Linux下free释放内存死锁问题
#0 0x00007f6267789d2b in pthread_once () from /lib64/libpthread.so.0
#1 0x00007f626689ec54 in backtrace () from /lib64/libc.so.6
#2 0x00007f626681084b in __libc_message () from /lib64/libc.so.6
#3 0x00007f6266816166 in malloc_printerr () from /lib64/libc.so.6
#4 0x00007f6266819be4 in _int_malloc () from /lib64/libc.so.6
#5 0x00007f626681a626 in calloc () from /lib64/libc.so.6
#6 0x00007f62679a4d2f in _dl_new_object () from /lib64/ld-linux-x86-64.so.2
#7 0x00007f62679a11be in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2
#8 0x00007f62679a237a in _dl_map_object () from /lib64/ld-linux-x86-64.so.2
#9 0x00007f62679aca44 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#10 0x00007f62679a81b6 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#11 0x00007f62679ac4fa in _dl_open () from /lib64/ld-linux-x86-64.so.2
#12 0x00007f62668c6e10 in do_dlopen () from /lib64/libc.so.6
#13 0x00007f62679a81b6 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#14 0x00007f62668c6f67 in __libc_dlopen_mode () from /lib64/libc.so.6
#15 0x00007f626689eb25 in init () from /lib64/libc.so.6
#16 0x00007f6267789d33 in pthread_once () from /lib64/libpthread.so.0
#17 0x00007f626689ec54 in backtrace () from /lib64/libc.so.6
#18 0x00007f626681084b in __libc_message () from /lib64/libc.so.6
#19 0x00007f6266816166 in malloc_printerr () from /lib64/libc.so.6
#20 0x00007f6266818c93 in _int_free () from /lib64/libc.so.6
#21 0x000000000046c6d6 in cpool_release_pool ()
我的内存池释放内存时最后会卡在pthread_once函数中出不来，用pstack命令查看如上堆栈信息。请各位大侠帮忙分析下。
代码没法贴，太多了。
这个问题太纠结了，总共出现过三次。都毫无头绪，如果是内存非法释放，越界，重复释放应该是挂掉的。
账号分不多了，只能放80
------解决思路----------------------
为什么只有一个线程的信息，楼主的程序是单线程的？
看楼主这个堆栈信息怎么好像是有很多递归调用，在释放内存的后面(_int_free)还有申请内存(_int_malloc)
这个内存池是自己写的吧
------解决思路----------------------
引用:#0 0x00007f6267789d2b in pthread_once () from /lib64/libpthread.so.0
#1 0x00007f626689ec54 in backtrace () from /lib64/libc.so.6
#2 0x00007f626681084b in __libc_message () from /lib64/libc.so.6
#3 0x00007f6266816166 in malloc_printerr () from /lib64/libc.so.6
#4 0x00007f6266819be4 in _int_malloc () from /lib64/libc.so.6
#5 0x00007f626681a626 in calloc () from /lib64/libc.so.6
#6 0x00007f62679a4d2f in _dl_new_object () from /lib64/ld-linux-x86-64.so.2
#7 0x00007f62679a11be in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2
#8 0x00007f62679a237a in _dl_map_object () from /lib64/ld-linux-x86-64.so.2
#9 0x00007f62679aca44 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#10 0x00007f62679a81b6 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#11 0x00007f62679ac4fa in _dl_open () from /lib64/ld-linux-x86-64.so.2
