sanitizer_common: add thread safety annotations

[dvyukov]

Summary

Enable clang Thread Safety Analysis for sanitizers:
https://clang.llvm.org/docs/ThreadSafetyAnalysis.html

Thread Safety Analysis can detect inconsistent locking,
deadlocks and data races. Without GUARDED_BY annotations
it has limited value. But this does all the heavy lifting
to enable analysis and allows to add GUARDED_BY incrementally.

[melver]

compiler-rt/CMakeLists.txt

362

Should this be CMAKE_CXX_COMPILER_ID ?

[dvyukov]

switch to CMAKE_CXX_COMPILER_ID

[protze.joachim]

compiler-rt/lib/sanitizer_common/sanitizer_allocator_primary64.h

315

Same annotations should go into sanitizer_allocator_primary32.h for 32-bit systems

see greendragon failure: https://green.lab.llvm.org/green/job/lldb-cmake/33604/consoleFull#-77815080549ba4694-19c4-4d7e-bec5-911270d8a58c

[dvyukov]

compiler-rt/lib/sanitizer_common/sanitizer_allocator_primary64.h

315

Thanks. I am looking into this right now.
Also trying to make 64-bit tests tests detect this.

[dvyukov]

compiler-rt/lib/sanitizer_common/sanitizer_allocator_primary64.h

315

I've mailed https://reviews.llvm.org/D105808
Currently running all compiler-rt tests, will merge once they pass.

[dim]

After this commit (tentative) I'm getting these compile errors on FreeBSD, when it's building the googletest parts of the compiler-rt tests:

FAILED: projects/compiler-rt/lib/sanitizer_common/tests/SANITIZER_TEST_OBJECTS.gmock-all.cc.i386.o
cd /home/dim/obj/llvm-llvmorg-14-init-588-g7c921753e0f5-freebsd14-amd64-ninja-clang-rel-1/projects/compiler-rt/lib/sanitizer_common/tests && /home/dim/obj/llvm-llvmorg-14-init-588-g7c921753e0f5-freebsd14-amd64-ninja-clang-rel-1/./bin/clang -Werror=thread-safety -Werror=thread-safety-reference -Werror=thread-safety-beta -g -Wno-covered-switch-default -Wno-suggest-override -DGTEST_NO_LLVM_SUPPORT=1 -DGTEST_HAS_RTTI=0 -I/share/dim/src/llvm/llvm-project/llvm/utils/unittest/googletest/include -I/share/dim/src/llvm/llvm-project/llvm/utils/unittest/googletest -DGTEST_NO_LLVM_SUPPORT=1 -DGTEST_HAS_RTTI=0 -I/share/dim/src/llvm/llvm-project/llvm/utils/unittest/googlemock/include -I/share/dim/src/llvm/llvm-project/llvm/utils/unittest/googlemock -I/share/dim/src/llvm/llvm-project/compiler-rt/include -I/share/dim/src/llvm/llvm-project/compiler-rt/lib -I/share/dim/src/llvm/llvm-project/compiler-rt/lib/sanitizer_common -fno-rtti -O2 -Werror=sign-compare -Wno-gnu-zero-variadic-macro-arguments -gline-tables-only -m32 -c -o SANITIZER_TEST_OBJECTS.gmock-all.cc.i386.o /share/dim/src/llvm/llvm-project/llvm/utils/unittest/googlemock/src/gmock-all.cc
In file included from /share/dim/src/llvm/llvm-project/llvm/utils/unittest/googlemock/src/gmock-all.cc:39:
In file included from /share/dim/src/llvm/llvm-project/llvm/utils/unittest/googlemock/include/gmock/gmock.h:59:
In file included from /share/dim/src/llvm/llvm-project/llvm/utils/unittest/googlemock/include/gmock/gmock-actions.h:53:
In file included from /share/dim/src/llvm/llvm-project/llvm/utils/unittest/googlemock/include/gmock/internal/gmock-internal-utils.h:48:
In file included from /share/dim/src/llvm/llvm-project/llvm/utils/unittest/googlemock/include/gmock/internal/gmock-port.h:57:
/share/dim/src/llvm/llvm-project/llvm/utils/unittest/googletest/include/gtest/internal/gtest-port.h:1636:3: error: mutex 'mutex_' is still held at the end of function [-Werror,-Wthread-safety-analysis]
  }
  ^
/share/dim/src/llvm/llvm-project/llvm/utils/unittest/googletest/include/gtest/internal/gtest-port.h:1633:32: note: mutex acquired here
    GTEST_CHECK_POSIX_SUCCESS_(pthread_mutex_lock(&mutex_));
                               ^
/share/dim/src/llvm/llvm-project/llvm/utils/unittest/googletest/include/gtest/internal/gtest-port.h:1645:32: error: releasing mutex 'mutex_' that was not held [-Werror,-Wthread-safety-analysis]
    GTEST_CHECK_POSIX_SUCCESS_(pthread_mutex_unlock(&mutex_));
                               ^
2 errors generated.

Do we need to annotate the googletest stuff now too? Or exclude this from the -Wthread-safety flags somehow?

[dvyukov]

In D105716#2923598, @dim wrote:

After this commit (tentative) I'm getting these compile errors on FreeBSD, when it's building the googletest parts of the compiler-rt tests:
Do we need to annotate the googletest stuff now too? Or exclude this from the -Wthread-safety flags somehow?

googletest wraps pthread and it seems FreeBSD pthread.h is the only one annotated with thread-safety annotations:
https://github.com/freebsd/freebsd-src/blob/9bb8a4091c4f63dacda5108f4f994f7f6b35bbf1/include/pthread.h#L240

Long term it would be good to annotation googletest to be compatible with thread-safety annotations (at least headers). But it probably won't happen over-night.
I've checked if FreeBSD pthread annotations can be disabled with some macro or something, but it seems they are enabled unconditionally whenever compiler supports them:
https://github.com/freebsd/freebsd-src/blob/ea3fbe0707f9a02a29875966668b6f15284f335a/sys/sys/cdefs.h#L834-L845

The only thing I can think of is to disable -Wthread-safety on FreeBSD for now, or turn it into a non-fatal error.

