dmalloc输出“未释放”：使用“printf”和“fgetc”时，“0x7f2e20d36808\s1”(1182字节)来自“未知”

Question

我们一直使用dmalloc作为工具集的一部分，以验证我们的核心库是否没有内存泄漏。然而，最近我们发现使用printf或fgetc会导致dmalloc在dmalloc.log中抛出以下警告。

not freed: '0x7f2e20d36808|s1' (1182 bytes) from 'unknown'

为了演示这个问题，下面是一个非常简单的程序，我们用它来重现错误：

#include <stdio.h>
#include <stdlib.h>
#include "dmalloc.h"

void main() {
        dmalloc_debug_setup("log-stats,log-non-free,check-fence,log=dmalloc.log");
        printf("Hello World\n");
        fgetc(stdin);
}

用以下方法编译程序：

gcc test.c -ldmalloc -g -o test

运行，我将得到以下结果：

1630587465: 2: Dmalloc version '5.5.2' from 'http://dmalloc.com/'
1630587465: 2: flags = 0x403, logfile 'dmalloc.log'
1630587465: 2: interval = 0, addr = 0, seen # = 0, limit = 0
1630587465: 2: threads enabled, lock-on = 0, lock-init = 2
1630587465: 2: starting time = 1630587464
1630587465: 2: process pid = 2079
1630587465: 2: Dumping Chunk Statistics:
1630587465: 2: basic-block 4096 bytes, alignment 8 bytes
1630587465: 2: heap address range: 0x7f343a6e0000 to 0x7f343a712000, 204800 bytes
1630587465: 2:     user blocks: 4 blocks, 8192 bytes (33%)
1630587465: 2:    admin blocks: 2 blocks, 8192 bytes (33%)
1630587465: 2:    total blocks: 6 blocks, 24576 bytes
1630587465: 2: heap checked 0
1630587465: 2: alloc calls: malloc 2, calloc 0, realloc 0, free 0
1630587465: 2: alloc calls: recalloc 0, memalign 0, posix_memalign 0, valloc 0
1630587465: 2: alloc calls: new 0, delete 0
1630587465: 2:   current memory in use: 8192 bytes (2 pnts)
1630587465: 2:  total memory allocated: 8192 bytes (2 pnts)
1630587465: 2:  max in use at one time: 8192 bytes (2 pnts)
1630587465: 2: max alloced with 1 call: 4096 bytes
1630587465: 2: max unused memory space: 8192 bytes (50%)
1630587465: 2: top 10 allocations:
1630587465: 2:  total-size  count in-use-size  count  source
1630587465: 2:           0      0           0      0  Total of 0
1630587465: 2: Dumping Not-Freed Pointers Changed Since Start:
1630587465: 2:  not freed: '0x7f343a6f0008|s1' (4096 bytes) from 'unknown'
1630587465: 2:  not freed: '0x7f343a710008|s1' (4096 bytes) from 'unknown'
1630587465: 2:  total-size  count  source
1630587465: 2:           0      0  Total of 0
1630587465: 2: ending time = 1630587465, elapsed since start = 0:00:01

删除fgetc，我只收到一个警告，内存未被释放。

1630587578: 1: Dumping Not-Freed Pointers Changed Since Start:
1630587578: 1:  not freed: '0x7f939f4e0008|s1' (4096 bytes) from 'unknown'
1630587578: 1:  total-size  count  source
1630587578: 1:           0      0  Total of 0

删除printf，然后我得到：

1630587655: 0: Dumping Not-Freed Pointers Changed Since Start:
1630587655: 0:  memory table is empty
1630587655: 0: ending time = 1630587655, elapsed since start = 0:00:00

这里使用的gcc版本为9.3.0，dmalloc为5.5.2，这是大多数最新的Linux发行版在使用其包管理器安装时提供的。

如果这是一个已知的dmalloc问题，或者我在这里缺少一些明显的设置，经验丰富的人能帮助我指出吗？

更新

1. 在用g++编译时也会注意到这一点。
2. 有人指出，图书馆5.5.2已经很旧了。我已经构建了最新的5.6.5版本，并使用gcc 11.2.0进行了测试，问题仍然存在。

1630589888: 2: Dmalloc version '5.6.5' from 'http://dmalloc.com/'
1630589888: 2: flags = 0x403, logfile 'dmalloc.log'
1630589888: 2: interval = 0, addr = 0x0, seen # = 0, limit = 0
1630589888: 2: starting time = 1630589886
1630589888: 2: process pid = 11185
1630589888: 2: Dumping Chunk Statistics:
1630589888: 2: basic-block 4096 bytes, alignment 8 bytes
1630589888: 2: heap address range: 0x7ff82bd98000 to 0x7ff82bd9b000, 12288 bytes
1630589888: 2:     user blocks: 1 blocks, 2048 bytes (16%)
1630589888: 2:    admin blocks: 2 blocks, 8192 bytes (67%)
1630589888: 2:    total blocks: 3 blocks, 12288 bytes
1630589888: 2: heap checked 0
1630589888: 2: alloc calls: malloc 2, calloc 0, realloc 0, free 0
1630589888: 2: alloc calls: recalloc 0, memalign 0, valloc 0
1630589888: 2: alloc calls: new 0, delete 0
1630589888: 2:   current memory in use: 2048 bytes (2 pnts)
1630589888: 2:  total memory allocated: 2048 bytes (2 pnts)
1630589888: 2:  max in use at one time: 2048 bytes (2 pnts)
1630589888: 2: max alloced with 1 call: 1024 bytes
1630589888: 2: max unused memory space: 2048 bytes (50%)
1630589888: 2: top 10 allocations:
1630589888: 2:  total-size  count in-use-size  count  source
1630589888: 2:           0      0           0      0  Total of 0
1630589888: 2: Dumping Not-Freed Pointers Changed Since Start:
1630589888: 2:  not freed: '0x7ff82bd9a008|s1' (1024 bytes) from 'unknown'
1630589888: 2:  not freed: '0x7ff82bd9a808|s1' (1024 bytes) from 'unknown'
1630589888: 2:  total-size  count  source
1630589888: 2:           0      0  Total of 0
1630589888: 2: ending time = 1630589888, elapsed since start = 0:00:02

1. 添加了与dmalloc引发的问题的链接。请参阅这里

Answer 1

我会在这里回答我自己的问题。经过更多的测试后，我可以确认这种行为也是从jemalloc或mtrace等其他库中观察到的。结论是，在不同的平台上，“libc”的实现当然是不同的，在这个场景中，Linux的实现(在我的Debian和Ubuntu上观察到)在这些库可以检查的最后一点之前并没有释放分配的缓冲区。

因此，这不是dmalloc中的一个bug。其他的工具，如‘英勇’，将是一个更适合这种情况。