glibc提供的malloc()的调试工具【转】
转自：https://www.cnblogs.com/arnoldlu/p/10827884.html
关键词：MALLOC_CHECK_、mtrace()、muntrace()、MALLOC_TRACE、mprobe()、-lmcheck等等。
1. MALLOC_CHECK_环境变量(double free)
MALLOC_CHECK_提供了类似于mcheck()和mprobe()函数的功能，但是无需对程序进行修改和重新编译。
设置不同整数值可以控制程序对内存分配错误的响应方式。
0 - 不产生错误信息，也不中止这个程序
1 - 产生错误信息，但是不中止这个程序
2 - 不产生错误信息，但是中止这个程序
3 - 产生错误信息，并中止这个程序
下面构造一个double free的错误程序验证一下：
#include#include void main(void) { char *s = NULL; s = malloc(32); free(s); free(s); }
env MALLOC_CHECK_=0 ./dfree的效果类似于直接执行./dfree。
env MALLOC_CHECK_=1 ./dfree产生如下的错误信息：
*** Error in `./dfree': free(): invalid pointer: 0x0000000000e22010 ***
env MALLOC_CHECK_=2 ./dfree简单的终止程序，生成coredump文件。
Aborted (core dumped)
通过分析core文件，然后bt full查看backtrace：
(gdb) bt full
#0 0x00007fb4cd69c428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
resultvar = 0
pid = 3415
selftid = 3415
#1 0x00007fb4cd69e02a in __GI_abort () at abort.c:89
save_stage = 2
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 , 1095216660480, 0}}, sa_flags = 0, sa_restorer = 0x0}
sigs = {__val = {32, 0 }}
#2 0x00007fb4cd6e6430 in malloc_printerr (ar_ptr=, ptr=, str=, action=) at malloc.c:5010
No locals.
#3 free_check (mem=, caller=) at hooks.c:314
No locals.
#4 0x00007fb4cd6eb5e7 in __GI___libc_free (mem=) at malloc.c:2942
ar_ptr =
p =
hook =
#5 0x000000000040059c in main ()
No symbol table info available.
env MALLOC_CHECK_=3 ./dfree显示更多的信息并且coredump。
*** Error in `./dfree': free(): invalid pointer: 0x0000000000aa0010 *** ======= Backtrace: =========--------------------------------------------------------------------问题点的backtrace。 /lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f640d3447e5] /lib/x86_64-linux-gnu/libc.so.6(+0x7f72a)[0x7f640d34c72a] /lib/x86_64-linux-gnu/libc.so.6(cfree+0xf7)[0x7f640d3515e7] ./dfree[0x40059c] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f640d2ed830] ./dfree[0x400499] ======= Memory map: ========---------------------------------------------------------------------当前进程的maps。 00400000-00401000 r-xp 00000000 08:11 33178794 /home/al/test/dfree 00600000-00601000 r--p 00000000 08:11 33178794 /home/al/test/dfree 00601000-00602000 rw-p 00001000 08:11 33178794 /home/al/test/dfree 00aa0000-00ac1000 rw-p 00000000 00:00 0 [heap] 7f640d0b7000-7f640d0cd000 r-xp 00000000 08:02 4199205 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f640d0cd000-7f640d2cc000 ---p 00016000 08:02 4199205 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f640d2cc000-7f640d2cd000 rw-p 00015000 08:02 4199205 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f640d2cd000-7f640d48d000 r-xp 00000000 08:02 4199167 /lib/x86_64-linux-gnu/libc-2.23.so 7f640d48d000-7f640d68d000 ---p 001c0000 08:02 4199167 /lib/x86_64-linux-gnu/libc-2.23.so 7f640d68d000-7f640d691000 r--p 001c0000 08:02 4199167 /lib/x86_64-linux-gnu/libc-2.23.so 7f640d691000-7f640d693000 rw-p 001c4000 08:02 4199167 /lib/x86_64-linux-gnu/libc-2.23.so 7f640d693000-7f640d697000 rw-p 00000000 00:00 0 7f640d697000-7f640d6bd000 r-xp 00000000 08:02 4199139 /lib/x86_64-linux-gnu/ld-2.23.so 7f640d890000-7f640d893000 rw-p 00000000 00:00 0 7f640d8bb000-7f640d8bc000 rw-p 00000000 00:00 0 7f640d8bc000-7f640d8bd000 r--p 00025000 08:02 4199139 /lib/x86_64-linux-gnu/ld-2.23.so 7f640d8bd000-7f640d8be000 rw-p 00026000 08:02 4199139 /lib/x86_64-linux-gnu/ld-2.23.so 7f640d8be000-7f640d8bf000 rw-p 00000000 00:00 0 7ffc0fb27000-7ffc0fb49000 rw-p 00000000 00:00 0 [stack] 7ffc0fbb2000-7ffc0fbb5000 r--p 00000000 00:00 0 [vvar] 7ffc0fbb5000-7ffc0fbb7000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] Aborted (core dumped)
下面是详细的栈信息：