[nikic]

It looks like this also causes a build error on FreeBSD 11 even without tests, due to a false positive warning:

2021-08-08T22:26:43.9999824Z sccache /usr/local/bin/x86_64-unknown-freebsd11-clang++   -I/checkout/src/llvm-project/compiler-rt/lib/asan/.. -ffunction-sections -fdata-sections -fPIC --target=x86_64-unknown-freebsd -static-libstdc++ -Wall -std=c++14 -O3 -DNDEBUG    -fPIC -fno-builtin -fno-exceptions -fomit-frame-pointer -funwind-tables -fno-stack-protector -fno-sanitize=safe-stack -fvisibility=hidden -fno-lto -Werror=thread-safety -Werror=thread-safety-reference -Werror=thread-safety-beta -O3 -gline-tables-only -nostdinc++ -fno-rtti -MD -MT lib/asan/CMakeFiles/RTAsan.x86_64.dir/asan_allocator.cpp.o -MF lib/asan/CMakeFiles/RTAsan.x86_64.dir/asan_allocator.cpp.o.d -o lib/asan/CMakeFiles/RTAsan.x86_64.dir/asan_allocator.cpp.o -c /checkout/src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp
2021-08-08T22:26:44.0004227Z clang: warning: argument unused during compilation: '-static-libstdc++' [-Wunused-command-line-argument]
2021-08-08T22:26:44.0005611Z In file included from /checkout/src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:31:
2021-08-08T22:26:44.0007444Z /checkout/src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_quarantine.h:121:7: error: calling function 'Recycle' requires holding mutex 'recycle_mutex_' exclusively [-Werror,-Wthread-safety-analysis]
2021-08-08T22:26:44.0009017Z       Recycle(atomic_load_relaxed(&min_size_), cb);
2021-08-08T22:26:44.0009477Z       ^
2021-08-08T22:26:44.0011389Z /checkout/src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:765:16: note: in instantiation of member function '__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Drain' requested here
2021-08-08T22:26:44.0012845Z     quarantine.Drain(GetQuarantineCache(ms), QuarantineCallback(ac, stack));
2021-08-08T22:26:44.0013531Z                ^
2021-08-08T22:26:44.0014540Z In file included from /checkout/src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:31:
2021-08-08T22:26:44.0016241Z /checkout/src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_quarantine.h:121:7: error: releasing mutex 'recycle_mutex_' that was not held [-Werror,-Wthread-safety-analysis]
2021-08-08T22:26:44.0017465Z       Recycle(atomic_load_relaxed(&min_size_), cb);
2021-08-08T22:26:44.0017923Z       ^
2021-08-08T22:26:44.0018303Z 2 errors generated.

Apparently the used compiler is clang 6.0.

Can you please drop the -Werror? This is exactly the reason for the general recommendation that -Werror should never be enabled in default configurations: Unless you're actually testing all supported compilers and compiler versions, you're pretty much guaranteed to break the build somewhere due to differences in warnings...

[dim]

In D105716#2934855, @nikic wrote:

It looks like this also causes a build error on FreeBSD 11 even without tests, due to a false positive warning:

...

Apparently the used compiler is clang 6.0.

Weird, the currently supported FreeBSD 11 version is at 11.4, and it has clang 10.0.1. But I see /usr/local/bin/x86_64-unknown-freebsd11-clang++ in the command line, so it's likely an installed port or hand-built installation?

That said, FreeBSD 11.4 (and the whole 11.x branch) will expire 2021-09-30 so in less than two months. Not sure if it's worth much effort to fix now. :)

Can you please drop the -Werror? This is exactly the reason for the general recommendation that -Werror should never be enabled in default configurations: Unless you're actually testing all supported compilers and compiler versions, you're pretty much guaranteed to break the build somewhere due to differences in warnings...

Yes, -Werror is also a bane of FreeBSD port maintainers. You either have to fiddle with configure scripts to get rid of the -Werror flag or add -Wno-xxx flags, or to monkey-patch the source to silence those warnings...

[nikic]

@dim Oh right, looks like this build actually uses clang 6 from Ubuntu 18.04 together with a FreeBSD 11.4 sysroot.

Don't think it really matters though, as ultimately LLVM requires clang >= 3.5 (per https://llvm.org/docs/GettingStarted.html#host-c-toolchain-both-compiler-and-standard-library), so that version should be supported.

[dvyukov]

Yikes.
Turning off -Werror renders it all useless, even worse it will add code with no benefit (nobody is checking warnings, bots don't fail/notify, there are tons of warnings already, no chance of noticing a new one).
So instead of removing -Werror, I would rather remove all of the annotations altogether.
Will it work for you if we enable the thread-safety annotations only if clang_major >= 13? (not sure what's the exact version, but 13 should be safe enough)

[nikic]

In D105716#2935074, @dvyukov wrote:

Yikes.
Turning off -Werror renders it all useless, even worse it will add code with no benefit (nobody is checking warnings, bots don't fail/notify, there are tons of warnings already, no chance of noticing a new one).
So instead of removing -Werror, I would rather remove all of the annotations altogether.
Will it work for you if we enable the thread-safety annotations only if clang_major >= 13? (not sure what's the exact version, but 13 should be safe enough)

The usual approach is to not enable -Werror in a default configuration, but explicitly enable it in CI where the used compiler version is known. For compiler-rt there is a COMPILER_RT_ENABLE_WERROR flag for for purpose. Based on a quick search, it seems to be enabled at least in some buildbot configurations, for example it's used here: https://github.com/llvm/llvm-zorg/blob/855fdb4cdc09e306370533c0715897e6ac7f3027/zorg/buildbot/builders/sanitizers/buildbot_cmake.sh#L245 However, if you say that there are already warnings (with clang), then possibly that isn't working properly.

Anyway, limiting by clang version seems like a reasonable workaround for this issue, though that wouldn't fix the error @dim reported. (From our side an upstream fix isn't strictly necessary -- as it's only a build issue, we can patch it.)

