1622fe49b55cb60d6132bb100236f591de1515146sewardj 2622fe49b55cb60d6132bb100236f591de1515146sewardj#include <assert.h> 3622fe49b55cb60d6132bb100236f591de1515146sewardj#include <stdio.h> 4622fe49b55cb60d6132bb100236f591de1515146sewardj#include <stdlib.h> 5622fe49b55cb60d6132bb100236f591de1515146sewardj#include <pthread.h> 6622fe49b55cb60d6132bb100236f591de1515146sewardj#include <unistd.h> 7622fe49b55cb60d6132bb100236f591de1515146sewardj 8622fe49b55cb60d6132bb100236f591de1515146sewardjstatic char* s_mem; 9622fe49b55cb60d6132bb100236f591de1515146sewardj 10622fe49b55cb60d6132bb100236f591de1515146sewardj/* wait a second, so as to guarantee that the parent access 11622fe49b55cb60d6132bb100236f591de1515146sewardj the malloc'd area, then free it. */ 12622fe49b55cb60d6132bb100236f591de1515146sewardjstatic void* thread_func(void* arg) 13622fe49b55cb60d6132bb100236f591de1515146sewardj{ 14622fe49b55cb60d6132bb100236f591de1515146sewardj sleep(1); 15622fe49b55cb60d6132bb100236f591de1515146sewardj free(s_mem); 16622fe49b55cb60d6132bb100236f591de1515146sewardj return NULL; 17622fe49b55cb60d6132bb100236f591de1515146sewardj} 18622fe49b55cb60d6132bb100236f591de1515146sewardj 19622fe49b55cb60d6132bb100236f591de1515146sewardjint main(int argc, char** argv) 20622fe49b55cb60d6132bb100236f591de1515146sewardj{ 21622fe49b55cb60d6132bb100236f591de1515146sewardj pthread_t tid; 22622fe49b55cb60d6132bb100236f591de1515146sewardj int quiet; 23622fe49b55cb60d6132bb100236f591de1515146sewardj 24622fe49b55cb60d6132bb100236f591de1515146sewardj fprintf(stderr, "Start.\n"); 25622fe49b55cb60d6132bb100236f591de1515146sewardj 26622fe49b55cb60d6132bb100236f591de1515146sewardj quiet = argc > 1; 27622fe49b55cb60d6132bb100236f591de1515146sewardj 28622fe49b55cb60d6132bb100236f591de1515146sewardj s_mem = malloc(10); 29622fe49b55cb60d6132bb100236f591de1515146sewardj if (0 && !quiet) 30622fe49b55cb60d6132bb100236f591de1515146sewardj fprintf(stderr, "Pointer to allocated memory: %p\n", s_mem); 31622fe49b55cb60d6132bb100236f591de1515146sewardj assert(s_mem); 32622fe49b55cb60d6132bb100236f591de1515146sewardj pthread_create(&tid, NULL, thread_func, NULL); 33622fe49b55cb60d6132bb100236f591de1515146sewardj 34622fe49b55cb60d6132bb100236f591de1515146sewardj /* Write, which isn't coordinated with the free ==> a race 35622fe49b55cb60d6132bb100236f591de1515146sewardj should be reported. */ 36622fe49b55cb60d6132bb100236f591de1515146sewardj char c = s_mem[5]; 37622fe49b55cb60d6132bb100236f591de1515146sewardj __asm__ __volatile__("" : : "r"((long)c) ); 38622fe49b55cb60d6132bb100236f591de1515146sewardj 39622fe49b55cb60d6132bb100236f591de1515146sewardj pthread_join(tid, NULL); 40622fe49b55cb60d6132bb100236f591de1515146sewardj fprintf(stderr, "Done.\n"); 41622fe49b55cb60d6132bb100236f591de1515146sewardj return 0; 42622fe49b55cb60d6132bb100236f591de1515146sewardj} 43