Linux内核发送崩溃时,kdump会生成一个内核转储文件vmcore。 可以通过分析vmcore分析出内核崩溃的原因。
原理
Linux内核发送崩溃时,kdump会生成一个内核转储文件vmcore。 可以通过分析vmcore分析出内核崩溃的原因。
crash是一个被广泛应用的内核崩溃转储文件分析工具。使用crash调试内核转储文件,需要安装crash工具和内核调试工具kernel-debuginfo。
安装需要的软件
1、查看系统内核
- [root@qd01-stop-free015~]#uname-r
- 3.10.0-1160.15.2.el7.x86_64
2、安装kdump,crash
- yuminstallcrashkexec-tools-y
3、安装kernel-debuginfo
下载链接http://debuginfo.centos.org/7/x86_64/
- rpm-ivhkernel-debuginfo-3.10.0-1160.15.2.el7.x86_64.rpmkernel-debuginfo-common-x86_64-3.10.0-1160.15.2.el7.x86_64.rpm
crash报告分析
1、使用crash命令加载vmcore文件
- [root@qd01-stop-free015kdump]#crash/usr/lib/debug/lib/modules/3.10.0-1160.15.2.el7.x86_64/vmlinuxvmcore
- crash7.2.3-11.el7_9.1
- Copyright(C)2002-2017RedHat,Inc.
- Copyright(C)2004,2005,2006,2010IBMCorporation
- Copyright(C)1999-2006Hewlett-PackardCo
- Copyright(C)2005,2006,2011,2012FujitsuLimited
- Copyright(C)2006,2007VALinuxSystemsJapanK.K.
- Copyright(C)2005,2011NECCorporation
- Copyright(C)1999,2002,2007SiliconGraphics,Inc.
- Copyright(C)1999,2000,2001,2002MissionCriticalLinux,Inc.
- Thisprogramisfreesoftware,coveredbytheGNUGeneralPublicLicense,
- andyouarewelcometochangeitand/ordistributecopiesofitunder
- certainconditions.Enter"helpcopying"toseetheconditions.
- Thisprogramhasabsolutelynowarranty.Enter"helpwarranty"fordetails.
- GNUgdb(GDB)7.6
- Copyright(C)2013FreeSoftwareFoundation,Inc.
- LicenseGPLv3+:GNUGPLversion3orlater<http://gnu.org/licenses/gpl.html>
- Thisisfreesoftware:youarefreetochangeandredistributeit.
- ThereisNOWARRANTY,totheextentpermittedbylaw.Type"showcopying"
- and"showwarranty"fordetails.
- ThisGDBwasconfiguredas"x86_64-unknown-linux-gnu"...
- WARNING:kernelrelocated[274MB]:patching87300gdbminimal_symbolvalues
- KERNEL:/usr/lib/debug/lib/modules/3.10.0-1160.15.2.el7.x86_64/vmlinux
- DUMPFILE:vmcore[PARTIALDUMP]
- CPUS:8
- DATE:ThuMar410:12:382021
- UPTIME:00:05:04
- LOADAVERAGE:5.28,3.20,1.38
- TASKS:256
- NODENAME:zf-dbslave001
- RELEASE:3.10.0-1160.15.2.el7.x86_64
- VERSION:#1SMPWedFeb315:06:38UTC2021
- MACHINE:x86_64(2500Mhz)
- MEMORY:63GB
- PANIC:"BUG:unabletohandlekernelNULLpointerdereferenceat0000000000000074"
- PID:1362
- COMMAND:"AliYunDun"
- TASK:ffff90f972365280[THREAD_INFO:ffff90f9767a4000]
- CPU:5
- STATE:TASK_RUNNING(PANIC)
输出注释如下:
- KERNEL:系统崩溃时运行的 kernel 文件
- DUMPFILE: 内核转储文件
- CPUS: 所在机器的 CPU 数量
- DATE:系统崩溃的时间
- TASKS:系统崩溃时内存中的任务数
- NODENAME:崩溃的系统主机名
- RELEASE: 和 VERSION:内核版本号
- MACHINE:CPU 架构
- MEMORY:崩溃主机的物理内存
- PANIC:崩溃类型,常见的崩溃类型包括:
- SysRq (System Request):通过魔法组合键导致的系统崩溃,通常是测试使用。通过 echo c > /proc/sysrq-trigger,就可以触发系统崩溃。
- oops:可以看成是内核级的 Segmentation Fault。应用程序如果进行了非法内存访问或执行了非法指令,会得到 Segfault 信号,一般行为是 coredump,应用程序也可以自己截获 Segfault 信号,自行处理。如果内核自己犯了这样的错误,则会弹出 oops 信息。
从以上输出可以知道,本次系统崩溃的原因是:PANIC: "BUG: unable to handle kernel NULL pointer dereference at 0000000000000074",然后导致AliYunDun把系统重启了。
PS:搞不懂阿里云的破逻辑,服务器被黑了居然只会不断重启服务器?