[dvyukov]

I did not know about COMPILER_RT_ENABLE_WERROR enabled on some bots.
And also I was wrong about existing warnings. They present but only with gcc (since I compile with both regularly, I had impression I always see warnings).
I've mailed https://reviews.llvm.org/D107826 is it what you meant?
I've also removed the FreeBSD workaround added by @dim. It won't be needed anymore, right?

[dim]

In D105716#2936928, @dvyukov wrote:

I did not know about COMPILER_RT_ENABLE_WERROR enabled on some bots.
And also I was wrong about existing warnings. They present but only with gcc (since I compile with both regularly, I had impression I always see warnings).
I've mailed https://reviews.llvm.org/D107826 is it what you meant?
I've also removed the FreeBSD workaround added by @dim. It won't be needed anymore, right?

If they're warnings now, they won't break the build, indeed. (Would still be nice to patch up gtest at some point, but it's not necessary right away.)

[dvyukov]

I can keep that part if you prefer (with REPLACE "-W" "-Wno-").

[dim]

In D105716#2936972, @dvyukov wrote:

I can keep that part if you prefer (with REPLACE "-W" "-Wno-").

No, leave the warnings in, then there is at least *some* incentive to fix them at some point, even if it's just to fix the annoyance. :)

compiler-rt/CMakeLists.txt

if(MSVC)
   # Disable thread safe initialization for static locals. ASan shouldn't need
   # it. Thread safe initialization assumes that the CRT has already been
   # initialized, but ASan initializes before the CRT.
   list(APPEND SANITIZER_COMMON_CFLAGS /Zc:threadSafeInit-)
 endif()
 
 append_list_if(COMPILER_RT_DEBUG -DSANITIZER_DEBUG=1 SANITIZER_COMMON_CFLAGS)
 
+if(CMAKE_CXX_COMPILER_ID MATCHES Clang)
+  list(APPEND SANITIZER_COMMON_CFLAGS
+      "-Werror=thread-safety"
+      "-Werror=thread-safety-reference"
+      "-Werror=thread-safety-beta"
+)
+endif()
+
 # If we're using MSVC,
 # always respect the optimization flags set by CMAKE_BUILD_TYPE instead.
 if (NOT MSVC)
 
   # Build with optimization, unless we're in debug mode.
   if(COMPILER_RT_DEBUG)
     list(APPEND SANITIZER_COMMON_CFLAGS -O0)
   else()

compiler-rt/lib/asan/asan_allocator.cpp

void Purge(BufferedStackTrace *stack) {
     allocator.ForceReleaseToOS();
   }
 
   void PrintStats() {
     allocator.PrintStats();
     quarantine.PrintStats();
   }
 
-  void ForceLock() {
+  void ForceLock() ACQUIRE(fallback_mutex) {
     allocator.ForceLock();
     fallback_mutex.Lock();
   }
 
-  void ForceUnlock() {
+  void ForceUnlock() RELEASE(fallback_mutex) {
     fallback_mutex.Unlock();
     allocator.ForceUnlock();
   }
 };
 
 static Allocator instance(LINKER_INITIALIZED);
 
 static AsanAllocator &get_allocator() {
uptr asan_malloc_usable_size(const void *ptr, uptr pc, uptr bp) {
   }
   return usable_size;
 }
 
 uptr asan_mz_size(const void *ptr) {
   return instance.AllocationSize(reinterpret_cast<uptr>(ptr));
 }
 
-void asan_mz_force_lock() {
-  instance.ForceLock();
-}
+void asan_mz_force_lock() NO_THREAD_SAFETY_ANALYSIS { instance.ForceLock(); }
 
-void asan_mz_force_unlock() {
+void asan_mz_force_unlock() NO_THREAD_SAFETY_ANALYSIS {
   instance.ForceUnlock();
 }
 
 void AsanSoftRssLimitExceededCallback(bool limit_exceeded) {
   instance.SetRssLimitExceeded(limit_exceeded);
 }
 
 }  // namespace __asan

compiler-rt/lib/cfi/cfi.cpp

void InitShadow() {
   VReport(1, "CFI: VMA size %zx, shadow size %zx\n", vma, GetShadowSize());
 
   UpdateShadow();
 }
 
 THREADLOCAL int in_loader;
 BlockingMutex shadow_update_lock(LINKER_INITIALIZED);
 
-void EnterLoader() {
+void EnterLoader() NO_THREAD_SAFETY_ANALYSIS {
   if (in_loader == 0) {
     shadow_update_lock.Lock();
   }
   ++in_loader;
 }
 
-void ExitLoader() {
+void ExitLoader() NO_THREAD_SAFETY_ANALYSIS {
   CHECK(in_loader > 0);
   --in_loader;
   UpdateShadow();
   if (in_loader == 0) {
     shadow_update_lock.Unlock();
   }
 }
 

compiler-rt/lib/lsan/lsan_common.h

 // Returns the address range occupied by the global allocator object.
 void GetAllocatorGlobalRange(uptr *begin, uptr *end);
 // Wrappers for allocator's ForceLock()/ForceUnlock().
 void LockAllocator();
 void UnlockAllocator();
 // Returns true if [addr, addr + sizeof(void *)) is poisoned.
 bool WordIsPoisoned(uptr addr);
 // Wrappers for ThreadRegistry access.
-void LockThreadRegistry();
-void UnlockThreadRegistry();
+void LockThreadRegistry() NO_THREAD_SAFETY_ANALYSIS;
+void UnlockThreadRegistry() NO_THREAD_SAFETY_ANALYSIS;
 ThreadRegistry *GetThreadRegistryLocked();
 bool GetThreadRangesLocked(tid_t os_id, uptr *stack_begin, uptr *stack_end,
                            uptr *tls_begin, uptr *tls_end, uptr *cache_begin,
                            uptr *cache_end, DTLS **dtls);
 void GetAllThreadAllocatorCachesLocked(InternalMmapVector<uptr> *caches);
 void ForEachExtraStackRange(tid_t os_id, RangeIteratorCallback callback,
                             void *arg);
 // If called from the main thread, updates the main thread's TID in the thread

compiler-rt/lib/memprof/memprof_allocator.cpp

if (m->Beg() != p)
       return 0;
     return user_requested_size;
   }
 
   void Purge(BufferedStackTrace *stack) { allocator.ForceReleaseToOS(); }
 
   void PrintStats() { allocator.PrintStats(); }
 
-  void ForceLock() {
+  void ForceLock() NO_THREAD_SAFETY_ANALYSIS {
     allocator.ForceLock();
     fallback_mutex.Lock();
   }
 
