compiler-rt/test/hwasan/TestCases/many-threads-uaf.c

   1 // RUN: %clang_hwasan %s -o %t && not %env_hwasan_opts=verbose_threads=1 %run %t 2>&1 | FileCheck %s
   2
   3 #include <pthread.h>
   4 #include <stdlib.h>
   5 #include <stdio.h>
   6
   7 #include <sanitizer/hwasan_interface.h>
   8
   9 void *BoringThread(void *arg) {
  10   char * volatile x = (char*)malloc(10);
  11   x[5] = 0;
  12   free(x);
  13   return NULL;
  14 }
  15
  16 // CHECK: Creating  : T0
  17 // CHECK: Creating  : T1
  18 // CHECK: Destroying: T1
  19 // CHECK: Creating  : T1100
  20 // CHECK: Destroying: T1100
  21 // CHECK: Creating  : T1101
  22
  23 void *UAFThread(void *arg) {
  24   char * volatile x = (char*)malloc(10);
  25   fprintf(stderr, "ZZZ %p\n", x);
  26   fflush(stderr);
  27   free(x);
  28   x[5] = 42;
  29   // CHECK: ERROR: HWAddressSanitizer: tag-mismatch on address
  30   // CHECK: WRITE of size 1
  31   // CHECK: many-threads-uaf.c:[[@LINE-3]]
  32   // CHECK: Thread: T1101
  33   return NULL;
  34 }
  35
  36 int main() {
  37   __hwasan_enable_allocator_tagging();
  38   pthread_t t;
  39   for (int i = 0; i < 1100; i++) {
  40     pthread_create(&t, NULL, BoringThread, NULL);
  41     pthread_join(t, NULL);
  42   }
  43   pthread_create(&t, NULL, UAFThread, NULL);
  44   pthread_join(t, NULL);
  45 }