Shared memory abnormal access behavior detection method, device and equipment

Abstract

The invention relates to a shared memory abnormal access behavior detection method, device and equipment, and the method comprises the steps: obtaining a memory access address corresponding to a target access behavior when the target access behavior for accessing a target memory region is triggered; the memory access address is determined to be located in a shared memory area corresponding to the target process, a shared shadow memory corresponding to the shared memory area is obtained, the state of each memory segment in the current shared memory area is recorded in the shared shadow, and the states comprise a first state representing that access is allowed and a second state representing that access is not allowed; based on the memory access address, determining a target state corresponding to each target memory segment in the target memory area from the shared shadow memory; if the second state exists in the target states, it is determined that the target access behavior belongs to the abnormal access behavior, the abnormal behavior of inter-process shared memory access can be effectively detected, and data security is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device and equipment for detecting abnormal access behavior of shared memory. Background Art

[0002] In memory management, manually managing the dynamic allocation and release of memory is a common method. However, during the management process, there may be abnormal memory access behaviors, such as out-of-bounds access, which not only affects the reliability of the software, but may also cause serious security issues. Therefore, it is very important to detect and repair abnormal memory access behaviors for the security and stability of the software.

[0003] In the related art, abnormal memory access behaviors are usually detected through detection tools such as ASAN (Address Sanitizer) and Valgrind. ASAN inserts detection code at compile time, and detects and reports access behaviors such as out-of-bounds access and use of unallocated or released memory at runtime. Valgrind monitors program execution through binary translation technology, and analyzes and inserts programs at runtime.

[0004] However, in the process of detecting abnormal access behavior, the above detection tool only supports the detection of abnormal access behavior of the memory of a single process, but does not support the detection of abnormal access behavior of shared memory between multiple processes. Summary of the invention

[0005] The present invention provides a shared memory abnormal access behavior detection method, device and equipment, which are used to realize abnormal access behavior detection for shared memory.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting abnormal access behavior of a shared memory, the method comprising:

[0007] When a target access behavior for accessing a target memory area is triggered, a memory access address corresponding to the target access behavior is obtained;

[0008] Determine that the memory access address is located in a shared memory area corresponding to the target process, and obtain a shared shadow memory corresponding to the shared memory area, wherein the shared shadow records the status of each memory segment in the current shared memory area, the status includes a first status indicating that access is allowed, and a second status indicating that access is not allowed, and the memory segment is an area with a preset capacity in the shared memory area;

[0009] Based on the memory access address, determine the target states corresponding to the target memory segments in the target memory area from the shared shadow memory;

[0010] If the second state exists in the target state, it is determined that the target access behavior is an abnormal access behavior.

[0011] The above method sets a corresponding shared shadow memory for each shared memory and records the status of each memory segment in the corresponding shared memory in the shared shadow memory. When the target process accesses the shared memory area, based on the carried access address and the status of the corresponding access address recorded in the shared shadow memory, it determines whether the current access behavior is an abnormal access behavior, thereby realizing accurate detection of abnormal access behavior of the shared memory.

[0012] In a possible implementation, determining the target states corresponding to the target memory segments in the target memory area from the shared shadow memory based on the memory access address includes:

[0013] Based on the starting address of the shared memory area and the memory access address, determining a plurality of target memory segments corresponding to the target memory area;

[0014] Based on the mapping relationship between each memory segment in the shared memory area and each byte in the shared shadow memory, determine the target bytes corresponding to each target memory segment from the shared shadow memory;

[0015] Based on the value of each target byte, the state corresponding to the corresponding target memory segment is determined.

[0016] The above method, based on the starting address and memory access address of the shared memory area, determines the target memory segments corresponding to the target access behavior from the memory segments included in the shared memory area, and then determines the status of each target memory segment based on the bytes corresponding to each target memory segment in the shared shadow memory. This method ensures the accuracy of the determined status of each memory segment.

[0017] In a possible implementation, the determining of the plurality of target memory segments corresponding to the target memory area based on the start address of the shared memory area and the memory access address includes:

[0018] Based on the starting address of the shared memory area and the starting address included in the memory access address, determining a first target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area;

[0019] Based on the starting address of the shared memory area and the ending address included in the memory access address, determining the last target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area;

[0020] The memory segments between the first target memory segment and the last target memory segment are used as multiple target memory segments corresponding to the target memory area.

[0021] The above method improves the efficiency of determining the target memory segments by determining the first target memory segment and the last target memory segment based on the start address and the end address, and then determining each target memory segment based on the first target memory segment and the end address.

[0022] In a possible implementation manner, before the target access behavior of triggering access to the target memory area, the method further includes:

[0023] When the target process is started, the shared memory area corresponding to the target process is obtained;

[0024] Based on the area range of the shared memory area, determine the reference capacity of the shared shadow memory;

[0025] Memory of the reference capacity is divided from unallocated memory to serve as the shared shadow memory.

[0026] The above method creates a corresponding shared shadow memory for the shared memory area after the target process is started. The shared shadow memory allows multiple processes (i.e., multiple processes corresponding to the shared memory area) to access it, thereby detecting the access behavior of the shared memory area.

[0027] In a possible implementation, the above method further includes:

[0028] When it is determined that the shared memory area is in an unavailable state, the shared shadow memory is restored to an unallocated state.