#0 0x00007f640d302428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
resultvar = 0
pid = 3542
selftid = 3542
#1 0x00007f640d30402a in __GI_abort () at abort.c:89
save_stage = 2
act = {__sigaction_handler = {sa_handler = 0x2070782d72203030, sa_sigaction = 0x2070782d72203030}, sa_mask = {__val = {3472328296227680304, 3467824696768081952, 2314885530818453536, 2314885530818453536,
7166204968890474528, 3544385727815773281, 4048771456345059427, 4123381033782620218, 2314885530819966513, 2314885530818453536, 3395749441387372576, 6860733171187738988, 8679965255892022326, 7091318039360988973,
8299627453906824547, 7219327610922666607}}, sa_flags = 808532278, sa_restorer = 0x48}
sigs = {__val = {32, 0 }}
#2 0x00007f640d3447ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f640d45ded8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
ap =
fd = 3
on_2 =
list =
nlist =
cp =
written =
#3 0x00007f640d34c72a in malloc_printerr (ar_ptr=0x7f640d691b20 , ptr=, str=0x7f640d45acaf "free(): invalid pointer", action=) at malloc.c:5006
buf = "0000000000aa0010"
cp =
ar_ptr = 0x7f640d691b20
ptr =
str = 0x7f640d45acaf "free(): invalid pointer"
action =
#4 free_check (mem=, caller=) at hooks.c:314
No locals.
#5 0x00007f640d3515e7 in __GI___libc_free (mem=) at malloc.c:2942
ar_ptr =
p =
hook =
#6 0x000000000040059c in main ()
No symbol table info available.
3.2.4.4 Interpreting the traces》。
- 0x000000000002ba00 Realloc 1109 was never alloc'd 0x2af654bc
(-表示释放) (free对应内存地址) Realloc (在log中行号) was never alloc'd (free释放点)
(-表示释放) (free对应内存地址) Realloc (在log中行号) was never alloc'd (free释放点)
realloc()首先释放然后重新申请内存，表示在realloc()释放内存的时候没有找到对应的alloc()。
+ 0x000000000006ea48 Alloc 17136 duplicate: 0x2b2ef800 /lib/libstdc++.so.6:(_Znwj+0x24)[0x2b2ef800]
(+表示alloc()) (alloc()内存地址) Alloc (在log中行号) duplicate: (alloc()调用点)
表示两次alloc两次，申请的内存地址是一样的。前一次alloc()到本次alloc()之间没有free。
3. mcheck()检查内存一致性(重复释放、越界)
mcheck()函数允许程序对已分配内存块进行一致性检查。
3.1 mcheck()介绍
#includeint mcheck(void (*abortfunc)(enum mcheck_status mstatus));
调用该函数后，后续内存分配、释放都将进行内存连续性检查，并在内存连续性检查失败后，调用abortfunc。
枚举体mcheck_status如下：
enum mcheck_status
{
MCHECK_DISABLED = -1, /* Consistency checking is not turned on. */
MCHECK_OK, /* Block is fine. */
MCHECK_FREE, /* Block freed twice. */
MCHECK_HEAD, /* Memory before the block was clobbered. */
MCHECK_TAIL /* Memory after the block was clobbered. */
};
3.2 mcheck()实例
下例创建捕获错误函数abortfun()，三种你错误类型：重复释放、头覆盖、尾覆盖。
#include#include #include #include #include void abortfun(enum mcheck_status mstatus) { if(mstatus == MCHECK_FREE) fprintf(stderr, "Block freed twice.\n"); else if(mstatus == MCHECK_HEAD) fprintf(stderr, "Memory before the block was clobbered.\n"); else if(mstatus == MCHECK_TAIL) fprintf(stderr, "Memory after the block was clobbered.\n"); else fprintf(stderr, "Block is fine.\n"); } void main(void) { char *s = NULL; if(mcheck(abortfun) != 0) { fprintf(stderr, "mcheck:%s\n", strerror(errno)); return; } s = malloc(32); *(s-1) = 3;--------------------------头覆盖。 *(s+32) = 3;-------------------------尾覆盖。 free(s); free(s);-----------------------------重复释放。 }
