59 lines · c
1// Tests UAF detection where Allocate/Deallocate/Use2// happen in separate threads.3// RUN: %clang_hwasan %s -o %t && not %run %t 2>&1 | FileCheck %s4 5#include <pthread.h>6#include <stdlib.h>7#include <stdio.h>8 9#include <sanitizer/hwasan_interface.h>10 11char *volatile x;12int state;13 14void *Allocate(void *arg) {15 x = (char*)malloc(10);16 __sync_fetch_and_add(&state, 1);17 while (__sync_fetch_and_add(&state, 0) != 3) {}18 return NULL;19}20void *Deallocate(void *arg) {21 free(x);22 __sync_fetch_and_add(&state, 1);23 while (__sync_fetch_and_add(&state, 0) != 3) {}24 return NULL;25}26 27void *Use(void *arg) {28 x[5] = 42;29 // CHECK: ERROR: HWAddressSanitizer: tag-mismatch on address30 // CHECK: WRITE of size 1 {{.*}} in thread T331 // CHECK: thread-uaf.c:[[@LINE-3]]32 // CHECK: Cause: use-after-free33 // CHECK: freed by thread T2 here34 // CHECK: in Deallocate35 // CHECK: previously allocated by thread T1 here:36 // CHECK: in Allocate37 // CHECK-DAG: Thread: T2 0x38 // CHECK-DAG: Thread: T3 0x39 // CHECK-DAG: Thread: T0 0x40 // CHECK-DAG: Thread: T1 0x41 __sync_fetch_and_add(&state, 1);42 return NULL;43}44 45int main() {46 __hwasan_enable_allocator_tagging();47 pthread_t t1, t2, t3;48 49 pthread_create(&t1, NULL, Allocate, NULL);50 while (__sync_fetch_and_add(&state, 0) != 1) {}51 pthread_create(&t2, NULL, Deallocate, NULL);52 while (__sync_fetch_and_add(&state, 0) != 2) {}53 pthread_create(&t3, NULL, Use, NULL);54 55 pthread_join(t1, NULL);56 pthread_join(t2, NULL);57 pthread_join(t3, NULL);58}59