[clang-tidy] implement concurrency-mt-unsafe

[segoon]

Summary

Checks for some thread-unsafe functions against a black list of known-to-be-unsafe functions. Usually they access static variables without synchronization (e.g. gmtime(3)) or utilize signals in a racy way (e.g. sleep(3)).

The patch adds a check instead of auto-fix as thread-safe alternatives usually have API with an additional argument (e.g. gmtime(3) v.s. gmtime_r(3)) or have a different semantics (e.g. exit(3) v.s. __exit(3)), so it is a rather tricky or non-expected fix.

An option specifies which functions in libc should be considered thread-safe, possible values are posix, glibc, or any (the most strict check). It defaults to 'any' as it is unknown what target libc type is - clang-tidy may be run on linux but check sources compiled for other *NIX.

The check is used in Yandex Taxi backend and has caught many unpleasant bugs. A similar patch for coroutine-unsafe API is coming next.

[lebedev.ri]

clang-tools-extra/test/clang-tidy/checkers/misc-mt-unsafe.cpp

3–4

Tests should be hermetic, they can not use headers from system

[segoon]

don't include any system headers in tests

[segoon]

clang-tools-extra/test/clang-tidy/checkers/misc-mt-unsafe.cpp

3–4

fixed

[njames93]

It appears to not check for signs that the code is running in a multi threaded manner, This will result in many false positives in code that is known to be single threaded.

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

20

Don't use an anonymous namespace, just make the decls contained static.

200

I don't think this range needs appending onto the diagnostic.

clang-tools-extra/docs/clang-tidy/checks/list.rst

33

Can you undo this change and all other unrelated changes to this file.

[segoon]

clang-tools-extra/docs/clang-tidy/checks/list.rst

33

These changes are added by ./add_new_check.py. I guess the file was altered by hands w/o using the script the last time(s).

[njames93]

clang-tools-extra/docs/clang-tidy/checks/list.rst

33

I'm aware of that. but these changes are unrelated and shouldn't be a part of the PR.

[segoon]

In D90944#2379688, @njames93 wrote:

It appears to not check for signs that the code is running in a multi threaded manner, This will result in many false positives in code that is known to be single threaded.

I'm not sure there is a trustworthy check whether a source is going to be used in MT environment. A program can be linked with threads libraries but still use a single thread and use MT-unsafe API with no problem. I'd rather disable the check by default and let the user explicitly enable the check. I'm not sure what's clang-tidy policy for such case - should I create a new module instead of "misc" (given that llvm itself and probably many other users manually enable "misc-*")?

[segoon]

• use static instead of namespace {}
• don't use SourceRange()
• revert unrelated changes to .rst

[lebedev.ri]

While i share concern about false-positives, it is literally impossible to avoid them here,
and this should be viewed more as an enforcement tool (don't use thread-unsafe fns),
not bug-detection check.

What i would however like to be improved, is better docs.
I'm guessing mt-unsafe is MT-Unsafe from https://www.gnu.org/software/libc/manual/html_node/POSIX-Safety-Concepts.html ?
Does this fully cover all glibc functions? POSIX? Etc?

[segoon]

• add Libc option
• improve docs

[segoon]

• minor changes to docs

[segoon]

In D90944#2380910, @lebedev.ri wrote:

What i would however like to be improved, is better docs.

I hope I've addressed your questions in documentation. Please tell me whether you still have any unanswered questions.

[njames93]

Just a general drive by point, is it wise to add a new tidy module to clang-tidy called threads (or similar).
We have got a few other checks related to multi-threaded code in the pipeline (D77493, D75229) that would fit perfectly for the same module.
Not to mention it would make it a lot easier to find checks specifically designed for multi-threaded workloads.

[lebedev.ri]

Libc option name doesn't really make sense to me, maybe FunctionSet would fit better.

