t_tsan_heap_use_after_free.sh revision 1.3 
1# Copyright (c) 2018 The NetBSD Foundation, Inc.
2# All rights reserved.
3#
4# This code is derived from software contributed to The NetBSD Foundation
5# by Yang Zheng.
6#
7# Redistribution and use in source and binary forms, with or without
8# modification, are permitted provided that the following conditions
9# are met:
10# 1. Redistributions of source code must retain the above copyright
11#    notice, this list of conditions and the following disclaimer.
12# 2. Redistributions in binary form must reproduce the above copyright
13#    notice, this list of conditions and the following disclaimer in the
14#    documentation and/or other materials provided with the distribution.
15#
16# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26# POSSIBILITY OF SUCH DAMAGE.
27#
28
29test_target()
30{
31	SUPPORT='n'
32	# Detect address space larger than 32 bits
33	maxaddress=`sysctl vm.maxaddress|awk '{print $3}'`
34	if [ $maxaddress -gt 4294967295 ]; then
35		if command -v cc >/dev/null 2>&1; then
36			if ! echo __clang__ | cc -E - | grep -q __clang__; then
37				SUPPORT='y'
38			elif ! cc -v 2>&1 | awk '/gcc version/{print $3}' | \
39				awk -F '.' '($0+0) > 9 {exit 1}'; then
40				SUPPORT='y'
41			fi
42		fi
43	fi
44}
45
46atf_test_case heap_use_after_free
47heap_use_after_free_head() {
48	atf_set "descr" "Test thread sanitizer for use-after-free condition"
49	atf_set "require.progs" "c++ paxctl"
50}
51
52atf_test_case heap_use_after_free_profile
53heap_use_after_free_profile_head() {
54	atf_set "descr" "Test thread sanitizer for use-after-free with profiling option"
55	atf_set "require.progs" "c++ paxctl"
56}
57atf_test_case heap_use_after_free_pic
58heap_use_after_free_pic_head() {
59	atf_set "descr" "Test thread sanitizer for use-after-free with position independent code (PIC) flag"
60	atf_set "require.progs" "c++ paxctl"
61}
62atf_test_case heap_use_after_free_pie
63heap_use_after_free_pie_head() {
64	atf_set "descr" "Test thread sanitizer for use-after-free with position independent execution (PIE) flag"
65	atf_set "require.progs" "c++ paxctl"
66}
67
68heap_use_after_free_body(){
69	cat > test.cc << EOF
70#include <pthread.h>
71#include <stdlib.h>
72
73int *ptr;
74pthread_barrier_t barrier;
75void *Thread(void *a) {
76  pthread_barrier_wait(&barrier);
77  *ptr = 42;
78  return 0;
79}
80
81int main() {
82  pthread_t t;
83  pthread_barrier_init(&barrier, NULL, 2);
84  ptr = (int *)malloc(sizeof(int));
85  pthread_create(&t, NULL, Thread, NULL);
86  free(ptr);
87  pthread_barrier_wait(&barrier);
88  pthread_join(t, NULL);
89  return 0;
90}
91EOF
92
93	c++ -fsanitize=thread -o test test.cc
94	paxctl +a test
95	atf_check -s ignore -o ignore -e match:"WARNING: ThreadSanitizer: heap-use-after-free" ./test
96}
97
98heap_use_after_free_profile_body(){
99	cat > test.cc << EOF
100#include <pthread.h>
101#include <stdlib.h>
102
103int *ptr;
104pthread_barrier_t barrier;
105void *Thread(void *a) {
106  pthread_barrier_wait(&barrier);
107  *ptr = 42;
108  return 0;
109}
110
111int main() {
112  pthread_t t;
113  pthread_barrier_init(&barrier, NULL, 2);
114  ptr = (int *)malloc(sizeof(int));
115  pthread_create(&t, NULL, Thread, NULL);
116  free(ptr);
117  pthread_barrier_wait(&barrier);
118  pthread_join(t, NULL);
119  return 0;
120}
121EOF
122
123	c++ -fsanitize=thread -o test -pg test.cc
124	paxctl +a test
125	atf_check -s ignore -o ignore -e match:"WARNING: ThreadSanitizer: heap-use-after-free" ./test
126}
127
128heap_use_after_free_pic_body(){
129	cat > test.cc << EOF
130#include <stdio.h>
131#include <stdlib.h>
132int help(int);
133int main(int argc, char **argv) {return help(argc);}
134EOF
135
136	cat > pic.cc << EOF
137#include <pthread.h>
138#include <stdlib.h>
139
140int *ptr;
141pthread_barrier_t barrier;
142void *Thread(void *a) {
143  pthread_barrier_wait(&barrier);
144  *ptr = 42;
145  return 0;
146}
147
148int help(int argc) {
149  pthread_t t;
150  pthread_barrier_init(&barrier, NULL, 2);
151  ptr = (int *)malloc(sizeof(int));
152  pthread_create(&t, NULL, Thread, NULL);
153  free(ptr);
154  pthread_barrier_wait(&barrier);
155  pthread_join(t, NULL);
156  return 0;
157}
158EOF
159
160	c++ -fsanitize=thread -fPIC -shared -o libtest.so pic.cc
161	c++ -o test test.cc -fsanitize=thread -L. -ltest
162	paxctl +a test
163
164	export LD_LIBRARY_PATH=.
165	atf_check -s ignore -o ignore -e match:"WARNING: ThreadSanitizer: heap-use-after-free" ./test
166}
167heap_use_after_free_pie_body(){
168	
169	#check whether -pie flag is supported on this architecture
170	if ! c++ -pie -dM -E - < /dev/null 2>/dev/null >/dev/null; then 
171		atf_set_skip "c++ -pie not supported on this architecture"
172	fi
173	cat > test.cc << EOF
174#include <pthread.h>
175#include <stdlib.h>
176
177int *ptr;
178pthread_barrier_t barrier;
179void *Thread(void *a) {
180  pthread_barrier_wait(&barrier);
181  *ptr = 42;
182  return 0;
183}
184
185int main() {
186  pthread_t t;
187  pthread_barrier_init(&barrier, NULL, 2);
188  ptr = (int *)malloc(sizeof(int));
189  pthread_create(&t, NULL, Thread, NULL);
190  free(ptr);
191  pthread_barrier_wait(&barrier);
192  pthread_join(t, NULL);
193  return 0;
194}
195EOF
196
197	c++ -fsanitize=thread -o test -fpie -pie test.cc
198	paxctl +a test
199	atf_check -s ignore -o ignore -e match:"WARNING: ThreadSanitizer: heap-use-after-free" ./test
200}
201
202
203atf_test_case target_not_supported
204target_not_supported_head()
205{
206	atf_set "descr" "Test forced skip"
207}
208
209target_not_supported_body()
210{
211	atf_skip "Target is not supported"
212}
213
214atf_init_test_cases()
215{
216	test_target
217	test $SUPPORT = 'n' && {
218		atf_add_test_case target_not_supported
219		return 0
220	}
221	atf_add_test_case heap_use_after_free
222	atf_add_test_case heap_use_after_free_profile
223	atf_add_test_case heap_use_after_free_pie
224	atf_add_test_case heap_use_after_free_pic
225}
226