#12 0x00007f62668c6e10 in do_dlopen () from /lib64/libc.so.6
#13 0x00007f62679a81b6 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#14 0x00007f62668c6f67 in __libc_dlopen_mode () from /lib64/libc.so.6
#15 0x00007f626689eb25 in init () from /lib64/libc.so.6
#16 0x00007f6267789d33 in pthread_once () from /lib64/libpthread.so.0
#17 0x00007f626689ec54 in backtrace () from /lib64/libc.so.6
#18 0x00007f626681084b in __libc_message () from /lib64/libc.so.6
#19 0x00007f6266816166 in malloc_printerr () from /lib64/libc.so.6
#20 0x00007f6266818c93 in _int_free () from /lib64/libc.so.6
#21 0x000000000046c6d6 in cpool_release_pool ()
我的内存池释放内存时最后会卡在pthread_once函数中出不来，用pstack命令查看如上堆栈信息。请各位大侠帮忙分析下。
代码没法贴，太多了。
这个问题太纠结了，总共出现过三次。都毫无头绪，如果是内存非法释放，越界，重复释放应该是挂掉的。
账号分不多了，只能放80
看看你free的指针是不是你malloc的指针。
------解决思路----------------------
仅供参考//将c:\\tmp文件夹下的所有文件的内容全部放到用malloc分配的内存中
#include
#include
#include
#include
struct FB {
char fn[256];
size_t fl;
char *b;
struct FB *next;
struct FB *prev;
} *fh,*fb,*ft;
char ln[256];
char fpn[256];
FILE *af;
FILE *f;
int L,n;
int main() {
system("dir /b /a-d c:\\tmp\\*.* >c:\\allfn.txt");
af=fopen("c:\\allfn.txt","r");
if (NULL==af) {
printf("Can not open file c:\\allfn.txt!\n");
return 1;
}
fh=NULL;
fb=NULL;
n=0;
while (1) {
if (NULL==fgets(ln,256,af)) break;
L=strlen(ln);
if ('\n'==ln[L-1]) ln[L-1]=0;
printf("read %s\n",ln);
strcpy(fpn,"c:\\tmp\\");
strcat(fpn,ln);
ft=(struct FB *)malloc(sizeof(struct FB));
if (NULL==ft) {
printf("Can not malloc ft!\n");
fclose(af);
return 2;//之前的malloc在main退出后由操作系统自动free
}
printf("ft[%d]==%p\n",n,ft);
strcpy(ft->fn,fpn);
f=fopen(fpn,"rb");
if (NULL==f) {
printf("Can not open file %s!\n",fpn);
fclose(af);
return 3;//之前的malloc在main退出后由操作系统自动free
}
ft->fl=_filelength(fileno(f));
ft->b=malloc(ft->fl);
if (NULL==ft->b) {
printf("Can not malloc ft->b!\n");
fclose(f);
fclose(af);
return 4;//之前的malloc在main退出后由操作系统自动free
}
printf("ft[%d]->b==%p\n",n,ft->b);
if (ft->fl!=fread(ft->b,1,ft->fl,f)) {
printf("fread error!\n");
fclose(f);
fclose(af);
return 5;//之前的malloc在main退出后由操作系统自动free
}
fclose(f);
ft->next=NULL;
if (NULL==fh) {
ft->prev=NULL;
fh=ft;
} else {
fb->next=ft;
ft->prev=fb;
}
fb=ft;
n++;
}
fclose(af);
printf("-----list-----\n");
for (ft=fh;NULL!=ft;ft=ft->next) {
printf("%8d %s\n",ft->fl,ft->fn);
if (NULL!=ft) fb=ft;
}
printf("-----free-----\n");
n--;
if (NULL!=fh) {
for (ft=fb->prev;NULL!=ft;ft=ft->prev) {
if (NULL!=ft->next->b) {
printf("ft[%d]->b==%p\n",n,ft->next->b);
free(ft->next->b);
}
if (NULL!=ft->next) {
printf("ft[%d]==%p\n",n,ft->next);
free(ft->next);
}
n--;
}
