pid: 3421, tid: 3515, name:PowerManagerSer  >>>system_server <<<

signal 6 (SIGABRT), code -6 (SI_TKILL),fault addr --------

Abort message:'BitTube::recvObjects(count=256, size=104), res=18 (partial events werereceived!)'

rax 0000000000000000  rbx00007d0735ac94f8  rcx00007d074d9bfe97  rdx 0000000000000006

rsi 0000000000000dbb  rdi0000000000000d5d

r8  0000000000000030  r9 0000000000000069  r10 0000000000000008  r11 0000000000000202

r12 0000000000000dbb  r130000000000000006  r140000000000000000  r15 00007d072c28e640

cs  0000000000000033  ss 000000000000002b

rip 00007d074d9bfe97  rbp000000000000000b  rsp00007d0735ac7cc8  eflags 0000000000000202

backtrace:

#00 pc 000000000008ee97 /system/lib64/libc.so (tgkill+7)

#01 pc 000000000008b8b2 /system/lib64/libc.so (pthread_kill+66)

#02 pc 00000000000302d1 /system/lib64/libc.so (raise+17)

#03 pc 00000000000286be /system/lib64/libc.so (abort+78)

#04 pc 0000000000010f4f /system/lib64/libcutils.so (__android_log_assert+287)

#05 pc 0000000000064008 /system/lib64/libgui.so(_ZN7android7BitTube11recvObjectsERKNS_2spIS0_EEPvmm+264)

#06 pc 00000000000856c6 /system/lib64/libgui.so(_ZN7android16SensorEventQueue4readEP12ASensorEventm+54)

#07 pc 00000000001566e7 /system/lib64/libandroid_runtime.so

#08 pc 0000000000018b06 /system/lib64/libutils.so (_ZN7android6Looper9pollInnerEi+998)

#09 pc 000000000001865a /system/lib64/libutils.so (_ZN7android6Looper8pollOnceEiPiS1_PPv+42)

#10 pc 0000000000101126 /system/lib64/libandroid_runtime.so(_ZN7android18NativeMessageQueue8pollOnceEP7_JNIEnvP8_jobjecti+38)

#11 pc 0000000073fc48f8 /data/dalvik-cache/x86_64/system@framework@boot.oat (offset 0x2c0d000)

从调用栈分析是主动abort

168ssize_t BitTube::recvObjects(const sp<BitTube>& tube,

169        void* events, size_tcount, size_t objSize)

170{

171    char* vaddr =reinterpret_cast<char*>(events);

172    ssize_t size = tube->read(vaddr,count*objSize);//size = 18，objSize = 104，count = 256，count*objSize =26k

173

174    // should never happenbecause of SOCK_SEQPACKET

175    LOG_ALWAYS_FATAL_IF((size >= 0)&& (size % static_cast<ssize_t>(objSize)),//--》((size >=0) && (size % objSize)=1)不为0所以主动abort

176           "BitTube::recvObjects(count=%zu, size=%zu), res=%zd (partial eventswere received!)",

177            count, objSize, size);

178

180    return size < 0 ? size :size / static_cast<ssize_t>(objSize);

181}

ssize_t BitTube::read(void* vaddr, size_t size)

{

ssize_t err, len;

do {

len = ::recv(mReceiveFd,vaddr, size, MSG_DONTWAIT);//这里的size =26k

err = len < 0 ? errno :0;

} while (err == EINTR);//EINTR =4

if (err == EAGAIN || err ==EWOULDBLOCK) {//EAGAIN 11

// EAGAIN means that we havenon-blocking I/O but there was

// no data to be read.Nothing the client should care about.

return 0;

}

return err == 0 ? len :-err;//#define EXDEV 18--》Cross-device link

}

(gdb) f 8

#8  0x00007d074c0ec6e8 in (anonymousnamespace)::Receiver::handleEvent (this=0x7d072c364ec0,

fd=<optimized out>,events=<optimized out>, data=<optimized out>)

atframeworks/base/core/jni/android_hardware_SensorManager.cpp:294

294 frameworks/base/core/jni/android_hardware_SensorManager.cpp:No such file or directory.

ASensorEvent buffer[16];

(gdb) info locals

env = 0x7d07405918c0

q = {

m_ptr = 0x7d0743026d80

}

buffer = {{

version = 104, ---》sizeof(structASensorEvent)

sensor = 58,

type = 8, --------》SENSOR_TYPE_PROXIMITY（距离感应sensor）

reserved0 = 0,

timestamp = 13488767000000

转而分析内存和read的地址，从代码看read地址是mRecBuffer转换的

ssize_t SensorEventQueue::read(ASensorEvent* events, size_t numEvents) {

if (mAvailable == 0) {

ssize_t err =BitTube::recvObjects(mSensorChannel,

mRecBuffer,MAX_RECEIVE_BUFFER_EVENT_COUNT);

ssize_t BitTube::recvObjects(const sp<BitTube>& tube,

void* events, size_t count,size_t objSize)

{

char* vaddr =reinterpret_cast<char*>(events);//--》mRecBuffer = 0x7d072b8bf840

ssize_t size =tube->read(vaddr, count*objSize);

LOG_ALWAYS_FATAL_IF((size >=0) && (size % static_cast<ssize_t>(objSize)),

"BitTube::recvObjects(count=%zu,size=%zu), res=%zd (partial events were received!)",

count, objSize, size);

}

(gdb) f 7

#7  android::SensorEventQueue::read(this=0x7d0743026d80, events=events@entry=0x7d0735ac8350,

numEvents=<optimized out>,numEvents@entry=16) at frameworks/native/libs/gui/SensorEventQueue.cpp:70

70  inframeworks/native/libs/gui/SensorEventQueue.cpp

(gdb) p /x *this->mRecBuffer

$4 = {//这里的值明显是异常值

version = 0x432b5441,

sensor = 0x3d4d5352,

type = 0x2c323931,

reserved0 = 0x33303231,

timestamp = 0xc44992a0d32,

{

{

data = {0x5, 0xe5, 0x66, 0x0<repeats 13 times>},

vector = {

{

v = {0x5, 0xe5, 0x66},

{

x = 0x5,

y = 0xe5,

z = 0x66

},

看内存mRecBuffer地址在堆上。

mRecBuffer =0x7d072b8bf840

7d072b800000-7d072ba00000rw-p 00000000 00:00 0                         [anon:libc_malloc]

读取mRecBuffer内容发现，内部是一个at命令相关的字符串，而当前读取的应该是距离感应的数据，不可能有这样的字串

(gdb) x /104s  0x7d072b8bf840

0x7d072b8bf840: "AT+CRSM=192,12032\r*\231D\f"

0x7d072b8bf857: ""

0x7d072b8bf858: ""

0x7d072b8bf859: ""

发现mRecBuffer被覆盖了