Scudo 错误：解除分配地址时块状态无效

Question

02-22 16:29:32.296 10336 25983 25983 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : Build fingerprint: 'samsung/t2quew/t2q:13/TP1A.220624.014/G996U1UEU7EWF4:user/release-keys'
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : Revision: '13'
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : ABI: 'arm64'
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : Processor: '5'
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : Timestamp: 2024-02-22 16:29:31.336448992-0500
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : Process uptime: 2611s
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : Cmdline: 
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : pid: 4343, tid: 23038, name: Thread-50  >>>  <<<
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : uid: 10336
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
02-22 16:29:32.296 10336 25983 25983 F DEBUG   : Abort message: 'Scudo ERROR: invalid chunk state when deallocating address 0x200007245343bd0'
02-22 16:29:32.296 10336 25983 25983 F DEBUG   :     x0  0000000000000000  x1  00000000000059fe  x2  0000000000000006  x3  00000071e9599700
02-22 16:29:32.296 10336 25983 25983 F DEBUG   :     x4  0000000000808080  x5  0000000000808080  x6  0000000000808080  x7  8080808080808080
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :     x8  00000000000000f0  x9  000000751716fbf8  x10 0000000000000001  x11 00000075171b0870
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :     x12 0101010101010101  x13 0000001842a57509  x14 00353a113f330800  x15 0000000000000030
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :     x16 0000007517218d70  x17 00000075171f45b0  x18 000000715dd66000  x19 00000000000010f7
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :     x20 00000000000059fe  x21 00000000ffffffff  x22 0000000000000000  x23 00000074fd14e538
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :     x24 00000071e959a050  x25 00000073451d5560  x26 000000000000306e  x27 00000074fd14d818
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :     x28 00000071e9599f10  x29 00000071e9599780
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :     lr  00000075171a17a8  sp  00000071e95996e0  pc  00000075171a17d4  pst 0000000000001000
02-22 16:29:32.297 10336 25983 25983 F DEBUG   : backtrace:
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :       #00 pc 00000000000537d4  /apex/com.android.runtime/lib64/bionic/libc.so (abort+168) (BuildId: 870560a8376a70249f9e9a7b480cc02f)
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :       #01 pc 00000000000429d4  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::die()+12) (BuildId: 870560a8376a70249f9e9a7b480cc02f)
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :       #02 pc 0000000000043120  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::ScopedErrorReport::~ScopedErrorReport()+36) (BuildId: 870560a8376a70249f9e9a7b480cc02f)
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :       #03 pc 00000000000434a0  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::reportInvalidChunkState(scudo::AllocatorAction, void*)+120) (BuildId: 870560a8376a70249f9e9a7b480cc02f)
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :       #04 pc 0000000000044d3c  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::Allocator<scudo::AndroidConfig, &(scudo_malloc_postinit)>::deallocate(void*, scudo::Chunk::Origin, unsigned long, unsigned long)+316) (BuildId: 870560a8376a70249f9e9a7b480cc02f)
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :       #05 pc 00000000005c9044  /data/app/~~fSQ64Wncf38e8DzoZvjc-g==/-M54UxjGX7TcmvHo3b0t-ew==/lib/arm64/libnative-lib.so (std::__ndk1::_DeallocateCaller::__do_call(void*)+20) (BuildId: 805dbaf19559ab3b52f2528c2c225d0c47b0d496)
02-22 16:29:32.297 10336 25983 25983 F DEBUG   :       #06 pc 00000000005c8ff4  /data/app/~~fSQ64Wncf38e8DzoZvjc-g==/-M54UxjGX7TcmvHo3b0t-ew==/lib/arm64/libnative-lib.so (std::__ndk1::_DeallocateCaller::__do_deallocate_handle_size(void*, unsigned long)+24) (BuildId: 805dbaf19559ab3b52f2528c2c225d0c47b0d496)

我的应用程序使用 NDK 库 .so，当应用程序崩溃时会出现此问题。

Answer 1

Abort message: 'Scudo ERROR: invalid chunk state when deallocating address 0x200007245343bd0'

此错误意味着堆损坏（堆缓冲区溢出、释放未分配的缓冲区、释放某些内容两次、在释放内存后使用内存等）。

使用 AddressSantizer 查找损坏堆的位置。