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

33–34

I would expect this can be outside of all the namespaces right after using namespace clang::ast_matchers;

288–289

Likewise, i would expect this can be outside of namespaces

296

return anyOf(hasAnyName(posixFunctions), hasAnyName(glibcFunctions));

310–311

Is there any way to invert the direction of this matcher,
instead of checking each call that it's callee isn't one of the bad ones,
look through all function decls, and for all the bad ones, diagnose all calls to them?

clang-tools-extra/docs/ReleaseNotes.rst

111

<...>, Currently knows about POSIX and GLIBC.

or something along those lines

[segoon]

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

296

It would be a bit slower than now - the current code removes duplicates. If/when other FunctionSets are added, duplicate list will be much bigger.

310–311

I'm not sure it is possible without additional costs - it would require somehow marking bad FunctionDecl, it requires an addition of state.

I'm not an expert in LLVM AST, maybe it is very cheap and easy to do, but I don't see how, do you?

[njames93]

Also can this be ran through clang-tidy, feeling a few naming violations are in here. If you use arc to upload your patches you'll get lint warnings about clang-tidy and clang-format.

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

280–283

Would it not be faster to get rid of the set. Instead insert all the items in to a vector, then sort and unique it

[lebedev.ri]

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

280–283

I can't imagine this will have measurable performance difference.
The main problem is algorithmic, https://reviews.llvm.org/D90944#inline-853246

But my main point is https://llvm.org/docs/CodingStandards.html#do-not-use-static-constructors

[segoon]

• move plugin to concurrent group
• naming fixes
• use anyOf
• Libc -> FunctionSet

[njames93]

In D90944#2399759, @segoon wrote:

• move plugin to concurrent group

While this is definitely a step in the right direction, it should be a separate patch to introduce the new module. After making that, set this to be a child of it.

[segoon]

• concurrent -> concurrency
• split the patch apart

[lebedev.ri]

Looks good to me, but i'm still uneasy about doing the checking in inverted sense.

clang-tools-extra/clang-tidy/concurrency/MtUnsafeCheck.cpp

31–32 ↗

(On Diff #306020)

I commented, but the comment was lost; do these arrays really have to be in namespace?
I'd think they can be right afterwards using namespace clang::ast_matchers;.

clang-tools-extra/clang-tidy/concurrency/MtUnsafeCheck.h

9 ↗

(On Diff #306020)

s/CONCURRENT/CONCURRENCY/, maybe elsewhere too

[segoon]

• move static vectors out of namespace
• mark mt-unsafe decls and check for marks in exprs

[lebedev.ri]

In D90944#2418792, @segoon wrote:

• move static vectors out of namespace

Nice.

• mark mt-unsafe decls and check for marks in exprs

Eeeh.
I was thinking of either some smart matcher "match any function declaration
with name from these lists, and then match every call to said decl".
But the current implementation, i'm not sure this approach is even legal for checks.
So i guess let's stick with the original solution..

[segoon]

In D90944#2418845, @lebedev.ri wrote:

In D90944#2418792, @segoon wrote:

• mark mt-unsafe decls and check for marks in exprs

Eeeh.
I was thinking of either some smart matcher "match any function declaration
with name from these lists, and then match every call to said decl".

I tried to utilize bind()+equalsBoundNode(), but it seems it's impossible to mark and use the mark in a single matcher.

But the current implementation, i'm not sure this approach is even legal for checks.

The trick is stolen from abseil/UpgradeDurationConversionsCheck.h. If it's invalid here, then abseil should be fixed too.

[segoon]

• revert decls marking

[lebedev.ri]

Please upload all patches with full context (-U9999)
I'm guessing you'll need help committing this, in which case please specify Author <[e-mail]> to be used for git commit --author="<>"

Thanks, looks good to me then.
Does anyone else have any further thoughts here?

In D90944#2418864, @segoon wrote:

In D90944#2418845, @lebedev.ri wrote:

In D90944#2418792, @segoon wrote:

• mark mt-unsafe decls and check for marks in exprs

Eeeh.
I was thinking of either some smart matcher "match any function declaration
with name from these lists, and then match every call to said decl".

