Windbg調試死鎖

目錄

示例代碼

運行

分析

結論

擴展

參考資料


示例代碼

#include <iostream>
#include <stdlib.h>
#include <windows.h>
#include <process.h>

static CRITICAL_SECTION g_cs1;
static CRITICAL_SECTION g_cs2;

unsigned int __stdcall threadFunc1(LPVOID lp)
{
	std::cout << "Enter threadFunc1" << std::endl;

	EnterCriticalSection(&g_cs1);	
	Sleep(10);

	EnterCriticalSection(&g_cs2);
	// do something
 	LeaveCriticalSection(&g_cs2);

 	LeaveCriticalSection(&g_cs1);
	std::cout << "Leave threadFunc1" << std::endl;
	return 0;
}

unsigned int  __stdcall threadFunc2(LPVOID lp)
{
	std::cout << "Enter threadFunc2" << std::endl;
	EnterCriticalSection(&g_cs2);	
	Sleep(10);

	EnterCriticalSection(&g_cs1);
	// do something
 	LeaveCriticalSection(&g_cs1);

 	LeaveCriticalSection(&g_cs2);
	std::cout << "Leave threadFunc2" << std::endl;
	return 0;
}

int main()
{
	InitializeCriticalSection(&g_cs1);
	InitializeCriticalSection(&g_cs2);

	_beginthreadex(NULL, 0, threadFunc1, 0, 0, NULL);
	_beginthreadex(NULL, 0, threadFunc2, 0, 0, NULL);

	system("pause");
	return 0;
}

運行

並未輸出:Leave threadFunc1 及 Leave threadFunc2

分析

1. 輸入指令:!locks

*** WARNING: Unable to verify checksum for DeadLock.exe

CritSec DeadLock!g_cs1+0 at 0133437c

WaiterWoken        No

LockCount          1

RecursionCount     1

OwningThread       6284

EntryCount         0

ContentionCount    1

*** Locked

 

CritSec DeadLock!g_cs2+0 at 01334394

WaiterWoken        No

LockCount          1

RecursionCount     1

OwningThread       7288

EntryCount         0

ContentionCount    1

*** Locked

 

Scanned 109 critical sections

經過分析,我們發現有兩個鎖,一個是g_cs1,地址爲0133437c,其所屬線程爲6284;另一個是g_cs2,地址爲01334394,其所屬線程爲7288。爲方便,以表格形式展示:

鎖名稱

鎖地址

所屬線程

g_cs1

0133437c

6284

g_cs2

01334394

7288

2. 查看所有線程:~

0  Id: 7084.737c Suspend: 1 Teb: 7efdd000 Unfrozen

1  Id: 7084.6284 Suspend: 1 Teb: 7efda000 Unfrozen

2  Id: 7084.7288 Suspend: 1 Teb: 7efd7000 Unfrozen

3  Id: 7084.7048 Suspend: 1 Teb: 7ef9f000 Unfrozen

從線程信息可以看到,線程6282及7288當前的狀態都是Suspend(7084表示進程號)。16284線程的相對線程號,27288線程的相對線程號。

3. 分別查看線程6284及7288的堆棧:

查看線程6248堆棧:~1 kb

# ChildEBP RetAddr  Args to Child             

00 0088f7b8 7773eb4e 00000044 00000000 00000000 ntdll!NtWaitForSingleObject+0x15

01 0088f81c 7773ea32 00000000 00000000 0063f8a0 ntdll!RtlpWaitOnCriticalSection+0x13e

02 0088f844 01331045 01334394 01331000 01331000 ntdll!RtlEnterCriticalSection+0x150

03 0088f85c 65a262e4 00000000 5230abd3 00000000 DeadLock!threadFunc1+0x45 [f:\總結文檔\windbg\deadlock\deadlock\deadlock.cpp @ 23]

04 0088f898 75d9336a 0063f8a0 0088f8e4 777298f2 ucrtbase!thread_start<unsigned int (__stdcall*)(void *)>+0x54

05 0088f8a4 777298f2 0063f8a0 74cb5f34 00000000 kernel32!BaseThreadInitThunk+0xe

06 0088f8e4 777298c5 65a26290 0063f8a0 00000000 ntdll!__RtlUserThreadStart+0x70

07 0088f8fc 00000000 65a26290 0063f8a0 00000000 ntdll!_RtlUserThreadStart+0x1b

         6284線程當前在等待鎖01334394也即g_cs2

查看線程7288堆棧:~2 kb

# ChildEBP RetAddr  Args to Child             

00 009efdf8 7773eb4e 00000048 00000000 00000000 ntdll!NtWaitForSingleObject+0x15

01 009efe5c 7773ea32 00000000 00000000 0063f900 ntdll!RtlpWaitOnCriticalSection+0x13e

02 009efe84 013310d5 0133437c 01331090 01331090 ntdll!RtlEnterCriticalSection+0x150

03 009efe9c 65a262e4 00000000 5226ad93 00000000 DeadLock!threadFunc2+0x45 [f:\總結文檔\windbg\deadlock\deadlock\deadlock.cpp @ 38]

04 009efed8 75d9336a 0063f900 009eff24 777298f2 ucrtbase!thread_start<unsigned int (__stdcall*)(void *)>+0x54

05 009efee4 777298f2 0063f900 74dd58f4 00000000 kernel32!BaseThreadInitThunk+0xe

06 009eff24 777298c5 65a26290 0063f900 00000000 ntdll!__RtlUserThreadStart+0x70

07 009eff3c 00000000 65a26290 0063f900 00000000 ntdll!_RtlUserThreadStart+0x1b

         7288線程當前在等待鎖0133437c也即g_cs1

結論

將上述分析結果以表格形式彙總:

從彙總結果看,線程1,2形成了死鎖。

擴展

1. !cs Address:顯示指定臨界區

0:001> !cs 01334394

-----------------------------------------

Critical section   = 0x01334394 (DeadLock!g_cs2+0x0)

DebugInfo          = 0x0063f868

LOCKED

LockCount          = 0x1

WaiterWoken        = No

OwningThread       = 0x00007288

RecursionCount     = 0x1

LockSemaphore      = 0x44

SpinCount          = 0x00000000

2. !cs –l :顯示鎖定的臨界區

0:001> !cs -l

-----------------------------------------

DebugInfo          = 0x0063f0a8

Critical section   = 0x0133437c (DeadLock!g_cs1+0x0)

LOCKED

LockCount          = 0x1

WaiterWoken        = No

OwningThread       = 0x00006284

RecursionCount     = 0x1

LockSemaphore      = 0x48

SpinCount          = 0x00000000

-----------------------------------------

DebugInfo          = 0x0063f868

Critical section   = 0x01334394 (DeadLock!g_cs2+0x0)

LOCKED

LockCount          = 0x1

WaiterWoken        = No

OwningThread       = 0x00007288

RecursionCount     = 0x1

LockSemaphore      = 0x44

SpinCount          = 0x00000000

3. !cs –o:Displays the owner's stack for any locked critical section that is being displayed

參考資料

1. 調試死鎖

2. !deadlock

 

 

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章