2、使用bt 命令用于查看系统崩溃前的堆栈信息。
- crash>bt
- PID:1362TASK:ffff90f972365280CPU:5COMMAND:"AliYunDun"
- #0[ffff90f9767a77a0]machine_kexecatffffffff922662c4
- #1[ffff90f9767a7800]__crash_kexecatffffffff923227a2
- #2[ffff90f9767a78d0]crash_kexecatffffffff92322890
- #3[ffff90f9767a78e8]oops_endatffffffff9298c798
- #4[ffff90f9767a7910]no_contextatffffffff92275d14
- #5[ffff90f9767a7960]__bad_area_nosemaphoreatffffffff92275fe2
- #6[ffff90f9767a79b0]bad_area_nosemaphoreatffffffff92276104
- #7[ffff90f9767a79c0]__do_page_faultatffffffff9298f750
- #8[ffff90f9767a7a30]trace_do_page_faultatffffffff9298fa26
- #9[ffff90f9767a7a70]do_async_page_faultatffffffff9298efa2
- #10[ffff90f9767a7a90]async_page_faultatffffffff9298b7a8
- #11[ffff90f9767a7b98]kmem_cache_alloc_traceatffffffff92428a0c
- #12[ffff90f9767a7c98]mntputatffffffff92471d94
- #13[ffff90f9767a7d88]kvm_sched_clock_readatffffffff9226d3be
- #14[ffff90f9767a7ec8]putnameatffffffff9245fd3d
- #15[ffff90f9767a7f50]system_call_fastpathatffffffff92994f92
- RIP:00007f84fd928315RSP:00007f84fb011af8RFLAGS:00000206
- RAX:000000000000004eRBX:000000000244e010RCX:ffffffffffffffff
- RDX:0000000000008000RSI:000000000244e010RDI:0000000000000012
- RBP:000000000244e010R8:0000000000000020R9:0000000000008030
- R10:0000000000000076R11:0000000000000246R12:ffffffffffffff30
- R13:0000000000000000R14:000000000244dfe0R15:000000000000052a
- ORIG_RAX:000000000000004eCS:0033SS:002b
3、log 命令可以打印系统消息缓冲区,从而可能找到系统崩溃的线索。输出太多,这里只截取部分信息。
- crash>log
- [0.000000]Initializingcgroupsubsyscpuset
- [0.000000]Initializingcgroupsubsyscpu
- [0.000000]Initializingcgroupsubsyscpuacct
- [0.000000]Linuxversion3.10.0-1160.15.2.el7.x86_64(mockbuild@kbuilder.bsys.centos.org)(gccversion4.8.520150623(RedHat4.8.5-44)(GCC))#1SMPWedFeb315:06:38UTC2021
- [0.000000]Commandline:BOOT_IMAGE=/boot/vmlinuz-3.10.0-1160.15.2.el7.x86_64root=UUID=1114fe9e-2309-4580-b183-d778e6d97397rocrashkernel=autorhgbquietLANG=en_US.UTF-8idle=haltbiosdevname=0net.ifnames=0console=tty0console=ttyS0,115200n8noibrs
- [0.000000]e820:BIOS-providedphysicalRAMmap:
- [0.000000]BIOS-e820:[mem0x0000000000000000-0x000000000009fbff]usable
- [0.000000]BIOS-e820:[mem0x000000000009fc00-0x000000000009ffff]reserved
- [0.000000]BIOS-e820:[mem0x00000000000f0000-0x00000000000fffff]reserved
- [0.000000]BIOS-e820:[mem0x0000000000100000-0x0000000013ffffff]usable
- [0.000000]BIOS-e820:[mem0x0000000014000000-0x000000001511ffff]reserved
- [0.000000]BIOS-e820:[mem0x0000000015120000-0x00000000bffcdfff]usable
- [0.000000]BIOS-e820:[mem0x00000000bffce000-0x00000000bfffffff]reserved
- [0.000000]BIOS-e820:[mem0x00000000feffc000-0x00000000feffffff]reserved
