Memory trampling problem positioning method and device, electronic equipment and readable medium

Abstract

The invention relates to a memory trampling problem positioning method and device, electronic equipment and a readable medium, and the method comprises the steps: setting the access authority of a target memory region allocated by an application program to be read-only in the running process of the application program; when the application program executes a write-in operation on the target memory area every time, triggering an exception, and recording a write-in memory address corresponding to the current write-in operation and call stack information in an information base; acquiring an abnormal memory address under the condition of detecting that the application program is triggered to have a fault due to memory treading; and querying target call stack information corresponding to the abnormal memory address in an information base, so as to position the problem code through the target call stack information. The problem that it is difficult to effectively locate memory trampling occurring in a legally allocated memory area is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a memory stepping problem positioning method and device, electronic equipment and readable medium. BACKGROUND

[0002] In the running process of a software system, memory stepping is a common and difficult-to-position problem. For the memory stepping problem, on the one hand, a static code analysis tool can find some potential out-of-bound access risks by analyzing source code, but it is difficult to accurately detect the actual memory stepping behavior in the running process due to the lack of runtime context information. On the other hand, a dynamic detection tool can also monitor memory access behavior to find illegal memory access, but for stepping that occurs entirely within a legally allocated memory region, that is, the address of the write operation itself does not exceed the boundary, but the content, timing or context of the write operation is incorrect, and the current dynamic detection tool is difficult to effectively locate.

[0003] Therefore, the problem that it is difficult to effectively locate the memory stepping occurring in the legally allocated memory region needs to be solved.

[0004] At present, no effective solution has been proposed for the above problem. SUMMARY

[0005] The present application provides a memory stepping problem positioning method and device, electronic equipment and readable medium to solve the technical problem that it is difficult to effectively locate the memory stepping occurring in the legally allocated memory region.

[0006] According to an aspect of an embodiment of the present application, the present application provides a memory stepping problem positioning method, comprising: setting the access permission of a target memory region allocated by an application program as read-only during the running process of the application program; triggering an exception each time the application program performs a write operation on the target memory region, and recording the write memory address corresponding to the current write operation and the call stack information in an information library; in the case of detecting that the application program triggers a fault due to memory stepping, acquiring an abnormal memory address; and querying the target call stack information corresponding to the abnormal memory address in the information library to locate the problem code through the target call stack information.

[0007] Optionally, setting the access permission of the target memory region allocated by the application program as read-only comprises: in response to the call of the application program on a memory allocation function, performing memory allocation through a monitoring component to acquire allocation information, wherein the allocation information comprises the start address and region size of the target memory region; and transmitting the allocation information to a driver module in the kernel space to enable the driver module to set the access permission of the page table entry corresponding to the target memory region as read-only.

[0008] Optionally, each time the application program performs a write operation on the target memory region, an exception is triggered, and the write memory address corresponding to the current write operation and the call stack information are recorded in the information library, including: when detecting that the application program performs a write operation on the target memory region, triggering a page fault exception; reading the write memory address of the write operation through the driver module in the kernel space; backtracking the kernel stack and user stack at the time of the page fault exception occurrence, to generate call stack information; recording the write memory address and the call stack information into the information library.

[0009] Optionally, after triggering the page fault exception, the method further includes: obtaining write data corresponding to the write operation; associating the write data with the write memory address and the call stack information, and recording into the information library.

[0010] Optionally, after recording the write memory address corresponding to the current write operation and the call stack information in the information library, the method further includes: mapping the physical memory page triggering the exception to the kernel address space in a writable access mode, and obtaining a corresponding kernel writable mapping address; according to the kernel writable mapping address and the write data, simulating the execution of the interrupted write operation to complete data writing according to the write instruction; after completing the data writing, updating the value of the program counter to the next instruction address of the write instruction; performing an exception handling return operation to make the application program resume execution from the next instruction address, and the access permission of the physical memory page remains read-only.

[0011] Optionally, querying the target call stack information corresponding to the exception memory address in the information library to locate the problem code, including: taking the exception memory address as an index to search in the information library, and screening out the target historical record matching the exception memory address; extracting the target call stack information from the target historical record; determining the problem code according to the target call stack information.

