[clang-tidy] implement concurrency-mt-unsafe

[segoon]

Summary

Checks for some thread-unsafe functions against a black list of known-to-be-unsafe functions. Usually they access static variables without synchronization (e.g. gmtime(3)) or utilize signals in a racy way (e.g. sleep(3)).

The patch adds a check instead of auto-fix as thread-safe alternatives usually have API with an additional argument (e.g. gmtime(3) v.s. gmtime_r(3)) or have a different semantics (e.g. exit(3) v.s. __exit(3)), so it is a rather tricky or non-expected fix.

An option specifies which functions in libc should be considered thread-safe, possible values are posix, glibc, or any (the most strict check). It defaults to 'any' as it is unknown what target libc type is - clang-tidy may be run on linux but check sources compiled for other *NIX.

The check is used in Yandex Taxi backend and has caught many unpleasant bugs. A similar patch for coroutine-unsafe API is coming next.

[lebedev.ri]

clang-tools-extra/test/clang-tidy/checkers/misc-mt-unsafe.cpp

3–4 ↗

(On Diff #303440)

Tests should be hermetic, they can not use headers from system

[segoon]

don't include any system headers in tests

[segoon]

clang-tools-extra/test/clang-tidy/checkers/misc-mt-unsafe.cpp

3–4 ↗

(On Diff #303440)

fixed

[njames93]

It appears to not check for signs that the code is running in a multi threaded manner, This will result in many false positives in code that is known to be single threaded.

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

19 ↗

(On Diff #303499)

Don't use an anonymous namespace, just make the decls contained static.

199 ↗

(On Diff #303499)

I don't think this range needs appending onto the diagnostic.

clang-tools-extra/docs/clang-tidy/checks/list.rst

34

Can you undo this change and all other unrelated changes to this file.

[segoon]

clang-tools-extra/docs/clang-tidy/checks/list.rst

34

These changes are added by ./add_new_check.py. I guess the file was altered by hands w/o using the script the last time(s).

[njames93]

clang-tools-extra/docs/clang-tidy/checks/list.rst

34

I'm aware of that. but these changes are unrelated and shouldn't be a part of the PR.

[segoon]

In D90944#2379688, @njames93 wrote:

It appears to not check for signs that the code is running in a multi threaded manner, This will result in many false positives in code that is known to be single threaded.

I'm not sure there is a trustworthy check whether a source is going to be used in MT environment. A program can be linked with threads libraries but still use a single thread and use MT-unsafe API with no problem. I'd rather disable the check by default and let the user explicitly enable the check. I'm not sure what's clang-tidy policy for such case - should I create a new module instead of "misc" (given that llvm itself and probably many other users manually enable "misc-*")?

[segoon]

• use static instead of namespace {}
• don't use SourceRange()
• revert unrelated changes to .rst

[lebedev.ri]

While i share concern about false-positives, it is literally impossible to avoid them here,
and this should be viewed more as an enforcement tool (don't use thread-unsafe fns),
not bug-detection check.

What i would however like to be improved, is better docs.
I'm guessing mt-unsafe is MT-Unsafe from https://www.gnu.org/software/libc/manual/html_node/POSIX-Safety-Concepts.html ?
Does this fully cover all glibc functions? POSIX? Etc?

[segoon]

• add Libc option
• improve docs

[segoon]

• minor changes to docs

[segoon]

In D90944#2380910, @lebedev.ri wrote:

What i would however like to be improved, is better docs.

I hope I've addressed your questions in documentation. Please tell me whether you still have any unanswered questions.

[njames93]

Just a general drive by point, is it wise to add a new tidy module to clang-tidy called threads (or similar).
We have got a few other checks related to multi-threaded code in the pipeline (D77493, D75229) that would fit perfectly for the same module.
Not to mention it would make it a lot easier to find checks specifically designed for multi-threaded workloads.

[lebedev.ri]

Libc option name doesn't really make sense to me, maybe FunctionSet would fit better.

