这段C代码错在哪里啊，找了一下午了。。。

wliang511

源代码如下：最后到scull_exit函数中第二条free语句即是free(qsetnp->data),进程被杀死，glibc提示错误

由于是经过简单化处理的，所以可能有点乱

1楼市源代码，2楼是调试过程

1. 
   
2. #include <stdio.h>
   
3. #include <stdlib.h>
   
4. #include <string.h>
   
5. #include <errno.h>
   
6. 
   
7. 
   
8. struct scull_qset
   
9. {
   
10.   void **data;
    
11.   struct scull_qset *next;
    
12. };
    
13. 
    
14. struct scull_dev
    
15. {
    
16.   struct scull_qset*data;/*point to the first set of quanta*/
    
17.   int quantum;/*size of current quanta*/
    
18.   int qset;/*number of pointer array element,the array element may point to the quanta*/
    
19.   unsigned long size;/*total size data of current dev*/
    
20.   unsigned int access_key;
    
21. };
    
22. 
    
23. #define MYSCULL_NO 1
    
24. #define MYSCULL_NAME "scull"
    
25. #define MYSCULL_SZ_QSET    1000/*qset->data ,1000 elements if malloced*/
    
26. #define MYSCULL_SZ_QUAN    4000/*each quanta size of bytes if malloced*/
    
27. 
    
28. static struct scull_dev myscull[MYSCULL_NO];
    
29. 
    
30. 
    
31. int scull_write(struct scull_dev *devp,char *bufp,unsigned count,unsigned long*offp)
    
32. {
    
33.   int ret = 0,i;
    
34.   unsigned int itemindex;
    
35.   unsigned long itemsize;
    
36.   unsigned long itemoff;
    
37.   unsigned int quanindex;
    
38.   unsigned long quanoff;
    
39.   struct scull_qset *itemp;
    
40.   struct scull_qset *prev_itemp;
    
41.   
    
42.   if (devp == NULL)
    
43.   {
    
44.     return -1;
    
45.   }
    
46. 
    
47.   devp->data = malloc(sizeof(struct scull_qset));
    
48.   if (devp->data == NULL)
    
49.   {
    
50.         ret = -4;
    
51.         goto out;
    
52.   }
    
53.   itemp = devp->data;
    
54.   itemp->data = NULL;
    
55.   itemp->next = NULL;
    
56.   
    
57.   itemp->data = malloc(sizeof(devp->qset * sizeof(char *)));
    
58.   if (itemp->data == NULL)
    
59.   {
    
60.     ret = -5;
    
61.     goto out;
    
62.   }
    
63.   //memset((void *)itemp->data,0,sizeof(devp->qset * sizeof(char *)));
    
64.   for (i = 0;i < devp->qset;i ++)
    
65.           itemp->data[i] = NULL;
    
66. 
    
67. 
    
68. out:
    
69. 
    
70.   return ret;
    
71. }
    
72. 
    
73. 
    
74. static void  scull_exit(void)
    
75. {
    
76.   int i,j;
    
77.   struct scull_qset *qsetp;
    
78.   struct scull_qset *qsetnp;
    
79. 
    
80.   
    
81. /*free memory*/
    
82. for (i = 0;i < MYSCULL_NO;i ++)
    
83. {
    
84.    qsetnp = myscull[i].data;
    
85.    while (qsetnp != NULL)
    
86.    {
    
87.      if (qsetnp->data != NULL)
    
88.      {
    
89.        for (j = 0;j < myscull[i].qset;j++)
    
90.        {
    
91.          if (qsetnp->data[j] != NULL)
    
92.             free(qsetnp->data[j]);            
    
93.        }
    
94.           free(qsetnp->data);/*执行这条语句立马收到SIGABRT信号，进程被kill*/
    
95.      }
    
96.    qsetp = qsetnp;
    
97.    qsetnp = qsetnp->next;
    
98.    free(qsetp);
    
99.    }
    
100.    
     
101.    myscull[i].data = NULL;
     
102.    myscull[i].qset = 0;
     
103.    myscull[i].quantum= 0;
     
104.    myscull[i].size = 0;
     
105.    myscull[i].access_key = 0;
     
106.      
     
107. }
     
108.   
     
109. }
     
110. 
     
