没有合适的资源?快使用搜索试试~ 我知道了~
__lll_mutex_lock_wait的错误原因
需积分: 50 10 下载量 11 浏览量
2018-09-10
10:44:17
上传
评论
收藏 239KB PDF 举报
温馨提示
试读
34页
(gdb) bt #0 0x00002b9405ea1c38 in __lll_mutex_lock_wait () from /lib64/libc.so.6 #1 0x00002b9405e45e5f in _L_lock_4026 () from /lib64/libc.so.6 #2 0x00002b9405e42df1 in free () from /lib64/libc.so.6 #3 0x00002b9405e5b148 in tzset_internal () from /lib64/libc.so.6 #4 0x00002b9405e5b9d0 in tzset () from /lib64/libc.so.6 #5 0x00002b9405e5fe44 in strftime_l () from /lib64/libc.so.6 #6 0x00002b9405e93701 in __vsyslog_chk () from /lib64/libc.so.6 #7 0x00002b9405e3c6d0 in __libc_message () from /lib64/libc.so.6 #8 0x00002b9405e4177e in malloc_printerr () from /lib64/libc.so.6 #9 0x00002b9405e42dfc in free () from /lib64/libc.so.6 #10 0x00000000004007c9 in main (argc=1, argv=0x7fffa524f4d8) at x.cpp:17
资源推荐
资源详情
资源评论
__lll_mutex_lock_wait 的错误原因
一见 2015/10/8
1. x86_64 栈(glib 2.4):
free 时:
(gdb) bt
#0 0x00002b9405ea1c38 in __lll_mutex_lock_wait () from /lib64/libc.so.6
#1 0x00002b9405e45e5f in _L_lock_4026 () from /lib64/libc.so.6
#2 0x00002b9405e42df1 in free () from /lib64/libc.so.6
#3 0x00002b9405e5b148 in tzset_internal () from /lib64/libc.so.6
#4 0x00002b9405e5b9d0 in tzset () from /lib64/libc.so.6
#5 0x00002b9405e5fe44 in strftime_l () from /lib64/libc.so.6
#6 0x00002b9405e93701 in __vsyslog_chk () from /lib64/libc.so.6
#7 0x00002b9405e3c6d0 in __libc_message () from /lib64/libc.so.6
#8 0x00002b9405e4177e in malloc_printerr () from /lib64/libc.so.6
#9 0x00002b9405e42dfc in free () from /lib64/libc.so.6
#10 0x00000000004007c9 in main (argc=1, argv=0x7fffa524f4d8) at x.cpp:17
malloc 时:
#0 0x00002afca8597c38 in __lll_mutex_lock_wait () from /lib64/libc.so.6
#1 0x00002afca853be5f in _L_lock_4026 () from /lib64/libc.so.6
#2 0x00002afca8538df1 in free () from /lib64/libc.so.6
#3 0x00002afca8551148 in tzset_internal () from /lib64/libc.so.6
#4 0x00002afca85519d0 in tzset () from /lib64/libc.so.6
#5 0x00002afca8555e44 in strftime_l () from /lib64/libc.so.6
#6 0x00002afca8589701 in __vsyslog_chk () from /lib64/libc.so.6
#7 0x00002afca85326d0 in __libc_message () from /lib64/libc.so.6
#8 0x00002afca853777e in malloc_printerr () from /lib64/libc.so.6
#9 0x00002afca8539774 in _int_malloc () from /lib64/libc.so.6
#10 0x00002afca853b1b6 in malloc () from /lib64/libc.so.6
#11 0x00002afca8125fcd in operator new () from /usr/lib64/libstdc++.so.6
2. x86 栈(glib 2.4):
(gdb) bt
#0 0xbfffe402 in __kernel_vsyscall ()
#1 0xb7e4a18e in __lll_mutex_lock_wait () from /lib/libc.so.6
#2 0xb7de8d81 in _L_mutex_lock_4119 () from /lib/libc.so.6