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

32–33 ↗

(On Diff #305460)

I would expect this can be outside of all the namespaces right after using namespace clang::ast_matchers;

287–288 ↗

(On Diff #305460)

Likewise, i would expect this can be outside of namespaces

295 ↗

(On Diff #305460)

return anyOf(hasAnyName(posixFunctions), hasAnyName(glibcFunctions));

309–310 ↗

(On Diff #305460)

Is there any way to invert the direction of this matcher,
instead of checking each call that it's callee isn't one of the bad ones,
look through all function decls, and for all the bad ones, diagnose all calls to them?

clang-tools-extra/docs/ReleaseNotes.rst

122

<...>, Currently knows about POSIX and GLIBC.

or something along those lines

[segoon]

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

295 ↗

(On Diff #305460)

It would be a bit slower than now - the current code removes duplicates. If/when other FunctionSets are added, duplicate list will be much bigger.

309–310 ↗

(On Diff #305460)

I'm not sure it is possible without additional costs - it would require somehow marking bad FunctionDecl, it requires an addition of state.

I'm not an expert in LLVM AST, maybe it is very cheap and easy to do, but I don't see how, do you?

[njames93]

Also can this be ran through clang-tidy, feeling a few naming violations are in here. If you use arc to upload your patches you'll get lint warnings about clang-tidy and clang-format.

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

279–282 ↗

(On Diff #305460)

Would it not be faster to get rid of the set. Instead insert all the items in to a vector, then sort and unique it

[lebedev.ri]

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

279–282 ↗

(On Diff #305460)

I can't imagine this will have measurable performance difference.
The main problem is algorithmic, https://reviews.llvm.org/D90944#inline-853246

But my main point is https://llvm.org/docs/CodingStandards.html#do-not-use-static-constructors

[segoon]

• move plugin to concurrent group
• naming fixes
• use anyOf
• Libc -> FunctionSet

[njames93]

In D90944#2399759, @segoon wrote:

• move plugin to concurrent group

While this is definitely a step in the right direction, it should be a separate patch to introduce the new module. After making that, set this to be a child of it.

[segoon]

• concurrent -> concurrency
• split the patch apart

[lebedev.ri]

Looks good to me, but i'm still uneasy about doing the checking in inverted sense.

clang-tools-extra/clang-tidy/concurrency/MtUnsafeCheck.cpp

32–33

I commented, but the comment was lost; do these arrays really have to be in namespace?
I'd think they can be right afterwards using namespace clang::ast_matchers;.

clang-tools-extra/clang-tidy/concurrency/MtUnsafeCheck.h

10

s/CONCURRENT/CONCURRENCY/, maybe elsewhere too

[segoon]

• move static vectors out of namespace
• mark mt-unsafe decls and check for marks in exprs

[lebedev.ri]

In D90944#2418792, @segoon wrote:

• move static vectors out of namespace

Nice.

• mark mt-unsafe decls and check for marks in exprs

Eeeh.
I was thinking of either some smart matcher "match any function declaration
with name from these lists, and then match every call to said decl".
But the current implementation, i'm not sure this approach is even legal for checks.
So i guess let's stick with the original solution..

[segoon]

In D90944#2418845, @lebedev.ri wrote:

In D90944#2418792, @segoon wrote:

• mark mt-unsafe decls and check for marks in exprs

Eeeh.
I was thinking of either some smart matcher "match any function declaration
with name from these lists, and then match every call to said decl".

I tried to utilize bind()+equalsBoundNode(), but it seems it's impossible to mark and use the mark in a single matcher.

But the current implementation, i'm not sure this approach is even legal for checks.

The trick is stolen from abseil/UpgradeDurationConversionsCheck.h. If it's invalid here, then abseil should be fixed too.

[segoon]

• revert decls marking

[lebedev.ri]

Please upload all patches with full context (-U9999)
I'm guessing you'll need help committing this, in which case please specify Author <[e-mail]> to be used for git commit --author="<>"

Thanks, looks good to me then.
Does anyone else have any further thoughts here?