[0012] Optionally, extracting the target call stack information from the target historical record, including: if the target historical record is multiple, sorting the target historical records in chronological order; traversing each target historical record in reverse, and comparing the actual data with the write data in each target historical record, wherein the actual data is the data read from the exception memory address when the fault is triggered; if the write data matches the actual data, extracting the call stack information from the target historical record where the write data is located, and determining the call stack information as the target call stack information.

[0013] According to another aspect of the embodiments of the present application, the present application provides a memory trampling problem positioning device, comprising: a setting unit configured to set an access permission of a target memory region allocated by an application as read-only during a running process of the application; a recording unit configured to trigger an exception and record a write memory address corresponding to a current write operation and call stack information in an information base whenever the application performs a write operation on the target memory region; an obtaining unit configured to obtain an abnormal memory address when it is detected that the application triggers a fault due to memory trampling; and a querying unit configured to query target call stack information corresponding to the abnormal memory address in the information base to locate a problem code through the target call stack information.

[0014] According to another aspect of the embodiments of the present application, the present application provides an electronic device, comprising a memory, a processor, a communication interface and a communication bus, the memory stores a computer program capable of running on the processor, the memory, the processor and the communication interface communicate through the communication bus, and the processor implements the steps of the above method when executing the computer program.

[0015] According to another aspect of the embodiments of the present application, the present application further provides a computer readable medium having a non-volatile program code executable by a processor, the program code causing the processor to execute the above method.

[0016] The above technical solution provided by the embodiments of the present application has the following advantages compared with related art: The present application provides a memory trampling problem positioning method, comprising: setting an access permission of a target memory region allocated by an application as read-only during a running process of the application; triggering an exception and recording a write memory address corresponding to a current write operation and call stack information in an information base whenever the application performs a write operation on the target memory region; obtaining an abnormal memory address when it is detected that the application triggers a fault due to memory trampling; and querying target call stack information corresponding to the abnormal memory address in the information base to locate a problem code through the target call stack information. By setting the access permission of the target memory region allocated legally as read-only, recording the write memory address corresponding to the write operation and the call stack information when the write operation triggers an exception, and performing reverse correlation analysis after the memory trampling triggers a fault, the problem of being difficult to effectively locate the memory trampling occurring in the memory region allocated legally is solved. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the embodiments or the related art description. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without any creative effort.

[0019] Figure 1 A hardware environment schematic diagram of an optional memory stepping problem positioning method provided according to the embodiments of the present application; Figure 2 A flowchart of an optional memory stepping problem positioning method provided according to the embodiments of the present application; Figure 3 A schematic diagram of an optional memory stepping problem positioning system provided according to the embodiments of the present application; Figure 4 A block diagram of an optional memory stepping problem positioning apparatus provided according to the embodiments of the present application; Figure 5 An optional electronic device structure schematic diagram provided according to the embodiments of the present application. DETAILED DESCRIPTION

[0020] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort fall within the scope of protection of the present application.

[0021] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only for the convenience of the description of the present application, and have no specific meaning. Therefore, "module" and "component" can be used interchangeably.

[0022] In the running process of a software system, memory stepping is a common and difficult-to-position problem. For the memory stepping problem, on the one hand, a static code analysis tool can find some potential out-of-bound access risks by analyzing the source code, but it is difficult to accurately detect the actual memory stepping behavior in the running process due to the lack of runtime context information. On the other hand, a dynamic detection tool can also monitor memory access behavior to find illegal memory access, but for the stepping that occurs completely within the legal allocated memory region, that is, the address of the write operation itself does not exceed the boundary, but the content, timing or context of the write operation is incorrect, the current dynamic detection tool is difficult to effectively position.

[0023] Therefore, it is difficult to effectively locate the memory stomping occurring in the legal memory allocation region, and the problem needs to be solved urgently.

[0024] In order to solve the problems mentioned in the background art, according to an aspect of an embodiment of the present application, an embodiment of a memory stomping problem locating method is provided.