执行后结果如下，捕获到了尾覆盖和重复释放，头覆盖没有捕获到；但是单独头覆盖是可以捕获到的。
并且产生了coredump文件。
Memory after the block was clobbered. Block freed twice. *** Error in `./dfree': double free or corruption (fasttop): 0x0000000000957030 *** ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fc2eac267e5] /lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7fc2eac2f37a] /lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7fc2eac3353c] /lib/x86_64-linux-gnu/libc.so.6(+0x87fa0)[0x7fc2eac36fa0] /lib/x86_64-linux-gnu/libc.so.6(cfree+0xf7)[0x7fc2eac335e7] ./dfree[0x40084a] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fc2eabcf830] ./dfree[0x400659] ======= Memory map: ======== 00400000-00401000 r-xp 00000000 08:11 33173251 /home/al/test/dfree 00600000-00601000 r--p 00000000 08:11 33173251 /home/al/test/dfree 00601000-00602000 rw-p 00001000 08:11 33173251 /home/al/test/dfree 00957000-00978000 rw-p 00000000 00:00 0 [heap] 7fc2e4000000-7fc2e4021000 rw-p 00000000 00:00 0 7fc2e4021000-7fc2e8000000 ---p 00000000 00:00 0 7fc2ea999000-7fc2ea9af000 r-xp 00000000 08:02 4199205 /lib/x86_64-linux-gnu/libgcc_s.so.1 7fc2ea9af000-7fc2eabae000 ---p 00016000 08:02 4199205 /lib/x86_64-linux-gnu/libgcc_s.so.1 7fc2eabae000-7fc2eabaf000 rw-p 00015000 08:02 4199205 /lib/x86_64-linux-gnu/libgcc_s.so.1 7fc2eabaf000-7fc2ead6f000 r-xp 00000000 08:02 4199167 /lib/x86_64-linux-gnu/libc-2.23.so 7fc2ead6f000-7fc2eaf6f000 ---p 001c0000 08:02 4199167 /lib/x86_64-linux-gnu/libc-2.23.so 7fc2eaf6f000-7fc2eaf73000 r--p 001c0000 08:02 4199167 /lib/x86_64-linux-gnu/libc-2.23.so 7fc2eaf73000-7fc2eaf75000 rw-p 001c4000 08:02 4199167 /lib/x86_64-linux-gnu/libc-2.23.so 7fc2eaf75000-7fc2eaf79000 rw-p 00000000 00:00 0 7fc2eaf79000-7fc2eaf9f000 r-xp 00000000 08:02 4199139 /lib/x86_64-linux-gnu/ld-2.23.so 7fc2eb172000-7fc2eb175000 rw-p 00000000 00:00 0 7fc2eb19d000-7fc2eb19e000 rw-p 00000000 00:00 0 7fc2eb19e000-7fc2eb19f000 r--p 00025000 08:02 4199139 /lib/x86_64-linux-gnu/ld-2.23.so 7fc2eb19f000-7fc2eb1a0000 rw-p 00026000 08:02 4199139 /lib/x86_64-linux-gnu/ld-2.23.so 7fc2eb1a0000-7fc2eb1a1000 rw-p 00000000 00:00 0 7ffcc5840000-7ffcc5862000 rw-p 00000000 00:00 0 [stack] 7ffcc58df000-7ffcc58e2000 r--p 00000000 00:00 0 [vvar] 7ffcc58e2000-7ffcc58e4000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] Aborted (core dumped)
4. mprobe()
函数格式介绍：
#includeenum mcheck_status mprobe(void *ptr);
mprobe()示例：
#include#include #include #include #include void abortfun(enum mcheck_status mstatus) { if(mstatus == MCHECK_FREE) fprintf(stderr, "Block freed twice.\n"); else if(mstatus == MCHECK_HEAD) fprintf(stderr, "Memory before the block was clobbered.\n"); else if(mstatus == MCHECK_TAIL) fprintf(stderr, "Memory after the block was clobbered.\n"); else fprintf(stderr, "Block is fine.\n"); } void main(void) { char *s = NULL; if(mcheck(abortfun) != 0) { fprintf(stderr, "mcheck:%s\n", strerror(errno)); return; } s = malloc(32); mprobe(s);------------------------------正确 mprobe(s-1);----------------------------错误，返回MCHECK_HEAD错误类型。 mprobe(s+32);---------------------------错误，返回MCHECK_HEAD错误类型。 free(s); }
返回结果：
Memory before the block was clobbered. Memory before the block was clobbered.