[0029] In a possible implementation manner, the shared memory area includes a plurality of memory items, each memory item includes at least one memory segment; and the method further includes:

[0030] For any memory item, when a creation operation on the memory item is detected, a first flag bit and a second flag bit corresponding to the memory item in the shared memory area are set to an initial state;

[0031] When an application operation for the memory item is detected, the identification information of the function call stack used by the current application operation is recorded in the first flag bit;

[0032] When a release operation on the above-mentioned memory item is detected, identification information of the function call stack used by the current release operation is recorded in the above-mentioned second flag bit.

[0033] The above method stores information about the function call stack used when applying for a memory item based on the first flag bit, and stores information about the function call stack used when releasing a memory item based on the second flag bit. When abnormal behaviors such as memory use after release and out-of-bounds access occur, the shared memory usage process can be traced back to improve the efficiency of problem location.

[0034] In a possible implementation manner, after determining that the target access behavior is an abnormal access behavior, the method further includes:

[0035] Obtain a first value of a first flag bit corresponding to the target memory area, and a second value of a second flag bit;

[0036] Based on the function call stack currently used by the target access behavior and the first value and the second value obtained, a log corresponding to the abnormal access behavior is generated.

[0037] The above method can trace back the shared memory usage process based on the currently used function call stack, the first value, and the log generated by the second value. When abnormal behaviors such as memory use after release and out-of-bounds access occur, the problem location efficiency can be greatly improved.

[0038] In a second aspect, an embodiment of the present application provides a shared memory abnormal access behavior detection device, the device comprising:

[0039] An address acquisition module, used to acquire a memory access address corresponding to the target access behavior when a target access behavior to access the target memory area is triggered;

[0040] A memory acquisition module is used to determine that the memory access address is located in a shared memory area corresponding to the target process, and to acquire a shared shadow memory corresponding to the shared memory area, wherein the shared shadow records the status of each memory segment in the current shared memory area, the status including a first status indicating that access is allowed, and a second status indicating that access is not allowed, and the memory segment is an area with a preset capacity in the shared memory area;

[0041] A state determination module, used to determine, based on the memory access address, from the shared shadow memory, target states corresponding to the target memory segments in the target memory area;

[0042] The behavior determination module is used to determine that the target access behavior is an abnormal access behavior if the second state exists in the target state.

[0043] In a possible implementation manner, the state determination module is specifically configured to:

[0044] Determine a plurality of target memory segments corresponding to the target memory area based on the start address of the shared memory area and the memory access address;

[0045] Based on the mapping relationship between each memory segment in the shared memory area and each byte in the shared shadow memory, determine the target bytes corresponding to each target memory segment from the shared shadow memory;

[0046] Based on the value of each target byte, the state corresponding to the corresponding target memory segment is determined.

[0047] In a possible implementation manner, the state determination module is specifically configured to:

[0048] Based on the starting address of the shared memory area and the starting address included in the memory access address, determining a first target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area;

[0049] Based on the start address of the shared memory area and the end address included in the memory access address, determining the last target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area;

[0050] The memory segments between the first target memory segment and the last target memory segment are used as the multiple target memory segments corresponding to the target memory area.

[0051] In a possible implementation manner, before the address acquisition module triggers a target access behavior of accessing the target memory area, it is also used to:

[0052] When the target process is started, obtaining a shared memory area corresponding to the target process;

[0053] Determine a reference capacity of the shared shadow memory based on the area range of the shared memory area;

[0054] A memory of the reference capacity is divided from the unallocated memory to serve as the shared shadow memory.

[0055] In a possible implementation manner, the above device further includes a restoration module, specifically configured to:

[0056] When it is determined that the shared memory area is in an unavailable state, the shared shadow memory is restored to an unallocated state.

[0057] In a possible implementation manner, the shared memory area includes a plurality of memory items, each memory item includes at least one memory segment; the above device further includes a flag bit determination module, specifically configured to:

[0058] For any memory item, when a creation operation on the memory item is detected, a first flag bit and a second flag bit corresponding to the memory item in the shared memory area are set to an initial state;

[0059] When an application operation on the memory item is detected, recording identification information of a function call stack used by the current application operation in the first flag bit;

[0060] When a release operation on the memory item is detected, identification information of the function call stack used by the current release operation is recorded in the second flag bit.

[0061] In a possible implementation manner, after the behavior determination module determines that the target access behavior is an abnormal access behavior, it is further configured to:

[0062] Obtaining a first value of a first flag bit corresponding to the target memory area, and a second value of a second flag bit;

[0063] A log corresponding to the abnormal access behavior is generated based on the function call stack currently used by the target access behavior and the obtained first value and second value.

[0064] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps in the method for detecting abnormal shared memory access behavior when executing the computer program.

[0065] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-mentioned shared memory abnormal access behavior detection method of the present application.

[0066] In the fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which is stored in a computer-readable storage medium; when the processor of a memory access device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the memory access device executes the steps in the above-mentioned shared memory abnormal access behavior detection method of the present application.

