Windbg调试死锁

最新推荐文章于 2025-03-19 10:02:59 发布

CoderAndClimber

最新推荐文章于 2025-03-19 10:02:59 发布

阅读量884

点赞数

分类专栏： C++

本文链接：https://blog.youkuaiyun.com/u014023993/article/details/102983475

版权

C++ 专栏收录该内容

27 篇文章

订阅专栏

本文通过示例代码和Windbg调试步骤详细解析了如何分析死锁情况。在分析过程中，发现两个锁g_cs1和g_cs2分别被不同线程持有，导致线程1和线程2形成死锁状态。通过`!locks`，`~`和查看线程堆栈等指令，可以确定死锁原因并提供解决方案。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

示例代码

#include <iostream>
#include <stdlib.h>
#include <windows.h>
#include <process.h>

static CRITICAL_SECTION g_cs1;
static CRITICAL_SECTION g_cs2;

unsigned int __stdcall threadFunc1(LPVOID lp)
{
	std::cout << "Enter threadFunc1" << std::endl;

	EnterCriticalSection(&g_cs1);	
	Sleep(10);

	EnterCriticalSection(&g_cs2);
	// do something
 	LeaveCriticalSection(&g_cs2);

 	LeaveCriticalSection(&g_cs1);
	std::cout << "Leave threadFunc1" << std::endl;
	return 0;
}

unsigned int  __stdcall threadFunc2(LPVOID lp)
{
	std::cout << "Enter threadFunc2" << std::endl;
	EnterCriticalSection(&g_cs2);	
	Sleep(10);

	EnterCriticalSection(&g_cs1);
	// do something
 	LeaveCriticalSection(&g_cs1);

 	LeaveCriticalSection(&g_cs2);
	std::cout << "Leave threadFunc2" << std::endl;
	return 0;
}

int main()
{
	InitializeCriticalSection(&g_cs1);
	InitializeCriticalSection(&g_cs2);

	_beginthreadex(NULL, 0, threadFunc1, 0, 0, NULL);
	_beginthreadex(NULL, 0, threadFunc2, 0, 0, NULL);

	system("pause");
	return 0;
}

运行

并未输出：Leave threadFunc1 及 Leave threadFunc2

分析

1. 输入指令：!locks

*** WARNING: Unable to verify checksum for DeadLock.exe

CritSec DeadLock!g_cs1+0 at 0133437c

WaiterWoken No

LockCount 1

RecursionCount 1

OwningThread 6284

EntryCount 0

ContentionCount 1

*** Locked

CritSec DeadLock!g_cs2+0 at 01334394

WaiterWoken No

LockCount 1

RecursionCount 1

OwningThread 7288

EntryCount 0

ContentionCount 1

*** Locked

Scanned 109 critical sections

经过分析，我们发现有两个锁，一个是g_cs1，地址为0133437c，其所属线程为6284；另一个是g_cs2，地址为01334394，其所属线程为7288。为方便，以表格形式展示：

锁名称	锁地址	所属线程
g_cs1	0133437c	6284
g_cs2	01334394	7288

2. 查看所有线程：~

0 Id: 7084.737c Suspend: 1 Teb: 7efdd000 Unfrozen

1 Id: 7084.6284 Suspend: 1 Teb: 7efda000 Unfrozen

2 Id: 7084.7288 Suspend: 1 Teb: 7efd7000 Unfrozen

3 Id: 7084.7048 Suspend: 1 Teb: 7ef9f000 Unfrozen

从线程信息可以看到，线程6282及7288当前的状态都是Suspend（7084表示进程号）。1是6284线程的相对线程号，2是7288线程的相对线程号。

3. 分别查看线程6284及7288的堆栈：

查看线程6248堆栈：~1 kb

# ChildEBP RetAddr Args to Child

00 0088f7b8 7773eb4e 00000044 00000000 00000000 ntdll!NtWaitForSingleObject+0x15

01 0088f81c 7773ea32 00000000 00000000 0063f8a0 ntdll!RtlpWaitOnCriticalSection+0x13e

02 0088f844 01331045 01334394 01331000 01331000 ntdll!RtlEnterCriticalSection+0x150

03 0088f85c 65a262e4 00000000 5230abd3 00000000 DeadLock!threadFunc1+0x45 [f:\总结文档\windbg\deadlock\deadlock\deadlock.cpp @ 23]

04 0088f898 75d9336a 0063f8a0 0088f8e4 777298f2 ucrtbase!thread_start<unsigned int (__stdcall*)(void *)>+0x54

05 0088f8a4 777298f2 0063f8a0 74cb5f34 00000000 kernel32!BaseThreadInitThunk+0xe

06 0088f8e4 777298c5 65a26290 0063f8a0 00000000 ntdll!__RtlUserThreadStart+0x70

07 0088f8fc 00000000 65a26290 0063f8a0 00000000 ntdll!_RtlUserThreadStart+0x1b

6284线程当前在等待锁01334394，也即g_cs2

查看线程7288堆栈：~2 kb

# ChildEBP RetAddr Args to Child

00 009efdf8 7773eb4e 00000048 00000000 00000000 ntdll!NtWaitForSingleObject+0x15

01 009efe5c 7773ea32 00000000 00000000 0063f900 ntdll!RtlpWaitOnCriticalSection+0x13e

02 009efe84 013310d5 0133437c 01331090 01331090 ntdll!RtlEnterCriticalSection+0x150

03 009efe9c 65a262e4 00000000 5226ad93 00000000 DeadLock!threadFunc2+0x45 [f:\总结文档\windbg\deadlock\deadlock\deadlock.cpp @ 38]

04 009efed8 75d9336a 0063f900 009eff24 777298f2 ucrtbase!thread_start<unsigned int (__stdcall*)(void *)>+0x54

05 009efee4 777298f2 0063f900 74dd58f4 00000000 kernel32!BaseThreadInitThunk+0xe

06 009eff24 777298c5 65a26290 0063f900 00000000 ntdll!__RtlUserThreadStart+0x70

07 009eff3c 00000000 65a26290 0063f900 00000000 ntdll!_RtlUserThreadStart+0x1b

7288线程当前在等待锁0133437c，也即g_cs1

结论

将上述分析结果以表格形式汇总：

从汇总结果看，线程1,2形成了死锁。

扩展

1. !cs Address：显示指定临界区

0:001> !cs 01334394

-----------------------------------------

Critical section = 0x01334394 (DeadLock!g_cs2+0x0)

DebugInfo = 0x0063f868

LOCKED

LockCount = 0x1

WaiterWoken = No

OwningThread = 0x00007288

RecursionCount = 0x1

LockSemaphore = 0x44

SpinCount = 0x00000000

2. !cs –l ：显示锁定的临界区

0:001> !cs -l

-----------------------------------------

DebugInfo = 0x0063f0a8

Critical section = 0x0133437c (DeadLock!g_cs1+0x0)

LOCKED

LockCount = 0x1

WaiterWoken = No

OwningThread = 0x00006284

RecursionCount = 0x1

LockSemaphore = 0x48

SpinCount = 0x00000000

-----------------------------------------

DebugInfo = 0x0063f868

Critical section = 0x01334394 (DeadLock!g_cs2+0x0)

LOCKED

LockCount = 0x1

WaiterWoken = No

OwningThread = 0x00007288

RecursionCount = 0x1

LockSemaphore = 0x44

SpinCount = 0x00000000

3. !cs –o：Displays the owner's stack for any locked critical section that is being displayed

参考资料

1. 调试死锁

2. !deadlock