111. static int  scull_init(void)
     
112. {
     
113.   int i;
     
114.   int ret = 0;
     
115. 
     
116.   for (i = 0;i < MYSCULL_NO;i ++)
     
117.   {
     
118.     myscull[i].data = NULL;
     
119.     myscull[i].quantum = MYSCULL_SZ_QUAN;
     
120.     myscull[i].qset = MYSCULL_SZ_QSET;
     
121.     myscull[i].size = 0;
     
122.     myscull[i].access_key = 0666;
     
123.   }
     
124. 
     
125.   printf("scull init return:%d\n",ret);
     
126. 
     
127.   return ret;
     
128. }
     
129. 
     
130. int main(void)
     
131. {
     
132.   char bufp[300];
     
133.   unsigned long off;
     
134.   int ret;
     
135. 
     
136.   memset(bufp,0xee,sizeof(bufp));
     
137. 
     
138.   scull_init();
     
139. 
     
140.   off = 0;
     
141. //  ret = scull_write(&myscull[0],bufp,sizeof(bufp),&off);
     
142.   ret = scull_write(myscull,bufp,300,&off);
     
143. // if (ret > 0) off += ret;
     
144. // ret = scull_write(&myscull[0],bufp,sizeof(bufp),&off);
     
145. 
     
146.   scull_exit();
     
147. 
     
148.   return 0;
     
149. }
     
150. 
     

复制代码

[ 本帖最后由 wliang511 于 2009-12-23 22:22 编辑 ]

wliang511

1. 
   
2. 
   
3. [?1034hGNU gdb Red Hat Linux (6.6-8.fc7rh)
   
4. Copyright (C) 2006 Free Software Foundation, Inc.
   
5. GDB is free software, covered by the GNU General Public License, and you are
   
6. welcome to change it and/or distribute copies of it under certain conditions.
   
7. Type "show copying" to see the conditions.
   
8. There is absolutely no warranty for GDB.  Type "show warranty" for details.
   
9. This GDB was configured as "i386-redhat-linux-gnu".
   
10. (gdb) file a.out
    
11. Reading symbols from /home/share/driver/cdev/exam_1/test/a.out...done.
    
12. Using host libthread_db library "/lib/libthread_db.so.1".
    
13. (gdb) l
    
14. 272          
    
15. 273        }
    
16. 274       
    
17. 275        int main(void)
    
18. 276        {
    
19. 277          char bufp[300];
    
20. 278          unsigned long off;
    
21. 279          int ret;
    
22. 280       
    
23. 281          memset(bufp,0xee,sizeof(bufp));
    
24. (gdb) b 281
    
25. Breakpoint 1 at 0x80488d4: file scull.c, line 281.
    
26. (gdb) r
    
27. Starting program: /home/share/driver/cdev/exam_1/test/a.out
    
28. 
    
29. Breakpoint 1, main () at scull.c:281
    
30. 281          memset(bufp,0xee,sizeof(bufp));
    
31. (gdb) n
    
32. 283          scull_init();
    
33. (gdb)
    
34. 285          off = 0;
    
35. (gdb)
    
36. 287          ret = scull_write(myscull,bufp,300,&off);
    
37. (gdb) s
    
38. scull_write (devp=0x8049bf0, bufp=0xbfff0654 '? <repeats 200 times>..., count=300,
    
39.     offp=0xbfff0650) at scull.c:97
    
40. 97          int ret = 0,i;
    
41. (gdb)
    
42. 106          if (devp == NULL)
    
43. (gdb)
    
44. 111          devp->data = malloc(sizeof(struct scull_qset));
    
45. (gdb)
    
46. 112          if (devp->data == NULL)
    
47. (gdb) p devp-?data>data
    
48. $1 = (struct scull_qset *) 0x8429008
    
49. (gdb) s
    
50. 117          itemp = devp->data;
    
51. (gdb)
    
52. 118          itemp->data = NULL;
    
53. (gdb)
    
54. 119          itemp->next = NULL;
    
55. (gdb)
    
56. 121          itemp->data = malloc(sizeof(devp->qset * sizeof(char *)));
    
57. (gdb)
    
58. 122          if (itemp->data == NULL)
    