[0025] Optionally, in the embodiment of the present application, the memory stomping problem locating method can be applied to the hardware environment composed of the terminal 101 and the server 103 as shown in the figure. Figure 1 As shown in the figure, the server 103 is connected with the terminal 101 through a network, which can be used to provide services for the terminal or the client installed on the terminal, and a database 105 can be set on the server or independently from the server, which is used to provide data storage services for the server 103, and the network includes but is not limited to a wide area network, a metropolitan area network or a local area network, and the terminal 101 includes but is not limited to a PC, a mobile phone, a tablet computer and the like. Figure 1

[0026] The memory stomping problem locating method in the embodiment of the present application can be executed by the server 103, and can also be executed by the server 103 and the terminal 101 together, as shown in the figure, which includes the following steps. Figure 2 Step 201, setting the access permission of the target memory region allocated by the application program as read-only during the running process of the application program; Step 202, triggering an exception whenever the application program executes a write operation on the target memory region, and recording the write memory address corresponding to the current write operation and the call stack information in the information base; Step 203, acquiring the abnormal memory address when the application program triggers a fault due to memory stomping; Step 204, querying the target call stack information corresponding to the abnormal memory address in the information base, so as to locate the problem code through the target call stack information.

[0027] In the operating system starting stage, the kernel component mcheck.ko for memory monitoring and exception processing is loaded, and in the application program starting stage, the user state component mcheck.so for intercepting memory management function calls is loaded, so as to reload the allocation malloc and release free functions of the standard library.

[0028] During the running process of the application program, the access permission of the target memory region allocated by the application program is actively set as read-only, so as to convert each write operation into a capturable hardware exception event.

[0029] Each time an exception is triggered due to a write operation, the write memory address and the call stack information of the current write operation are synchronously captured and recorded, and stored in the persistent information base.​​

[0030] When the program finally triggers a fault due to memory stomping, the abnormal memory address in the fault information is used to query the information library reversely, so that the target call stack information causing the final state error of data can be screened and located from all historical records, thereby locating the problem code this time.

[0031] Figure 3 The schematic diagram of the memory stomping problem positioning system provided in the present application is shown in the figure. In step ①, when an application program (APP) applies for memory through malloc, calloc and the like, the call is first intercepted and processed by an enhanced monitoring library (new_malloc, new_calloc in the figure). After successfully allocating memory, the enhanced monitoring library does not return directly, but sends the start address and size of the allocated memory to the kernel as a control command through an ioctl system call; at this time, the kernel module (corresponding to the "driver module" of the present application) located in the kernel space receives and analyzes this command, and then calls the memory management function of the kernel to find the page table entry corresponding to the memory address, and modifies its access permission to "read only"; in step ②, the APP executes a write instruction (such as mov(eax), 0x2 in the figure) to try to write data 0x2 to the target memory area which has been set to read only; the memory management unit of the CPU (Central Processing Unit, Central Processing Unit) will check the page table permission before executing the instruction, and find that the "read only" permission conflicts with the "write" operation. Therefore, the CPU immediately generates a "page fault" exception and suspends the execution of the current instruction; in step ③, the capture function of the kernel module is activated by the page fault exception, and the precise memory address triggering this exception is read from the specific registers of the CPU, as well as the call stack backtracking at the time of the exception, to generate a function call chain, accurately pointing out which line of source code initiated this write, and then from the context of the interrupted instruction, the data content (i.e. 0x2) that tries to write is parsed; in step ④, the precise memory address, call stack and data content captured by the kernel module are associated and written into the log file on the disk to form an unalterable historical record. After the record is completed, the monitoring module maps the memory segment where the exception occurs to the kernel space in a writable manner, simulates the write memory instruction, writes data into the abnormal memory, and then modifies the PC register to the next instruction address. When returning from the exception, the monitored program can continue to run without sensing, and will be captured again when writing to the protected memory next time.

[0032] The steps 1-4 are automatically looped each time the protected memory is written, and when the application eventually crashes or behaves abnormally due to the memory data being destroyed, the user can obtain the abnormal memory address from the crash report; in the monitoring log on the disk, search for all records that have been written to the address; analyze these records, especially the call stack and write data, to accurately locate the line of source code that initially performed the erroneous write, thereby fixing the memory stomping problem.