-  void ForceUnlock() {
+  void ForceUnlock() NO_THREAD_SAFETY_ANALYSIS {
     fallback_mutex.Unlock();
     allocator.ForceUnlock();
   }
 };
 
 static Allocator instance(LINKER_INITIALIZED);
 
 static MemprofAllocator &get_allocator() { return instance.allocator; }

compiler-rt/lib/sanitizer_common/CMakeLists.txt

set(SANITIZER_IMPL_HEADERS
   sanitizer_symbolizer_mac.h
   sanitizer_syscall_generic.inc
   sanitizer_syscall_linux_aarch64.inc
   sanitizer_syscall_linux_arm.inc
   sanitizer_syscall_linux_x86_64.inc
   sanitizer_syscall_linux_riscv64.inc
   sanitizer_syscalls_netbsd.inc
   sanitizer_thread_registry.h
+  sanitizer_thread_safety.h
   sanitizer_tls_get_addr.h
   sanitizer_vector.h
   sanitizer_win.h
   sanitizer_win_defs.h
   sanitizer_win_dll_thunk.h
   sanitizer_win_weak_interception.h
   )
 

compiler-rt/lib/sanitizer_common/sanitizer_addrhashmap.h

bool AddrHashMap<T, kSize>::Handle::exists() const {
   return cell_ != nullptr;
 }
 
 template<typename T, uptr kSize>
 AddrHashMap<T, kSize>::AddrHashMap() {
   table_ = (Bucket*)MmapOrDie(kSize * sizeof(table_[0]), "AddrHashMap");
 }
 
-template<typename T, uptr kSize>
-void AddrHashMap<T, kSize>::acquire(Handle *h) {
+template <typename T, uptr kSize>
+void AddrHashMap<T, kSize>::acquire(Handle *h) NO_THREAD_SAFETY_ANALYSIS {
   uptr addr = h->addr_;
   uptr hash = calcHash(addr);
   Bucket *b = &table_[hash];
 
   h->created_ = false;
   h->addidx_ = -1U;
   h->bucket_ = b;
   h->cell_ = nullptr;
if (add->size == add->cap) {
     add = add1;
   }
   // Store.
   uptr i = add->size++;
   Cell *c = &add->cells[i];
   CHECK_EQ(atomic_load(&c->addr, memory_order_relaxed), 0);
   h->addidx_ = i;
   h->cell_ = c;
  }
 
-template<typename T, uptr kSize>
-void AddrHashMap<T, kSize>::release(Handle *h) {
+ template <typename T, uptr kSize>
+ void AddrHashMap<T, kSize>::release(Handle *h) NO_THREAD_SAFETY_ANALYSIS {
    if (!h->cell_)
      return;
    Bucket *b = h->bucket_;
    Cell *c = h->cell_;
    uptr addr1 = atomic_load(&c->addr, memory_order_relaxed);
    if (h->created_) {
      // Denote completion of insertion.
      CHECK_EQ(addr1, 0);
      // After the following store, the element becomes available
      // for lock-free reads.
      atomic_store(&c->addr, h->addr_, memory_order_release);
      b->mtx.Unlock();
    } else if (h->remove_) {
      // Denote that the cell is empty now.
      CHECK_EQ(addr1, h->addr_);
      atomic_store(&c->addr, 0, memory_order_release);
      // See if we need to compact the bucket.
-    AddBucket *add = (AddBucket*)atomic_load(&b->add, memory_order_relaxed);
+     AddBucket *add = (AddBucket *)atomic_load(&b->add, memory_order_relaxed);
      if (h->addidx_ == -1U) {
        // Removed from embed array, move an add element into the freed cell.
        if (add && add->size != 0) {
          uptr last = --add->size;
          Cell *c1 = &add->cells[last];
          c->val = c1->val;
          uptr addr1 = atomic_load(&c1->addr, memory_order_relaxed);
          atomic_store(&c->addr, addr1, memory_order_release);
          atomic_store(&c1->addr, 0, memory_order_release);
        }
      } else {
        // Removed from add array, compact it.
        uptr last = --add->size;
        Cell *c1 = &add->cells[last];
        if (c != c1) {
          *c = *c1;
          atomic_store(&c1->addr, 0, memory_order_relaxed);
        }
      }
      if (add && add->size == 0) {
        // FIXME(dvyukov): free add?
      }
      b->mtx.Unlock();
    } else {
      CHECK_EQ(addr1, h->addr_);
      if (h->addidx_ != -1U)
        b->mtx.ReadUnlock();
    }
  }
 
 template<typename T, uptr kSize>
 uptr AddrHashMap<T, kSize>::calcHash(uptr addr) {
   addr += addr << 10;
   addr ^= addr >> 6;
   return addr % kSize;
 }
 
 } // namespace __sanitizer
 
 #endif // SANITIZER_ADDRHASHMAP_H

compiler-rt/lib/sanitizer_common/sanitizer_allocator_combined.h

public:
 
   void PrintStats() {
     primary_.PrintStats();
     secondary_.PrintStats();
   }
 
   // ForceLock() and ForceUnlock() are needed to implement Darwin malloc zone
   // introspection API.
-  void ForceLock() {
+  void ForceLock() NO_THREAD_SAFETY_ANALYSIS {
     primary_.ForceLock();
     secondary_.ForceLock();
   }
 
-  void ForceUnlock() {
+  void ForceUnlock() NO_THREAD_SAFETY_ANALYSIS {
     secondary_.ForceUnlock();
     primary_.ForceUnlock();
   }
 