if (NULL!=fh->b) {
printf("ft[0]->b==%p\n",fh->b);
free(fh->b);
}
printf("ft[0]==%p\n",fh);
free(fh);
}
return 0;
}
//C:\tmp\tmp\Debug>dir /a-d c:\tmp
// 驱动器 C 中的卷是 C_HD5_1
// 卷的序列号是 1817-D526
//
// c:\tmp 的目录
//
//找不到文件
//
//C:\tmp\tmp\Debug>tmp
//找不到文件
//-----list-----
//-----free-----
//
//C:\tmp\tmp\Debug>dir /a-d c:\tmp
// 驱动器 C 中的卷是 C_HD5_1
// 卷的序列号是 1817-D526
//
// c:\tmp 的目录
//
//2011-06-30 18:04 44,840 my_c.rar
//2011-06-30 17:18 1,036 err.frm
//2011-06-30 14:32 14,243 出租.txt
//2011-06-28 12:08 23,681 MSDN98书签.txt
// 4 个文件 83,800 字节
// 0 个目录 17,041,870,848 可用字节
//
//C:\tmp\tmp\Debug>tmp
//read my_c.rar
//ft[0]==00421800
//ft[0]->b==00520068
//read err.frm
//ft[1]==00421670
//ft[1]->b==0052AFC0
//read 出租.txt
//ft[2]==00421530
//ft[2]->b==00378F28
//read MSDN98书签.txt
//ft[3]==004213F0
//ft[3]->b==0052B3F8
//-----list-----
// 44840 c:\tmp\my_c.rar
// 1036 c:\tmp\err.frm
// 14243 c:\tmp\出租.txt
// 23681 c:\tmp\MSDN98书签.txt
//-----free-----
//ft[3]->b==0052B3F8
//ft[3]==004213F0
//ft[2]->b==00378F28
//ft[2]==00421530
//ft[1]->b==0052AFC0
//ft[1]==00421670
//ft[0]->b==00520068
//ft[0]==00421800
//
//C:\tmp\tmp\Debug>
------解决思路----------------------
再供参考：//循环向a函数每次发送200个字节长度(这个是固定的)的buffer,
//a函数中需要将循环传进来的buffer，组成240字节(也是固定的)的新buffer进行处理，
//在处理的时候每次从新buffer中取两个字节打印
#ifdef WIN32
#pragma warning(disable:4996)
#endif
#include
#include
#include
#ifdef WIN32
#include
#include
#include
#define MYVOID void
#define vsnprintf _vsnprintf
#else
#include
#include
#include
#define CRITICAL_SECTION pthread_mutex_t
#define MYVOID void *
#endif
//Log{
#define MAXLOGSIZE 20000000
#define MAXLINSIZE 16000
#include
#include
#include
char logfilename1[]="MyLog1.log";
char logfilename2[]="MyLog2.log";
static char logstr[MAXLINSIZE+1];
char datestr[16];
char timestr[16];
char mss[4];
CRITICAL_SECTION cs_log;
FILE *flog;
#ifdef WIN32
void Lock(CRITICAL_SECTION *l) {
EnterCriticalSection(l);
}
void Unlock(CRITICAL_SECTION *l) {
LeaveCriticalSection(l);
}
void sleep_ms(int ms) {
Sleep(ms);
}
#else
void Lock(CRITICAL_SECTION *l) {
pthread_mutex_lock(l);
}
void Unlock(CRITICAL_SECTION *l) {
pthread_mutex_unlock(l);
}
void sleep_ms(int ms) {
usleep(ms*1000);
}
#endif
void LogV(const char *pszFmt,va_list argp) {
struct tm *now;
struct timeb tb;
if (NULL==pszFmt
------解决思路----------------------
0==pszFmt[0]) return;
vsnprintf(logstr,MAXLINSIZE,pszFmt,argp);
ftime(&tb);
now=localtime(&tb.time);
sprintf(datestr,"%04d-%02d-%02d",now->tm_year+1900,now->tm_mon+1,now->tm_mday);
sprintf(timestr,"%02d:%02d:%02d",now->tm_hour ,now->tm_min ,now->tm_sec );
sprintf(mss,"%03d",tb.millitm);