- [0.000000]BIOS-e820:[mem0x00000000fffc0000-0x00000000ffffffff]reserved
- [0.000000]BIOS-e820:[mem0x0000000100000000-0x0000000fffffffff]usable
- [0.000000]BIOS-e820:[mem0x0000001000000000-0x000000103fffffff]reserved
- [0.000000]NX(ExecuteDisable)protection:active
- [0.000000]SMBIOS2.8present.
- [0.000000]DMI:AlibabaCloudAlibabaCloudECS,BIOSe62364704/01/2014
- [0.000000]Hypervisordetected:KVM
- [0.000000]e820:update[mem0x00000000-0x00000fff]usable==>reserved
- [0.000000]e820:remove[mem0x000a0000-0x000fffff]usable
- [0.000000]e820:last_pfn=0x1000000max_arch_pfn=0x400000000
- [0.000000]MTRRdefaulttype:write-back
- [0.000000]MTRRfixedrangesenabled:
- [0.000000]00000-9FFFFwrite-back
- [0.000000]A0000-BFFFFuncachable
- [0.000000]C0000-FFFFFwrite-protect
- [0.000000]MTRRvariablerangesenabled:
- [0.000000]0base0000C0000000mask3FFFC0000000uncachable
- [0.000000]1disabled
- [0.000000]2disabled
- [0.000000]3disabled
- [0.000000]4disabled
- [0.000000]5disabled
- [0.000000]6disabled
- [0.000000]7disabled
- [0.000000]PATconfiguration[0-7]:WBWCUC-UCWBWPUC-UC
- [0.000000]e820:last_pfn=0xbffcemax_arch_pfn=0x400000000
- [0.000000]foundSMPMP-tableat[mem0x000f5a00-0x000f5a0f]mappedat[ffffffffff200a00]
- [0.000000]Basememorytrampolineat[ffff90f800099000]99000size24576
- [0.000000]UsingGBpagesfordirectmapping
- [0.000000]BRK[0x70e74000,0x70e74fff]PGTABLE
- [0.000000]BRK[0x70e75000,0x70e75fff]PGTABLE
- [0.000000]BRK[0x70e76000,0x70e76fff]PGTABLE
- [0.000000]BRK[0x70e77000,0x70e77fff]PGTABLE
- [0.000000]BRK[0x70e78000,0x70e78fff]PGTABLE
- [0.000000]RAMDISK:[mem0x3625c000-0x37125fff]
- [0.000000]Earlytablechecksumverificationdisabled
- [0.000000]ACPI:RSDP00000000000f59b000014(v00BOCHS)
- [0.000000]ACPI:RSDT00000000bffe218500034(v01BOCHSBXPCRSDT00000001BXPC00000001)
- [0.000000]ACPI:FACP00000000bffe093e00074(v01BOCHSBXPCFACP00000001BXPC00000001)
- [0.000000]ACPI:DSDT00000000bffdfd8000BBE(v01BOCHSBXPCDSDT00000001BXPC00000001)
- [0.000000]ACPI:FACS00000000bffdfd4000040
- [0.000000]ACPI:SSDT00000000bffe09b2015FB(v01BOCHSBXPCSSDT00000001BXPC00000001)
- [0.000000]ACPI:APIC00000000bffe1fad000B0(v01BOCHSBXPCAPIC00000001BXPC00000001)
- [0.000000]ACPI:SRAT00000000bffe205d00128(v01BOCHSBXPCSRAT00000001BXPC00000001)
- [4.722250]Adding33554428kswapon/data/swapfile.Priority:-2extents:24across:35823612kFS
- [5.841211]input:QEMUQEMUUSBTabletas/devices/pci0000:00/0000:00:01.2/usb1/1-1/1-1:1.0/input/input5
- [5.841325]hid-generic0003:0627:0001.0001:input,hidraw0:USBHIDv0.01Pointer[QEMUQEMUUSBTablet]onusb-0000:00:01.2-1/input0
- [13.615575]mzoneinfo:loadingout-of-treemoduletaintskernel.