   // Iterate over all existing chunks.
   // The allocator must be locked when calling this function.
   void ForEachChunk(ForEachChunkCallback callback, void *arg) {
     primary_.ForEachChunk(callback, arg);
     secondary_.ForEachChunk(callback, arg);
   }
 
  private:
   PrimaryAllocator primary_;
   SecondaryAllocator secondary_;
   AllocatorGlobalStats stats_;
 };

compiler-rt/lib/sanitizer_common/sanitizer_allocator_primary64.h

Printf("Stats: SizeClassAllocator64: %zdM mapped (%zdM rss) in "
            "%zd allocations; remains %zd\n", total_mapped >> 20,
            total_rss >> 20, n_allocated, n_allocated - n_freed);
     for (uptr class_id = 1; class_id < kNumClasses; class_id++)
       PrintStats(class_id, rss_stats[class_id]);
   }
 
   // ForceLock() and ForceUnlock() are needed to implement Darwin malloc zone
   // introspection API.
-  void ForceLock() {
+  void ForceLock() NO_THREAD_SAFETY_ANALYSIS {
     for (uptr i = 0; i < kNumClasses; i++) {
       GetRegionInfo(i)->mutex.Lock();
     }
   }
 
-  void ForceUnlock() {
+  void ForceUnlock() NO_THREAD_SAFETY_ANALYSIS {
     for (int i = (int)kNumClasses - 1; i >= 0; i--) {
       GetRegionInfo(i)->mutex.Unlock();
     }
   }
 
   // Iterate over all existing chunks.
   // The allocator must be locked when calling this function.
   void ForEachChunk(ForEachChunkCallback callback, void *arg) {

compiler-rt/lib/sanitizer_common/sanitizer_allocator_secondary.h

for (uptr i = 0; i < ARRAY_SIZE(stats.by_size_log); i++) {
       if (!c) continue;
       Printf("%zd:%zd; ", i, c);
     }
     Printf("\n");
   }
 
   // ForceLock() and ForceUnlock() are needed to implement Darwin malloc zone
   // introspection API.
-  void ForceLock() {
-    mutex_.Lock();
-  }
+  void ForceLock() ACQUIRE(mutex_) { mutex_.Lock(); }
 
-  void ForceUnlock() {
-    mutex_.Unlock();
-  }
+  void ForceUnlock() RELEASE(mutex_) { mutex_.Unlock(); }
 
   // Iterate over all existing chunks.
   // The allocator must be locked when calling this function.
   void ForEachChunk(ForEachChunkCallback callback, void *arg) {
     EnsureSortedChunks();  // Avoid doing the sort while iterating.
     const Header *const *chunks = AddressSpaceView::Load(chunks_, n_chunks_);
     for (uptr i = 0; i < n_chunks_; i++) {
       const Header *t = chunks[i];

compiler-rt/lib/sanitizer_common/sanitizer_fuchsia.cpp

void BlockingMutex::Unlock() {
   u32 v = atomic_exchange(m, MtxUnlocked, memory_order_release);
   CHECK_NE(v, MtxUnlocked);
   if (v == MtxSleeping) {
     zx_status_t status = _zx_futex_wake(reinterpret_cast<zx_futex_t *>(m), 1);
     CHECK_EQ(status, ZX_OK);
   }
 }
 
-void BlockingMutex::CheckLocked() {
-  atomic_uint32_t *m = reinterpret_cast<atomic_uint32_t *>(&opaque_storage_);
+void BlockingMutex::CheckLocked() const {
+  auto m = reinterpret_cast<atomic_uint32_t const *>(&opaque_storage_);
   CHECK_NE(MtxUnlocked, atomic_load(m, memory_order_relaxed));
 }
 
 uptr GetPageSize() { return _zx_system_get_page_size(); }
 
 uptr GetMmapGranularity() { return _zx_system_get_page_size(); }
 
 sanitizer_shadow_bounds_t ShadowBounds;

compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp

 #elif SANITIZER_NETBSD
                    /* No userspace futex-like synchronization */
 #else
     internal_syscall(SYSCALL(futex), (uptr)m, FUTEX_WAKE_PRIVATE, 1, 0, 0, 0);
 #endif
   }
 }
 
-void BlockingMutex::CheckLocked() {
-  atomic_uint32_t *m = reinterpret_cast<atomic_uint32_t *>(&opaque_storage_);
+void BlockingMutex::CheckLocked() const {
+  auto m = reinterpret_cast<atomic_uint32_t const *>(&opaque_storage_);
   CHECK_NE(MtxUnlocked, atomic_load(m, memory_order_relaxed));
 }
-#endif // !SANITIZER_SOLARIS
+#  endif  // !SANITIZER_SOLARIS
 
 // ----------------- sanitizer_linux.h
 // The actual size of this structure is specified by d_reclen.
 // Note that getdents64 uses a different structure format. We only provide the
 // 32-bit syscall here.
 #if SANITIZER_NETBSD
 // Not used
 #else

compiler-rt/lib/sanitizer_common/sanitizer_mac.cpp

void BlockingMutex::Lock() {
   CHECK_EQ(owner_, 0);
   OSSpinLockLock((OSSpinLock*)&opaque_storage_);
 }
 
 void BlockingMutex::Unlock() {
   OSSpinLockUnlock((OSSpinLock*)&opaque_storage_);
 }
 
-void BlockingMutex::CheckLocked() {
+void BlockingMutex::CheckLocked() const {
   CHECK_NE(*(OSSpinLock*)&opaque_storage_, 0);
 }
 
 u64 NanoTime() {
   timeval tv;
   internal_memset(&tv, 0, sizeof(tv));
   gettimeofday(&tv, 0);
   return (u64)tv.tv_sec * 1000*1000*1000 + tv.tv_usec * 1000;

compiler-rt/lib/sanitizer_common/sanitizer_mutex.h

 //===----------------------------------------------------------------------===//
 
 #ifndef SANITIZER_MUTEX_H
 #define SANITIZER_MUTEX_H
 
 #include "sanitizer_atomic.h"
 #include "sanitizer_internal_defs.h"
 #include "sanitizer_libc.h"
+#include "sanitizer_thread_safety.h"
 
 namespace __sanitizer {
 
-class StaticSpinMutex {
+class MUTEX StaticSpinMutex {
  public:
   void Init() {
     atomic_store(&state_, 0, memory_order_relaxed);
   }
 