In D90944#2418864, @segoon wrote:

In D90944#2418845, @lebedev.ri wrote:

In D90944#2418792, @segoon wrote:

• mark mt-unsafe decls and check for marks in exprs

Eeeh.
I was thinking of either some smart matcher "match any function declaration
with name from these lists, and then match every call to said decl".

I tried to utilize bind()+equalsBoundNode(), but it seems it's impossible to mark and use the mark in a single matcher.

But the current implementation, i'm not sure this approach is even legal for checks.

The trick is stolen from abseil/UpgradeDurationConversionsCheck.h. If it's invalid here, then abseil should be fixed too.

The problem with that approach isn't so much that it stores state in check (i guess that is fine in general - see preprocessor handling callbacks),
but that

1. is it guaranteed that we'll match all the decl before first callinst to that decl?
2. and what's worse, this approach wouldn't actually solve the problem, because it still matches all the callinsts, it just caches "is bad callee" check somewhat..

[segoon]

• git diff -U9999

[segoon]

In D90944#2419420, @lebedev.ri wrote:

Please upload all patches with full context (-U9999)

Done.

I'm guessing you'll need help committing this, in which case please specify Author <[e-mail]> to be used for git commit --author="<>"

Vasily Kulikov <[e-mail]>

clang-tools-extra/clang-tidy/concurrency/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   Support
   )
 
 add_clang_library(clangTidyConcurrencyModule
   ConcurrencyTidyModule.cpp
+  MtUnsafeCheck.cpp
 
   LINK_LIBS
   clangTidy
   clangTidyUtils
   )
 
 clang_target_link_libraries(clangTidyConcurrencyModule
   PRIVATE
   clangAnalysis
   clangAST
   clangASTMatchers
   clangBasic
   clangLex
   clangSerialization
   clangTooling
   )

clang-tools-extra/clang-tidy/concurrency/ConcurrencyTidyModule.cpp

 //===--- ConcurrencyTidyModule.cpp - clang-tidy ---------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "../ClangTidy.h"
 #include "../ClangTidyModule.h"
 #include "../ClangTidyModuleRegistry.h"
+#include "MtUnsafeCheck.h"
 
 namespace clang {
 namespace tidy {
 namespace concurrency {
 
 class ConcurrencyModule : public ClangTidyModule {
 public:
-  void addCheckFactories(ClangTidyCheckFactories &CheckFactories) override {}
+  void addCheckFactories(ClangTidyCheckFactories &CheckFactories) override {
+    CheckFactories.registerCheck<concurrency::MtUnsafeCheck>(
+        "concurrency-mt-unsafe");
+  }
 };
 
 } // namespace concurrency
 
 // Register the ConcurrencyTidyModule using this statically initialized variable.
 static ClangTidyModuleRegistry::Add<concurrency::ConcurrencyModule>
     X("concurrency-module", "Adds concurrency checks.");
 
 // This anchor is used to force the linker to link in the generated object file
 // and thus register the ConcurrencyModule.
 volatile int ConcurrencyModuleAnchorSource = 0;
 
 } // namespace tidy
 } // namespace clang

clang-tools-extra/clang-tidy/concurrency/MtUnsafeCheck.h

+//===--- MtUnsafeCheck.h - clang-tidy ---------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CONCURRENCY_MTUNSAFECHECK_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CONCURRENCY_MTUNSAFECHECK_H
+
+#include "../ClangTidyCheck.h"
+
+namespace clang {
+namespace tidy {
+namespace concurrency {
+
+/// Checks that non-thread-safe functions are not used.
+///
+/// For the user-facing documentation see:
+/// http://clang.llvm.org/extra/clang-tidy/checks/threads-mt-unsafe.html
+class MtUnsafeCheck : public ClangTidyCheck {
+public:
+  MtUnsafeCheck(StringRef Name, ClangTidyContext *Context);
+  void storeOptions(ClangTidyOptions::OptionMap &Opts) override;
+  void registerMatchers(ast_matchers::MatchFinder *Finder) override;
+  void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
+
+  enum class FunctionSet {
+    Posix,
+    Glibc,
+    Any,
+  };
+
+private:
+  const FunctionSet FuncSet;
+};
+
+} // namespace concurrency
+} // namespace tidy
+} // namespace clang
+
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CONCURRENCY_MTUNSAFECHECK_H

