• Windbg命令学习10 CriticalSection leak问题


    示例代码:

    #include "windows.h"
    #include <stdio.h>
    #include <tchar.h>
    
    CRITICAL_SECTION g_cs;
    
    DWORD WINAPI ThreadProc1(LPVOID lpParameter)
    {
    	EnterCriticalSection(&g_cs);
    	printf("thread1\n");
    	return 0;
    }
    DWORD WINAPI ThreadProc2(LPVOID lpParameter)
    {
    	EnterCriticalSection(&g_cs);
    	printf("thread2\n");
    	return 0;
    }
    int _tmain(int argc, _TCHAR* argv[])
    {
    	InitializeCriticalSection(&g_cs);
    	CreateThread(NULL,NULL,ThreadProc1,NULL,NULL,NULL);
    	Sleep(1000);
    	CreateThread(NULL,NULL,ThreadProc2,NULL,NULL,NULL);
    	getchar();
    	return 0;
    }

    编译成release,运行,windbg强制附加:

    0:002> ~*kb
    
       0  Id: 10c4.a18 Suspend: 1 Teb: 7ffdf000 Unfrozen
    ChildEBP RetAddr  Args to Child              
    0012fc8c 7c92daea 7c932298 00000018 0012fcf0 ntdll!KiFastSystemCallRet
    0012fc90 7c932298 00000018 0012fcf0 0012fcf0 ntdll!ZwRequestWaitReplyPort+0xc
    0012fcb0 7c872a51 00000000 00260688 0002021d ntdll!CsrClientCallServer+0x8c
    0012fdac 7c872b98 00000003 785bc660 00001000 kernel32!ReadConsoleInternal+0x1be
    0012fe34 7c8018b7 00000003 785bc660 00001000 kernel32!ReadConsoleA+0x3b
    0012fe8c 78588ef2 00000003 785bc660 00001000 kernel32!ReadFile+0x64
    0012fed0 78589376 00000000 785bc660 00001000 MSVCR90!_read_nolock+0x203 [f:\dd\vctools\crt_bld\self_x86\crt\src\read.c @ 233]
    0012ff14 7854efd2 00000000 785bc660 00001000 MSVCR90!_read+0xc0 [f:\dd\vctools\crt_bld\self_x86\crt\src\read.c @ 93]
    0012ff30 7854e4fe 785b73a8 0165941f 00403390 MSVCR90!_filbuf+0x7d [f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c @ 136]
    0012ff68 7854e557 785b73a8 0040108c 00000001 MSVCR90!getc+0xe0 [f:\dd\vctools\crt_bld\self_x86\crt\src\fgetc.c @ 49]
    0012ff70 0040108c 00000001 00001650 004011fa MSVCR90!_fgetchar+0xb [f:\dd\vctools\crt_bld\self_x86\crt\src\fgetchar.c @ 37]
    WARNING: Stack unwind information not available. Following frames may be wrong.
    0012ffc0 7c817077 80000001 03edd9e4 7ffd9000 test2+0x108c
    0012fff0 00000000 00401342 00000000 78746341 kernel32!BaseProcessStart+0x23
    
       1  Id: 10c4.1650 Suspend: 1 Teb: 7ffde000 Unfrozen
    ChildEBP RetAddr  Args to Child              
    0050ff18 7c92df5a 7c939b23 0000002c 00000000 ntdll!KiFastSystemCallRet
    0050ff1c 7c939b23 0000002c 00000000 00000000 ntdll!NtWaitForSingleObject+0xc
    0050ffa4 7c921046 00403370 0040102b 00403370 ntdll!RtlpWaitForCriticalSection+0x132
    0050ffac 0040102b 00403370 7c80b729 00000000 ntdll!RtlEnterCriticalSection+0x46
    WARNING: Stack unwind information not available. Following frames may be wrong.
    0050ffec 00000000 00401020 00000000 00000000 test2+0x102b
    
    #  2  Id: 10c4.1a70 Suspend: 1 Teb: 7ffdd000 Unfrozen
    ChildEBP RetAddr  Args to Child              
    003bffc8 7c972119 00000005 00000004 00000001 ntdll!DbgBreakPoint
    003bfff4 00000000 00000000 00000000 00000000 ntdll!DbgUiRemoteBreakin+0x2d

    注意到1线程在等待临界区,对临界区继续分析:

     

    0:002> !cs 00403370 
    -----------------------------------------
    Critical section   = 0x00403370 (test2+0x3370)
    DebugInfo          = 0x7c99e9c0
    LOCKED
    LockCount          = 0x1
    OwningThread       = 0x0000155c
    RecursionCount     = 0x1
    LockSemaphore      = 0x2C
    SpinCount          = 0x00000000
    0:002> ~~[0x0000155c]
                        ^ Illegal thread error in '~~[0x0000155c]'

    竟然是错误的线程,这说明这个破线程没有调用LeaveCriticalSection就挂了!