5. -lmcheck自动开启检查
在编译的时候加上-lmcheck，不需要修改代码就可以对malloc()/free()进行检查。
#include#include void main(void) { char *s = NULL; s = malloc(32); free(s); free(s); }
gcc dfree.c -o dfree -lmcheck编译后，执行./dfree。
block freed twice Aborted (core dumped)
查看coredump bt full如下：
#0 0x00007fdf1e826428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
resultvar = 0
pid = 5719
selftid = 5719
#1 0x00007fdf1e82802a in __GI_abort () at abort.c:89
save_stage = 2
act = {__sigaction_handler = {sa_handler = 0x3065383363666637, sa_sigaction = 0x3065383363666637}, sa_mask = {__val = {8659703141076316208, 3472328296227676272, 3472339291342909488, 2314885530818457632,
2314885530818453536, 2314885530818453536, 8314900945785856032, 7378697629477789039, 3472335126135203430, 7378697628523966512, 3474076752553600614, 8659703141076316209, 3472328296227676272, 3472339291342909488,
2314885530818457632, 2314885530818453536}}, sa_flags = 538976288, sa_restorer = 0x54}
sigs = {__val = {32, 0 }}
#2 0x00007fdf1e8687ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fdf1e981ed8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
ap =
fd = 3
on_2 =
list =
nlist =
cp =
written =
#3 0x00007fdf1e87137a in malloc_printerr (ar_ptr=, ptr=, str=0x7fdf1e981fa0 "double free or corruption (fasttop)", action=3) at malloc.c:5006
buf = "000000000186a010"
cp =
ar_ptr =
str = 0x7fdf1e981fa0 "double free or corruption (fasttop)"
action = 3
#4 _int_free (av=, p=, have_lock=0) at malloc.c:3867
size =
fb =
nextchunk =
nextsize =
nextinuse =
prevsize =
bck =
fwd =
errstr =
locked =
#5 0x00007fdf1e87553c in __GI___libc_free (mem=) at malloc.c:2968
ar_ptr =
p =
hook =
#6 0x000000000040059c in register_tm_clones ()
No symbol table info available.
#7 0x00007ffc38dc54c0 in ?? ()
No symbol table info available.
#8 0x000000000186a010 in ?? ()
No symbol table info available.
#9 0x00000000004005a0 in register_tm_clones ()
No symbol table info available.
#10 0x00007fdf1e811830 in __libc_start_main (main=0x400566 , argc=1, argv=0x7ffc38dc54c8, init=, fini=, rtld_fini=, stack_end=0x7ffc38dc54b8)
at ../csu/libc-start.c:291
result =
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 4770583698588052314, 4195440, 140721262449856, 0, 0, -4770167831151236262, -4788811728122270886}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x400610 ,
0x7fdf1ebcbab0 <_dl_fini>}, data = {prev = 0x0, cleanup = 0x0, canceltype = 4195856}}}
not_first_call =
#11 0x0000000000400499 in ?? ()
No symbol table info available.
#12 0x00007ffc38dc54b8 in ?? ()
No symbol table info available.
#13 0x000000000000001c in ?? ()
No symbol table info available.
#14 0x0000000000000001 in ?? ()
No symbol table info available.
#15 0x00007ffc38dc5fba in ?? ()
No symbol table info available.
#16 0x0000000000000000 in ?? ()
No symbol table info available.
6. 小结
对比以上几个内存你检查手段：MALLOC_CHECK_最简单，其次是-lmcheck，最后是mtrace()/muntrace()、mcheck()、mprobe()。
但是这几种技术检查的全面性都不够，没有一种能够全面检查内存泄漏、内存踩踏、重复释放的。
要想全面的检查还是需要Valgrind这种技术，参考《valgrind使用方法》。
参考文档：《mtrace-内存使用追踪（内存）》、《mcheck 函数使用（glibc-3-内存）》
联系方式:arnoldlu@qq.com