clang-tools-extra/clang-tidy/concurrency/MtUnsafeCheck.cpp

+//===--- MtUnsafeCheck.cpp - clang-tidy -----------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "MtUnsafeCheck.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+
+using namespace clang::ast_matchers;
+
+// Initial list was extracted from gcc documentation
+static const clang::StringRef GlibcFunctions[] = {
+    "::argp_error",
+    "::argp_help",
+    "::argp_parse",
+    "::argp_state_help",
+    "::argp_usage",
+    "::asctime",
+    "::clearenv",
+    "::crypt",
+    "::ctime",
+    "::cuserid",
+    "::drand48",
+    "::ecvt",
+    "::encrypt",
+    "::endfsent",
+    "::endgrent",
+    "::endhostent",
+    "::endnetent",
+    "::endnetgrent",
+    "::endprotoent",
+    "::endpwent",
+    "::endservent",
+    "::endutent",
+    "::endutxent",
+    "::erand48",
+    "::error_at_line",
+    "::exit",
+    "::fcloseall",
+    "::fcvt",
+    "::fgetgrent",
+    "::fgetpwent",
+    "::gammal",
+    "::getchar_unlocked",
+    "::getdate",
+    "::getfsent",
+    "::getfsfile",
+    "::getfsspec",
+    "::getgrent",
+    "::getgrent_r",
+    "::getgrgid",
+    "::getgrnam",
+    "::gethostbyaddr",
+    "::gethostbyname",
+    "::gethostbyname2",
+    "::gethostent",
+    "::getlogin",
+    "::getmntent",
+    "::getnetbyaddr",
+    "::getnetbyname",
+    "::getnetent",
+    "::getnetgrent",
+    "::getnetgrent_r",
+    "::getopt",
+    "::getopt_long",
+    "::getopt_long_only",
+    "::getpass",
+    "::getprotobyname",
+    "::getprotobynumber",
+    "::getprotoent",
+    "::getpwent",
+    "::getpwent_r",
+    "::getpwnam",
+    "::getpwuid",
+    "::getservbyname",
+    "::getservbyport",
+    "::getservent",
+    "::getutent",
+    "::getutent_r",
+    "::getutid",
+    "::getutid_r",
+    "::getutline",
+    "::getutline_r",
+    "::getutxent",
+    "::getutxid",
+    "::getutxline",
+    "::getwchar_unlocked",
+    "::glob",
+    "::glob64",
+    "::gmtime",
+    "::hcreate",
+    "::hdestroy",
+    "::hsearch",
+    "::innetgr",
+    "::jrand48",
+    "::l64a",
+    "::lcong48",
+    "::lgammafNx",
+    "::localeconv",
+    "::localtime",
+    "::login",
+    "::login_tty",
+    "::logout",
+    "::logwtmp",
+    "::lrand48",
+    "::mallinfo",
+    "::mallopt",
+    "::mblen",
+    "::mbrlen",
+    "::mbrtowc",
+    "::mbsnrtowcs",
+    "::mbsrtowcs",
+    "::mbtowc",
+    "::mcheck",
+    "::mprobe",
+    "::mrand48",
+    "::mtrace",
+    "::muntrace",
+    "::nrand48",
+    "::__ppc_get_timebase_freq",
+    "::ptsname",
+    "::putchar_unlocked",
+    "::putenv",
+    "::pututline",
+    "::pututxline",
+    "::putwchar_unlocked",
+    "::qecvt",
+    "::qfcvt",
+    "::register_printf_function",
+    "::seed48",
+    "::setenv",
+    "::setfsent",
+    "::setgrent",
+    "::sethostent",
+    "::sethostid",
+    "::setkey",
+    "::setlocale",
+    "::setlogmask",
+    "::setnetent",
+    "::setnetgrent",
+    "::setprotoent",
+    "::setpwent",
+    "::setservent",
+    "::setutent",
+    "::setutxent",
+    "::siginterrupt",
+    "::sigpause",
+    "::sigprocmask",
+    "::sigsuspend",
+    "::sleep",
+    "::srand48",
+    "::strerror",
+    "::strsignal",
+    "::strtok",
+    "::tcflow",
+    "::tcsendbreak",
+    "::tmpnam",
+    "::ttyname",
+    "::unsetenv",
+    "::updwtmp",
+    "::utmpname",
+    "::utmpxname",
+    "::valloc",
+    "::vlimit",
+    "::wcrtomb",
+    "::wcsnrtombs",
+    "::wcsrtombs",
+    "::wctomb",
+    "::wordexp",
+};
+
+static const clang::StringRef PosixFunctions[] = {
+    "::asctime",