-  void Lock() {
+  void Lock() ACQUIRE() {
     if (TryLock())
       return;
     LockSlow();
   }
 
-  bool TryLock() {
+  bool TryLock() TRY_ACQUIRE(true) {
     return atomic_exchange(&state_, 1, memory_order_acquire) == 0;
   }
 
-  void Unlock() {
-    atomic_store(&state_, 0, memory_order_release);
-  }
+  void Unlock() RELEASE() { atomic_store(&state_, 0, memory_order_release); }
 
-  void CheckLocked() {
+  void CheckLocked() const CHECK_LOCKED {
     CHECK_EQ(atomic_load(&state_, memory_order_relaxed), 1);
   }
 
  private:
   atomic_uint8_t state_;
 
   void NOINLINE LockSlow() {
     for (int i = 0;; i++) {
       if (i < 10)
         proc_yield(10);
       else
         internal_sched_yield();
       if (atomic_load(&state_, memory_order_relaxed) == 0
           && atomic_exchange(&state_, 1, memory_order_acquire) == 0)
         return;
     }
   }
 };
 
-class SpinMutex : public StaticSpinMutex {
+class MUTEX SpinMutex : public StaticSpinMutex {
  public:
   SpinMutex() {
     Init();
   }
 
  private:
   SpinMutex(const SpinMutex &) = delete;
   void operator=(const SpinMutex &) = delete;
 };
 
-class BlockingMutex {
+class MUTEX BlockingMutex {
  public:
   explicit constexpr BlockingMutex(LinkerInitialized)
       : opaque_storage_ {0, }, owner_ {0} {}
   BlockingMutex();
-  void Lock();
-  void Unlock();
+  void Lock() ACQUIRE();
+  void Unlock() RELEASE();
 
   // This function does not guarantee an explicit check that the calling thread
   // is the thread which owns the mutex. This behavior, while more strictly
   // correct, causes problems in cases like StopTheWorld, where a parent thread
   // owns the mutex but a child checks that it is locked. Rather than
   // maintaining complex state to work around those situations, the check only
   // checks that the mutex is owned, and assumes callers to be generally
   // well-behaved.
-  void CheckLocked();
+  void CheckLocked() const CHECK_LOCKED;
 
  private:
   // Solaris mutex_t has a member that requires 64-bit alignment.
   ALIGNED(8) uptr opaque_storage_[10];
   uptr owner_;  // for debugging
 };
 
 // Reader-writer spin mutex.
-class RWMutex {
+class MUTEX RWMutex {
  public:
   RWMutex() {
     atomic_store(&state_, kUnlocked, memory_order_relaxed);
   }
 
   ~RWMutex() {
     CHECK_EQ(atomic_load(&state_, memory_order_relaxed), kUnlocked);
   }
 
-  void Lock() {
+  void Lock() ACQUIRE() {
     u32 cmp = kUnlocked;
     if (atomic_compare_exchange_strong(&state_, &cmp, kWriteLock,
                                        memory_order_acquire))
       return;
     LockSlow();
   }
 
-  void Unlock() {
+  void Unlock() RELEASE() {
     u32 prev = atomic_fetch_sub(&state_, kWriteLock, memory_order_release);
     DCHECK_NE(prev & kWriteLock, 0);
     (void)prev;
   }
 
-  void ReadLock() {
+  void ReadLock() ACQUIRE_SHARED() {
     u32 prev = atomic_fetch_add(&state_, kReadLock, memory_order_acquire);
     if ((prev & kWriteLock) == 0)
       return;
     ReadLockSlow();
   }
 
-  void ReadUnlock() {
+  void ReadUnlock() RELEASE_SHARED() {
     u32 prev = atomic_fetch_sub(&state_, kReadLock, memory_order_release);
     DCHECK_EQ(prev & kWriteLock, 0);
     DCHECK_GT(prev & ~kWriteLock, 0);
     (void)prev;
   }
 
-  void CheckLocked() {
+  void CheckLocked() const CHECK_LOCKED {
     CHECK_NE(atomic_load(&state_, memory_order_relaxed), kUnlocked);
   }
 
  private:
   atomic_uint32_t state_;
 
   enum {
     kUnlocked = 0,
for (int i = 0;; i++) {
         return;
     }
   }
 
   RWMutex(const RWMutex &) = delete;
   void operator=(const RWMutex &) = delete;
 };
 
-template<typename MutexType>
-class GenericScopedLock {
+template <typename MutexType>
+class SCOPED_LOCK GenericScopedLock {
  public:
-  explicit GenericScopedLock(MutexType *mu)
-      : mu_(mu) {
+  explicit GenericScopedLock(MutexType *mu) ACQUIRE(mu) : mu_(mu) {
     mu_->Lock();
   }
 
-  ~GenericScopedLock() {
-    mu_->Unlock();
-  }
+  ~GenericScopedLock() RELEASE() { mu_->Unlock(); }
 
  private:
   MutexType *mu_;
 
   GenericScopedLock(const GenericScopedLock &) = delete;
   void operator=(const GenericScopedLock &) = delete;
 };
 
-template<typename MutexType>
-class GenericScopedReadLock {
+template <typename MutexType>
+class SCOPED_LOCK GenericScopedReadLock {
  public:
-  explicit GenericScopedReadLock(MutexType *mu)
-      : mu_(mu) {
+  explicit GenericScopedReadLock(MutexType *mu) ACQUIRE(mu) : mu_(mu) {
     mu_->ReadLock();
   }
 
-  ~GenericScopedReadLock() {
-    mu_->ReadUnlock();
-  }
+  ~GenericScopedReadLock() RELEASE() { mu_->ReadUnlock(); }
 
  private:
   MutexType *mu_;
 