- [13.615611]mzoneinfo:moduleverificationfailed:signatureand/orrequiredkeymissing-taintingkernel
- [305.100071]BUG:unabletohandlekernelNULLpointerdereferenceat0000000000000074
- [305.101048]IP:[<ffffffffc02d74c0>]0xffffffffc02d74c0
- [305.101653]PGD800000010d7ed067PUD176f9c067PMD0
- [305.102276]Oops:0000[#1]SMP
- [305.102675]Moduleslinkedin:tcp_diaginet_diagcirrusttmnfitdrm_kms_helperlibnvdimmsyscopyareappdevsysfillrectintel_powerclampsysimgbltfb_sys_fopsdrmiosf_mbiparport_pccrc32_pclmulvirtio_balloonparportghash_clmulni_intelaesni_intellrwgf128muldrm_panel_orientation_quirksglue_helperpcspkri2c_piix4joydevablk_helpercryptdip_tablesext4mbcachejbd2ata_genericpata_acpivirtio_netvirtio_consolenet_failovervirtio_blkfailoverata_piixlibatacrct10dif_pclmulcrct10dif_commoncrc32c_intelvirtio_pcivirtio_ringfloppyserio_rawvirtio
- [305.109021]CPU:5PID:1362Comm:AliYunDunKdump:loadedTainted:GOE------------3.10.0-1160.15.2.el7.x86_64#1
- [305.110306]Hardwarename:AlibabaCloudAlibabaCloudECS,BIOSe62364704/01/2014
- [305.111150]task:ffff90f972365280ti:ffff90f9767a4000task.ti:ffff90f9767a4000
- [305.111977]RIP:0010:[<ffffffffc02d74c0>][<ffffffffc02d74c0>]0xffffffffc02d74c0
- [305.112843]RSP:0018:ffff90f9767a7b48EFLAGS:00010283
- [305.113437]RAX:fffffffffffffbd0RBX:0000000000000240RCX:00000000000007cd
- [305.114228]RDX:0000000000000000RSI:ffff90f972365280RDI:00000000ffffffff
- [305.115014]RBP:ffff90f9767a7b88R08:0000000040000000R09:0000000000000400
- [305.115804]R10:0000000000000000R11:ffffd9d105c1ea00R12:0000000000000240
- [305.116586]R13:0000000000000258R14:0000000000000018R15:ffff90f9707aa000
- [305.117377]FS:00007f84fb012700(0000)GS:ffff9107ffd40000(0000)knlGS:0000000000000000
- [305.118276]CS:0010DS:0000ES:0000CR0:0000000080050033
- [305.118921]CR2:0000000000000074CR3:000000017839e000CR4:00000000003606e0
- [305.119710]DR0:0000000000000000DR1:0000000000000000DR2:0000000000000000
- [305.120502]DR3:0000000000000000DR6:00000000fffe0ff0DR7:0000000000000400
- [305.121291]CallTrace:
- [305.121581][<ffffffff92428a0c>]?kmem_cache_alloc_trace+0x3c/0x200
- [305.122304][<ffffffff9242832e>]?__kmalloc+0x2e/0x230
- [305.122898][<ffffffff92471d94>]?mntput+0x24/0x40
- [305.123458][<ffffffff9226d3be>]?kvm_sched_clock_read+0x1e/0x30
- [305.124162][<ffffffff9245fd3d>]?putname+0x3d/0x60
- [305.124733][<ffffffff92994f92>]?system_call_fastpath+0x25/0x2a
- [305.125417]Code:65488b3425c00e0100488b9630040000488d82d0fbffff4839c6742c3b7a74742ab9d0070000eb0d0f1f00<3b>7a74741b83e9017413488b9030040000488d82d0