+    "::basename",
+    "::catgets",
+    "::crypt",
+    "::ctime",
+    "::dbm_clearerr",
+    "::dbm_close",
+    "::dbm_delete",
+    "::dbm_error",
+    "::dbm_fetch",
+    "::dbm_firstkey",
+    "::dbm_nextkey",
+    "::dbm_open",
+    "::dbm_store",
+    "::dirname",
+    "::dlerror",
+    "::drand48",
+    "::encrypt",
+    "::endgrent",
+    "::endpwent",
+    "::endutxent",
+    "::ftw",
+    "::getc_unlocked",
+    "::getchar_unlocked",
+    "::getdate",
+    "::getenv",
+    "::getgrent",
+    "::getgrgid",
+    "::getgrnam",
+    "::gethostent",
+    "::getlogin",
+    "::getnetbyaddr",
+    "::getnetbyname",
+    "::getnetent",
+    "::getopt",
+    "::getprotobyname",
+    "::getprotobynumber",
+    "::getprotoent",
+    "::getpwent",
+    "::getpwnam",
+    "::getpwuid",
+    "::getservbyname",
+    "::getservbyport",
+    "::getservent",
+    "::getutxent",
+    "::getutxid",
+    "::getutxline",
+    "::gmtime",
+    "::hcreate",
+    "::hdestroy",
+    "::hsearch",
+    "::inet_ntoa",
+    "::l64a",
+    "::lgamma",
+    "::lgammaf",
+    "::lgammal",
+    "::localeconv",
+    "::localtime",
+    "::lrand48",
+    "::mrand48",
+    "::nftw",
+    "::nl_langinfo",
+    "::ptsname",
+    "::putc_unlocked",
+    "::putchar_unlocked",
+    "::putenv",
+    "::pututxline",
+    "::rand",
+    "::readdir",
+    "::setenv",
+    "::setgrent",
+    "::setkey",
+    "::setpwent",
+    "::setutxent",
+    "::strerror",
+    "::strsignal",
+    "::strtok",
+    "::system",
+    "::ttyname",
+    "::unsetenv",
+    "::wcstombs",
+    "::wctomb",
+};
+
+namespace clang {
+namespace tidy {
+
+template <> struct OptionEnumMapping<concurrency::MtUnsafeCheck::FunctionSet> {
+  static llvm::ArrayRef<
+      std::pair<concurrency::MtUnsafeCheck::FunctionSet, StringRef>>
+  getEnumMapping() {
+    static constexpr std::pair<concurrency::MtUnsafeCheck::FunctionSet,
+                               StringRef>
+        Mapping[] = {{concurrency::MtUnsafeCheck::FunctionSet::Posix, "posix"},
+                     {concurrency::MtUnsafeCheck::FunctionSet::Glibc, "glibc"},
+                     {concurrency::MtUnsafeCheck::FunctionSet::Any, "any"}};
+    return makeArrayRef(Mapping);
+  }
+};
+
+namespace concurrency {
+
+static ast_matchers::internal::Matcher<clang::NamedDecl>
+hasAnyMtUnsafeNames(MtUnsafeCheck::FunctionSet libc) {
+  switch (libc) {
+  case MtUnsafeCheck::FunctionSet::Posix:
+    return hasAnyName(PosixFunctions);
+  case MtUnsafeCheck::FunctionSet::Glibc:
+    return hasAnyName(GlibcFunctions);
+  case MtUnsafeCheck::FunctionSet::Any:
+    return anyOf(hasAnyName(PosixFunctions), hasAnyName(GlibcFunctions));
+  }
+  llvm_unreachable("invalid FunctionSet");
+}
+
+MtUnsafeCheck::MtUnsafeCheck(StringRef Name, ClangTidyContext *Context)
+    : ClangTidyCheck(Name, Context),
+      FuncSet(Options.get("FunctionSet", MtUnsafeCheck::FunctionSet::Any)) {}
+
+void MtUnsafeCheck::storeOptions(ClangTidyOptions::OptionMap &Opts) {
+  Options.store(Opts, "FunctionSet", FuncSet);
+}
+
+void MtUnsafeCheck::registerMatchers(MatchFinder *Finder) {
+  Finder->addMatcher(
+      callExpr(callee(functionDecl(hasAnyMtUnsafeNames(FuncSet))))
+          .bind("mt-unsafe"),
+      this);
+}
+
+void MtUnsafeCheck::check(const MatchFinder::MatchResult &Result) {
+  const auto *Call = Result.Nodes.getNodeAs<CallExpr>("mt-unsafe");
+  assert(Call && "Unhandled binding in the Matcher");
+
+  diag(Call->getBeginLoc(), "function is not thread safe");
+}
+
+} // namespace concurrency
+} // namespace tidy
+} // namespace clang

