2017-06-18 132 views
0

ENV: O/S版本:版本的Linux 3.4.11-RT19 硬件:MIPS 语言:CMIPS如何找到损坏的调用堆栈原因

问题: 如果调用堆栈被损坏,如何分析得到有用的信息,找出根本原因。

我检查了backtrace,coredump文件和源代码给出的funM DolMgmtGetNextRec(使用IPC来请求来自另一个进程的数据),发现没有任何可疑结果。被调用方框架已损坏,无法返回给调用方。调用者的每个本地定义的变量和参数都无法访问。

大部分时间它运行良好,但是当我使用某些工具攻击我的程序的开放端口时,内存消耗很快,则出现此问题, 程序以信号11终止,分段错误。

(gdb) bt 
#0 0x77277218 in DolMgmtGetNextRec (devCtxt=Cannot access memory at address 0x68 
) 
Cannot access memory at address 0x64 
(gdb) info reg 
      zero  at  v0  v1  a0  a1  a2  a3 
R0 00000000 10009900 00000000 00000001 00000001 00000001 00000001 00000000 
      t0  t1  t2  t3  t4  t5  t6  t7 
R8 00000000 00001000 00001000 fffffff0 00000807 00000800 00000400 00000008 
      s0  s1  s2  s3  s4  s5  s6  s7 
R16 76d044f0 00000000 774fd020 00000000 00000000 00000000 00008000 774fb000 
      t8  t9  k0  k1  gp  sp  s8  ra 
R24 00000001 774e4f30 00000000 00000000 772d4e10 76d03d90 00000000 77277218 
      sr  lo  hi  bad cause  pc 
     00009913 a6d6a883 2775cba8 00000028 00000008 77277218 
      fsr  fir 
     00000000 00000000 
(gdb) 
(gdb) info locals 
priority = <error reading variable priority (Cannot access memory at address 0x44)> 
dstNodeId = <error reading variable dstNodeId (Cannot access memory at address 0x3c)> 
ReceiveLen = <error reading variable ReceiveLen (Cannot access memory at address 0x50)> 
srcChnlId = <error reading variable srcChnlId (Cannot access memory at address 0x54)> 
pStruMsg = <error reading variable pStruMsg (Cannot access memory at address 0x30)> 
Ret = <error reading variable Ret (Cannot access memory at address 0x48)> 
SendLen = <error reading variable SendLen (Cannot access memory at address 0x40)> 
getRequest = <error reading variable getRequest (Cannot access memory at address 0x58)> 
pRspMsg = <error reading variable pRspMsg (Cannot access memory at address 0x34)> 
dstChnlId = <error reading variable dstChnlId (Cannot access memory at address 0x38)> 
__FUNCTION__ = "DolMgmtGetNextRec" 
(gdb) 

回答

0

它可能是一个堆栈缓冲区溢出(这可能是一个生产软件致命的)。

尝试Valgrind,clang-sanitizer

你也可以看看堆栈(hexdump)(肉眼)看看哪些数据包溢出栈(如果你熟悉你的数据包)