printf("%s %s.%s %s",datestr,timestr,mss,logstr);
flog=fopen(logfilename1,"a");
if (NULL!=flog) {
fprintf(flog,"%s %s.%s %s",datestr,timestr,mss,logstr);
if (ftell(flog)>MAXLOGSIZE) {
fclose(flog);
if (rename(logfilename1,logfilename2)) {
remove(logfilename2);
rename(logfilename1,logfilename2);
}
} else {
fclose(flog);
}
}
}
void Log(const char *pszFmt,...) {
va_list argp;
Lock(&cs_log);
va_start(argp,pszFmt);
LogV(pszFmt,argp);
va_end(argp);
Unlock(&cs_log);
}
//Log}
#define ASIZE 200
#define BSIZE 240
#define CSIZE 2
char Abuf[ASIZE];
char Cbuf[CSIZE];
CRITICAL_SECTION cs_HEX ;
CRITICAL_SECTION cs_BBB ;
struct FIFO_BUFFER {
int head;
int tail;
int size;
char data[BSIZE];
} BBB;
int No_Loop=0;
void HexDump(int cn,char *buf,int len) {
int i,j,k;
char binstr[80];
Lock(&cs_HEX);
for (i=0;i
if (0==(i%16)) {
sprintf(binstr,"%03d %04x -",cn,i);
sprintf(binstr,"%s %02x",binstr,(unsigned char)buf[i]);
} else if (15==(i%16)) {
sprintf(binstr,"%s %02x",binstr,(unsigned char)buf[i]);
sprintf(binstr,"%s ",binstr);
for (j=i-15;j<=i;j++) {
sprintf(binstr,"%s%c",binstr,('!'
}
Log("%s\n",binstr);
} else {
sprintf(binstr,"%s %02x",binstr,(unsigned char)buf[i]);
}
}
if (0!=(i%16)) {
k=16-(i%16);
for (j=0;j
sprintf(binstr,"%s ",binstr);
}
sprintf(binstr,"%s ",binstr);
k=16-k;
for (j=i-k;j
sprintf(binstr,"%s%c",binstr,('!'
}
Log("%s\n",binstr);
}
Unlock(&cs_HEX);
}
int GetFromRBuf(int cn,CRITICAL_SECTION *cs,FIFO_BUFFER *fbuf,char *buf,int len) {
int lent,len1,len2;
lent=0;
Lock(cs);
if (fbuf->size>=len) {
lent=len;
if (fbuf->head+lent>BSIZE) {
len1=BSIZE-fbuf->head;
memcpy(buf ,fbuf->data+fbuf->head,len1);
len2=lent-len1;
memcpy(buf+len1,fbuf->data ,len2);
fbuf->head=len2;
} else {
memcpy(buf ,fbuf->data+fbuf->head,lent);
fbuf->head+=lent;
}
fbuf->size-=lent;
}
Unlock(cs);
return lent;
}
MYVOID thdB(void *pcn) {
char *recv_buf;
int recv_nbytes;
int cn;
int wc;
int pb;
cn=(int)pcn;
Log("%03d thdB thread begin...\n",cn);
while (1) {
sleep_ms(10);
recv_buf=(char *)Cbuf;
recv_nbytes=CSIZE;
wc=0;
while (1) {
pb=GetFromRBuf(cn,&cs_BBB,&BBB,recv_buf,recv_nbytes);
if (pb) {
Log("%03d recv %d bytes\n",cn,pb);
HexDump(cn,recv_buf,pb);
sleep_ms(1);
} else {
sleep_ms(1000);
}
if (No_Loop) break;//
wc++;
if (wc>3600) Log("%03d %d==wc>3600!\n",cn,wc);
}
if (No_Loop) break;//
}
#ifndef WIN32
pthread_exit(NULL);
#endif
}
int PutToRBuf(int cn,CRITICAL_SECTION *cs,FIFO_BUFFER *fbuf,char *buf,int len) {
int lent,len1,len2;
Lock(cs);
lent=len;
if (fbuf->size+lent>BSIZE) {
lent=BSIZE-fbuf->size;
}
if (fbuf->tail+lent>BSIZE) {
len1=BSIZE-fbuf->tail;
memcpy(fbuf->data+fbuf->tail,buf ,len1);
len2=lent-len1;
