Linux系统C++调试利器systemtap定位内存double free

C++程序常碰到内存double free引起程序崩溃的问题，有时候通过分析代码来发现造成内存重复释放的地方是比较困难的。幸好通过systemtap我们可以轻松地找到造成内存重复释放的地方，下面通过一个简单的例子来说明检测方法。

systemtap检测内存double free代码

//doubleFreeCheck.stp
global ptr2bt
global ptr2count

probe begin {
    warn("Start tracing. Wait for 10 sec to complete.\n")
}

probe process("/usr/lib64/libc.so.6").function("__libc_malloc").return {
    if (pid() == target()) {
		//printf("malloc: %p (bytes %d)\n", $return, $bytes)
		ptr = $return
		if(ptr != 0) {
            ptr2count[ptr] = 1
        }
    }
}

probe process("/usr/lib64/libc.so.6").function("__libc_free") {
    if (pid() == target()) {
        //printf("free: %p\n", $mem)
        ptr = $mem

        if(ptr != 0) {
            bt = ptr2bt[ptr]

			if(ptr2count[ptr] == 0) {
				printf("double free detected!\n");
				printf("===================current free stack================================\n")
				print_ustack(ubacktrace())
				printf("=====================================================================\n")
				printf("===================previous free stack===============================\n")
				print_ustack(bt)
				printf("=====================================================================\n")
			} else {
				ptr2count[ptr] = 0
				bt = ubacktrace()
				ptr2bt[ptr] = bt
			}
        }
    }
}

probe end {
	delete ptr2bt
	delete ptr2count
}

测试demo程序

//g++ -g test.cpp -o test

#include <unistd.h>

char *p = NULL;

void func1(int i) {
    if(i%3 == 0)
        p = new char[10];
}

void func2(int i) {
    if(i%3 == 1) delete[] p;
}

void func3(int i) {
    if(i%10 == 0) delete[] p;
} 

int main() {

    for(int i=0;i<60;i++) {
        func1(i);
        func2(i);
        func3(i);
        sleep(1);
    }
    
    return 0;
}

测试命令：stap -d /home/dongsongz/debug/stap/doubleFree/test -d /usr/lib64/libstdc++.so.6.0.19 ./doubleFreeCheck.stp -c ./test

