qiu*_*qiu 2 c linux printf multithreading clone
#define _GNU_SOURCE
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void func();
void main(int argc,char **argv)
{
printf("i am main\n");
int clone_flag,arg,retval;
char *stack;
clone_flag=CLONE_VM|CLONE_SIGHAND;
stack=(char*)malloc(4096);
retval=clone((void*)func,&(stack[4095]),clone_flag,NULL);
stack=(char*)malloc(4096);
retval=clone((void*)func,&(stack[4095]),clone_flag,NULL);
}
void func()
{
int i;
for(i=0;i<3;i++)
{
printf("i: %d\n ",i);
}
}
输出：
i am main
i: 0
i: 1
strace-f
5915 fstat(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(4, 1), ...}) = 0
5915 ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
5915 brk(NULL) = 0xaf2000
5915 brk(0xb14000) = 0xb14000
5915 write(1, "i am main\n", 10) = 10
5915 clone(child_stack=0xaf400f, flags=CLONE_VM|CLONE_SIGHAND) = 5916
5915 clone(child_stack=0xaf501f, flags=CLONE_VM|CLONE_SIGHAND) = 5917
5915 exit_group(5917) = ?
5915 +++ exited with 29 +++
5917 write(1, "i", 1) = 1
5917 write(1, ": 0\n ", 5) = 5
5917 write(1, "i", 1) = 1
5917 write(1, ": 1\n ", 5) = 5
5916 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xaf194f} ---
5916 +++ killed by SIGSEGV (core dumped) +++
5917 +++ killed by SIGSEGV +++
gdb ./a.out 核心
Core was generated by `./a.out'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 buffered_vfprintf (s=0x7f737fd43620 <_IO_2_1_stdout_>,
format=0x40074e "i: %d\n ", args=0x1f49f27) at vfprintf.c:2299
2299 vfprintf.c: No such file or directory.
[Current thread is 1 (LWP 6280)]
(gdb) where
#0 buffered_vfprintf (s=0x7f737fd43620 <_IO_2_1_stdout_>,
format=0x40074e "i: %d\n ", args=0x1f49f27) at vfprintf.c:2299
#1 0x00007f737f9cb32d in _IO_vfprintf_internal (
s=0x7f737fd43620 <_IO_2_1_stdout_>, format=0x40074e "i: %d\n ",
ap=ap@entry=0x1f49f27) at vfprintf.c:1293
#2 0x00007f737f9d3899 in __printf (format=<optimized out>) at printf.c:33
#3 0x00000000004006a8 in func () at code.c:23
#4 0x00007f737fa8541d in clone ()
at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
如果我删除“printf(“i am main\n”);”会很混乱 代码将运行良好
斯特雷斯
5937 brk(NULL) = 0x1f75000
5937 brk(0x1f97000) = 0x1f97000
5937 clone(child_stack=0x1f75fff, flags=CLONE_VM|CLONE_SIGHAND) = 5938
5937 clone(child_stack=0x1f7700f, flags=CLONE_VM|CLONE_SIGHAND) = 5939
5937 exit_group(5939) = ?
5937 +++ exited with 51 +++
5939 fstat(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(4, 1), ...}) = 0
5939 ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
5939 write(1, "i: 0\n", 5) = 5
5939 write(1, " i: 1\n", 6) = 6
5939 write(1, " i: 2\n", 6) = 6
5938 write(1, " i: 2\ni: 0\n", 11) = 11
5939 exit_group(6) = ?
5939 +++ exited with 6 +++
5938 write(1, " i: 1\n", 6) = 6
5938 write(1, " i: 2\n", 6) = 6
5938 exit_group(6) = ?
5938 +++ exited with 6 +++
为什么“printf”会产生如此大的差异？（顺便问一下，为什么 SIGSEGV 杀死了另一个进程？）
您的调用printf溢出了可用堆栈。4096 字节不足以完成所有需要做的事情。为了确认这一点，这里有一个 gdb 会话示例：
Reading symbols from ./a.out...done.
(gdb) break 14
Breakpoint 1 at 0x400624: file source.c, line 14.
(gdb) break 16
Breakpoint 2 at 0x400659: file source.c, line 16.
(gdb) break func
Breakpoint 3 at 0x40068b: file source.c, line 21.
(gdb) run
Starting program: a.out
i am main
Breakpoint 1, main (argc=1, argv=0x7fffffffe3a8) at source.c:14
14 retval=clone((void*)func,&(stack[4095]),clone_flag,NULL);
(gdb) print/x stack
$1 = 0x602420
(gdb) cont
Continuing.
[New LWP 25381]
[Switching to LWP 25381]
Thread 2 hit Breakpoint 3, func () at source.c:21
21 for(i=0;i<3;i++)
(gdb) print/x &i
$2 = 0x60340b
(gdb) watch $rsp < 0x602420
Watchpoint 4: $rsp < 0x602420
gdb当堆栈指针（$rsp在 x86-64 机器上；根据您的 CPU，您可能需要不同的寄存器）低于分配的堆栈范围的起始位置时，我要求停止。
(gdb) cont
Continuing.
[Switching to LWP 25375]
Thread 1 "a.out" hit Breakpoint 2, main (argc=1, argv=0x7fffffffe3a8) at source.c:16
16 retval=clone((void*)func,&(stack[4095]),clone_flag,NULL);
(gdb) print/x stack
$3 = 0x603430
(gdb) cont
Continuing.
[New LWP 25383]
[Switching to LWP 25383]
Thread 3 hit Breakpoint 3, func () at source.c:21
21 for(i=0;i<3;i++)
(gdb) cont
Continuing.
[Switching to LWP 25381]
Thread 2 hit Watchpoint 4: $rsp < 0x602420
Old value = 0
New value = 1
buffered_vfprintf (s=0x7ffff7dd2620 <_IO_2_1_stdout_>, format=0x40074e "i: %d\n ", args=0x603327) at vfprintf.c:2295
2295 vfprintf.c: No such file or directory.
(gdb) where
#0 buffered_vfprintf (s=0x7ffff7dd2620 <_IO_2_1_stdout_>, format=0x40074e "i: %d\n ", args=0x603327) at vfprintf.c:2295
#1 0x00007ffff7a5a32d in _IO_vfprintf_internal (s=0x7ffff7dd2620 <_IO_2_1_stdout_>, format=0x40074e "i: %d\n ",
ap=ap@entry=0x603327) at vfprintf.c:1293
#2 0x00007ffff7a62899 in __printf (format=<optimised out>) at printf.c:33
#3 0x00000000004006a8 in func () at source.c:23
#4 0x00007ffff7b1441d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
我们现在可以看到堆栈指针已经远远低于分配的堆栈范围。
(gdb) print/x $rsp
$4 = 0x600c4f
关于造成的差异printf，您可以比较执行跟踪（使用简单的si循环生成）。我发现他们在这次测试中首先出现分歧：
if (UNBUFFERED_P (s))
/* Use a helper function which will allocate a local temporary buffer
for the stream and then call us again. */
return buffered_vfprintf (s, format, ap, mode_flags);
看来早期的调用已将printf的模式更改stdout为“无缓冲”，因此后面的调用printf需要更深入地处理它。您可以通过将第一个替换为 来重现此printf内容setbuf(stdout,NULL)。
然而，真正的问题不是为什么printf会产生影响，而是“它是如何运作的？”。有三个进程，其中两个进程不小心使用它们共享的内存空间，因此它们是否以及何时崩溃取决于时间。