   GenericScopedReadLock(const GenericScopedReadLock &) = delete;
   void operator=(const GenericScopedReadLock &) = delete;
 };
 
 typedef GenericScopedLock<StaticSpinMutex> SpinMutexLock;
 typedef GenericScopedLock<BlockingMutex> BlockingMutexLock;
 typedef GenericScopedLock<RWMutex> RWMutexLock;
 typedef GenericScopedReadLock<RWMutex> RWMutexReadLock;
 
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_MUTEX_H

compiler-rt/lib/sanitizer_common/sanitizer_quarantine.h

private:
   atomic_uintptr_t min_size_;
   atomic_uintptr_t max_cache_size_;
   char pad1_[kCacheLineSize];
   StaticSpinMutex cache_mutex_;
   StaticSpinMutex recycle_mutex_;
   Cache cache_;
   char pad2_[kCacheLineSize];
 
-  void NOINLINE Recycle(uptr min_size, Callback cb) {
+  void NOINLINE Recycle(uptr min_size, Callback cb) REQUIRES(recycle_mutex_)
+      RELEASE(recycle_mutex_) {
     Cache tmp;
     {
       SpinMutexLock l(&cache_mutex_);
       // Go over the batches and merge partially filled ones to
       // save some memory, otherwise batches themselves (since the memory used
       // by them is counted against quarantine limit) can overcome the actual
       // user's quarantined chunks, which diminishes the purpose of the
       // quarantine.

compiler-rt/lib/sanitizer_common/sanitizer_solaris.cpp

 }
 
 void BlockingMutex::Unlock() {
   CHECK(owner_ == (uptr)thr_self());
   owner_ = 0;
   CHECK_EQ(mutex_unlock((mutex_t *)&opaque_storage_), 0);
 }
 
-void BlockingMutex::CheckLocked() {
-  CHECK_EQ((uptr)thr_self(), owner_);
-}
+void BlockingMutex::CheckLocked() const { CHECK_EQ((uptr)thr_self(), owner_); }
 
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_SOLARIS

compiler-rt/lib/sanitizer_common/sanitizer_thread_registry.h

public:
   virtual void OnDetached(void *arg) {}
 
  protected:
   ~ThreadContextBase();
 };
 
 typedef ThreadContextBase* (*ThreadContextFactory)(u32 tid);
 
-class ThreadRegistry {
+class MUTEX ThreadRegistry {
  public:
   ThreadRegistry(ThreadContextFactory factory);
   ThreadRegistry(ThreadContextFactory factory, u32 max_threads,
                  u32 thread_quarantine_size, u32 max_reuse);
   void GetNumberOfThreads(uptr *total = nullptr, uptr *running = nullptr,
                           uptr *alive = nullptr);
   uptr GetMaxAliveThreads();
 
-  void Lock() { mtx_.Lock(); }
-  void CheckLocked() { mtx_.CheckLocked(); }
-  void Unlock() { mtx_.Unlock(); }
+  void Lock() ACQUIRE() { mtx_.Lock(); }
+  void CheckLocked() const CHECK_LOCKED { mtx_.CheckLocked(); }
+  void Unlock() RELEASE() { mtx_.Unlock(); }
 
   // Should be guarded by ThreadRegistryLock.
   ThreadContextBase *GetThreadLocked(u32 tid) {
     return threads_[tid];
   }
 
   u32 CreateThread(uptr user_id, bool detached, u32 parent_tid, void *arg);
 

compiler-rt/lib/sanitizer_common/sanitizer_thread_safety.h

+//===-- sanitizer_thread_safety.h -------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is shared between sanitizer tools.
+//
+// Wrappers around thread safety annotations.
+// https://clang.llvm.org/docs/ThreadSafetyAnalysis.html
+//===----------------------------------------------------------------------===//
+
+#ifndef SANITIZER_THREAD_SAFETY_H
+#define SANITIZER_THREAD_SAFETY_H
+
+#if defined(__clang__)
+#  define THREAD_ANNOTATION(x) __attribute__((x))
+#else
+#  define THREAD_ANNOTATION(x)
+#endif
+
+#define MUTEX THREAD_ANNOTATION(capability("mutex"))
+#define SCOPED_LOCK THREAD_ANNOTATION(scoped_lockable)
+#define GUARDED_BY(x) THREAD_ANNOTATION(guarded_by(x))
+#define PT_GUARDED_BY(x) THREAD_ANNOTATION(pt_guarded_by(x))
+#define REQUIRES(...) THREAD_ANNOTATION(requires_capability(__VA_ARGS__))
+#define REQUIRES_SHARED(...) \
+  THREAD_ANNOTATION(requires_shared_capability(__VA_ARGS__))
+#define ACQUIRE(...) THREAD_ANNOTATION(acquire_capability(__VA_ARGS__))
+#define ACQUIRE_SHARED(...) \
+  THREAD_ANNOTATION(acquire_shared_capability(__VA_ARGS__))
+#define TRY_ACQUIRE(...) THREAD_ANNOTATION(try_acquire_capability(__VA_ARGS__))
+#define RELEASE(...) THREAD_ANNOTATION(release_capability(__VA_ARGS__))
+#define RELEASE_SHARED(...) \
+  THREAD_ANNOTATION(release_shared_capability(__VA_ARGS__))
+#define EXCLUDES(...) THREAD_ANNOTATION(locks_excluded(__VA_ARGS__))
+#define CHECK_LOCKED THREAD_ANNOTATION(assert_capability(this))
+#define NO_THREAD_SAFETY_ANALYSIS THREAD_ANNOTATION(no_thread_safety_analysis)
+
+#endif

compiler-rt/lib/sanitizer_common/sanitizer_win.cpp

 }
 
 void BlockingMutex::Unlock() {
   CheckLocked();
   owner_ = 0;
   ReleaseSRWLockExclusive((PSRWLOCK)opaque_storage_);
 }
 
-void BlockingMutex::CheckLocked() {
-  CHECK_EQ(owner_, GetThreadSelf());
-}
+void BlockingMutex::CheckLocked() const { CHECK_EQ(owner_, GetThreadSelf()); }
 
 uptr GetTlsSize() {
   return 0;
 }
 
 void InitTlsSize() {
 }
 

compiler-rt/lib/scudo/scudo_allocator.cpp

if (!Chunk::isAligned(Ptr))
       return false;
     return Chunk::isValid(Ptr);
   }
 
