c - SIGSEGV 在 memalign 中运行 efence

Question

我正在尝试在我的代码上运行 efence，它总是核心在这里:

Electric Fence 2.1 Copyright (C) 1987-1998 Bruce Perens.
Program received signal SIGSEGV, Segmentation fault.
memalign (alignment=4, userSize=28) at ../utils/libefence/efence.c:492
492     ../utils/libefence/efence.c: No such file or directory.
        in ../utils/libefence/efence.c
(gdb) bt
#0  memalign (alignment=4, userSize=28) at ../utils/libefence/efence.c:492
#1  0xf7ff928c in malloc (size=27) at ../utils/libefence/efence.c:816
#2  0x41c92c67 in operator new(unsigned int) () from /usr/lib/libstdc++.so.6
#3  0x41c78204 in std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_Rep::_S_create(unsigned int, unsigned int, std::allocator<char> const&) () from /usr/lib/libstdc++.so.6
#4  0x41c7a468 in char* std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) () from /usr/lib/libstdc++.so.6
#5  0x41c7a5d6 in std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) ()
   from /usr/lib/libstdc++.so.6
#6  0xefb12078 in __static_initialization_and_destruction_0 ()
    at ../include/isan/objstoredefs/core/Parameters.h:125
#7  _GLOBAL__sub_I_RecurrWindowPBI.cc(void) ()
    at ../dme/svc/common/src/gen/ifc/beh/./imp/trig/RecurrWindowPBI.cc:77
#8  0xefbc9dfd in __do_global_ctors_aux ()
   from /isan/lib/libsvc_ifc_behcommon.so
#9  0xefaf59b5 in _init () from /isan/lib/libsvc_ifc_behcommon.so
#10 0x419fd486 in __ctype_init () from /lib/libc.so.6
#11 0x4100ed39 in ?? () from /lib/ld-linux.so.2
#12 0x4100ee8f in ?? () from /lib/ld-linux.so.2
#13 0x410011ef in ?? () from /lib/ld-linux.so.2
(gdb) frame 2
#2  0x41c92c67 in operator new(unsigned int) () from /usr/lib/libstdc++.so.6

我尝试使用 GDB 运行程序，并将 efence 库的环境设置为 LD_PRELOAD。

问题似乎出在这里:

491 for ( slot = allocationList, count = slotCount ; count > 0; count-- ) {
492     if ( slot->mode == FREE
493      && slot->internalSize >= internalSize ) {
494         if ( !fullSlot
495          ||slot->internalSize < fullSlot->internalSize){
496             fullSlot = slot;
497             if ( slot->internalSize == internalSize
498              && emptySlots[0] )
499                 break;  /* All done, */
500         }
501     }
502     else if ( slot->mode == NOT_IN_USE ) {
503         if ( !emptySlots[0] )
504             emptySlots[0] = slot;
505         else if ( !emptySlots[1] )
506             emptySlots[1] = slot;
507         else if ( fullSlot
508          && fullSlot->internalSize == internalSize )
509             break;  /* All done. */
510     }
511     slot++;
512 }

但是，在 GDB 中，我可以毫无问题地复制槽结构:

(gdb) p slot
$1 = (Slot *) 0xef846000
(gdb) p slot->mode
$2 = NOT_IN_USE
(gdb) 
(gdb) x/10i $eip
=> 0xf7ff9590 <memalign+448>:   mov    0x10(%edi),%edx
   0xf7ff9593 <memalign+451>:   cmp    $0x1,%edx
   0xf7ff9596 <memalign+454>:   jne    0xf7ff95c0 <memalign+496>
   0xf7ff9598 <memalign+456>:   mov    0xc(%edi),%edx
   0xf7ff959b <memalign+459>:   cmp    %edx,%esi
   0xf7ff959d <memalign+461>:   ja     0xf7ff95f8 <memalign+552>
   0xf7ff959f <memalign+463>:   test   %ecx,%ecx
   0xf7ff95a1 <memalign+465>:   je     0xf7ff95a8 <memalign+472>
   0xf7ff95a3 <memalign+467>:   cmp    0xc(%ecx),%edx
   0xf7ff95a6 <memalign+470>:   jae    0xf7ff95f8 <memalign+552>

(gdb) p/x $edi
$5 = 0xef846000

(gdb) ptype (*slot)
type = struct _Slot {
    void *userAddress;
    void *internalAddress;
    size_t userSize;
    size_t internalSize;
    Mode mode;
}
(gdb) p allocationList
$6 = (Slot *) 0xef846000
(gdb) p allocationList[0]
$7 = {userAddress = 0x0, internalAddress = 0x0, userSize = 0, 
  internalSize = 0, mode = NOT_IN_USE}

有什么帮助吗？

efence代码如下: http://linux.softpedia.com/get/Programming/Debuggers/Electric-Fence-3305.shtml

谢谢!!

Answer 1

所以 0xef846000 SEGV 处的可疑插槽不是 NULL。解释是相邻段被读/写保护，导致 SIGBUS。但我猜在 linux 上这个 BUS 原来是一个 SEGV。

在 GDB repl 中，那些段读保护位被禁用/否决。

那么剩下的问题就是allocationList[0]位于哪个内存段？我猜它在没有读取位的栅栏中。怎么会这样？不知道。