测试结果如下，可见首次内存释放在于func3，再次释放在func2，发生了double free引起程序崩溃。

stap -d /home/dongsongz/debug/stap/doubleFree/test -d /usr/lib64/libstdc++.so.6.0.19 ./doubleFreeCheck.stp -c ./test
WARNING: Start tracing. Wait for 10 sec to complete.
*** Error in `./test': double free or corruption (fasttop): 0x00000000023d0010 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81329)[0x7fd67fb45329]
./test[0x4006a4]
./test[0x40071a]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fd67fae6555]
./test[0x400559]
======= Memory map: ========
00400000-00401000 r-xp 00000000 fd:00 20827024                           /home/dongsongz/debug/stap/doubleFree/test
00600000-00601000 r--p 00000000 fd:00 20827024                           /home/dongsongz/debug/stap/doubleFree/test
00601000-00602000 rw-p 00001000 fd:00 20827024                           /home/dongsongz/debug/stap/doubleFree/test
023d0000-023f1000 rw-p 00000000 00:00 0                                  [heap]
7fd678000000-7fd678021000 rw-p 00000000 00:00 0 
7fd678021000-7fd67c000000 ---p 00000000 00:00 0 
7fd67fac4000-7fd67fc88000 r-xp 00000000 fd:00 355066                     /usr/lib64/libc-2.17.so
7fd67fc88000-7fd67fe87000 ---p 001c4000 fd:00 355066                     /usr/lib64/libc-2.17.so
7fd67fe87000-7fd67fe8b000 r--p 001c3000 fd:00 355066                     /usr/lib64/libc-2.17.so
7fd67fe8b000-7fd67fe8d000 rw-p 001c7000 fd:00 355066                     /usr/lib64/libc-2.17.so
7fd67fe8d000-7fd67fe92000 rw-p 00000000 00:00 0 
7fd67fe92000-7fd67fea7000 r-xp 00000000 fd:00 85                         /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fd67fea7000-7fd6800a6000 ---p 00015000 fd:00 85                         /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fd6800a6000-7fd6800a7000 r--p 00014000 fd:00 85                         /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fd6800a7000-7fd6800a8000 rw-p 00015000 fd:00 85                         /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fd6800a8000-7fd6801a9000 r-xp 00000000 fd:00 355074                     /usr/lib64/libm-2.17.so
7fd6801a9000-7fd6803a8000 ---p 00101000 fd:00 355074                     /usr/lib64/libm-2.17.so
7fd6803a8000-7fd6803a9000 r--p 00100000 fd:00 355074                     /usr/lib64/libm-2.17.so
7fd6803a9000-7fd6803aa000 rw-p 00101000 fd:00 355074                     /usr/lib64/libm-2.17.so
7fd6803aa000-7fd680493000 r-xp 00000000 fd:00 355165                     /usr/lib64/libstdc++.so.6.0.19
7fd680493000-7fd680693000 ---p 000e9000 fd:00 355165                     /usr/lib64/libstdc++.so.6.0.19
7fd680693000-7fd68069b000 r--p 000e9000 fd:00 355165                     /usr/lib64/libstdc++.so.6.0.19
7fd68069b000-7fd68069d000 rw-p 000f1000 fd:00 355165                     /usr/lib64/libstdc++.so.6.0.19
7fd68069d000-7fd6806b2000 rw-p 00000000 00:00 0 
7fd6806b2000-7fd6806d4000 r-xp 00000000 fd:00 355059                     /usr/lib64/ld-2.17.so
7fd6808b7000-7fd6808bc000 rw-p 00000000 00:00 0 
7fd6808d1000-7fd6808d3000 rw-p 00000000 00:00 0 
7fd6808d3000-7fd6808d4000 r--p 00021000 fd:00 355059                     /usr/lib64/ld-2.17.so
7fd6808d4000-7fd6808d5000 rw-p 00022000 fd:00 355059                     /usr/lib64/ld-2.17.so
7fd6808d5000-7fd6808d6000 rw-p 00000000 00:00 0 
7ffc8ca6a000-7ffc8ca8b000 rw-p 00000000 00:00 0                          [stack]
7ffc8cb76000-7ffc8cb78000 r-xp 00000000 00:00 0                          [vdso]
7fffffffe000-7ffffffff000 --xp 00000000 00:00 0 
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
WARNING: Child process exited with signal 6 (Aborted)
double free detected!
===================current free stack================================
 0x7fd67fb49b60 : free+0x0/0xe0 [/usr/lib64/libc-2.17.so]
 0x4006a4 : _Z5func2i+0x48/0x4a [/home/dongsongz/debug/stap/doubleFree/test]
 0x40071a : main+0x25/0x4b [/home/dongsongz/debug/stap/doubleFree/test]
 0x7fd67fae6555 : __libc_start_main+0xf5/0x1c0 [/usr/lib64/libc-2.17.so]
 0x400559 : _start+0x29/0x30 [/home/dongsongz/debug/stap/doubleFree/test]
=====================================================================
===================previous free stack===============================
 0x7fd67fb49b60 : free+0x0/0xe0 [/usr/lib64/libc-2.17.so]
 0x4006f3 : _Z5func3i+0x4d/0x4f [/home/dongsongz/debug/stap/doubleFree/test]
 0x400724 : main+0x2f/0x4b [/home/dongsongz/debug/stap/doubleFree/test]
 0x7fd67fae6555 : __libc_start_main+0xf5/0x1c0 [/usr/lib64/libc-2.17.so]
 0x400559 : _start+0x29/0x30 [/home/dongsongz/debug/stap/doubleFree/test]
=====================================================================
WARNING: /usr/bin/staprun exited with status: 1
Pass 5: run failed.  [man error::pass5]