I tried to utilize bind()+equalsBoundNode(), but it seems it's impossible to mark and use the mark in a single matcher.

But the current implementation, i'm not sure this approach is even legal for checks.

The trick is stolen from abseil/UpgradeDurationConversionsCheck.h. If it's invalid here, then abseil should be fixed too.

The problem with that approach isn't so much that it stores state in check (i guess that is fine in general - see preprocessor handling callbacks),
but that

1. is it guaranteed that we'll match all the decl before first callinst to that decl?
2. and what's worse, this approach wouldn't actually solve the problem, because it still matches all the callinsts, it just caches "is bad callee" check somewhat..

[segoon]

• git diff -U9999

[segoon]

In D90944#2419420, @lebedev.ri wrote:

Please upload all patches with full context (-U9999)

Done.

I'm guessing you'll need help committing this, in which case please specify Author <[e-mail]> to be used for git commit --author="<>"

Vasily Kulikov <[e-mail]>

clang-tools-extra/clang-tidy/misc/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   FrontendOpenMP
   Support
   )
 
 add_clang_library(clangTidyMiscModule
   DefinitionsInHeadersCheck.cpp
   MiscTidyModule.cpp
   MisplacedConstCheck.cpp
+  MtUnsafeCheck.cpp
   NewDeleteOverloadsCheck.cpp
   NoRecursionCheck.cpp
   NonCopyableObjects.cpp
   NonPrivateMemberVariablesInClassesCheck.cpp
   RedundantExpressionCheck.cpp
   StaticAssertCheck.cpp
   ThrowByValueCatchByReferenceCheck.cpp
   UnconventionalAssignOperatorCheck.cpp

clang-tools-extra/clang-tidy/misc/MiscTidyModule.cpp

 //===--- MiscTidyModule.cpp - clang-tidy ----------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "../ClangTidy.h"
 #include "../ClangTidyModule.h"
 #include "../ClangTidyModuleRegistry.h"
 #include "DefinitionsInHeadersCheck.h"
 #include "MisplacedConstCheck.h"
+#include "MtUnsafeCheck.h"
 #include "NewDeleteOverloadsCheck.h"
 #include "NoRecursionCheck.h"
 #include "NonCopyableObjects.h"
 #include "NonPrivateMemberVariablesInClassesCheck.h"
 #include "RedundantExpressionCheck.h"
 #include "StaticAssertCheck.h"
 #include "ThrowByValueCatchByReferenceCheck.h"
 #include "UnconventionalAssignOperatorCheck.h"
 #include "UniqueptrResetReleaseCheck.h"
 #include "UnusedAliasDeclsCheck.h"
 #include "UnusedParametersCheck.h"
 #include "UnusedUsingDeclsCheck.h"
 
 namespace clang {
 namespace tidy {
 namespace misc {
 
 class MiscModule : public ClangTidyModule {
 public:
   void addCheckFactories(ClangTidyCheckFactories &CheckFactories) override {
     CheckFactories.registerCheck<DefinitionsInHeadersCheck>(
         "misc-definitions-in-headers");
     CheckFactories.registerCheck<MisplacedConstCheck>("misc-misplaced-const");
+    CheckFactories.registerCheck<MtUnsafeCheck>(
+        "misc-mt-unsafe");
     CheckFactories.registerCheck<NewDeleteOverloadsCheck>(
         "misc-new-delete-overloads");
     CheckFactories.registerCheck<NoRecursionCheck>("misc-no-recursion");
     CheckFactories.registerCheck<NonCopyableObjectsCheck>(
         "misc-non-copyable-objects");
     CheckFactories.registerCheck<NonPrivateMemberVariablesInClassesCheck>(
         "misc-non-private-member-variables-in-classes");
     CheckFactories.registerCheck<RedundantExpressionCheck>(