59. (gdb) p itemp-?>data
    
60. $2 = (void **) 0x8429018
    
61. (gdb) p itemp
    
62. $3 = (struct scull_qset *) 0x8429008
    
63. (gdb) s
    
64. 128          for (i = 0;i < devp->qset;i ++)
    
65. (gdb)
    
66. 129                  itemp->data[i] = NULL;
    
67. (gdb) l
    
68. 124            ret = -5;
    
69. 125            goto out;
    
70. 126          }
    
71. 127          //memset((void *)itemp->data,0,sizeof(devp->qset * sizeof(char *)));
    
72. 128          for (i = 0;i < devp->qset;i ++)
    
73. 129                  itemp->data[i] = NULL;
    
74. 130       
    
75. 131       
    
76. 132       
    
77. 133          return 0;
    
78. (gdb) u 133
    
79. scull_write (devp=0x8049bf0, bufp=0xbfff0654 '? <repeats 200 times>..., count=300,
    
80.     offp=0xbfff0650) at scull.c:133
    
81. 133          return 0;
    
82. (gdb) s
    
83. 217        }
    
84. (gdb)
    
85. main () at scull.c:291
    
86. 291          scull_exit();
    
87. (gdb)
    
88. scull_exit () at scull.c:246
    
89. 246         for (i = 0;i < MYSCULL_NO;i ++)
    
90. (gdb)
    
91. 248           qsetnp = myscull[i].data;
    
92. (gdb)
    
93. 249           while (qsetnp != NULL)
    
94. (gdb)
    
95. 251             if (qsetnp->data != NULL)
    
96. (gdb)
    
97. 253               for (j = 0;j < myscull[i].qset;j++)
    
98. (gdb) p qsetnp
    
99. $4 = (struct scull_qset *) 0x8429008
    
100. (gdb) p sqsetnp_-?dat>data
     
101. $5 = (void **) 0x8429018
     
102. (gdb) s
     
103. 255                 if (qsetnp->data[j] != NULL)
     
104. (gdb)
     
105. 253               for (j = 0;j < myscull[i].qset;j++)
     
106. (gdb) l
     
107. 248           qsetnp = myscull[i].data;
     
108. 249           while (qsetnp != NULL)
     
109. 250           {
     
110. 251             if (qsetnp->data != NULL)
     
111. 252             {
     
112. 253               for (j = 0;j < myscull[i].qset;j++)
     
113. 254               {
     
114. 255                 if (qsetnp->data[j] != NULL)
     
115. 256                           free(qsetnp->data[j]);            
     
116. 257               }
     
117. (gdb) l 256
     
118. 251             if (qsetnp->data != NULL)
     
119. 252             {
     
120. 253               for (j = 0;j < myscull[i].qset;j++)
     
121. 254               {
     
122. 255                 if (qsetnp->data[j] != NULL)
     
123. 256                           free(qsetnp->data[j]);            
     
124. 257               }
     
125. 258                   free(qsetnp->data);
     
126. 259             }
     
127. 260           qsetp = qsetnp;
     
128. (gdb) u 260
     
129. scull init return:0
     
130. 
     
131. Program received signal SIGABRT, Aborted.
     
132. 0x0092c402 in __kernel_vsyscall ()
     
133. (gdb) q
     
134. The program is running.  Exit anyway? (y or n) Not confirmed.
     
135. (gdb) bt
     
136. #0  0x0092c402 in __kernel_vsyscall ()
     
137. #1  0x00129fa0 in raise () from /lib/libc.so.6
     
138. #2  0x0012b8b1 in abort () from /lib/libc.so.6
     
139. #3  0x00160ebb in __libc_message () from /lib/libc.so.6
     
140. #4  0x00168f41 in _int_free () from /lib/libc.so.6
     
141. #5  0x0016c580 in free () from /lib/libc.so.6
     
142. #6  0x08048819 in scull_exit () at scull.c:258
     
143. #7  0x08048931 in main () at scull.c:291
     
144. (gdb) quit
     
145. The program is running.  Exit anyway? (y or n)
     
146. 
     

复制代码

wliang511

找到了。。好低级的一个错误。。竟然找了一下午。。。
itemp->data = malloc(sizeof(devp->qset * sizeof(char *)));

版主帮忙删下帖子。。。

peijieking

你太强了吧，程序很复杂

lanjing5

qset 是没有初始化吧？