys/cdefs.h>
+#include <sys/mman.h>
+#include <sys/resource.h>
+#include <sys/user.h>
+
+#include <async_safe/log.h>
+
+struct FdEntry {
+  _Atomic(uint64_t) close_tag;
+};
+
+struct FdTableOverflow {
+  size_t len;
+  FdEntry entries[0];
+};
+
+template <size_t inline_fds>
+struct FdTable {
+  _Atomic(android_fdsan_error_level) error_level;
+
+  FdEntry entries[inline_fds];
+  _Atomic(FdTableOverflow*) overflow;
+
+  FdEntry* at(size_t idx) {
+    if (idx < inline_fds) {
+      return &entries[idx];
+    }
+
+    // Try to create the overflow table ourselves.
+    FdTableOverflow* local_overflow = atomic_load(&overflow);
+    if (__predict_false(!local_overflow)) {
+      struct rlimit rlim = { .rlim_max = 32768 };
+      getrlimit(RLIMIT_NOFILE, &rlim);
+      rlim_t max = rlim.rlim_max;
+
+      if (max == RLIM_INFINITY) {
+        // This isn't actually possible (the kernel has a hard limit), but just
+        // in case...
+        max = 32768;
+      }
+
+      if (idx > max) {
+        // This can happen if an fd is created and then the rlimit is lowered.
+        // In this case, just return nullptr and ignore the fd.
+        return nullptr;
+      }
+
+      size_t required_count = max - inline_fds;
+      size_t required_size = sizeof(FdTableOverflow) + required_count * sizeof(FdEntry);
+      size_t aligned_size = __BIONIC_ALIGN(required_size, PAGE_SIZE);
+      size_t aligned_count = (aligned_size - sizeof(FdTableOverflow)) / sizeof(FdEntry);
+
+      void* allocation =
+          mmap(nullptr, aligned_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+      if (allocation == MAP_FAILED) {
+        async_safe_fatal("fdsan: mmap failed: %s", strerror(errno));
+      }
+
+      FdTableOverflow* new_overflow = reinterpret_cast<FdTableOverflow*>(allocation);
+      new_overflow->len = aligned_count;
+
+      if (atomic_compare_exchange_strong(&overflow, &local_overflow, new_overflow)) {
+        local_overflow = new_overflow;
+      } else {
+        // Someone beat us to it. Deallocate and use theirs.
+        munmap(allocation, aligned_size);
+      }
+    }
+
+    size_t offset = idx - inline_fds;
+    if (local_overflow->len < offset) {
+      return nullptr;
+    }
+    return &local_overflow->entries[offset];
+  }
+};
diff --git a/libc/private/bionic_globals.h b/libc/private/bionic_globals.h
index 94dd7e8..e569209 100644
--- a/libc/private/bionic_globals.h
+++ b/libc/private/bionic_globals.h
@@ -31,6 +31,7 @@
 
 #include <sys/cdefs.h>
 
+#include "private/bionic_fdsan.h"
 #include "private/bionic_malloc_dispatch.h"
 #include "private/bionic_vdso.h"
 #include "private/WriteProtected.h"
@@ -43,6 +44,15 @@
 
 __LIBC_HIDDEN__ extern WriteProtected<libc_globals> __libc_globals;
 
+// Globals shared between the dynamic linker and libc.so.
+struct libc_shared_globals {
+  FdTable<128> fd_table;
+};
+
+__LIBC_HIDDEN__ extern libc_shared_globals* __libc_shared_globals;
+__LIBC_HIDDEN__ void __libc_init_shared_globals(libc_shared_globals*);
+__LIBC_HIDDEN__ void __libc_init_fdsan();
+
 class KernelArgumentBlock;
 __LIBC_HIDDEN__ void __libc_init_malloc(libc_globals* globals);
 __LIBC_HIDDEN__ void __libc_init_setjmp_cookie(libc_globals* globals, KernelArgumentBlock& args);
diff --git a/libc/stdio/stdio.cpp b/libc/stdio/stdio.cpp
index 1f08ea1..050157b 100644
--- a/libc/stdio/stdio.cpp
+++ b/libc/stdio/stdio.cpp
@@ -46,6 +46,8 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
+#include <android/fdsan.h>
+
 #include <async_safe/log.h>
 
 #include "local.h"
@@ -54,6 +56,8 @@
 #include "private/ErrnoRestorer.h"
 #include "private/thread_private.h"
 
+extern "C" int ___close(int fd);
+
 #define ALIGNBYTES (sizeof(uintptr_t) - 1)
 #define ALIGN(p) (((uintptr_t)(p) + ALIGNBYTES) &~ ALIGNBYTES)
 
@@ -102,6 +106,19 @@
 FILE* stderr = &__sF[2];
 
 static pthread_mutex_t __stdio_mutex = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
+
+static uint64_t __get_file_tag(FILE* fp) {
+  // Don't use a tag for the standard streams.
+  // They don't really own their file descriptors, because the values are well-known, and you're
+  // allowed to do things like `close(STDIN_FILENO); open("foo", O_RDONLY)` when single-threaded.
+  if (fp == stdin || fp == stderr || fp == stdout) {
+    return 0;
+  }
+
+  return android_fdsan_create_owner_tag(ANDROID_FDSAN_OWNER_TYPE_FILE,
+                                        reinterpret_cast<uint64_t>(fp));
+}
+
 struct glue __sglue = { nullptr, 3, __sF };
 static struct glue* lastglue = &__sglue;
 
@@ -219,6 +236,7 @@
   FILE* fp = __sfp();
   if (fp != nullptr) {
     fp->_file = fd;
+    android_fdsan_exchange_owner_tag(fd, 0, __get_file_tag(fp));
     fp->_flags = flags;
     fp->_cookie = fp;
     fp->_read = __sread;
@@ -373,6 +391,7 @@
 
   fp->_flags = flags;
   fp->_file = fd;
+  android_fdsan_exchange_owner_tag(fd, 0, __get_file_tag(fp));
   fp->_cookie = fp;
   fp->_read = __sread;
   fp->_write = __swrite;
@@ -518,7 +537,7 @@
 
 int __sclose(void* cookie) {
   FILE* fp = reinterpret_cast<FILE*>(cookie);
-  return close(fp->_file);
+  return android_fdsan_close_with_tag(fp->_file, __get_file_tag(fp));
 }
 
 static off64_t __seek_unlocked(FILE* fp, off64_t offset, int whence) {