memcpy(fbuf->data ,buf+len1,len2);
fbuf->tail=len2;
} else {
memcpy(fbuf->data+fbuf->tail,buf ,lent);
fbuf->tail+=lent;
}
fbuf->size+=lent;
Unlock(cs);
return lent;
}
MYVOID thdA(void *pcn) {
char *send_buf;
int send_nbytes;
int cn;
int wc;
int a;
int pa;
cn=(int)pcn;
Log("%03d thdA thread begin...\n",cn);
a=0;
while (1) {
sleep_ms(100);
memset(Abuf,a,ASIZE);
a=(a+1)%256;
if (16==a) {No_Loop=1;break;}//去掉这句可以让程序一直循环直到按Ctrl+C或Ctrl+Break或当前目录下存在文件No_Loop
send_buf=(char *)Abuf;
send_nbytes=ASIZE;
Log("%03d sending %d bytes\n",cn,send_nbytes);
HexDump(cn,send_buf,send_nbytes);
wc=0;
while (1) {
pa=PutToRBuf(cn,&cs_BBB,&BBB,send_buf,send_nbytes);
Log("%03d sent %d bytes\n",cn,pa);
HexDump(cn,send_buf,pa);
send_buf+=pa;
send_nbytes-=pa;
if (send_nbytes<=0) break;//
sleep_ms(1000);
if (No_Loop) break;//
wc++;
if (wc>3600) Log("%03d %d==wc>3600!\n",cn,wc);
}
if (No_Loop) break;//
}
#ifndef WIN32
pthread_exit(NULL);
#endif
}
int main() {
#ifdef WIN32
InitializeCriticalSection(&cs_log);
InitializeCriticalSection(&cs_HEX );
InitializeCriticalSection(&cs_BBB );
#else
pthread_t threads[2];
int threadsN;
int rc;
pthread_mutex_init(&cs_log,NULL);
pthread_mutex_init(&cs_HEX,NULL);
pthread_mutex_init(&cs_BBB,NULL);
#endif
Log("Start===========================================================\n");
BBB.head=0;
BBB.tail=0;
BBB.size=0;
#ifdef WIN32
_beginthread((void(__cdecl *)(void *))thdA,0,(void *)1);
_beginthread((void(__cdecl *)(void *))thdB,0,(void *)2);
#else
threadsN=0;
rc=pthread_create(&(threads[threadsN++]),NULL,thdA,(void *)1);if (rc) Log("%d=pthread_create %d error!\n",rc,threadsN-1);
rc=pthread_create(&(threads[threadsN++]),NULL,thdB,(void *)2);if (rc) Log("%d=pthread_create %d error!\n",rc,threadsN-1);
#endif
if (!access("No_Loop",0)) {
remove("No_Loop");
if (!access("No_Loop",0)) {
No_Loop=1;
}
}
while (1) {
sleep_ms(1000);
if (No_Loop) break;//
if (!access("No_Loop",0)) {
No_Loop=1;
}
}
sleep_ms(3000);
Log("End=============================================================\n");
#ifdef WIN32
DeleteCriticalSection(&cs_BBB );
DeleteCriticalSection(&cs_HEX );
DeleteCriticalSection(&cs_log);
#else
pthread_mutex_destroy(&cs_BBB);
pthread_mutex_destroy(&cs_HEX);
pthread_mutex_destroy(&cs_log);
#endif
return 0;
}
------解决思路----------------------
引用:Quote: 引用:Quote: 引用:#0 0x00007f6267789d2b in pthread_once () from /lib64/libpthread.so.0
#1 0x00007f626689ec54 in backtrace () from /lib64/libc.so.6
#2 0x00007f626681084b in __libc_message () from /lib64/libc.so.6
#3 0x00007f6266816166 in malloc_printerr () from /lib64/libc.so.6
#4 0x00007f6266819be4 in _int_malloc () from /lib64/libc.so.6