    继续分析,找出原因:

    Application Verifier 是类似pageheap 的工具,使用范围更广。可以通过Application Verifier
    方便设定注册表,让操作系统主动地提供关于handle, critical section, heap 等系统层面的调试
    信息.

    在这里有下载:http://www.microsoft.com/en-us/download/details.aspx?id=20028

    启动Application Verifier 后,添加程序名字,然后勾选Locks。在windbg 中用ctrl+E 打开这个程序重新运行

    windbg中断了:

    0:000> g
    
    
    =======================================
    VERIFIER STOP 00000200: pid 0xA28: Thread cannot own a critical section. 
    
    	00000CFC : Thread ID.
    	00403370 : Critical section address.
    	002A8250 : Critical section debug information address.
    	00000000 : Critical section initialization stack trace.
    
    
    =======================================
    This verifier stop is continuable.
    After debugging it use `go' to continue.
    
    =======================================
    
    (a28.cfc): Break instruction exception - code 80000003 (first chance)
    eax=002a82a8 ebx=00387d08 ecx=00000001 edx=01caface esi=00000000 edi=002a82a8
    eip=7c92120e esp=01cafb58 ebp=01cafd5c iopl=0         nv up ei pl nz na po nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
    ntdll!DbgBreakPoint:
    7c92120e cc              int     3

    原因很明显:Thread cannot own a critical section.线程ID是cfc

    0:001> ~~[00000CFC]
    .  1  Id: a28.cfc Suspend: 1 Teb: 7ffde000 Unfrozen
          Start: kernel32!BaseThreadStartThunk (7c8106f9) 
          Priority: 0  Priority class: 32  Affinity: f
    0:001> ~1kb
    ChildEBP RetAddr  Args to Child              
    01cafb54 10003b68 11ca2a3c 00000000 002a8250 ntdll!DbgBreakPoint
    01cafd5c 0037c427 003860c8 00000200 00000cfc vrfcore!VerifierStopMessageEx+0x4d1
    01cafe00 0037c47e 00403370 002a8250 fffffffe vfbasics!AVrfpCheckCriticalSection+0x169
    01cafe20 0037c5f2 018e1a90 fffffffe 00000000 vfbasics!AVrfpCheckCriticalSectionSplayNode+0x34
    01caff48 0037c6a9 018e1888 fffffffe 00000000 vfbasics!AVrfpCheckCriticalSectionTree+0x47
    01caff64 00384002 fffffffe 00000000 00000000 vfbasics!AVrfCheckForOrphanedCriticalSections+0x75
    01caff78 00384020 fffffffe 00384314 01f29440 vfbasics!AVrfpCheckThreadTermination+0x11
    01caff80 00384314 01f29440 7c92e920 7c98b127 vfbasics!AVrfpCheckCurrentThreadTermination+0x15
    01caffb4 7c80b729 018e1af8 7c92e920 7c98b127 vfbasics!AVrfpStandardThreadFunction+0x4c
    01caffec 00000000 003842c8 018e1af8 00000000 kernel32!BaseThreadStart+0x37

    这些破函数我也不认识,但是我认识这些:CheckThreadTermination   CheckCriticalSection!!!这里可以看到,线程1试图退出当前线程,但是由于还拥有没有释放的CriticalSection,所以在激活Application Verifier 后,就会自动产生一个break point exception.


     

  • 相关阅读:
    将指定文件夹下所有图片转换成base64并返回数组
    SQL技巧
    yii 进行事务操作是不可以在一条sql里边放多条sql
    yii 直接执行sql
    按照特定方法排序
    表名为变量时的语法
    如何添加 actions
    触发器原理
    codeCeption 调试方法
    最长不下降子序列(LIS)
  • 原文地址:https://www.cnblogs.com/hgy413/p/3693523.html
Copyright © 2020-2023  润新知