Linux下保护类内存数组检测段错误的问题求助

Let's break down your problem step by step. First, your mprotect test isn't triggering a segfault because there are a few key issues with how you're applying memory protection, and then we'll cover alternative strategies to track down that mutex corruption.

Why Your mprotect Isn't Working #

The main issues here are tied to memory alignment and proper error handling for the mprotect call:

1. Page Alignment Requirements: mprotect only operates on full, page-aligned memory regions. While you added __attribute__((aligned(4096))) to _buffer, the struct S itself might not be page-aligned when allocated by the third-party framework's new call. Default new aligns memory to the largest fundamental type (usually 8 or 16 bytes), not 4096. This means &_buffer[0] might not actually point to the start of a memory page, causing mprotect to silently fail.
2. Missing Error Checking: You aren't validating the return value of mprotect. It returns -1 on failure and sets errno to explain why (e.g., EINVAL for misaligned addresses). Always check this to catch setup failures early!

Fixing the mprotect Approach

Option 1: Align the entire S struct to a page boundary to ensure _buffer starts at a page edge:

struct S __attribute__((aligned(4096))) {
    char _buffer[4096] __attribute__((aligned(4096)));
    std::mutex _mutex;
    // ... other members

    S() {
        int ret = mprotect(&_buffer[0], 4096, PROT_NONE);
        if (ret == -1) {
            perror("mprotect failed");
            exit(EXIT_FAILURE);
        }
        // This should now trigger a segfault
        const int test = _buffer[0];
    }
};

Option 2: Use mmap to allocate the protected buffer directly (guarantees page alignment):

struct S {
    char* _buffer;
    std::mutex _mutex;
    // ... other members

    S() {
        _buffer = static_cast<char*>(mmap(nullptr, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
        if (_buffer == MAP_FAILED) {
            perror("mmap failed");
            exit(EXIT_FAILURE);
        }
        int ret = mprotect(_buffer, 4096, PROT_NONE);
        if (ret == -1) {
            perror("mprotect failed");
            exit(EXIT_FAILURE);
        }
        // Test access to confirm protection works
        const int test = _buffer[0];
    }

    ~S() {
        munmap(_buffer, 4096);
    }
};

Alternative Strategies to Track Mutex Corruption #

Since sanitizers aren't an option and Valgrind is too slow, try these practical, low-overhead approaches:

1. Hardware Watchpoints in GDB
   If you can reproduce the crash even occasionally, attach GDB to your process and set a write watchpoint on the mutex:

# Once the C object is instantiated, find the mutex address and set the watchpoint
watch -w &c.s._mutex

GDB will pause execution the moment any code writes to that mutex's memory, showing you the exact call stack responsible for the corruption. Hardware watchpoints are limited (usually 4 per CPU), but perfect for tracking single-variable writes.

2. Checked Mutex Wrapper
   Replace std::mutex with a custom wrapper that validates the mutex's integrity on every operation. This will catch corruption the next time the mutex is used:

#include <cstdio>
#include <mutex>
#include <execinfo.h>
#include <cstdlib>

struct CheckedMutex {
    std::mutex inner_mutex;
    uint32_t checksum;

    CheckedMutex() {
        checksum = calculate_checksum(&inner_mutex, sizeof(inner_mutex));
    }

    void lock() {
        verify_checksum();
        inner_mutex.lock();
    }

    void unlock() {
        inner_mutex.unlock();
        verify_checksum();
    }

private:
    uint32_t calculate_checksum(const void* data, size_t size) {
        const uint8_t* bytes = static_cast<const uint8_t*>(data);
        uint32_t sum = 0;
        for (size_t i = 0; i < size; ++i) {
            sum += bytes[i];
        }
        return sum;
    }

    void verify_checksum() {
        uint32_t current = calculate_checksum(&inner_mutex, sizeof(inner_mutex));
        if (current != checksum) {
            fprintf(stderr, "Mutex corrupted! Expected checksum: 0x%x, Got: 0x%x\n", checksum, current);
            // Print call stack to identify the culprit
            void* callstack[128];
            int frame_count = backtrace(callstack, 128);
            backtrace_symbols_fd(callstack, frame_count, STDERR_FILENO);
            abort();
        }
    }
};

// Update your struct S to use the checked mutex:
struct S {
    // ... other members
    CheckedMutex _mutex;
    // ...
};

3. Core Dump Analysis
   Ensure your system generates core dumps with ulimit -c unlimited before running your program. When the segfault occurs, load the core file into GDB:

gdb ./your_program core

Use commands like bt to get the crash stack, x/20x &s._mutex to inspect the corrupted memory, and info registers to see where the crash occurred. This can help you reverse-engineer what wrote to the mutex's address.

4. Perf Event Tracing
   Use the perf tool to track memory writes to the mutex's address. First, print the mutex address in your code:

printf("Mutex address: %p\n", &s._mutex);

Then run perf to trace writes to that address:

perf record -e mem:0x<mutex_address>:w -g ./your_program

When the crash happens, use perf report to view the call stacks associated with writes to that memory location.

内容的提问来源于stack exchange，提问作者user997112