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.h

+//===--- MtUnsafeCheck.h - clang-tidy ---------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_MISC_MTUNSAFECHECK_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_MISC_MTUNSAFECHECK_H
+
+#include "../ClangTidyCheck.h"
+
+namespace clang {
+namespace tidy {
+namespace misc {
+
+/// Checks that non-thread-safe functions are not used.
+///
+/// For the user-facing documentation see:
+/// http://clang.llvm.org/extra/clang-tidy/checks/misc-mt-unsafe.html
+class MtUnsafeCheck : public ClangTidyCheck {
+public:
+  MtUnsafeCheck(StringRef Name, ClangTidyContext *Context)
+      : ClangTidyCheck(Name, Context) {}
+  void registerMatchers(ast_matchers::MatchFinder *Finder) override;
+  void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
+};
+
+} // namespace misc
+} // namespace tidy
+} // namespace clang
+
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_MISC_MTUNSAFECHECK_H

clang-tools-extra/clang-tidy/misc/MtUnsafeCheck.cpp

+//===--- MtUnsafeCheck.cpp - clang-tidy -----------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "MtUnsafeCheck.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+
+using namespace clang::ast_matchers;
+
+namespace clang {
+namespace tidy {
+namespace misc {
+
+namespace {
+
+// Initial list was extracted from gcc documentation
+const StringRef functions[] = {
+    "::argp_error",
+    "::argp_help",
+    "::argp_parse",
+    "::argp_state_help",
+    "::argp_usage",
+    "::asctime",
+    "::clearenv",
+    "::crypt",
+    "::ctime",
+    "::cuserid",
+    "::drand48",
+    "::ecvt",
+    "::encrypt",
+    "::endfsent",
+    "::endgrent",
+    "::endhostent",
+    "::endnetent",
+    "::endnetgrent",
+    "::endprotoent",
+    "::endpwent",
+    "::endservent",
+    "::endutent",
+    "::endutxent",
+    "::erand48",
+    "::error_at_line",
+    "::exit",
+    "::fcloseall",
+    "::fcvt",
+    "::fgetgrent",
+    "::fgetpwent",
+    "::gammal",
+    "::getchar_unlocked",
+    "::getdate",
+    "::getfsent",
+    "::getfsfile",
+    "::getfsspec",
+    "::getgrent",
+    "::getgrent_r",
+    "::getgrgid",
+    "::getgrnam",
+    "::gethostbyaddr",
+    "::gethostbyname",
+    "::gethostbyname2",
+    "::gethostent",
+    "::getlogin",
+    "::getmntent",
+    "::getnetbyaddr",
+    "::getnetbyname",
+    "::getnetent",
+    "::getnetgrent",
+    "::getnetgrent_r",
+    "::getopt",
+    "::getopt_long",
+    "::getopt_long_only",
+    "::getpass",
+    "::getprotobyname",
+    "::getprotobynumber",
+    "::getprotoent",
+    "::getpwent",
+    "::getpwent_r",
+    "::getpwnam",
+    "::getpwuid",
+    "::getservbyname",
+    "::getservbyport",
+    "::getservent",
+    "::getutent",
+    "::getutent_r",
+    "::getutid",
+    "::getutid_r",
+    "::getutline",
+    "::getutline_r",
+    "::getutxent",
+    "::getutxid",
+    "::getutxline",
+    "::getwchar_unlocked",
+    "::glob",
+    "::glob64",
+    "::gmtime",
+    "::hcreate",
+    "::hdestroy",
+    "::hsearch",
+    "::innetgr",
+    "::jrand48",
+    "::l64a",
+    "::lcong48",
+    "::lgammafNx",
+    "::localeconv",
+    "::localtime",
+    "::login",
+    "::login_tty",
+    "::logout",
+    "::logwtmp",
+    "::lrand48",
+    "::mallinfo",
+    "::mallopt",
+    "::mblen",
+    "::mbrlen",
+    "::mbrtowc",
+    "::mbsnrtowcs",
+    "::mbsrtowcs",
+    "::mbtowc",
+    "::mcheck",
+    "::mprobe",
+    "::mrand48",
+    "::mtrace",
+    "::muntrace",
+    "::nrand48",
+    "::__ppc_get_timebase_freq",
+    "::ptsname",
+    "::putchar_unlocked",
+    "::putenv",
+    "::pututline",
+    "::pututxline",
+    "::putwchar_unlocked",
+    "::qecvt",
+    "::qfcvt",
+    "::register_printf_function",
+    "::seed48",
+    "::setenv",
+    "::setfsent",
+    "::setgrent",
+    "::sethostent",
+    "::sethostid",
+    "::setkey",
+    "::setlocale",
+    "::setlogmask",
+    "::setnetent",
+    "::setnetgrent",
+    "::setprotoent",
+    "::setpwent",
+    "::setservent",
+    "::setutent",
+    "::setutxent",
+    "::siginterrupt",
+    "::sigpause",
+    "::sigprocmask",
+    "::sigsuspend",
+    "::sleep",
+    "::srand48",
+    "::strerror",
+    "::strsignal",
+    "::strtok",
+    "::tcflow",
+    "::tcsendbreak",
+    "::tmpnam",
+    "::ttyname",
+    "::unsetenv",
+    "::updwtmp",
+    "::utmpname",
+    "::utmpxname",
+    "::valloc",
+    "::vlimit",
+    "::wcrtomb",
+    "::wcsnrtombs",
+    "::wcsrtombs",
+    "::wctomb",
+    "::wordexp",
+};
+
+ast_matchers::internal::Matcher<clang::NamedDecl> hasAnyMtUnsafeNames() {
+  return hasAnyName(functions);
+}
+
+} // namespace
+
+void MtUnsafeCheck::registerMatchers(MatchFinder *Finder) {
+  Finder->addMatcher(
+      callExpr(callee(functionDecl(hasAnyMtUnsafeNames()))).bind("mt-unsafe"),
+      this);
+}
+
+void MtUnsafeCheck::check(const MatchFinder::MatchResult &Result) {
+  const auto *Call = Result.Nodes.getNodeAs<CallExpr>("mt-unsafe");
+  assert(Call && "Unhandled binding in the Matcher");
+
+  diag(Call->getBeginLoc(), "function is not thread safe")
+      << SourceRange(Call->getBeginLoc(), Call->getEndLoc());
+}
+
+} // namespace misc
+} // namespace tidy
+} // namespace clang