   NOINLINE bool isRssLimitExceeded();
 
   // Allocates a chunk.
   void *allocate(uptr Size, uptr Alignment, AllocType Type,
-                 bool ForceZeroContents = false) {
+                 bool ForceZeroContents = false) NO_THREAD_SAFETY_ANALYSIS {
     initThreadMaybe();
 
     if (UNLIKELY(Alignment > MaxAlignment)) {
       if (AllocatorMayReturnNull())
         return nullptr;
       reportAllocationAlignmentTooBig(Alignment, MaxAlignment);
     }
     if (UNLIKELY(Alignment < MinAlignment))
if (SCUDO_CAN_USE_HOOKS && &__sanitizer_malloc_hook)
       __sanitizer_malloc_hook(Ptr, Size);
     return Ptr;
   }
 
   // Place a chunk in the quarantine or directly deallocate it in the event of
   // a zero-sized quarantine, or if the size of the chunk is greater than the
   // quarantine chunk size threshold.
   void quarantineOrDeallocateChunk(void *Ptr, UnpackedHeader *Header,
-                                   uptr Size) {
+                                   uptr Size) NO_THREAD_SAFETY_ANALYSIS {
     const bool BypassQuarantine = !Size || (Size > QuarantineChunksUpToSize);
     if (BypassQuarantine) {
       UnpackedHeader NewHeader = *Header;
       NewHeader.State = ChunkAvailable;
       Chunk::compareExchangeHeader(Ptr, &NewHeader, Header);
       void *BackendPtr = Chunk::getBackendPtr(Ptr, Header);
       if (Header->ClassId) {
         bool UnlockRequired;

compiler-rt/lib/scudo/scudo_tsd.h

 
 struct ALIGNED(SANITIZER_CACHE_LINE_SIZE) ScudoTSD {
   AllocatorCacheT Cache;
   uptr QuarantineCachePlaceHolder[4];
 
   void init();
   void commitBack();
 
-  inline bool tryLock() {
+  inline bool tryLock() TRY_ACQUIRE(true, Mutex) {
     if (Mutex.TryLock()) {
       atomic_store_relaxed(&Precedence, 0);
       return true;
     }
     if (atomic_load_relaxed(&Precedence) == 0)
       atomic_store_relaxed(&Precedence, static_cast<uptr>(
           MonotonicNanoTime() >> FIRST_32_SECOND_64(16, 0)));
     return false;
   }
 
-  inline void lock() {
+  inline void lock() ACQUIRE(Mutex) {
     atomic_store_relaxed(&Precedence, 0);
     Mutex.Lock();
   }
 
-  inline void unlock() { Mutex.Unlock(); }
+  inline void unlock() RELEASE(Mutex) { Mutex.Unlock(); }
 
   inline uptr getPrecedence() { return atomic_load_relaxed(&Precedence); }
 
  private:
   StaticSpinMutex Mutex;
   atomic_uintptr_t Precedence;
 };
 

compiler-rt/lib/scudo/scudo_tsd_exclusive.inc

 extern ScudoTSD FallbackTSD;
 
 ALWAYS_INLINE void initThreadMaybe(bool MinimalInit = false) {
   if (LIKELY(ScudoThreadState != ThreadNotInitialized))
     return;
   initThread(MinimalInit);
 }
 
-ALWAYS_INLINE ScudoTSD *getTSDAndLock(bool *UnlockRequired) {
+ALWAYS_INLINE ScudoTSD *getTSDAndLock(bool *UnlockRequired) NO_THREAD_SAFETY_ANALYSIS {
   if (UNLIKELY(ScudoThreadState != ThreadInitialized)) {
     FallbackTSD.lock();
     *UnlockRequired = true;
     return &FallbackTSD;
   }
   *UnlockRequired = false;
   return &TSD;
 }
 
 #endif  // SCUDO_TSD_EXCLUSIVE

compiler-rt/lib/tsan/rtl/tsan_rtl.cpp

#if TSAN_COLLECT_STATS
   StatAggregate(ctx->stat, thr->stat);
   StatOutput(ctx->stat);
 #endif
 
   return failed ? common_flags()->exitcode : 0;
 }
 
 #if !SANITIZER_GO
-void ForkBefore(ThreadState *thr, uptr pc) {
+void ForkBefore(ThreadState *thr, uptr pc) NO_THREAD_SAFETY_ANALYSIS {
   ctx->thread_registry->Lock();
   ctx->report_mtx.Lock();
   // Suppress all reports in the pthread_atfork callbacks.
   // Reports will deadlock on the report_mtx.
   // We could ignore sync operations as well,
   // but so far it's unclear if it will do more good or harm.
   // Unnecessarily ignoring things can lead to false positives later.
   thr->suppress_reports++;
   // On OS X, REAL(fork) can call intercepted functions (OSSpinLockLock), and
   // we'll assert in CheckNoLocks() unless we ignore interceptors.
   thr->ignore_interceptors++;
 }
 
-void ForkParentAfter(ThreadState *thr, uptr pc) {
+void ForkParentAfter(ThreadState *thr, uptr pc) NO_THREAD_SAFETY_ANALYSIS {
   thr->suppress_reports--;  // Enabled in ForkBefore.
   thr->ignore_interceptors--;
   ctx->report_mtx.Unlock();
   ctx->thread_registry->Unlock();
 }
 
-void ForkChildAfter(ThreadState *thr, uptr pc) {
+void ForkChildAfter(ThreadState *thr, uptr pc) NO_THREAD_SAFETY_ANALYSIS {
   thr->suppress_reports--;  // Enabled in ForkBefore.
   thr->ignore_interceptors--;
   ctx->report_mtx.Unlock();
   ctx->thread_registry->Unlock();
 
   uptr nthread = 0;
   ctx->thread_registry->GetNumberOfThreads(0, 0, &nthread /* alive threads */);
   VPrintf(1, "ThreadSanitizer: forked new process with pid %d,"