#5 0x00007f626681a626 in calloc () from /lib64/libc.so.6
#6 0x00007f62679a4d2f in _dl_new_object () from /lib64/ld-linux-x86-64.so.2
#7 0x00007f62679a11be in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2
#8 0x00007f62679a237a in _dl_map_object () from /lib64/ld-linux-x86-64.so.2
#9 0x00007f62679aca44 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#10 0x00007f62679a81b6 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#11 0x00007f62679ac4fa in _dl_open () from /lib64/ld-linux-x86-64.so.2
#12 0x00007f62668c6e10 in do_dlopen () from /lib64/libc.so.6
#13 0x00007f62679a81b6 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#14 0x00007f62668c6f67 in __libc_dlopen_mode () from /lib64/libc.so.6
#15 0x00007f626689eb25 in init () from /lib64/libc.so.6
#16 0x00007f6267789d33 in pthread_once () from /lib64/libpthread.so.0
#17 0x00007f626689ec54 in backtrace () from /lib64/libc.so.6
#18 0x00007f626681084b in __libc_message () from /lib64/libc.so.6
#19 0x00007f6266816166 in malloc_printerr () from /lib64/libc.so.6
#20 0x00007f6266818c93 in _int_free () from /lib64/libc.so.6
#21 0x000000000046c6d6 in cpool_release_pool ()
我的内存池释放内存时最后会卡在pthread_once函数中出不来，用pstack命令查看如上堆栈信息。请各位大侠帮忙分析下。
代码没法贴，太多了。
这个问题太纠结了，总共出现过三次。都毫无头绪，如果是内存非法释放，越界，重复释放应该是挂掉的。
账号分不多了，只能放80
看看你free的指针是不是你malloc的指针。
如果不是malloc出来的指针应该是要core掉，而不应该卡在那里不动了吧。
我之前遇到过类似问题，是重复free导致的，重复free会导致内存块的控制头写烂了，这样就会导致内存管理器失效，你看看你是不是也重复free了。
------解决思路----------------------
必要时加锁。
------解决思路----------------------
或者free后设置NULL
------解决思路----------------------
pthread_once函数是怎么调用的？
------解决思路----------------------
楼主总不至于编译命令行没指定-lpthread吧。
------解决思路----------------------
也可能malloc和free不支持多线程环境，需要用锁锁住。
------解决思路----------------------
1. 程序和相关的库在编译的时候要加上-pthread参数(不仅仅是链接的时候加-lpthread, 编译的时候也需要)
2. cpool_release_pool 有源码吗？
------解决思路----------------------
引用:1. 程序和相关的库在编译的时候要加上-pthread参数(不仅仅是链接的时候加-lpthread, 编译的时候也需要)
2. cpool_release_pool 有源码吗？
编译的时候加一个链接库的选项貌似没啥意义吧，编译选项里面压根不管这个-l
------解决思路----------------------
gcc/g++命令行选项：
-ftls-model=[global-dynamic
------解决思路----------------------
local-dynamic
------解决思路----------------------
initial-exec
------解决思路----------------------
local-exec] Indicates the default thread-local storage code generation model
关注一下？
------解决思路----------------------
马克，最近也正好在开发这个
------解决思路----------------------
引用:
找问题了，异常情况下重复释放了内存池导致的，pjsip重复释放不给我挂掉，竟然卡死，郁闷！！！
不要迷信书、考题、老师、回帖；
要迷信CPU、编译器、调试器、运行结果。
并请结合“盲人摸太阳”和“驾船出海时一定只带一个指南针。”加以理解。
任何理论、权威、传说、真理、标准、解释、想象、知识……都比不上摆在眼前的事实！
有人说一套做一套，你相信他说的还是相信他做的？
其实严格来说这个世界上古往今来所有人都是说一套做一套，不是吗？
不要写连自己也预测不了结果的代码！
不然以后请继续郁闷。