46 lines · c
1// RUN: %clang_hwasan %s -o %t && not %env_hwasan_opts=verbose_threads=1 %run %t 2>&1 | FileCheck %s2 3#include <pthread.h>4#include <stdlib.h>5#include <stdio.h>6 7#include <sanitizer/hwasan_interface.h>8 9void *BoringThread(void *arg) {10 char * volatile x = (char*)malloc(10);11 x[5] = 0;12 free(x);13 return NULL;14}15 16// CHECK: Creating : T017// CHECK: Creating : T118// CHECK: Destroying: T119// CHECK: Creating : T110020// CHECK: Destroying: T110021// CHECK: Creating : T110122 23void *UAFThread(void *arg) {24 char * volatile x = (char*)malloc(10);25 fprintf(stderr, "ZZZ %p\n", x);26 fflush(stderr);27 free(x);28 x[5] = 42;29 // CHECK: ERROR: HWAddressSanitizer: tag-mismatch on address30 // CHECK: WRITE of size 131 // CHECK: many-threads-uaf.c:[[@LINE-3]]32 // CHECK: Thread: T110133 return NULL;34}35 36int main() {37 __hwasan_enable_allocator_tagging();38 pthread_t t;39 for (int i = 0; i < 1100; i++) {40 pthread_create(&t, NULL, BoringThread, NULL);41 pthread_join(t, NULL);42 }43 pthread_create(&t, NULL, UAFThread, NULL);44 pthread_join(t, NULL);45}46