C++程序常碰到内存double free引起程序崩溃的问题，有时候通过分析代码来发现造成内存重复释放的地方是比较困难的。幸好通过systemtap我们可以轻松地找到造成内存重复释放的地方，下面通过一个简单的例子来说明检测方法。
systemtap检测内存double free代码
//doubleFreeCheck.stp
global ptr2bt
global ptr2count
probe begin {
warn("Start tracing. Wait for 10 sec to complete.n")
}
probe process("/usr/lib64/libc.so.6").function("__libc_malloc").return {
if (pid() == target()) {
//printf("malloc: %p (bytes %d)n", $return, $bytes)
ptr = $return
if(ptr != 0) {
ptr2count[ptr] = 1
}
}
}
probe process("/usr/lib64/libc.so.6").function("__libc_free") {
if (pid() == target()) {
//printf("free: %pn", $mem)
ptr = $mem
if(ptr != 0) {
bt = ptr2bt[ptr]
if(ptr2count[ptr] == 0) {
printf("double free detected!n");
printf("===================current free stack================================n")
print_ustack(ubacktrace())
printf("=====================================================================n")
printf("===================previous free stack===============================n")
print_ustack(bt)
printf("=====================================================================n")
} else {
ptr2count[ptr] = 0
bt = ubacktrace()
ptr2bt[ptr] = bt
}
}
}
}
probe end {
delete ptr2bt
delete ptr2count
}
测试demo程序
//g++ -g test.cpp -o test #includechar *p = NULL; void func1(int i) { if(i%3 == 0) p = new char[10]; } void func2(int i) { if(i%3 == 1) delete[] p; } void func3(int i) { if(i%10 == 0) delete[] p; } int main() { for(int i=0;i<60;i++) { func1(i); func2(i); func3(i); sleep(1); } return 0; }
测试命令：stap -d /home/dongsongz/debug/stap/doubleFree/test -d /usr/lib64/libstdc++.so.6.0.19 ./doubleFreeCheck.stp -c ./test
测试结果如下，可见首次内存释放在于func3，再次释放在func2，发生了double free引起程序崩溃。
stap -d /home/dongsongz/debug/stap/doubleFree/test -d /usr/lib64/libstdc++.so.6.0.19 ./doubleFreeCheck.stp -c ./test WARNING: Start tracing. Wait for 10 sec to complete. *** Error in `./test': double free or corruption (fasttop): 0x00000000023d0010 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x81329)[0x7fd67fb45329] ./test[0x4006a4] ./test[0x40071a] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7fd67fae6555] ./test[0x400559] ======= Memory map: ======== 00400000-00401000 r-xp 00000000 fd:00 20827024 /home/dongsongz/debug/stap/doubleFree/test 00600000-00601000 r--p 00000000 fd:00 20827024 /home/dongsongz/debug/stap/doubleFree/test 00601000-00602000 rw-p 00001000 fd:00 20827024 /home/dongsongz/debug/stap/doubleFree/test 023d0000-023f1000 rw-p 00000000 00:00 0 [heap] 7fd678000000-7fd678021000 rw-p 00000000 00:00 0 7fd678021000-7fd67c000000 ---p 00000000 00:00 0 7fd67fac4000-7fd67fc88000 r-xp 00000000 fd:00 355066 /usr/lib64/libc-2.17.so 7fd67fc88000-7fd67fe87000 ---p 001c4000 fd:00 355066 /usr/lib64/libc-2.17.so 7fd67fe87000-7fd67fe8b000 r--p 001c3000 fd:00 355066 /usr/lib64/libc-2.17.so 7fd67fe8b000-7fd67fe8d000 rw-p 001c7000 fd:00 355066 /usr/lib64/libc-2.17.so 