[0033] The application can monitor the memory write behavior of the process through malloc legal allocation without modifying the source code of the application. By setting the legal memory page as read-only and using the hardware page exception mechanism, the call stack information at the time of memory write is obtained in real time, and when the application crashes due to memory stomping, the specific write location that caused the problem can be located in reverse, thereby significantly improving the debugability and positioning efficiency of the memory stomping problem.

[0034] As an optional embodiment, setting the access permission of the target memory region allocated by the application to read-only includes: in response to the call of the memory allocation function by the application, performing memory allocation through the monitoring component to obtain allocation information, wherein the allocation information includes the start address and the region size of the target memory region; and transmitting the allocation information to the driver module in the kernel space to enable the driver module to set the access permission of the page table entry corresponding to the target memory region to read-only.

[0035] When the application calls the standard memory allocation function (such as malloc), the call is intercepted by the monitoring component. The monitoring component performs the actual allocation operation to obtain the start address and size information of the target memory region. Without changing the original memory allocation logic of the application, the space range of the target memory region allocated by the application can be accurately obtained.

[0036] ioctl is a standard interface for user mode and kernel mode communication. The monitoring component transmits the obtained memory address range information to the kernel mode driver module through the ioctl (input / output control) system call.

[0037] After receiving the allocation information, the driver module determines the page table entry corresponding to the target memory region according to the start address and region size of the target memory region.

[0038] The page table entry is a data structure used by the processor to describe the mapping relationship between virtual memory and physical memory, which contains an attribute bit for controlling memory access permission. The driver module sets the access permission of the page table entry to read-only by modifying the access permission attribute in the page table entry corresponding to the target memory region, so that the target memory region is in a read-only state during the application running.

[0039] After the modification of the access permission of the page table entry is completed, the application program can still normally access the data in the target memory region, but when the application program attempts to perform a write operation on the target memory region, a page exception of the processor will be triggered due to the target memory region being set as read-only.

[0040] By limiting the access permission of the target memory region after the memory allocation is completed, a memory write operation that is originally semantically legal is converted into an abnormal event that can be perceived at the hardware level. Since the processor will inevitably trigger a page exception when performing a write operation on a read-only memory region, the system can enter an exception handling process at the moment when the write behavior occurs, thereby achieving the capture of the memory write behavior.

[0041] As an optional embodiment, whenever an application program performs a write operation on a target memory region, an exception is triggered, and the write memory address corresponding to the current write operation and the call stack information are recorded in the information library, including: detecting that the application program performs a write operation on the target memory region, triggering a page fault exception; reading the write memory address of the write operation through the driver module in the kernel space; backtracking the kernel stack and user stack at the time of the page fault exception occurrence to generate call stack information; recording the write memory address and the call stack information into the information library.

[0042] When an application program attempts to perform a write operation on a target memory region that has been set as read-only, a page fault exception will be triggered due to the target memory region not having write permission, at which time the execution of the current instruction stream is interrupted.

[0043] After the page fault exception occurs, the processor switches the current execution context to the kernel space, and the kernel handles the page fault exception. The driver module in the kernel space is called during the exception handling process to capture the page fault exception. After capturing the page fault exception, the driver module reads the write memory address corresponding to the write operation, which is the specific memory location that the application program attempts to write.

[0044] At the same time of obtaining the write memory address, the driver module backtracks the call path at the time of the page fault exception occurrence to generate call stack information. The call stack information includes the kernel mode call stack and the user mode call stack at the time of the page fault exception occurrence.

[0045] The backtracking operation includes kernel stack backtracking and user stack backtracking. The kernel stack backtracking is to backtrack from a call stack frame of the current exception handling function in the kernel space to record a call path of the driver module itself and the kernel. The user stack backtracking is to recover a call stack of a user space site triggering an exception by analyzing a thread state of an application saved when the exception occurs. This usually needs to access virtual memory of a process, traverse a stack frame chain, extract a series of program counter addresses (i.e. return addresses) to form a complete call stack information. The call stack clearly shows all function call sequences between an application entry point and an instruction triggering a write exception. By backtracking the user stack, a call path of the application triggering the write operation can be obtained, thereby completely reflecting an execution context causing the write operation.

[0046] After the call stack information is generated, the driver module associates the write memory address with the corresponding call stack information, and stores the associated information as a write record into the information base.

