linux - SIGSEGV 的原因

Question

我创建了一个示例应用程序来理解 ELF 二进制格式的实验。

当我运行它时，它在收到 SIGSEGV 后崩溃。用 gdb 附加它然后运行后，我看到它在以下行崩溃

(gdb) x/i 0x08054697
=> 0x8054697:   mov    %edx,0x80f8f5c

但是，该指令的目标地址是一个有效地址，并且该内存被映射为可写。

(gdb) p/x *0x80f8f5c
$3 = 0x0
(gdb) si

Program received signal SIGSEGV, Segmentation fault.
0x08054697 in ?? ()

我想了解为什么这个进程会收到 SIGSEGV？为了找出原因，我还应该寻找什么其他的东西。

这里是 readelf 的输出，显示了映射的虚拟内存区域。

Elf file type is EXEC (Executable file)
Entry point 0x8048e08
There are 13 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x08047034 0x08047034 0x002a4 0x002a4 R E 0x1
  INTERP         0x0001d4 0x080471d4 0x080471d4 0x00013 0x00013 R   0x1
      [Requesting program interpreter: /lib/ld-linux.so.2]
  DYNAMIC        0x0001e7 0x080471e7 0x080471e7 0x00060 0x00060 RW  0x1
  LOAD           0x000000 0x08047000 0x08047000 0x01000 0x01000 R E 0x1
  LOAD           0x001000 0x08048000 0x08048000 0xae948 0xae948 R E 0x1000
  LOAD           0x0b06dc 0x080f86dc 0x080f86dc 0x015f8 0x07730 RW  0x1000
  LOAD           0x0c52b8 0x081002b8 0x081002b8 0x00400 0x00400 R E 0x1
  LOAD           0x0c56b8 0x081006b8 0x081006b8 0x00400 0x00400 R E 0x1
  LOAD           0x0c5ab8 0x08100ab8 0x08100ab8 0x00400 0x00400 R E 0x1
  NOTE           0x0010f4 0x080480f4 0x080480f4 0x00044 0x00044 R   0x4
  TLS            0x0b06dc 0x080f86dc 0x080f86dc 0x00010 0x00030 R   0x4
  GNU_STACK      0x001000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4
  GNU_RELRO      0x0b06dc 0x080f86dc 0x080f86dc 0x00924 0x00924 R   0x1

二进制文件中的相关指令是

0x805467d:  mov    0x64(%esp),%edx
0x8054681:  mov    0x68(%esp),%ecx
0x8054685:  mov    %eax,0x80f9a44
0x805468a:  lea    0x4(%ecx,%edx,4),%eax
0x805468e:  mov    0x78(%esp),%edx
0x8054692:  mov    %eax,0x80ff1c8
==> 0x8054697:  mov    %edx,0x80f8f5c
0x805469d:  lea    0x0(%esi),%esi

gdb 中有没有办法确定地址是否映射为只读？

此段错误的原因可能是什么？

C 代码

---

/*

ECHOSERV.C
==========
(c) Paul Griffiths, 1999
Email: mail@paulgriffiths.net

Simple TCP/IP echo server.

*/


#include <sys/socket.h>       /*  socket definitions        */
#include <sys/types.h>        /*  socket types              */
#include <arpa/inet.h>        /*  inet (3) functions         */
#include <unistd.h>           /*  misc. UNIX functions      */

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

#include <sys/stat.h>
#include <fcntl.h>

#include "helper.h"

#define LOG_FILE "test_disk.txt"

/*  Global constants  */

#define ECHO_PORT          (20002)
#define MAX_LINE           (1000)


int main(int argc, char *argv[]) {
    int       list_s;                /*  listening socket          */
    int       conn_s;                /*  connection socket         */
    short int port;                  /*  port number               */
    struct    sockaddr_in servaddr;  /*  socket address structure  */
    char      buffer[MAX_LINE];      /*  character buffer          */
    char     *endptr;                /*  for strtol()              */
    int file_fd = open(LOG_FILE, O_WRONLY|O_CREAT);

    /*  Get port number from the command line, and
        set to default port if no arguments were supplied  */
    if ( argc == 2 ) {
        port = strtol(argv[1], &endptr, 0);
        if ( *endptr ) {
            fprintf(stderr, "ECHOSERV: Invalid port number.\n");
            exit(EXIT_FAILURE);
        }
    }
    else if ( argc < 2 ) {
        port = ECHO_PORT;
    }
    else {
        fprintf(stderr, "ECHOSERV: Invalid arguments.\n");
        exit(EXIT_FAILURE);
    }


