test/malloc: Add a test for double-free when using mallocstabilize-15415.B-main

BRANCH=none
BUG=b:274737509
TEST=Add RUN_TEST(test_malloc_double_free) to run_test
     ./test/run_device_tests.py --board bloonchipper -t malloc
     => PASS
TEST=Add RUN_TEST(test_malloc_double_free) to run_test
     ./test/run_device_tests.py --board dartmonkey -t malloc
     => PASS
TEST=Add RUN_TEST(test_malloc_double_free) to run_test
     make run-malloc

Change-Id: I1695d3b5cbf5d29bbaf35aaddcea76be51de53f7
Signed-off-by: Tom Hughes <tomhughes@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/4406092
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>

1 files changed, 25 insertions, 0 deletions

diff --git a/test/malloc.c b/test/malloc.c
index 37c566b2ec..0a498acb82 100644
--- a/test/malloc.c
+++ b/test/malloc.c
@@ -79,6 +79,31 @@ test_static int test_malloc_too_large(void)
 	return EC_SUCCESS;
 }
 
+/**
+ * Useful for manually testing the behavior of double frees.
+ *
+ * For example, if you compile the malloc implementation provided by newlib
+ * with the patch in https://crrev.com/c/4406822, you'll get something like:
+ *
+ * assertion "inuse(p)" failed: file "newlib/libc/stdlib/mallocr.c",
+ * line 1841, function: do_check_inuse_chunk
+ * _exit called with rc: 1
+ *
+ * If you run the host tests you'll get something like:
+ *
+ * free(): double free detected in tcache 2
+ * Aborted
+ */
+test_static int test_malloc_double_free(void)
+{
+	uint8_t *volatile ptr = malloc(10);
+	TEST_NE(ptr, NULL, "%p");
+	free(ptr);
+	free(ptr);
+
+	return EC_SUCCESS;
+}
+
 void run_test(int argc, const char **argv)
 {
 	test_reset();