clang-tools-extra/docs/ReleaseNotes.rst

- New :doc:`bugprone-misplaced-pointer-arithmetic-in-alloc
   <clang-tidy/checks/bugprone-misplaced-pointer-arithmetic-in-alloc>` check.
 
 - New :doc:`bugprone-redundant-branch-condition
   <clang-tidy/checks/bugprone-redundant-branch-condition>` check.
 
   Finds condition variables in nested ``if`` statements that were also checked
   in the outer ``if`` statement and were not changed.
 
+- New :doc:`concurrency-mt-unsafe <clang-tidy/checks/concurrency-mt-unsafe>`
+  check.
+
+  Finds thread-unsafe functions usage. Currently knows about POSIX and
+  Glibc function sets.
+
 - New :doc:`bugprone-signal-handler
   <clang-tidy/checks/bugprone-signal-handler>` check.
 
   Finds functions registered as signal handlers that call non asynchronous-safe
   functions.
 
 - New :doc:`cert-sig30-c
   <clang-tidy/checks/cert-sig30-c>` check.

clang-tools-extra/docs/clang-tidy/checks/concurrency-mt-unsafe.rst

+.. title:: clang-tidy - concurrency-mt-unsafe
+
+concurrency-mt-unsafe
+=====================
+
+Checks for some thread-unsafe functions against a black list of
+known-to-be-unsafe functions. Usually they access static variables without
+synchronization (e.g. gmtime(3)) or utilize signals in a racy way.
+The set of functions to check is specified with the `FunctionSet` option.
+
+Note that using some thread-unsafe functions may be still valid in
+concurrent programming if only a single thread is used (e.g. setenv(3)),
+however, some functions may track a state in global variables which
+would be clobbered by subsequent (non-parallel, but concurrent) calls to
+a related function. E.g. the following code suffers from unprotected
+accesses to a global state:
+
+.. code-block:: c++
+
+    // getnetent(3) maintains global state with DB connection, etc.
+    // If a concurrent green thread calls getnetent(3), the global state is corrupted.
+    netent = getnetent();
+    yield();
+    netent = getnetent();
+
+
+Examples:
+
+.. code-block:: c++
+
+    tm = gmtime(timep); // uses a global buffer
+
+    sleep(1); // implementation may use SIGALRM
+
+.. option:: FunctionSet
+
+  Specifies which functions in libc should be considered thread-safe,
+  possible values are `posix`, `glibc`, or `any`.
+
+  `posix` means POSIX defined thread-unsafe functions. POSIX.1-2001
+  in "2.9.1 Thread-Safety" defines that all functions specified in the
+  standard are thread-safe except a predefined list of thread-unsafe
+  functions.
+
+  Glibc defines some of them as thread-safe (e.g. dirname(3)), but adds
+  non-POSIX thread-unsafe ones (e.g. getopt_long(3)). Glibc's list is
+  compiled from GNU web documentation with a search for MT-Safe tag:
+  https://www.gnu.org/software/libc/manual/html_node/POSIX-Safety-Concepts.html
+
+  If you want to identify thread-unsafe API for at least one libc or