- [305.128647]RIP[<ffffffffc02d74c0>]0xffffffffc02d74c0
- [305.129263]RSP<ffff90f9767a7b48>
- [305.129660]CR2:0000000000000074
4、ps 命令用于显示进程的状态,带 > 标识代表是活跃的进程。
- crash>ps
- PIDPPIDCPUTASKST%MEMVSZRSSCOMM
- 000ffffffff92e18480RU0.000[swapper/0]
- >001ffff90f964f74200RU0.000[swapper/1]
- 002ffff90f964f75280RU0.000[swapper/2]
- >003ffff90f964f76300RU0.000[swapper/3]
- 004ffff90f965760000RU0.000[swapper/4]
- 005ffff90f965761080RU0.000[swapper/5]
- 006ffff90f965762100RU0.000[swapper/6]
- >007ffff90f965763180RU0.000[swapper/7]
- 103ffff90f964b60000IN0.0434603816systemd
- 这里忽略部分信息......
- 104516ffff90f91038c200IN0.0110208880agetty
- 114413ffff90f966f6a100IN0.0325444304AliYunDunUpdate
- 114513ffff90f90b3a3180IN0.0325444304AliYunDunUpdate
- 114611ffff90f90b3a2100IN0.0325444304AliYunDunUpdate
- 116117ffff90f978bcb180IN0.0325444304AliYunDunUpdate
- 116511ffff90f910389080IN0.080287211300aliyun-service
- 116613ffff90f978bcc200IN0.080287211300aliyun-service
- 117015ffff90f978bc8000IN0.080287211300aliyun-service
- 118013ffff90f90c3f2100IN0.080287211300aliyun-service
- 118815ffff90f91038d280IN0.049362556matchpathcond
- 119115ffff90f91038b180IN0.0328208postcated
- 119317ffff90f977398000IN0.03304184telinited
- 119411935ffff90f910388000IN0.034361244telinited
- 120610ffff90f966f68000IN0.050881676devlinked
- 120911ffff90f970b40000IN0.017240logrotated
- 131311ffff90f90f7d4200IN0.057428417500gmain
- 131417ffff90f90f7d2100IN0.057428417500tuned
- 132215ffff90f9783b8000IN0.013953622220AliYunDun
- 132311ffff90f9533eb180IN0.013953622220AliYunDun
- 132415ffff90f9533ed280IN0.013953622220AliYunDun
- 134513ffff90f91279d280IN0.057428417500tuned
- 134615ffff90f91279e300IN0.057428417500tuned
- 134715ffff90f90eb84200IN0.07182407536rs:mainQ:Reg
- 134911ffff90f91279b180IN0.013953622220AliYunDun
- 135011ffff90f91279c200IN0.013953622220AliYunDun
- 135111ffff90f90b3a5280IN0.013953622220AliYunDun
- 135214ffff90f90b3a1080IN0.013953622220AliYunDun
- 135315ffff90f90b3a6300IN0.013953622220AliYunDun
- 135415ffff90f90b3a4200IN0.013953622220AliYunDun
- 135511ffff90f90b3a0000IN0.013953622220AliYunDun
- 135717ffff90f90b780000IN0.013953622220AliYunDun
- 135815ffff90f90b781080IN0.013953622220AliYunDun
- 135913ffff90f972361080IN0.013953622220AliYunDun
- 136013ffff90f972364200IN0.013953622220AliYunDun
- 136117ffff90f972366300IN0.013953622220AliYunDun
- >136215ffff90f972365280RU0.013953622220AliYunDun