    /*  Create the listening socket  */

    if ( (list_s = socket(AF_INET, SOCK_STREAM, 0)) < 0 ) {
        fprintf(stderr, "ECHOSERV: Error creating listening socket.\n");
        exit(EXIT_FAILURE);
    }


    /*  Set all bytes in socket address structure to
        zero, and fill in the relevant data members   */

    memset(&servaddr, 0, sizeof(servaddr));
    servaddr.sin_family      = AF_INET;
    servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
    servaddr.sin_port        = htons(port);


    /*  Bind our socket addresss to the 
        listening socket, and call listen()  */

    if ( bind(list_s, (struct sockaddr *) &servaddr, sizeof(servaddr)) < 0 ) {
        fprintf(stderr, "ECHOSERV: Error calling bind()\n");
        exit(EXIT_FAILURE);
    }

    if ( listen(list_s, LISTENQ) < 0 ) {
        fprintf(stderr, "ECHOSERV: Error calling listen()\n");
        exit(EXIT_FAILURE);
    }


    /*  Enter an infinite loop to respond
        to client requests and echo input  */

    while ( 1 ) {

        /*  Wait for a connection, then accept() it  */

        if ( (conn_s = accept(list_s, NULL, NULL) ) < 0 ) {
            fprintf(stderr, "ECHOSERV: Error calling accept()\n");
            exit(EXIT_FAILURE);
        }


        /*  Retrieve an input line from the connected socket
            then simply write it back to the same socket.     */

        Readline(conn_s, buffer, MAX_LINE-1);
        Writeline(conn_s, buffer, strlen(buffer));
        Writeline(file_fd, buffer, strlen(buffer));
        printf("%s\n", buffer);

        /*  Close the connected socket  */

        if ( close(conn_s) < 0 ) {
            fprintf(stderr, "ECHOSERV: Error calling close()\n");
            exit(EXIT_FAILURE);
        }
    }
}


/*

HELPER.C
========
(c) Paul Griffiths, 1999
Email: mail@paulgriffiths.net

Implementation of sockets helper functions.

Many of these functions are adapted from, inspired by, or 
otherwise shamelessly plagiarised from "Unix Network 
Programming", W Richard Stevens (Prentice Hall).

*/

#include "helper.h"
#include <sys/socket.h>
#include <unistd.h>
#include <errno.h>


/*  Read a line from a socket  */

ssize_t Readline(int sockd, void *vptr, size_t maxlen) {
    ssize_t n, rc;
    char    c, *buffer;

    buffer = (char *)vptr;

    for ( n = 1; n < maxlen; n++ ) {

        if ( (rc = read(sockd, &c, 1)) == 1 ) {
            *buffer++ = c;
            if ( c == '\n' )
                break;
        }
        else if ( rc == 0 ) {
            if ( n == 1 )
                return 0;
            else
                break;
        }
        else {
            if ( errno == EINTR )
                continue;
            return -1;
        }
    }

    *buffer = 0;
    return n;
}


/*  Write a line to a socket  */

ssize_t Writeline(int sockd, const void *vptr, size_t n) {
    size_t      nleft;
    ssize_t     nwritten;
    const char *buffer;

    buffer = (const char *)vptr;
    nleft  = n;

    while ( nleft > 0 ) {
        if ( (nwritten = write(sockd, buffer, nleft)) <= 0 ) {
            if ( errno == EINTR )
                nwritten = 0;
            else
                return -1;
        }
        nleft  -= nwritten;
        buffer += nwritten;
    }

    return n;
}

Answer 1

But, the destination address of this instruction is a valid address and this memory is mapped as writable.

不是 不是(或者指令不会导致 SIGSEGV )。

目的地0x80f8f5c被这个 LOAD 段“覆盖”:

LOAD           0x0b06dc 0x080f86dc 0x080f86dc 0x015f8 0x07730 RW  0x1000

还可以这样:

GNU_RELRO      0x0b06dc 0x080f86dc 0x080f86dc 0x00924 0x00924 R   0x1

GNU_RELRO要求运行时加载程序在加载程序执行重定位后将这部分地址空间设置为只读(这正是它所做的，也是触发崩溃的原因)。

Is there a way in gdb to figure out if the address is mapped as readonly or not?

你可以用info proc map询问gdb ，或者只查看 /proc/<pid>/maps .无论哪种方式，您都会发现内存映射为只读。