[0067] For each of the above-mentioned second to fifth aspects and the technical effects that may be achieved by each of the above-mentioned aspects, please refer to the above-mentioned description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0069] Figure 1 A schematic diagram of a shadow memory mapping process provided in an embodiment of the present application;

[0070] Figure 2 A schematic diagram of a shared memory abnormal access behavior detection method provided in an embodiment of the present application;

[0071] Figure 3 A schematic diagram of a shadow memory type provided in an embodiment of the present application;

[0072] Figure 4 A schematic diagram of a triggering process for detecting abnormal access behavior of shared memory provided in an embodiment of the present application;

[0073] Figure 5 A schematic diagram of a memory item state change process provided in an embodiment of the present application;

[0074] Figure 6 A schematic diagram of a problem location process provided in an embodiment of the present application;

[0075] Figure 7 A schematic diagram of an abnormal access behavior detection example provided in an embodiment of the present application;

[0076] Figure 8 A schematic diagram of a shared memory abnormal access behavior detection device provided in an embodiment of the present application;

[0077] Fig. 9 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0079] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0080] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0081] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0082] In order to facilitate those skilled in the art to better understand the technical solutions provided by the embodiments of the present application, the following is a brief description of the professional terms involved:

[0083] (1) Shared memory: Memory used for data sharing between multiple processes. Within the shared memory address space of each process, the same content can be accessed using the same offset.

[0084] (2) User memory: available memory obtained by users through standard libraries, system calls, etc.

[0085] (3) Shadow memory: Shadow memory is a type of memory allocated by the system to detect memory access behavior. There is a mapping relationship between user memory and shadow memory. Before each memory access operation (i.e., access behavior and storage behavior) of the user memory, the compiler will insert a series of instructions to check the status (value) of the shadow memory to detect the current memory access operation process.

[0086] In memory management based on C or C++ code, manually managing dynamic memory allocation and release is a common method. However, during the management process, there may be abnormal memory access behaviors, such as out-of-bounds access, Use-After-Free, and continued access to the previous call stack after the function returns. These abnormal access behaviors will not only affect the reliability of the software, but may also cause serious security issues. Therefore, it is very important to detect and repair abnormal memory access behaviors for the security and stability of the software.

[0087] In the related art, abnormal memory access behaviors are usually detected through detection tools such as ASAN (Address Sanitizer) and Valgrind. ASAN inserts detection code at compile time, and detects and reports access behaviors such as out-of-bounds access and use of unallocated or released memory at runtime. Valgrind monitors program execution through binary translation technology, and analyzes and inserts programs at runtime.

[0088] However, in the process of detecting abnormal access behavior, since the design purpose of inspection tools such as ASAN and Valgrind is to detect memory access within a single process, they rely on the detection code inserted at compile time and memory management at runtime to monitor and capture memory access errors, but they mainly work within the private virtual memory space of the process. Cross-process shared memory is usually created using system calls or library functions such as mmap and shmget, and shared between multiple processes. Therefore, the detection tool does not support the detection of abnormal access behavior of shared memory between such multiple processes.

[0089] In response to the above problems, an embodiment of the present application provides a method for detecting abnormal access behavior of shared memory. The method sets a corresponding shared shadow memory for each shared memory, and records the status of each memory segment in the corresponding shared memory in the shared shadow memory, so that when a subsequent target process accesses the shared memory area, based on the carried access address and the status of the corresponding access address recorded in the shared shadow memory, it is determined whether the current access behavior is an abnormal access behavior.

[0090] Before introducing the abnormal access behavior detection method provided in the embodiment of the present application, the basic working principle of the current ASAN is first introduced. Specifically, ASAN detects abnormal memory access behavior by allocating shadow memory to each block of user memory and inserting shadow detection instructions before memory access instructions (i.e., access instructions and storage instructions).

[0091] When allocating shadow for each memory block, the state of a preset number of bytes of memory can be mapped to a byte of shadow memory, such as Figure 1 As shown in the figure, the state of the 8-byte user memory can be mapped to the 1-byte shadow memory, that is, starting from an 8-byte aligned start address, 8 consecutive bytes will be mapped to the same byte of shadow memory. Among them, the value of each byte in the shadow memory has a certain special meaning, and the value of the shadow can be used to determine whether the current memory is allowed to be accessed. For example, when the shadow value is 0, it means that all 8 bytes in the memory are accessible; when the shadow value is 01-07, it means that part of the 8 bytes in the memory is accessible; when the shadow value is negative (that is, when the memory address is greater than 0x7f, the corresponding shadow memory value is greater than or equal to 8, which is a negative number from the perspective of a signed number), it means that all 8 bytes in the memory are inaccessible, which can be used to indicate special states, such as prohibited access areas, illegal stacks after function returns, etc. In implementation, the last 3 bits of the memory address to be detected can be compared with the shadow memory to determine whether the current access behavior is an abnormal access behavior.

[0092] The solution of the embodiment of the present application is improved on the basis of ASAN, and expands the type of shadow memory, namely shared shadow memory, and sets an abnormal access behavior detection process corresponding to the shared shadow memory, as well as a state change rule in the shared shadow memory, thereby realizing accurate detection of abnormal access behavior to the shared memory.

[0093] It should be noted that the embodiment of the present application only takes ASAN as an example to introduce the above-mentioned abnormal access behavior detection method. Optionally, the method can also be applied to other detection tools such as Valgrind.