[0047] Each write operation on the target memory region corresponds to generate a history record containing the write memory address and the call stack information.

[0048] The embodiment realizes the whole process recording of the memory write behavior by triggering a page fault exception when each write operation on the target memory region occurs, and synchronously recording the write memory address and the call stack information. When the memory stomping finally causes a fault, the corresponding call path can be accurately backtracked from the information base based on the fault memory address, thereby significantly improving the accuracy and efficiency of the memory stomping problem positioning.

[0049] As an optional embodiment, after the page fault exception is triggered, the method further includes: obtaining write data corresponding to the write operation; associating the write data with the write memory address and the call stack information, and recording into the information base.

[0050] After the page fault exception occurs, an exception handling process is entered, and an execution context corresponding to the current write operation is reserved. In the process of handling the page fault exception, the driver module in the kernel space obtains write data corresponding to the write operation according to the execution context when the exception occurs. The write data is data content of the application trying to write to the target memory region.

[0051] After the write data is obtained, the driver module associates the write data with the corresponding write memory address and the call stack information to form a complete write record corresponding to the write operation. Then, the write record is stored into the information base, so that each record in the information base not only includes the write memory address and the call stack information, but also further includes the write data corresponding to the write operation.

[0052] The embodiment further records the write data after the page error exception is triggered, so that the information base can simultaneously save the address information of the write operation, the calling path information and the specific write content. When the memory stomping problem occurs, not only can it be located which code segment executes the error write, but also can analyze the way of the memory destruction in combination with the write data, so as to improve the accuracy of the memory stomping problem positioning and analysis.

[0053] As an optional embodiment, after the write memory address corresponding to the current write operation and the calling stack information are recorded in the information base, the method further comprises: mapping the physical memory page triggering the exception to the kernel address space in a writable access mode, and obtaining a corresponding kernel writable mapping address; simulating the execution of the interrupted write operation according to the kernel writable mapping address and the write data, so as to complete the data write according to the write instruction; after the data write is completed, updating the value of the program counter to the next instruction address of the write instruction; performing an exception handling return operation, so that the application program resumes the execution from the next instruction address, and the access permission of the physical memory page remains read-only.

[0054] The kernel address space is a memory region specially used by the operating system kernel (kernel mode). The code, data and kernel data structure shared by all processes of the kernel are located in this space.

[0055] After the information (write memory address, calling stack information, etc.) of the current write exception is captured and recorded through the kernel driver module, the driver module does not modify the read-only permission of the original memory page in the user space. Instead, it uses the kernel permission to call the memory management interface, maps the physical memory page triggering the current exception to a temporary location in the kernel address space in a writable access mode, and thus obtains a corresponding kernel writable mapping address.

[0056] After obtaining the kernel writable mapping address, the driver module simulates the execution of the write instruction interrupted by the page error exception in the kernel address space according to the write data captured in the exception field and the kernel writable mapping address.

[0057] In order to enable the application program to continue running, the driver module needs to modify the program counter of the processor. The program counter itself is a hardware register of the processor, which exists in the runtime context of the application program execution. The driver module updates the value of the program counter to the address of the next instruction of the interrupted write instruction. At this time, when the processor resumes the execution, it will skip the instruction that has been simulated by the kernel, so as to avoid triggering the same page error exception again, and form a correct execution flow.

[0058] Throughout the whole process, the page table entry of the user space original memory page is never modified, and the access permission thereof is always kept as read-only, so that a monitoring loophole caused by temporarily opening write permission can be avoided, and it is ensured that each write operation is necessarily captured, thereby achieving full-process monitoring without omission.

[0059] The write operation of the application program is simulated and completed in the kernel space, and thus no interference is caused to the program running.

[0060] As an optional embodiment, the target call stack information corresponding to the abnormal memory address is queried in the information base to locate the problem code causing the memory trampling, and the method comprises the following steps of: indexing the abnormal memory address to search in the information base, and screening out the target historical record matched with the abnormal memory address; extracting the target call stack information from the target historical record; and determining the problem code according to the target call stack information.

[0061] When the application program triggers a fault due to memory trampling and generates an abnormal memory address, the abnormal memory address is indexed to search in the information base. The information base stores historical write records, and each record comprises a write memory address, corresponding call stack information and write data.

