c++ - ThreadSanitizer FATAL 运行时异常

Question

我一直在努力让 ThreadSanitizer 与我拥有的 gcc 版本 (4.8.2) 一起工作，所以我采用了他们的简单示例:

#include <pthread.h>
#include <stdio.h>
#include <string>
#include <map>

typedef std::map<std::string, std::string> map_t;

void *threadfunc(void *p) {
  map_t& m = *(map_t*)p;
  m["foo"] = "bar";
  return 0;
}

int main() {
  map_t m;
  pthread_t t;
  pthread_create(&t, 0, threadfunc, &m);
  printf("foo=%s\n", m["foo"].c_str());
  pthread_join(t, 0);
}

并且在没有使用-fsanitize=thread的情况下进行编译，如下:

g++ -o testtsan testtsan.cpp -lpthread

这很好，然后我添加了线程 sanitizer

g++ -o testtsan testtsan.cpp -lpthread -fsanitize=thread

当然，如果没有 -pie -fPIC

，这当然会失败

g++ -o testtsan testtsan.cpp -lpthread -fsanitize=thread -pie -fPIC

然后编译，但是在运行时，我得到:

FATAL: ThreadSanitizer CHECK failed: ../../../../libsanitizer/sanitizer_common/sanitizer_allocator.h:310 "((kSpaceBeg)) == ((reinterpret_cast<uptr>(Mprotect(kSpaceBeg, kSpaceSize))))" (0x7d0000000000, 0xffffffffffffffff)
FATAL: ThreadSanitizer: failed to intercept pthread_mutex_lock

通过 strace 检查时，这似乎是因为它试图mmap 1TB 内存，所以失败并返回 ENOMEM。我已经启用了 ASLR，但现在我不知道这可能是什么 - 所以问题是，有人成功实现了吗？

在深入研究库代码之前，我希望有人可能已经遇到过这个......

环境:海湾合作委员会 4.8.2尝试过的内核:3.0.10 和 2.6.32(都是 Suse)，没有运气......

Answer 1

当我在 SLES11SP3 上使用 clang 3.4.2 的 TSan 遇到此故障时，我能够通过首先更改我的 shell 的 ulimit 来修复它，这样我可以创建那么大的映射，然后我需要以 super 用户身份执行它。

$ ./a.out
FATAL: ThreadSanitizer CHECK failed: bri/llvm-3.4.2.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_allocator.h:316 "((kSpaceBeg)) == (( reinterpret_cast<uptr>(Mprotect(kSpaceBeg, kSpaceSize))))" (0x7d0000000000, 0xfffffffffffffff4)
FATAL: ThreadSanitizer: failed to intercept pthread_mutex_lock

$ ulimit -v
10588960
$ ulimit -v $((10588960*1024))
$ ulimit -v
10843095040
$ ./a.out
==11348==WARNING: Program is run with limited virtual address space, which wouldn't work with ThreadSanitizer.
==11348==Re-execing with unlimited virtual address space.
==11348==WARNING: Program is run with limited virtual address space, which wouldn't work with ThreadSanitizer.
==11348==Re-execing with unlimited virtual address space.
==11348==WARNING: Program is run with limited virtual address space, which wouldn't work with ThreadSanitizer.
==11348==Re-execing with unlimited virtual address space.
...
# only able to recover w/Ctrl-C...

$ sudo ./a.out
root's password:
==11351==WARNING: Program is run with limited virtual address space, which wouldn't work with ThreadSanitizer.
==11351==Re-execing with unlimited virtual address space.
llvm-symbolizer: Unknown command line argument '--default-arch=x86_64'.  Try: '/usr/bin/llvm-symbolizer -help'
llvm-symbolizer: Did you mean '-demangle=x86_64'?
==11351==WARNING: Can't read from symbolizer at fd 3
llvm-symbolizer: Unknown command line argument '--default-arch=x86_64'.  Try: '/usr/bin/llvm-symbolizer -help'
llvm-symbolizer: Did you mean '-demangle=x86_64'?
==11351==WARNING: external symbolizer didn't start up correctly!
==11351==WARNING: Failed to use and restart external symbolizer!
==================
WARNING: ThreadSanitizer: data race (pid=11351)
  Write of size 4 at 0x7fbca5148c48 by thread T1:
    #0 Thread1 /home/bri/tmp/tsan/tiny_race.c:4 (exe+0x0000000ad64f)
    #1 <null> <null>:0 (a.out+0x000000052af4)

  Previous write of size 4 at 0x7fbca5148c48 by main thread:
    #0 main /home/bri/tmp/tsan/tiny_race.c:11 (exe+0x0000000ad6a3)

  Thread T1 (tid=11354, running) created by main thread at:
    #0 pthread_create bri/tsan/rtl/tsan_interceptors.cc:877 (exe+0x000000052c2b)
    #1 main /home/bri/tmp/tsan/tiny_race.c:10 (exe+0x0000000ad694)

SUMMARY: ThreadSanitizer: data race /home/bri/tmp/tsan/tiny_race.c:4 Thread1
==================
ThreadSanitizer: reported 1 warnings

symbolizer 警告可能是与我的特定 clang 构建相关的失败，请忽略它们。它可能仅用于分解 C++ 符号名称。