clang-tools-extra/docs/ReleaseNotes.rst

- New :doc:`bugprone-misplaced-pointer-arithmetic-in-alloc
   <clang-tidy/checks/bugprone-misplaced-pointer-arithmetic-in-alloc>` check.
 
 - New :doc:`bugprone-redundant-branch-condition
   <clang-tidy/checks/bugprone-redundant-branch-condition>` check.
 
   Finds condition variables in nested ``if`` statements that were also checked
   in the outer ``if`` statement and were not changed.
 
+- New :doc:`misc-mt-unsafe <clang-tidy/checks/misc-mt-unsafe>` check.
+
+  Finds thread-unsafe functions usage.
+
 - New :doc:`readability-function-cognitive-complexity
   <clang-tidy/checks/readability-function-cognitive-complexity>` check.
 
   Flags functions with Cognitive Complexity metric exceeding the configured limit.
 
 Changes in existing checks
 ^^^^^^^^^^^^^^^^^^^^^^^^^^
 

clang-tools-extra/docs/clang-tidy/checks/list.rst

.. csv-table::
    `abseil-no-namespace <abseil-no-namespace.html>`_,
    `abseil-redundant-strcat-calls <abseil-redundant-strcat-calls.html>`_, "Yes"
    `abseil-str-cat-append <abseil-str-cat-append.html>`_, "Yes"
    `abseil-string-find-startswith <abseil-string-find-startswith.html>`_, "Yes"
    `abseil-string-find-str-contains <abseil-string-find-str-contains.html>`_, "Yes"
    `abseil-time-comparison <abseil-time-comparison.html>`_, "Yes"
    `abseil-time-subtraction <abseil-time-subtraction.html>`_, "Yes"
    `abseil-upgrade-duration-conversions <abseil-upgrade-duration-conversions.html>`_, "Yes"
-   `altera-struct-pack-align <altera-struct-pack-align.html>`_,
+   `altera-struct-pack-align <altera-struct-pack-align.html>`_, "Yes"
    `android-cloexec-accept <android-cloexec-accept.html>`_, "Yes"
    `android-cloexec-accept4 <android-cloexec-accept4.html>`_,
    `android-cloexec-creat <android-cloexec-creat.html>`_, "Yes"
    `android-cloexec-dup <android-cloexec-dup.html>`_, "Yes"
    `android-cloexec-epoll-create <android-cloexec-epoll-create.html>`_,
    `android-cloexec-epoll-create1 <android-cloexec-epoll-create1.html>`_,
    `android-cloexec-fopen <android-cloexec-fopen.html>`_,
    `android-cloexec-inotify-init <android-cloexec-inotify-init.html>`_,
.. csv-table::
    `cppcoreguidelines-avoid-goto <cppcoreguidelines-avoid-goto.html>`_,
    `cppcoreguidelines-avoid-non-const-global-variables <cppcoreguidelines-avoid-non-const-global-variables.html>`_,
    `cppcoreguidelines-init-variables <cppcoreguidelines-init-variables.html>`_, "Yes"
    `cppcoreguidelines-interfaces-global-init <cppcoreguidelines-interfaces-global-init.html>`_,
    `cppcoreguidelines-macro-usage <cppcoreguidelines-macro-usage.html>`_,
    `cppcoreguidelines-narrowing-conversions <cppcoreguidelines-narrowing-conversions.html>`_,
    `cppcoreguidelines-no-malloc <cppcoreguidelines-no-malloc.html>`_,
    `cppcoreguidelines-owning-memory <cppcoreguidelines-owning-memory.html>`_,
+   `cppcoreguidelines-prefer-member-initializer <cppcoreguidelines-prefer-member-initializer.html>`_, "Yes"
    `cppcoreguidelines-pro-bounds-array-to-pointer-decay <cppcoreguidelines-pro-bounds-array-to-pointer-decay.html>`_,
    `cppcoreguidelines-pro-bounds-constant-array-index <cppcoreguidelines-pro-bounds-constant-array-index.html>`_, "Yes"