[0062] In the searching process, the target historical record matched with the abnormal memory address is screened out, that is, the record in which a write operation has occurred before and the write address is consistent with the abnormal memory address is screened out, and then the target call stack information corresponding to the write operation is extracted from the target historical record. The target call stack information can comprise a user mode call stack and a kernel mode call stack, and is used to describe the execution path of the write operation.

[0063] After the target call stack information is obtained, the specific problem code causing the memory trampling is determined according to the information, that is, the calling sequence and function position in the target call stack are analyzed to accurately locate the application program code segment triggering the abnormal write operation.

[0064] The embodiment can directly extract the corresponding call stack information from the historical write record by indexing and searching the abnormal memory address in the information base, accurately locate the source code of the memory trampling problem, and significantly improve the efficiency and accuracy of the memory trampling problem positioning, and reduce the manual troubleshooting workload.

[0065] As an optional embodiment, the target call stack information is extracted from the target history records, including: if the target history records are multiple, the target history records are sorted in chronological order; each target history record is traversed in reverse, and the actual data is compared with the write data in each target history record, wherein the actual data is the data read from the abnormal memory address when the fault is triggered; if the write data matches the actual data, the call stack information is extracted from the target history record where the write data is located, and the call stack information is determined as the target call stack information.

[0066] When there are multiple target history records matching the abnormal memory address in the information base, the target history records are first sorted in chronological order to ensure that the analysis process follows the time sequence of the actual write operation.

[0067] After sorting, each target history record is traversed in reverse, that is, starting from the most recent write operation and searching forward. In the traversal process, the actual data is compared with the write data recorded in each target history record. The actual data is the data content read from the abnormal memory address when the memory stomping fault is triggered, and the write data is the data content corresponding to each write operation stored in the history record.

[0068] When it is found in the traversal process that the write data completely matches the actual data, it is determined that the write operation corresponding to the history record is the write operation that triggers the exception, the call stack information is extracted from the target history record, and the call stack information is determined as the target call stack information.

[0069] The function call sequence of the target call stack information is analyzed, the application program function triggering the abnormal write operation is determined, and then the source code location is mapped according to the call information of the application program function to determine the specific code segment triggering the abnormal write operation. The specific code segment is the problem code causing the memory stomping.

[0070] The embodiment can accurately identify the operation that really causes the memory stomping from multiple history write records by comparing the actual data with the history write data, and extract the corresponding call stack information. This not only improves the accuracy of memory stomping problem positioning, but also reduces the misjudgment caused by multiple write record interference, provides reliable basis for developers to quickly locate problem code, and improves software debugging efficiency and system stability.

[0071] The application provides a memory trampling problem positioning method, comprising: setting access permission of a target memory region allocated by an application as read-only during application running; triggering an exception whenever the application performs a write operation on the target memory region, and recording a write memory address corresponding to the current write operation and call stack information in an information base; in the case that the application triggers a fault due to memory trampling, acquiring an abnormal memory address; querying the target call stack information corresponding to the abnormal memory address in the information base to locate problem code through the target call stack information. By setting access permission of a target memory region allocated legitimately as read-only, recording the write memory address corresponding to the write operation and the call stack information when the write operation triggers an exception, and performing reverse correlation analysis after the fault triggered by memory trampling, the problem that it is difficult to effectively locate memory trampling occurring in a memory region allocated legitimately is solved.

[0072] According to another aspect of the embodiments of the application, the application provides a memory trampling problem positioning device, as shown in the following Figure 4 , comprising: A setting unit 401 is configured to set access permission of a target memory region allocated by an application as read-only during application running. A recording unit 402 is configured to trigger an exception whenever the application performs a write operation on the target memory region, and record a write memory address corresponding to the current write operation and call stack information in an information base. An acquiring unit 403 is configured to acquire an abnormal memory address in the case that the application triggers a fault due to memory trampling. A querying unit 404 is configured to query the target call stack information corresponding to the abnormal memory address in the information base to locate problem code through the target call stack information.

