使用systemTap和objdump查看C++内存泄漏

1、C++程序

#include<stdio.h>
#include<stdlib.h>

void change(int &a){
    int b = 2;
    printf("&b=%p,a=%d\n",&b,a);
    a = b;
    printf("&a = %p, a=%d\n",&a,a);
    char *aaa = new char[100];
    void *p = malloc(10);
}

int main(){
    int a = 1;
    printf("address=%p\n",&a);

    change(a);
    printf("a=%d\n",a);
    return 0;
}

2、systemTap代码

wenjie@wenjie-Virtual-Machine:~/code$ cat memory.stp 
probe begin {
    printf("=============begin============\n")
}
 
global g_mem_ref_tbl
global g_mem_bt_tbl
 
probe process("/lib/x86_64-linux-gnu/libc.so.6").function("__libc_calloc").return, process("/lib/x86_64-linux-gnu/libc.so.6").function("__libc_malloc").return {
    printf("target()=%d,pid()=%d\n",target(),pid());
    if (target() == pid()) {
    printf("----\n")
        if (g_mem_ref_tbl[$return] == 0) {
            g_mem_ref_tbl[$return]++
            g_mem_bt_tbl[$return] = sprint_ubacktrace()
        }
    }
}
 
probe process("/lib/x86_64-linux-gnu/libc.so.6").function("__libc_free").call {
    if (target() == pid()) {
        g_mem_ref_tbl[$mem]--
 
        if (g_mem_ref_tbl[$mem] == 0) {
            if ($mem != 0) {
                g_mem_bt_tbl[$mem] = sprint_ubacktrace()
            }
        } else if (g_mem_ref_tbl[$mem] < 0 && $mem != 0) {
            printf("MMMMMMMMMMMMMMMMMMMMMMMMMMMM\n")
            printf("g_mem_ref_tbl[%p]: %d\n", $mem, g_mem_ref_tbl[$mem])
            print_ubacktrace()
            printf("last free backtrace:\n%s\n", g_mem_bt_tbl[$mem])
            printf("WWWWWWWWWWWWWWWWWWWWWWWWWWWW\n")
        }
    }
}
 
probe end {
    printf("=============end============\n")
    foreach(mem in g_mem_ref_tbl) {
        if (g_mem_ref_tbl[mem] > 0) {
            printf("%s\n", g_mem_bt_tbl[mem])
        }
    }
}

3、编译执行

wenjie@wenjie-Virtual-Machine:~/code$ cat build 
g++ $1.c -g -o $1
#  -fsanitize=address

./build address

wenjie@wenjie-Virtual-Machine:~/code$ sudo stap -v -d /usr/lib64/libc.so.6 -d /usr/lib64/libstdc++.so.6.0.19 ./memory.stp -c ./address
Pass 1: parsed user script and 482 library scripts using 134832virt/107140res/11528shr/95064data kb, in 450usr/70sys/519real ms.
Pass 2: analyzed script: 5 probes, 6 functions, 0 embeds, 2 globals using 145228virt/119120res/12928shr/105460data kb, in 170usr/0sys/177real ms.
WARNING: missing unwind/symbol data for module '/usr/lib64/libc.so.6'
WARNING: missing unwind/symbol data for module '/usr/lib64/libstdc++.so.6.0.19'
Pass 3: translated to C into "/tmp/stapPMojA7/stap_8e5f4ae678bd1aa6bb754b0d360c2a48_4637_src.c" using 151072virt/125112res/13120shr/111304data kb, in 10usr/10sys/117real ms.
warning: the compiler differs from the one used to build the kernel
  The kernel was built by: gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0
  You are using:           gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0
Pass 4: compiled C into "stap_8e5f4ae678bd1aa6bb754b0d360c2a48_4637.ko" in 6620usr/680sys/6805real ms.
Pass 5: starting run.
=============begin============
address=0x7ffedb343114
&b=0x7ffedb3430e4,a=1
&a = 0x7ffedb343114, a=2
a=2
target()=91260,pid()=91260
----
target()=91260,pid()=91260
----
target()=91260,pid()=91260
----
target()=91260,pid()=91260
----
=============end============
0x7f29460a893a [libstdc++.so.6.0.30+0xaa93a]

_IO_file_doallocate+0x94 [libc.so.6]
_IO_doallocbuf+0x50 [libc.so.6]
_IO_file_overflow@@GLIBC_2.2.5+0x1a0 [libc.so.6]
_IO_file_xsputn@@GLIBC_2.2.5+0xd5 [libc.so.6]
__vfprintf_internal+0x11d [libc.so.6]
_IO_printf+0xaf [libc.so.6]
0x559a1e7ab28a [address+0x128a]

0x7f29460ac98c [libstdc++.so.6.0.30+0xae98c]

0x559a1e7ab232 [address+0x1232]

WARNING: Missing unwind data for a module, rerun with 'stap -d /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30'
WARNING: Missing unwind data for a module, rerun with 'stap -d /home/wenjie/code/address'
Pass 5: run completed in 20usr/60sys/555real ms.
4、反汇编查找具体代码

wenjie@wenjie-Virtual-Machine:~/code$ objdump -S address | grep 128a
    128a:    48 8d 45 f4              lea    -0xc(%rbp),%rax
wenjie@wenjie-Virtual-Machine:~/code$ objdump -S address | grep 1232
    1232:    48 89 45 f0              mov    %rax,-0x10(%rbp)
wenjie@wenjie-Virtual-Machine:~/code$ objdump -S address | less

objdump -S -l --start-address=