+  unsure which libc will be used, use `any` (default).
+

clang-tools-extra/docs/clang-tidy/checks/list.rst

.. csv-table::
    `abseil-redundant-strcat-calls <abseil-redundant-strcat-calls.html>`_, "Yes"
    `abseil-str-cat-append <abseil-str-cat-append.html>`_, "Yes"
    `abseil-string-find-startswith <abseil-string-find-startswith.html>`_, "Yes"
    `abseil-string-find-str-contains <abseil-string-find-str-contains.html>`_, "Yes"
    `abseil-time-comparison <abseil-time-comparison.html>`_, "Yes"
    `abseil-time-subtraction <abseil-time-subtraction.html>`_, "Yes"
    `abseil-upgrade-duration-conversions <abseil-upgrade-duration-conversions.html>`_, "Yes"
    `altera-kernel-name-restriction <altera-kernel-name-restriction.html>`_,
    `altera-struct-pack-align <altera-struct-pack-align.html>`_,
    `android-cloexec-accept <android-cloexec-accept.html>`_, "Yes"
    `android-cloexec-accept4 <android-cloexec-accept4.html>`_,
    `android-cloexec-creat <android-cloexec-creat.html>`_, "Yes"
    `android-cloexec-dup <android-cloexec-dup.html>`_, "Yes"
    `android-cloexec-epoll-create <android-cloexec-epoll-create.html>`_,
    `android-cloexec-epoll-create1 <android-cloexec-epoll-create1.html>`_,
    `android-cloexec-fopen <android-cloexec-fopen.html>`_,
    `android-cloexec-inotify-init <android-cloexec-inotify-init.html>`_,
.. csv-table::
    `clang-analyzer-osx.cocoa.AutoreleaseWrite <clang-analyzer-osx.cocoa.AutoreleaseWrite.html>`_,
    `clang-analyzer-osx.cocoa.Loops <clang-analyzer-osx.cocoa.Loops.html>`_,
    `clang-analyzer-osx.cocoa.MissingSuperCall <clang-analyzer-osx.cocoa.MissingSuperCall.html>`_,
    `clang-analyzer-osx.cocoa.NonNilReturnValue <clang-analyzer-osx.cocoa.NonNilReturnValue.html>`_,
    `clang-analyzer-osx.cocoa.RunLoopAutoreleaseLeak <clang-analyzer-osx.cocoa.RunLoopAutoreleaseLeak.html>`_,
    `clang-analyzer-valist.CopyToSelf <clang-analyzer-valist.CopyToSelf.html>`_,
    `clang-analyzer-valist.Uninitialized <clang-analyzer-valist.Uninitialized.html>`_,
    `clang-analyzer-valist.Unterminated <clang-analyzer-valist.Unterminated.html>`_,
+   `concurrency-mt-unsafe <concurrency-mt-unsafe.html>`_,
    `cppcoreguidelines-avoid-goto <cppcoreguidelines-avoid-goto.html>`_,
    `cppcoreguidelines-avoid-non-const-global-variables <cppcoreguidelines-avoid-non-const-global-variables.html>`_,
    `cppcoreguidelines-init-variables <cppcoreguidelines-init-variables.html>`_, "Yes"
    `cppcoreguidelines-interfaces-global-init <cppcoreguidelines-interfaces-global-init.html>`_,
    `cppcoreguidelines-macro-usage <cppcoreguidelines-macro-usage.html>`_,
    `cppcoreguidelines-narrowing-conversions <cppcoreguidelines-narrowing-conversions.html>`_,
    `cppcoreguidelines-no-malloc <cppcoreguidelines-no-malloc.html>`_,
    `cppcoreguidelines-owning-memory <cppcoreguidelines-owning-memory.html>`_,