[0094] The present application is further described in detail below in conjunction with the accompanying drawings. Figure 2 As shown, it is a flow chart of a method for detecting abnormal shared memory access behavior provided by an embodiment of the present application. The method is applied to a target process, and its specific implementation process is as follows:

[0095] Step S201, when a target access behavior for accessing a target memory area is triggered, a memory access address corresponding to the target access behavior is obtained;

[0096] In some embodiments, the above-mentioned memory access address specifically includes: a starting address and an ending address of the target memory area.

[0097] In a possible implementation manner, before the above-mentioned target access behavior of triggering access to the target memory area, the method of the embodiment of the present application further includes:

[0098] When the target process starts, obtain the shared memory area corresponding to the target process;

[0099] Based on the area range of the shared memory area, determine the reference capacity of the shared shadow memory;

[0100] Memory of reference capacity is divided from unallocated memory as shared shadow memory.

[0101] In some embodiments, Figure 3 As shown, in order to solve the problem in the related art that the private shadow memories set for private memories are independent of each other and cannot detect the access behavior in the cross-process shared memory, the present application sets a shared shadow memory for the shared memory area, and the shared shadow memory allows multiple processes (that is, the multiple processes corresponding to the shared memory area) to access it, thereby realizing the detection of the access behavior to the shared memory area.

[0102] It should be noted that the above-mentioned target process refers to: any process among the multiple processes corresponding to the shared memory area.

[0103] In some embodiments, at the initial stage of the target process startup, each process corresponding to the shared memory area will obtain the address range of the shared memory area, and determine the reference capacity (i.e., size) of the corresponding shared shadow memory based on the address range. Specifically, in the embodiment of the present application, the correspondence between the shared memory area and the shared shadow memory can be pre-set, that is, 1 byte in the shared shadow memory corresponds to the number of bytes in the shared memory area (i.e., the size of the memory segment). Optionally, it can usually be set to: use 1 byte in the shared shadow to represent the state of 8 bytes (i.e., 1 memory segment) in the shared memory area.

[0104] In the specific implementation, since the shared shadow memory area will serve as a mechanism to monitor the cross-process memory access status, when any process operates on the shared memory, the corresponding shared shadow memory will undergo corresponding state changes. For example, during the process of memory allocation and release, the state recorded in the shared shadow memory will change appropriately. This change can be perceived by other processes. Therefore, based on the shared shadow memory, the access behavior of the shared memory can be detected in real time.

[0105] In some embodiments, Figure 3 As shown, the shared shadow memory includes the physical shared shadow memory (i.e. Figure 3 The middle area), and virtual shared shadow memory (i.e. Figure 3 In the specific implementation, the system will allocate reference capacity physical memory from unallocated physical memory for each shared memory area as physical shared shadow memory. Each process corresponding to the shared memory area will perform the above operation at the initial startup, that is, determine the reference capacity of the shared shadow memory, and allocate the content of the reference capacity from the unallocated virtual memory as virtual shared shadow memory, and map it to the physical shared shadow memory, so as to detect abnormal access behavior of shared memory between processes through shared shadow memory.

[0106] In a possible implementation, the method provided in the embodiment of the present application further includes:

[0107] When it is determined that the shared memory area is in an unavailable state, the shared shadow memory is restored to an unallocated state.

[0108] In some embodiments, since the shared shadow memory is set for the shared memory area, when the shared memory area is unavailable, the shared shadow memory needs to be restored to its original unallocated state and returned to the system for subsequent use.

[0109] In some embodiments, when the shared memory area is deleted or fails, the shared memory area may be considered to be in an unavailable state.

[0110] Step S202, determining that the memory access address is located in a shared memory area corresponding to the target process, and obtaining a shared shadow memory corresponding to the shared memory area;

[0111] The shared shadow records the status of each memory segment in the current shared memory area. The memory segment is an area with a preset capacity in the shared memory area. The status includes a first status indicating that access is allowed and a second status indicating that access is not allowed.

[0112] In some embodiments, during the stage of initializing the target process, the shared memory and shared shadow memory corresponding to the target process can be mapped to the memory address space of the target process through a memory mapping method, such as mmap, and the calculation parameters of the shadow memory address, that is, the starting position and the ending position of the shared memory area, are set, so as to facilitate the subsequent determination of whether the memory access address is located in the shared memory area based on the starting position and the ending position.

[0113] like Figure 4 As shown, after obtaining the memory access address corresponding to the access behavior, it is determined whether the memory access address is located in the shared memory area; specifically, when the starting address in the memory access address is located after the starting address of the shared memory, and when the ending address in the memory access address is located before the ending address of the shared memory, it is determined that the memory access address is located in the shared memory area; if it is determined that the memory access address is located in the shared memory area, the process of steps S202-S204 is executed, that is, abnormal access behavior is detected based on the shared shadow memory; if it is determined that the memory address to be accessed is not located in the shared memory range, private shadow memory (that is, the method of the prior art) is used to detect abnormal access behavior, and the detection result corresponding to the target access behavior is obtained, that is, whether it is an abnormal access behavior.

[0114] In some embodiments, in order to enhance the accuracy of abnormal access detection of shared memory, the state recorded in the shared shadow memory corresponding to the shared memory in the embodiments of the present application needs to change with the user's use process of the shared memory.