[0073] It should be noted that the setting unit 401 in the embodiment can be configured to perform step 201 in the embodiments of the application, the recording unit 402 in the embodiment can be configured to perform step 202 in the embodiments of the application, the acquiring unit 403 in the embodiment can be configured to perform step 203 in the embodiments of the application, and the querying unit 404 in the embodiment can be configured to perform step 204 in the embodiments of the application.

[0074] Optionally, the setting unit 401 is specifically configured to perform memory allocation through a monitoring component to acquire allocation information in response to an application call to a memory allocation function, wherein the allocation information comprises a start address and a region size of the target memory region; and transmit the allocation information to a driver module in a kernel space to enable the driver module to set access permission of a page table entry corresponding to the target memory region as read-only.

[0075] Optionally, the recording unit 402 is specifically configured to trigger a page fault exception when detecting that the application program performs a write operation to the target memory region; read a write memory address of the write operation through a driver module in the kernel space; backtrack a kernel stack and a user stack at the time when the page fault exception occurs, to generate call stack information; and record the write memory address and the call stack information into the information base.

[0076] Optionally, the apparatus further comprises an association unit configured to, after triggering the page fault exception, acquire write data corresponding to the write operation; associate the write data with the write memory address and the call stack information, and record into the information base.

[0077] Optionally, the apparatus further comprises a write unit configured to, after recording the write memory address corresponding to the current write operation and the call stack information into the information base, map the physical memory page triggering the exception to the kernel address space in a writable access mode, and obtain a corresponding kernel writable mapping address; simulate execution of the interrupted write operation according to the kernel writable mapping address and the write data, to complete data writing according to the write instruction; after completing the data writing, update a value of a program counter to a next instruction address of the write instruction; perform an exception handling return operation, so that the application program resumes execution from the next instruction address, and the access permission of the physical memory page remains read-only.

[0078] Optionally, the query unit 404 is specifically configured to index the abnormal memory address, search in the information base, and filter out a target historical record matching the abnormal memory address; extract target call stack information from the target historical record; and determine the problem code according to the target call stack information.

[0079] Optionally, the query unit 404 is further configured to, if the target historical record is multiple, sort the target historical records in chronological order; traverse each target historical record in reverse, and compare actual data with write data in each target historical record, wherein the actual data is data read from the abnormal memory address when triggering the fault; if the write data matches the actual data, extract call stack information from the target historical record where the write data is located, and determine the call stack information as the target call stack information.

[0080] It should be noted that the above modules and the examples and application scenarios implemented by the corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules as part of the apparatus can run in the hardware environment as shown in Figure 1 .

[0081] According to another aspect of the embodiments of the present application, the present application provides an electronic device, such as a server, a terminal, a mobile terminal, a personal computer, a notebook computer, a tablet computer, a wearable device, or the like. Figure 5As shown, the electronic device includes a memory 501, a processor 503, a communication interface 505, and a communication bus 507. The memory 501 stores a computer program executable on the processor 503. The memory 501 and the processor 503 communicate through the communication interface 505 and the communication bus 507. The processor 503 executes the computer program to implement the steps of the above method.

[0082] The memory and the processor in the electronic device communicate through the communication bus and the communication interface. The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0083] The memory can include a Random Access Memory (RAM) and can also include a non-volatile memory, such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0084] The processor described above can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc. It can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0085] According to another aspect of the embodiments of the present application, a computer readable medium having non-volatile program code executable by a processor is also provided.

[0086] Optionally, the specific examples in the embodiments can refer to the examples described in the above embodiments, and the embodiments will not be described here.

[0087] In the specific implementation, the embodiments of the present application can refer to the above various embodiments and have corresponding technical effects.

[0088] It can be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing units can be implemented within one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSP Devices), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), general purpose processors, controllers, micro-controllers, microprocessors, other electronic units designed to perform the functions described herein, or a combination thereof.

[0089] For software implementation, the techniques described herein can be implemented with a processing unit that executes software routines or functions to perform the techniques described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented within the processor or external to the processor.