    `cppcoreguidelines-pro-bounds-pointer-arithmetic <cppcoreguidelines-pro-bounds-pointer-arithmetic.html>`_,
    `cppcoreguidelines-pro-type-const-cast <cppcoreguidelines-pro-type-const-cast.html>`_,
    `cppcoreguidelines-pro-type-cstyle-cast <cppcoreguidelines-pro-type-cstyle-cast.html>`_, "Yes"
    `cppcoreguidelines-pro-type-member-init <cppcoreguidelines-pro-type-member-init.html>`_, "Yes"
    `cppcoreguidelines-pro-type-reinterpret-cast <cppcoreguidelines-pro-type-reinterpret-cast.html>`_,
    `cppcoreguidelines-pro-type-static-cast-downcast <cppcoreguidelines-pro-type-static-cast-downcast.html>`_, "Yes"
.. csv-table::
    `google-objc-avoid-throwing-exception <google-objc-avoid-throwing-exception.html>`_,
    `google-objc-function-naming <google-objc-function-naming.html>`_,
    `google-objc-global-variable-declaration <google-objc-global-variable-declaration.html>`_,
    `google-readability-avoid-underscore-in-googletest-name <google-readability-avoid-underscore-in-googletest-name.html>`_,
    `google-readability-casting <google-readability-casting.html>`_,
    `google-readability-todo <google-readability-todo.html>`_,
    `google-runtime-int <google-runtime-int.html>`_,
    `google-runtime-operator <google-runtime-operator.html>`_,
-   `google-runtime-references <google-runtime-references.html>`_,
    `google-upgrade-googletest-case <google-upgrade-googletest-case.html>`_, "Yes"
    `hicpp-avoid-goto <hicpp-avoid-goto.html>`_,
    `hicpp-exception-baseclass <hicpp-exception-baseclass.html>`_,
    `hicpp-multiway-paths-covered <hicpp-multiway-paths-covered.html>`_,
    `hicpp-no-assembler <hicpp-no-assembler.html>`_,
    `hicpp-signed-bitwise <hicpp-signed-bitwise.html>`_,
    `linuxkernel-must-use-errs <linuxkernel-must-use-errs.html>`_,
    `llvm-header-guard <llvm-header-guard.html>`_,
    `llvm-include-order <llvm-include-order.html>`_, "Yes"
    `llvm-namespace-comment <llvm-namespace-comment.html>`_,
    `llvm-prefer-isa-or-dyn-cast-in-conditionals <llvm-prefer-isa-or-dyn-cast-in-conditionals.html>`_, "Yes"
    `llvm-prefer-register-over-unsigned <llvm-prefer-register-over-unsigned.html>`_, "Yes"
    `llvm-twine-local <llvm-twine-local.html>`_, "Yes"
    `llvmlibc-callee-namespace <llvmlibc-callee-namespace.html>`_,
    `llvmlibc-implementation-in-namespace <llvmlibc-implementation-in-namespace.html>`_,
    `llvmlibc-restrict-system-libc-headers <llvmlibc-restrict-system-libc-headers.html>`_, "Yes"
    `misc-definitions-in-headers <misc-definitions-in-headers.html>`_, "Yes"
    `misc-misplaced-const <misc-misplaced-const.html>`_,
+   `misc-mt-unsafe <misc-mt-unsafe.html>`_, "Yes"
    `misc-new-delete-overloads <misc-new-delete-overloads.html>`_,
    `misc-no-recursion <misc-no-recursion.html>`_,
    `misc-non-copyable-objects <misc-non-copyable-objects.html>`_,
    `misc-non-private-member-variables-in-classes <misc-non-private-member-variables-in-classes.html>`_,
    `misc-redundant-expression <misc-redundant-expression.html>`_, "Yes"
    `misc-static-assert <misc-static-assert.html>`_, "Yes"
    `misc-throw-by-value-catch-by-reference <misc-throw-by-value-catch-by-reference.html>`_,
    `misc-unconventional-assign-operator <misc-unconventional-assign-operator.html>`_,