[0115] In some embodiments, the present application may divide the shared memory area into multiple shared memory pools, each shared memory pool includes multiple memory items, and each memory item includes at least one memory segment, that is, the size of each memory item is an integer multiple of the memory segment size. For example, the size of a memory item is 16 bytes, and the size of a memory segment is 8 bytes. In this case, a memory item consists of two memory segments.

[0116] like Figure 5 As shown, in the shared memory pool creation stage, the memory items included therein are all unallocated memory items. At this time, in the shared shadow memory, the status of the area corresponding to the shared memory pool is inaccessible; optionally, in an embodiment of the present application, the capacity of each memory item can be set to be larger than the user-accessible capacity, that is, each memory pool has an inaccessible area at any stage, and the area is used for subsequent flag bit setting, etc.

[0117] When the user calls the memory allocation interface to obtain a memory item, that is, after the allocation operation is performed on the unallocated memory item, the state corresponding to the accessible part of the memory item in the shared shadow memory is marked as the first state (i.e., accessible state), and the state corresponding to the remaining part (i.e., inaccessible part) in the shared shadow memory is marked as the second state (i.e., inaccessible state) to detect abnormal access behavior of the memory item.

[0118] When the allocated memory item is released, the corresponding states of the released memory item (ie, the entire area) in the shared shadow memory are all marked as the second state (ie, inaccessible state) to detect the scenario of re-access after release.

[0119] Step S203, based on the memory access address, determining the target states corresponding to the target memory segments in the target memory area from the shared shadow memory;

[0120] In a possible implementation, the above-mentioned determining the target states corresponding to the target memory segments in the target memory area from the shared shadow memory based on the memory access address specifically includes:

[0121] Based on the start address of the shared memory area and the memory access address, determine multiple target memory segments corresponding to the target memory area;

[0122] Based on the mapping relationship between each memory segment in the shared memory area and each byte in the shared shadow memory, the target bytes corresponding to each target memory segment are determined from the shared shadow memory;

[0123] Based on the value of each target byte, the state corresponding to the corresponding target memory segment is determined.

[0124] like Figure 1As shown, the state of each memory segment in the shared memory area in the embodiment of the present application is reflected as a byte value in the shared shadow memory, that is, the above-mentioned mapping relationship, wherein the number of bytes of the memory segment (that is, the above-mentioned preset capacity) can be set based on demand, and is usually set to an integer multiple of 8 bytes, such as 8 bytes, 16 bytes, etc. That is, starting from the starting address of the shared memory area, the multiple memory segments arranged in sequence correspond to the multiple bytes arranged in sequence in the shared shadow memory, respectively. Taking the memory segment set to 8 bytes as an example, the memory segment composed of the 1st to 8th bytes starting from the starting address of the shared memory area corresponds to the 1st byte in the shared shadow memory, and the memory segment composed of the 9th to 16th bytes after the starting address of the shared memory area corresponds to the 2nd byte in the shared shadow memory, and so on. Therefore, when determining the target state corresponding to each target memory segment in the target storage area, the target memory segments corresponding to the target access behavior can be determined from the memory segments included in the shared memory area based on the starting address of the shared memory area and the memory access address, and then the state of each target memory segment is determined based on the bytes corresponding to each target memory segment in the shared shadow memory.

[0125] In a possible implementation manner, the determining of the multiple target memory segments corresponding to the target memory area based on the start address of the shared memory area and the memory access address specifically includes:

[0126] Based on the start address of the shared memory area and the start address included in the memory access address, determining a first target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area;

[0127] Based on the start address of the shared memory area and the end address included in the memory access address, determining the last target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area;

[0128] The memory segments between the first target memory segment and the last target memory segment are used as multiple target memory segments corresponding to the target memory area.

[0129] In some embodiments, for the convenience of explanation, the starting address and the ending address included in the above-mentioned memory access address are referred to as the first starting address and the starting address included in the memory access address is referred to as the second starting address.

[0130] In specific implementation, when determining the multiple target memory segments corresponding to the target memory area, the present application determines the number of bytes between the first starting address and the second starting address, and determines the first target memory segment based on the number of bytes and the reference number of bytes of the memory segment; taking the reference number of bytes as 8 bytes and the number of bytes of the interval as 42 as an example, 42 is divided by 8, the result is 5, and the remainder is 2, so it can be determined that the second starting address is located in the 6th memory segment, that is, the 6th memory segment is used as the first target memory segment. Similarly, the number of bytes between the first starting address and the end address is determined, and the last target memory segment is determined based on the number of bytes and the reference number of bytes of the memory segment; the memory segment between the first target memory segment and the last target memory segment is used as the multiple target memory segments corresponding to the target memory area.

[0131] Step S204: if the target state includes the second state, it is determined that the target access behavior is an abnormal access behavior.

[0132] In some embodiments, when a second state exists in the target state, it is identified that the target memory area being accessed includes an area that is not allowed to be accessed. At this time, it can be determined that the current target access behavior is an abnormal access behavior, that is, the current access operation is terminated, and a corresponding log is generated at the same time, and a reminder is given to the staff so that the staff can locate the cause of the abnormal access behavior based on the relevant log and make corresponding adjustments or repairs to the program.