7fd67fe8d000-7fd67fe92000 rw-p 00000000 00:00 0 7fd67fe92000-7fd67fea7000 r-xp 00000000 fd:00 85 /usr/lib64/libgcc_s-4.8.5-20150702.so.1 7fd67fea7000-7fd6800a6000 ---p 00015000 fd:00 85 /usr/lib64/libgcc_s-4.8.5-20150702.so.1 7fd6800a6000-7fd6800a7000 r--p 00014000 fd:00 85 /usr/lib64/libgcc_s-4.8.5-20150702.so.1 7fd6800a7000-7fd6800a8000 rw-p 00015000 fd:00 85 /usr/lib64/libgcc_s-4.8.5-20150702.so.1 7fd6800a8000-7fd6801a9000 r-xp 00000000 fd:00 355074 /usr/lib64/libm-2.17.so 7fd6801a9000-7fd6803a8000 ---p 00101000 fd:00 355074 /usr/lib64/libm-2.17.so 7fd6803a8000-7fd6803a9000 r--p 00100000 fd:00 355074 /usr/lib64/libm-2.17.so 7fd6803a9000-7fd6803aa000 rw-p 00101000 fd:00 355074 /usr/lib64/libm-2.17.so 7fd6803aa000-7fd680493000 r-xp 00000000 fd:00 355165 /usr/lib64/libstdc++.so.6.0.19 7fd680493000-7fd680693000 ---p 000e9000 fd:00 355165 /usr/lib64/libstdc++.so.6.0.19 7fd680693000-7fd68069b000 r--p 000e9000 fd:00 355165 /usr/lib64/libstdc++.so.6.0.19 7fd68069b000-7fd68069d000 rw-p 000f1000 fd:00 355165 /usr/lib64/libstdc++.so.6.0.19 7fd68069d000-7fd6806b2000 rw-p 00000000 00:00 0 7fd6806b2000-7fd6806d4000 r-xp 00000000 fd:00 355059 /usr/lib64/ld-2.17.so 7fd6808b7000-7fd6808bc000 rw-p 00000000 00:00 0 7fd6808d1000-7fd6808d3000 rw-p 00000000 00:00 0 7fd6808d3000-7fd6808d4000 r--p 00021000 fd:00 355059 /usr/lib64/ld-2.17.so 7fd6808d4000-7fd6808d5000 rw-p 00022000 fd:00 355059 /usr/lib64/ld-2.17.so 7fd6808d5000-7fd6808d6000 rw-p 00000000 00:00 0 7ffc8ca6a000-7ffc8ca8b000 rw-p 00000000 00:00 0 [stack] 7ffc8cb76000-7ffc8cb78000 r-xp 00000000 00:00 0 [vdso] 7fffffffe000-7ffffffff000 --xp 00000000 00:00 0 ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] WARNING: Child process exited with signal 6 (Aborted) double free detected! ===================current free stack================================ 0x7fd67fb49b60 : free+0x0/0xe0 [/usr/lib64/libc-2.17.so] 0x4006a4 : _Z5func2i+0x48/0x4a [/home/dongsongz/debug/stap/doubleFree/test] 0x40071a : main+0x25/0x4b [/home/dongsongz/debug/stap/doubleFree/test] 0x7fd67fae6555 : __libc_start_main+0xf5/0x1c0 [/usr/lib64/libc-2.17.so] 0x400559 : _start+0x29/0x30 [/home/dongsongz/debug/stap/doubleFree/test] ===================================================================== ===================previous free stack=============================== 0x7fd67fb49b60 : free+0x0/0xe0 [/usr/lib64/libc-2.17.so] 0x4006f3 : _Z5func3i+0x4d/0x4f [/home/dongsongz/debug/stap/doubleFree/test] 0x400724 : main+0x2f/0x4b [/home/dongsongz/debug/stap/doubleFree/test] 0x7fd67fae6555 : __libc_start_main+0xf5/0x1c0 [/usr/lib64/libc-2.17.so] 0x400559 : _start+0x29/0x30 [/home/dongsongz/debug/stap/doubleFree/test] ===================================================================== WARNING: /usr/bin/staprun exited with status: 1 Pass 5: run failed. [man error::pass5]