#3 0xb7e8d509 in __PRETTY_FUNCTION__.7757 () from /lib/libc.so.6
#4 0x00000000 in ?? ()
3. 测试代码 1(两次 free):
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
int main()
{
setenv("LIBC_FATAL_STDERR_", "1", 1);
close(STDERR_FILENO);
time_t now = time(NULL);
struct tm* current = localtime(&now);
char* str = (char*)malloc(100);
free(str);
free(str);
return 0;
}
4. 测试代码 2(越界写):
运行下面的代码,即可重现上面的__lll_mutex_lock_wait()问题:
1 // g++ -g -o x x.cpp
2 include <stdlib.h>
3 #include <unistd.h>
4 #include <time.h>
5
6 int main(int argc, char** argv)
7 {
8 setenv("LIBC_FATAL_STDERR_", "1", 1); // 让__libc_message()写 stderr
9 close(STDERR_FILENO); // 让__libc_message()将出错写到系统日志
10
11 time_t now = time(NULL);
12 struct tm* t = localtime(&now);
13
14 char *p1 = new char[1024];
15 char *p2 = new char[4096];
16
17 p1[1024 + sizeof(size_t)] = 1; // 破坏 p2 的 malloc_chunk 的 size 成员
18 delete []p2;
19 delete []p1;
20 return 0;
21 }
当将上述代码中的“close(STDERR_FILENO)”注释掉后,亦即出错信息写标准输出:
// g++ -g -o b b.cpp
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
int main(int argc, char** argv)
{
setenv("LIBC_FATAL_STDERR_", "1", 1);
// close(STDERR_FILENO);
time_t now = time(NULL);
struct tm* current = localtime(&now);
char *p1 = new char[1024];
char *p2 = new char[4096];
p1[1024 + sizeof(size_t)] = 1;
delete []p2;
delete []p1;
return 0;
}
则看到的运行结果为:
*** glibc detected *** ./b: double free or corruption (!prev): 0x00000000005015a0 ***
======= Backtrace: =========
/lib64/libc.so.6[0x2acfbb87d77e]
/lib64/libc.so.6(__libc_free+0x6c)[0x2acfbb87edfc]
./b(__gxx_personality_v0+0x13f)[0x40076f]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x2acfbb82f304]
./b(__gxx_personality_v0+0x39)[0x400669]
======= Memory map: ========
00400000-00401000 r-xp 00000000 08:01 1261572 /tmp/X/b
00500000-00501000 rw-p 00000000 08:01 1261572 /tmp/X/b
00501000-00522000 rw-p 00501000 00:00 0 [heap]
2acfbb295000-2acfbb2b0000 r-xp 00000000 08:01 229419 /lib64/ld-2.4.so
2acfbb2b0000-2acfbb2b1000 rw-p 2acfbb2b0000 00:00 0
2acfbb2bf000-2acfbb2c0000 rw-p 2acfbb2bf000 00:00 0
2acfbb3af000-2acfbb3b1000 rw-p 0001a000 08:01 229419 /lib64/ld-2.4.so
2acfbb3b1000-2acfbb494000 r-xp 00000000 08:01 529172
/usr/lib64/libstdc++.so.6.0.8
2acfbb494000-2acfbb594000 ---p 000e3000 08:01 529172
/usr/lib64/libstdc++.so.6.0.8
2acfbb594000-2acfbb59a000 r--p 000e3000 08:01 529172
/usr/lib64/libstdc++.so.6.0.8
2acfbb59a000-2acfbb59d000 rw-p 000e9000 08:01 529172
/usr/lib64/libstdc++.so.6.0.8
2acfbb59d000-2acfbb5af000 rw-p 2acfbb59d000 00:00 0
2acfbb5af000-2acfbb603000 r-xp 00000000 08:01 229463 /lib64/libm-2.4.so