[0133] The above method provides an effective method for detecting abnormal access to shared memory between multiple processes, which can effectively locate abnormal access behaviors such as out-of-bounds access, use after memory release, and use of unallocated memory, thereby improving the security of the system.

[0134] In a possible implementation, the shared memory area includes a plurality of memory items, each memory item includes at least one memory segment; and the method of the embodiment of the present application further includes:

[0135] For any memory item, when a creation operation on the memory item is detected, a first flag bit and a second flag bit corresponding to the memory item in the shared memory area are set to an initial state;

[0136] When an application operation for a memory item is detected, the identification information of the function call stack used by the current application operation is recorded in the first flag bit;

[0137] When a release operation on a memory item is detected, identification information of a function call stack used by the current release operation is recorded in the second flag bit.

[0138] In order to improve the efficiency of problem locating after abnormal access behavior detection, in an embodiment of the present application, two flag bits are set for each memory item in the shared memory: a first flag bit and a second flag bit, wherein the first flag bit is used to store information of the function call stack used when applying for the memory item, and the second flag bit is used to store information of the function call stack used when releasing the memory item.

[0139] In a specific implementation, the first flag bit and the second flag bit corresponding to each memory item in the embodiment of the present application are adjusted in real time during the creation, application and release operations. Specifically, when a creation operation of a memory pool is detected, the first flag bit and the second flag bit corresponding to each memory item included in the memory pool are set to an initial state (for example, empty); when an application operation of a memory item is detected, the flag information of the currently used function call stack is stored in the first flag bit, and the information in the second flag bit is not modified; when a release operation of a memory item is detected, the flag information of the currently used function call stack is stored in the second flag bit, and the information in the first flag bit is not modified.

[0140] In some embodiments, each memory item in the present application corresponds to two flag bits, which can be set in the inaccessible area corresponding to the memory item (such as Figure 5 As shown), at the same time, when the target process's access behavior to the current memory item is detected, the target process's information can also be stored in the inaccessible area.

[0141] In a possible implementation manner, after determining that the target access behavior is an abnormal access behavior, the method of the embodiment of the present application further includes:

[0142] Obtain a first value of a first flag bit corresponding to a target memory area, and a second value of a second flag bit;

[0143] Based on the function call stack currently used by the target access behavior and the acquired first value and second value, a log corresponding to the abnormal access behavior is generated.

[0144] In some embodiments, based on the logs generated by the currently used function call stack, the first value, and the second value, the shared memory usage process can be traced back. When abnormal behaviors such as memory use after release and out-of-bounds access occur, the problem location efficiency can be greatly improved.

[0145] In some embodiments, when generating a log corresponding to an abnormal access behavior, in addition to recording the currently used and historically used function call stacks, relevant information of the process corresponding to the current abnormal access behavior is also required, that is, the PID (process control identifier) ​​of the target process, etc., to facilitate subsequent determination of the process corresponding to the log.

[0146] like Figure 6As shown in FIG. 1 , a possible abnormal access scenario of shared memory is given. The scenario specifically includes process A, process B and process C, wherein process A is used to manage the allocation and release of memory items in the shared memory pool, and processes B, C and A use the memory items in the shared memory pool together.

[0147] In this scenario, process A first creates a shared memory pool, and during the life cycle of the process, receives and processes requests for each memory item in the memory pool (such as application or release, etc.), and records the function call stack used in the processing.

[0148] After process A releases the shared memory pool, if process B triggers access to any memory item in the released shared memory pool, based on the steps described in S201-204 above, it can be detected that the access behavior is an abnormal access behavior. At this time, an abnormal exit will be triggered, and the memory access stack (i.e., function call stack) currently used by process B and the flag information corresponding to the memory items in the accessed shared memory pool (i.e., historical function call stack) will be recorded in log B. It should be noted that since process B has not triggered operations such as applying for or releasing the memory items at this time, the flag information corresponding to the memory items at this time is stored in the corresponding flag by process A.

[0149] When process A recreates the shared memory pool and initializes each memory item, that is, each memory item is in an unallocated state. At this time, if process C triggers an access behavior to the previous memory items in the shared memory pool (that is, the unallocated memory items), based on the steps described in S201-204 above, it can be detected that the access behavior is an abnormal access behavior. At this time, an abnormal exit will be triggered, and the memory access stack (that is, the function call stack) currently used by process C and the flag information corresponding to the memory items in the accessed shared memory pool (that is, the historical function call stack) will be recorded in log C. It should be noted that since process C has not triggered operations such as applying for or releasing memory items at this time, and the shared memory pool is currently in the creation stage, the flag information corresponding to the memory items is in the initial state.

[0150] It can be seen from the scenario that the solution of recording the usage of the function call stack in this application can effectively detect abnormal access to shared memory, making it easier for developers to reasonably adjust the timing of memory usage.