clang-tools-extra/docs/clang-tidy/checks/misc-mt-unsafe.rst

+.. title:: clang-tidy - misc-mt-unsafe
+
+misc-mt-unsafe
+==============
+
+Checks for some thread-unsafe functions against a black list of
+known-to-be-unsafe functions. Usually they access static variables without
+synchronization (e.g. gmtime(3)) or utilize signals in a racy way.
+
+Examples:
+
+.. code-block:: c++
+
+    tm = gmtime(timep); // uses a global buffer
+
+    sleep(1); // implementation may use SIGALRM

clang-tools-extra/test/clang-tidy/checkers/misc-mt-unsafe.cpp

+// RUN: %check_clang_tidy %s misc-mt-unsafe %t
+
+#include <unistd.h>
+#include <time.h>
+
+void foo() {
+  sleep(2);
+  // CHECK-MESSAGES: :[[@LINE-1]]:3: warning: function is not thread safe [misc-mt-unsafe]
+
+  ::sleep(2);
+  // CHECK-MESSAGES: :[[@LINE-2]]:3: warning: function is not thread safe [misc-mt-unsafe]
+
+  time_t tt{};
+  auto tm = gmtime(&tt);
+  // CHECK-MESSAGES: :[[@LINE-3]]:13: warning: function is not thread safe [misc-mt-unsafe]
+  tm = ::gmtime(&tt);
+  // CHECK-MESSAGES: :[[@LINE-4]]:8: warning: function is not thread safe [misc-mt-unsafe]
+}