2acfbb603000-2acfbb702000 ---p 00054000 08:01 229463 /lib64/libm-2.4.so
2acfbb702000-2acfbb704000 rw-p 00053000 08:01 229463 /lib64/libm-2.4.so
2acfbb704000-2acfbb711000 r-xp 00000000 08:01 229456 /lib64/libgcc_s.so.1
2acfbb711000-2acfbb810000 ---p 0000d000 08:01 229456 /lib64/libgcc_s.so.1
2acfbb810000-2acfbb811000 rw-p 0000c000 08:01 229456 /lib64/libgcc_s.so.1
2acfbb811000-2acfbb812000 rw-p 2acfbb811000 00:00 0
2acfbb812000-2acfbb948000 r-xp 00000000 08:01 229436 /lib64/libc-2.4.so
2acfbb948000-2acfbba48000 ---p 00136000 08:01 229436 /lib64/libc-2.4.so
2acfbba48000-2acfbba4b000 r--p 00136000 08:01 229436 /lib64/libc-2.4.so
2acfbba4b000-2acfbba4d000 rw-p 00139000 08:01 229436 /lib64/libc-2.4.so
2acfbba4d000-2acfbba53000 rw-p 2acfbba4d000 00:00 0
2acfbbb00000-2acfbbb21000 rw-p 2acfbbb00000 00:00 0
2acfbbb21000-2acfbbc00000 ---p 2acfbbb21000 00:00 0
7fffef800000-7fffef815000 rw-p 7fffef800000 00:00 0 [stack]
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vdso]
Aborted (core dumped)
并会产生 core 文件:
(gdb) bt
#0 0x00002abaa26ddf45 in raise () from /lib64/libc.so.6
#1 0x00002abaa26df340 in abort () from /lib64/libc.so.6
#2 0x00002abaa271478b in __libc_message () from /lib64/libc.so.6
#3 0x00002abaa271977e in malloc_printerr () from /lib64/libc.so.6
#4 0x00002abaa271adfc in free () from /lib64/libc.so.6
#5 0x000000000040076f in main (argc=1, argv=0x7fff08975c28) at b.cpp:18
如果将上面代码中的“delete [] p1;”和“delete [] p2;”先后顺序对调一下:
// g++ -g -o b b.cpp
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
int main(int argc, char** argv)
{
setenv("LIBC_FATAL_STDERR_", "1", 1);
//close(STDERR_FILENO);
time_t now = time(NULL);
struct tm* current = localtime(&now);
char *p1 = new char[1024];
char *p2 = new char[4096];
p1[1024 + sizeof(size_t)] = 1;
delete []p1; // core 在这
delete []p2;
return 0;
}
则运行时 core:
(gdb) bt
#0 0x00002b6e669df99e in _int_free () from /lib64/libc.so.6
#1 0x00002b6e669dfdfc in free () from /lib64/libc.so.6
#2 0x000000000040076f in main (argc=1, argv=0x7fff446b0938) at d.cpp:18
如果将代码改成如下(不调用 time 相关函数):
// g++ -g -o b b.cpp
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
int main(int argc, char** argv)
{
setenv("LIBC_FATAL_STDERR_", "1", 1);
close(STDERR_FILENO);
//time_t now = time(NULL);
//struct tm* current = localtime(&now);
char *p1 = new char[1024];
char *p2 = new char[4096];
p1[1024 + sizeof(size_t)] = 1;
delete [] p2;
delete [] p1;
剩余33页未读,继续阅读
资源评论
一见
- 粉丝: 382
- 资源: 53
上传资源 快速赚钱
- 我的内容管理 展开
- 我的资源 快来上传第一个资源
- 我的收益 登录查看自己的收益
- 我的积分 登录查看自己的积分
- 我的C币 登录后查看C币余额
- 我的收藏
- 我的下载
- 下载帮助
安全验证
文档复制为VIP权益,开通VIP直接复制
信息提交成功