clang-tools-extra/test/clang-tidy/checkers/concurrency-mt-unsafe-any.cpp

+// RUN: %check_clang_tidy %s concurrency-mt-unsafe %t
+
+extern unsigned int sleep (unsigned int __seconds);
+extern int *gmtime (const int *__timer);
+extern int *gmtime_r (const int *__timer, char*);
+extern char *dirname (char *__path);
+
+void foo() {
+  sleep(2);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: function is not thread safe [concurrency-mt-unsafe]
+  ::sleep(2);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: function is not thread safe [concurrency-mt-unsafe]
+
+  auto tm = gmtime(nullptr);
+  // CHECK-MESSAGES: :[[@LINE-1]]:13: warning: function is not thread safe [concurrency-mt-unsafe]
+  tm = ::gmtime(nullptr);
+  // CHECK-MESSAGES: :[[@LINE-1]]:8: warning: function is not thread safe [concurrency-mt-unsafe]
+
+  tm = gmtime_r(nullptr, nullptr);
+  tm = ::gmtime_r(nullptr, nullptr);
+
+  dirname(nullptr);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: function is not thread safe [concurrency-mt-unsafe]
+}

clang-tools-extra/test/clang-tidy/checkers/concurrency-mt-unsafe-glibc.cpp

+// RUN: %check_clang_tidy %s concurrency-mt-unsafe %t -- -config='{CheckOptions: [{key: "concurrency-mt-unsafe.FunctionSet", value: "glibc"}]}'
+
+extern unsigned int sleep (unsigned int __seconds);
+extern int *gmtime (const int *__timer);
+extern char *dirname (char *__path);
+
+void foo() {
+  sleep(2);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: function is not thread safe [concurrency-mt-unsafe]
+
+  ::sleep(2);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: function is not thread safe [concurrency-mt-unsafe]
+
+  dirname(nullptr);
+}

clang-tools-extra/test/clang-tidy/checkers/concurrency-mt-unsafe-posix.cpp

+// RUN: %check_clang_tidy %s concurrency-mt-unsafe %t -- -config='{CheckOptions: [{key: "concurrency-mt-unsafe.FunctionSet", value: "posix"}]}'
+
+extern unsigned int sleep (unsigned int __seconds);
+extern int *gmtime (const int *__timer);
+extern int *gmtime_r (const int *__timer, char*);
+extern char *dirname (char *__path);
+
+void foo() {
+  sleep(2);
+  ::sleep(2);
+
+  auto tm = gmtime(nullptr);
+  // CHECK-MESSAGES: :[[@LINE-1]]:13: warning: function is not thread safe [concurrency-mt-unsafe]
+  tm = ::gmtime(nullptr);
+  // CHECK-MESSAGES: :[[@LINE-1]]:8: warning: function is not thread safe [concurrency-mt-unsafe]
+
+  tm = gmtime_r(nullptr, nullptr);
+  tm = ::gmtime_r(nullptr, nullptr);
+
+  dirname(nullptr);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: function is not thread safe [concurrency-mt-unsafe]
+}