[0090] Those of ordinary skill in the art can understand that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0091] Those of ordinary skill in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0092] In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented by other ways. For example, the apparatus embodiments described above are only schematic, and the division of the modules is only a logical function division, and there can be another division way in actual implementation, for example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0093] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e. may be located in one place, or may be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0094] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0095] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application can be embodied in the form of software products, and the computer software products are stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, and various program codes that can be stored in the medium. It should be noted that in this paper, terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles or devices. Without more limitations, the elements defined by the statement "including a" do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0096] The above is only a specific embodiment of the present application, which enables those skilled in the art to understand or implement the present application. Various modifications of these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features applied herein.

Claims

1. A method for locating memory stampede problems, characterized in that, include: During application execution, the access permissions for the target memory region allocated by the application are set to read-only; Whenever the application performs a write operation on the target memory region, an exception is triggered, and the write memory address and call stack information corresponding to the current write operation are recorded in the information database; If the application is detected to have triggered a fault due to memory overload, obtain the abnormal memory address; The target call stack information corresponding to the abnormal memory address is queried in the information database in order to locate the problematic code through the target call stack information.

2. The method according to claim 1, characterized in that, Setting the access permissions of the target memory region allocated by the application to read-only includes: In response to the application's call to the memory allocation function, a monitoring component performs memory allocation to obtain allocation information, wherein the allocation information includes the starting address and size of the target memory region; The allocation information is transmitted to the driver module in the kernel space, so that the driver module sets the access permission of the page table entry corresponding to the target memory region to read-only.

3. The method according to claim 1, characterized in that, Whenever the application performs a write operation on the target memory region, an exception is triggered, and the write memory address and call stack information corresponding to the current write operation are recorded in the information database, including: When the application is detected to be performing a write operation to the target memory region, a page fault exception is triggered. The write memory address of the write operation is read through the driver module in the kernel space; The kernel stack and user stack at the time of the page fault exception are traced back to generate the call stack information; The memory address and the call stack information are recorded in the information database.

4. The method according to claim 3, characterized in that, After triggering the page error exception, the method further includes: Obtain the write data corresponding to the write operation; The written data is associated with the written memory address and the call stack information, and recorded in the information database.

5. The method according to claim 4, characterized in that, After recording the write memory address and call stack information corresponding to the current write operation in the information database, the method further includes: The physical memory page that triggered the exception is mapped to the kernel address space in a writable manner, and the corresponding kernel writable mapping address is obtained. Based on the kernel writable mapping address and the write data, simulate the interrupted write operation to complete the data write according to the write instruction; After the data writing is completed, the value of the program counter is updated to the address of the next instruction after the write instruction; An exception handling return operation is performed, allowing the application to resume execution from the next instruction address, while the access permissions of the physical memory page remain read-only.

6. The method according to claim 1, characterized in that, The step of querying the target call stack information corresponding to the abnormal memory address in the information database to locate the problematic code that caused the memory crash includes: Using the abnormal memory address as an index, a search is performed in the information database to filter out target historical records that match the abnormal memory address; Extract the target call stack information from the target's historical record; The problematic code is determined based on the target call stack information.

7. The method according to claim 6, characterized in that, Extracting the target call stack information from the target history includes: If there are multiple target historical records, then the target historical records are sorted in chronological order. The process involves reverse traversal of each target historical record and comparison of the actual data with the written data in each target historical record, wherein the actual data is the data read from the abnormal memory address when the fault is triggered. If the written data matches the actual data, the call stack information is extracted from the target historical record where the written data is located, and the call stack information is determined as the target call stack information.

8. A memory stamping problem location device, characterized in that, include: The setting unit is used to set the access permission of the target memory region allocated by the application to read-only during the application's operation. The recording unit is used to trigger an exception whenever the application performs a write operation on the target memory region, and to record the write memory address and call stack information corresponding to the current write operation in the information database; The acquisition unit is used to acquire the abnormal memory address when the application is detected to have triggered a fault due to memory overload. The query unit is used to query the target call stack information corresponding to the abnormal memory address in the information database, so as to locate the problematic code through the target call stack information.

9. An electronic device comprising a memory, a processor, a communication interface, and a communication bus, wherein the memory stores a computer program executable on the processor, and the memory and the processor communicate via the communication bus and the communication interface, characterized in that... When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable medium having processor-executable non-volatile program code, characterized in that, The program code causes the processor to execute the method of any one of claims 1 to 7.

Images