[0151] The following combination Figure 7 , the above-mentioned shared memory abnormal access behavior detection process is described in detail with a specific example, and the process specifically includes the following steps:

[0152] Step S701, when the target process is started, obtaining the shared memory area corresponding to the target process;

[0153] Step S702, based on the area range of the shared memory area, determining the reference capacity of the shared shadow memory, and allocating the memory of the reference capacity from the unallocated memory as the shared shadow memory;

[0154] Step S703, when the target process is initialized, the shared memory area and the shared shadow memory are mapped to the memory address space of the target process through a memory mapping method, and the address information of the shared memory area is recorded;

[0155] Step S704, when a target access behavior for accessing a target memory area is triggered, a memory access address corresponding to the target access behavior is obtained;

[0156] Step S705, determining whether the memory access address is located in the shared memory area, if so, executing step S706, otherwise executing step S709;

[0157] Step S706, based on the memory access address, determining the target states corresponding to the target memory segments in the target memory area from the shared shadow memory;

[0158] Step S707, if the target state has the second state, determining that the target access behavior is an abnormal access behavior;

[0159] Step S708, obtaining a first value of a first flag bit corresponding to the target memory area and a second value of a second flag bit, and generating a log corresponding to the abnormal access behavior based on the currently used function call stack, the first value and the second value;

[0160] Step S709: abnormal access behavior detection is performed based on native ASAN.

[0161] Based on the same inventive concept, the present application also provides a shared memory abnormal access behavior detection device, see Figure 8 , the device comprises:

[0162] The address acquisition module 801 is used to acquire the memory access address corresponding to the target access behavior when triggering the target access behavior to access the target memory area;

[0163] A memory acquisition module 802 is used to determine that the memory access address is located in a shared memory area corresponding to the target process, and to acquire a shared shadow memory corresponding to the shared memory area, wherein the shared shadow records the status of each memory segment in the current shared memory area, the status including a first status indicating that access is allowed, and a second status indicating that access is not allowed, and the memory segment is an area with a preset capacity in the shared memory area;

[0164] A state determination module 803 is used to determine, based on the memory access address, the target states corresponding to the target memory segments in the target memory area from the shared shadow memory;

[0165] The behavior determination module 804 is used to determine that the target access behavior is an abnormal access behavior if the second state exists in the target state.

[0166] In a possible implementation manner, the state determination module 803 is specifically configured to:

[0167] Determine a plurality of target memory segments corresponding to the target memory area based on the start address of the shared memory area and the memory access address;

[0168] Based on the mapping relationship between each memory segment in the shared memory area and each byte in the shared shadow memory, determine the target bytes corresponding to each target memory segment from the shared shadow memory;

[0169] Based on the value of each target byte, the state corresponding to the corresponding target memory segment is determined.

[0170] In a possible implementation manner, the state determination module 803 is specifically configured to:

[0171] Based on the starting address of the shared memory area and the starting address included in the memory access address, determining a first target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area;

[0172] Based on the start address of the shared memory area and the end address included in the memory access address, determining the last target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area;

[0173] The memory segments between the first target memory segment and the last target memory segment are used as the multiple target memory segments corresponding to the target memory area.

[0174] In a possible implementation manner, before the address acquisition module 801 triggers a target access behavior of accessing the target memory area, it is further used to:

[0175] When the target process is started, obtaining a shared memory area corresponding to the target process;

[0176] Determine a reference capacity of the shared shadow memory based on the area range of the shared memory area;

[0177] A memory of the reference capacity is divided from the unallocated memory to serve as the shared shadow memory.

[0178] In a possible implementation manner, the above device further includes a restoration module, specifically configured to:

[0179] When it is determined that the shared memory area is in an unavailable state, the shared shadow memory is restored to an unallocated state.

[0180] In a possible implementation manner, the shared memory area includes a plurality of memory items, each memory item includes at least one memory segment; the above device further includes a flag bit determination module, specifically configured to:

[0181] For any memory item, when a creation operation on the memory item is detected, a first flag bit and a second flag bit corresponding to the memory item in the shared memory area are set to an initial state;

[0182] When an application operation on the memory item is detected, recording identification information of a function call stack used by the current application operation in the first flag bit;

[0183] When a release operation on the memory item is detected, identification information of the function call stack used by the current release operation is recorded in the second flag bit.

[0184] In a possible implementation manner, after the behavior determination module 804 determines that the target access behavior is an abnormal access behavior, it is further configured to:

[0185] Obtaining a first value of a first flag bit corresponding to the target memory area, and a second value of a second flag bit;

[0186] A log corresponding to the abnormal access behavior is generated based on the function call stack currently used by the target access behavior and the obtained first value and second value.

[0187] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the function of the aforementioned shared memory abnormal access behavior detection device, referring to Fig. 9 , the electronic device comprises:

[0188] At least one processor 901, and a memory 902 connected to the at least one processor 901. The specific connection medium between the processor 901 and the memory 902 is not limited in the embodiment of the present application. Fig. 9 In the example, the processor 901 and the memory 902 are connected via a bus 900. The bus 900 is Fig. 9The bus 900 is represented by a bold line, and the connection between other components is only for schematic illustration and is not intended to be limiting. The bus 900 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 901 can also be called a controller, and there is no limitation on the name.

[0189] In the embodiment of the present application, the memory 902 stores instructions that can be executed by at least one processor 901. The at least one processor 901 can execute the shared memory abnormal access behavior detection method discussed above by executing the instructions stored in the memory 902. The processor 901 can implement Figure 8 The functions of each module in the device shown.