- 136315ffff90f97b76d280IN0.013953622220AliYunDun
- 140113ffff90f97638d280IN0.013953622220AliYunDun
- 140211ffff90f97638e300IN0.013953622220AliYunDun
- 140317ffff90f97638b180IN0.013953622220AliYunDun
- 140417ffff90f97b76b180IN0.013953622220AliYunDun
- 140515ffff90f97b76c200IN0.013953622220AliYunDun
- 140615ffff90f97b76e300IN0.013953622220AliYunDun
- 148315ffff90f970b45280IN0.01129364344sshd
- 157014837ffff90f90e386300IN0.01576406308sshd
- 203611ffff90f975791080IN0.080287211300aliyun-service
- 206015701ffff90f90c3f4200IN0.01576402508sshd
- 206620601ffff90f90cf8d280IN0.01155482084bash
- 296315ffff90f9767d3180IN0.0328264postcated
- 297312ffff90f9767cb180IN0.050841672devlinked
- 297717ffff90f9767d1080IN0.017244logrotated
- 392320667ffff90f9783be300IN0.02413604640sudo
- 392439235ffff90f975be0000IN0.01918722360su
- 392539241ffff90f90eb86300IN0.01156802160bash
- 450711ffff90f90c3f0000IN0.0178162096assist_daemon
- 450817ffff90f90c3f3180IN0.0178162096Timerthread
- 450911ffff90f90c3f6300IN0.0178162096assist_daemon
- 451011ffff90f90c3f1080IN0.0178162096Timerthread
- 582017ffff90f90eb83180IN0.0328208postcated
- 582414ffff90f9767cc200IN0.050841672devlinked
- 582813ffff90f975b83180IN0.017240logrotated
- 998915ffff90f90df95280IN0.0328204postcated
- 999316ffff90f9767b4200IN0.050881676devlinked
- 999713ffff90f967b7e300IN0.017240logrotated
- 1550212ffff90f966f6b180IN0.0328208postcated
- 1552814ffff90f9533ee300IN0.050841668devlinked
- 1553211ffff90f9533e8000IN0.017240logrotated
- 2238813ffff90f90f7c5280IN0.0328208postcated
- 2239214ffff90f975be3180IN0.050881676devlinked
- 2239615ffff90f977399080IN0.017240logrotated
- 3064715ffff90f9767b6300IN0.0328208postcated
- 3065116ffff90f975b81080IN0.050921676devlinked
- 3065515ffff90f975b85280IN0.017240logrotated
- 3077913ffff90f9757b8000IN0.024426083784mountinfo
- 3078012ffff90f975b86300IN0.024426083784mountinfo
- 3078114ffff90f975b82100IN0.024426083784mountinfo
- 3078317ffff90f975b84200IN0.024426083784mountinfo
- 3078411ffff90f90ebc1080IN0.024426083784mountinfo
- 3078511ffff90f8bb941080IN0.024426083784mountinfo
- >3174510ffff90f90f7d3180RU0.024426083784mountinfo
- >3174612ffff90f90f7d6300RU0.024426083784mountinfo
- >3174714ffff90f90f7d0000RU0.024426083784mountinfo
- >3174816ffff90f97b76a100RU0.024426083784mountinfo
从输出看出,mountinfo明显是异常进程,是导致本次系统重启的罪魁祸首
5、这里再次bt 命令来看一下堆栈
- crash>bt
- PID:1362TASK:ffff90f972365280CPU:5COMMAND:"AliYunDun"
- #0[ffff90f9767a77a0]machine_kexecatffffffff922662c4