[0190] Among them, processor 901 is the control center of the device, and can use various interfaces and lines to connect various parts of the entire control device. By running or executing instructions stored in memory 902 and calling data stored in memory 902, various functions of the device and processing data, the device can be monitored as a whole.

[0191] In one possible design, the processor 901 may include one or more processing units, and the processor 901 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 901. In some embodiments, the processor 901 and the memory 902 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0192] Processor 901 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the shared memory abnormal access behavior detection method disclosed in the embodiments of the present application can be directly embodied as a hardware processor execution, or a combination of hardware and software modules in the processor.

[0193] The memory 902 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 902 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 902 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 902 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0194] By designing and programming the processor 901, the code corresponding to the application anomaly detection method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 The steps of the shared memory abnormal access behavior detection method of the illustrated embodiment are as follows: How to design and program the processor 901 is a technique known to those skilled in the art and will not be described in detail here.

[0195] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0196] In some possible implementations, various aspects of the shared memory abnormal access behavior detection method provided in the present application can also be implemented in the form of a program product, which includes a program code. When the above-mentioned program product is run on an electronic device, the above-mentioned program code is used to enable the above-mentioned electronic device to execute the steps of the shared memory abnormal access behavior detection method according to various exemplary embodiments of the present application described above in this specification.

[0197] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0198] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0199] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0200] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0201] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0202] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting abnormal access behavior of shared memory, characterized in that: Applied to a target process, the method comprises: When a target access behavior for accessing a target memory area is triggered, a memory access address corresponding to the target access behavior is obtained; Determine that the memory access address is located in a shared memory area corresponding to the target process, and obtain a shared shadow memory corresponding to the shared memory area, wherein the shared shadow memory records the status of each memory segment in the current shared memory area, the status including a first status representing that access is allowed, and a second status representing that access is not allowed, and the memory segment is an area with a preset capacity in the shared memory area; Based on the memory access address, determine the target states corresponding to the target memory segments in the target memory area from the shared shadow memory; If the second state exists in the target state, it is determined that the target access behavior is an abnormal access behavior.

2. The method according to claim 1, characterized in that The determining, based on the memory access address, from the shared shadow memory, target states corresponding to the target memory segments in the target memory area, respectively, comprises: Determine a plurality of target memory segments corresponding to the target memory area based on the start address of the shared memory area and the memory access address; Based on the mapping relationship between each memory segment in the shared memory area and each byte in the shared shadow memory, determine the target bytes corresponding to each target memory segment from the shared shadow memory; Based on the value of each target byte, the state corresponding to the corresponding target memory segment is determined.

3. The method according to claim 2, characterized in that The step of determining a plurality of target memory segments corresponding to the target memory area based on the start address of the shared memory area and the memory access address comprises: Based on the starting address of the shared memory area and the starting address included in the memory access address, determining a first target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area; Based on the start address of the shared memory area and the end address included in the memory access address, determining the last target memory segment corresponding to the target memory area from the memory segments corresponding to the shared memory area; The memory segments between the first target memory segment and the last target memory segment are used as the multiple target memory segments corresponding to the target memory area.

4. The method according to claim 1, characterized in that: Before triggering the target access behavior to access the target memory area, the method further includes: When the target process is started, obtaining a shared memory area corresponding to the target process; Determine a reference capacity of the shared shadow memory based on the area range of the shared memory area; A memory of the reference capacity is divided from the unallocated memory to serve as the shared shadow memory.

5. The method according to claim 4, characterized in that The method further comprises: When it is determined that the shared memory area is in an unavailable state, the shared shadow memory is restored to an unallocated state.

6. The method according to any one of claims 1 to 5, characterized in that: The shared memory area includes a plurality of memory items, each memory item includes at least one memory segment; the method further includes: For any memory item, when a creation operation on the memory item is detected, a first flag bit and a second flag bit corresponding to the memory item in the shared memory area are set to an initial state; When an application operation on the memory item is detected, recording identification information of a function call stack used by the current application operation in the first flag bit; When a release operation on the memory item is detected, identification information of the function call stack used by the current release operation is recorded in the second flag bit.

7. The method according to claim 6, characterized in that After determining that the target access behavior is an abnormal access behavior, the method further includes: Obtaining a first value of a first flag bit corresponding to the target memory area, and a second value of a second flag bit; A log corresponding to the abnormal access behavior is generated based on the function call stack currently used by the target access behavior and the obtained first value and second value.

8. A shared memory abnormal access behavior detection device, characterized in that: The device comprises: An address acquisition module, used to acquire a memory access address corresponding to the target access behavior when a target access behavior for accessing a target memory area is triggered; A memory acquisition module, used to determine that the memory access address is located in a shared memory area corresponding to the target process, and to acquire a shared shadow memory corresponding to the shared memory area, wherein the shared shadow records the status of each memory segment in the current shared memory area, the status including a first status indicating that access is allowed, and a second status indicating that access is not allowed, and the memory segment is an area with a preset capacity in the shared memory area; A state determination module, used to determine, from the shared shadow memory, target states corresponding to the target memory segments in the target memory area based on the memory access address; The behavior determination module is used to determine that the target access behavior is an abnormal access behavior if the second state exists in the target state.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method according to any one of claims 1 to 7 when executing a computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images