- #1[ffff90f9767a7800]__crash_kexecatffffffff923227a2
- #2[ffff90f9767a78d0]crash_kexecatffffffff92322890
- #3[ffff90f9767a78e8]oops_endatffffffff9298c798
- #4[ffff90f9767a7910]no_contextatffffffff92275d14
- #5[ffff90f9767a7960]__bad_area_nosemaphoreatffffffff92275fe2
- #6[ffff90f9767a79b0]bad_area_nosemaphoreatffffffff92276104
- #7[ffff90f9767a79c0]__do_page_faultatffffffff9298f750
- #8[ffff90f9767a7a30]trace_do_page_faultatffffffff9298fa26
- #9[ffff90f9767a7a70]do_async_page_faultatffffffff9298efa2
- #10[ffff90f9767a7a90]async_page_faultatffffffff9298b7a8
- #11[ffff90f9767a7b98]kmem_cache_alloc_traceatffffffff92428a0c
- #12[ffff90f9767a7c98]mntputatffffffff92471d94
- #13[ffff90f9767a7d88]kvm_sched_clock_readatffffffff9226d3be
- #14[ffff90f9767a7ec8]putnameatffffffff9245fd3d
- #15[ffff90f9767a7f50]system_call_fastpathatffffffff92994f92
- RIP:00007f84fd928315RSP:00007f84fb011af8RFLAGS:00000206
- RAX:000000000000004eRBX:000000000244e010RCX:ffffffffffffffff
- RDX:0000000000008000RSI:000000000244e010RDI:0000000000000012
- RBP:000000000244e010R8:0000000000000020R9:0000000000008030
- R10:0000000000000076R11:0000000000000246R12:ffffffffffffff30
- R13:0000000000000000R14:000000000244dfe0R15:000000000000052a
- ORIG_RAX:000000000000004eCS:0033SS:002b
我们看到系统崩溃前的最后一个调用是“#15 [ffff90f9767a7f50] system_call_fastpath at ffffffff92994f92”,现在用 dis 命令来看一下该地址的反汇编结果
6、dis 反编译
- crash>dis-lffffffff92994f92
- /usr/src/debug/kernel-3.10.0-1160.15.2.el7/linux-3.10.0-1160.15.2.el7.x86_64/arch/x86/kernel/entry_64.S:511
- 0xffffffff92994f92<system_call_fastpath+37>:mov%rax,0x50(%rsp)
7、查看源码
从上面的反汇编结果中,我们看到问题出在entry_64.S: 第511行代码,翻开源码的相应位置,如下;
- 492system_call_fastpath:
- 493#if__SYSCALL_MASK==~0
- 494cmpq$__NR_syscall_max+1,%rax
- 495#else
- 496andl$__SYSCALL_MASK,%eax
- 497cmpl$__NR_syscall_max+1,%eax
- 498#endif
- 499jaebadsys
- 500ARRAY_INDEX_NOSPEC_SYSCALLclobber_reg=%rcx
- 501movq%r10,%rcx
- 502
- 503#ifdefCONFIG_RETPOLINE
- 504movqsys_call_table(,%rax,8),%rax
- 505call__x86_indirect_thunk_rax
- 506#else
- 507call*sys_call_table(,%rax,8)#XXX:riprelative
- 508#endif
- 509
- 510UNWIND_END_OF_STACK
- 511movq%rax,RAX(%rsp)
- 512/*
【编辑推荐】
- Windows10这功能已如同残废!教你如何彻底关闭它
- C++和C++程序员谁先完蛋?
- 2021年值得关注的人工智能趋势
- RAID磁盘阵列到底适不适合你?一文读懂
- Windows 10是绝唱!微软新系统开始换版本号了
©本文为清一色官方代发,观点仅代表作者本人,与清一色无关。清一色对文中陈述、观点判断保持中立,不对所包含内容的准确性、可靠性或完整性提供任何明示或暗示的保证。本文不作为投资理财建议,请读者仅作参考,并请自行承担全部责任。文中部分文字/图片/视频/音频等来源于网络,如侵犯到著作权人的权利,请与我们联系(微信/QQ:1074760229)。转载请注明出处:清一色财经