连汇顶PC端烧写工具手机崩溃分析

1:通地err.txt定位错误指令位置，运行到函数vfs_read+偏移位0xd4行代码报错,查询System.map文件

重定位运行时地址是c0112fac,+偏移位0xd4 等于c0113980,这个地址刚好吻和下面log

[ 45.521911] c2 PC is at vfs_read+0xd4/0x148

[ 45.521942] c2 LR is at proc_reg_read+0x88/0x90

[ 45.521942] c2 pc : [<c0113080>] lr : [<c015f800>] psr: 20070013

2:查找vfs_read所对应的源c代码文件，然后找到对应的目标二进制文件，生成反编译文件。如下所示指令

arm-eabi-objdump -Slz out/target/product/sd5031/obj/KERNEL/fs/read_write.o > err.S

3：查询编译文件err.S得知vfs_read不重定位运行地址是0x00000888，+偏移位0xd4定位到代码出错位置是0x95c，对应下面err.S文件内容

00000888 <vfs_read>:

vfs_read():

static inline void fsnotify_access(struct file *file)

{

struct path *path = &file->f_path;

struct inode *inode = path->dentry->d_inode;

95c: e5917028
ldr r7, [r1, #40]
; 0x28

/home/jamesguo/SP7731_NEW/kernel/include/linux/fsnotify.h:198

__u32 mask = FS_ACCESS;

4：查err.txt r1=3e38322f, ldr
r7, [r1, #40] ; 0x28,把r1+0x28,刚好等于3E383257，它的地址赋给r7,而r7=00000000，为空，所以

报下错误，与下面log吻和。

[ 44.698272] c0 android_work: sent uevent USB_STATE=CONFIGURED

[ 45.482604] c2 Unable to handle kernel paging request at virtual address 3e383257

[ 45.490142] c2 pgd = d3694000

[ 45.493072] [3e383257] *pgd=00000000

[ 45.496673] c2 Internal error: Oops: 5 [#1] PREEMPT SMP ARM

5：综上所述：c0113080地址处访问了空指针。对应代码出错位置，下面*path是空地址。

struct path *path = &file->f_path;

struct inode *inode = path->dentry->d_inode;

6：进一步跟跟踪。vfs_read<---proc_reg_read<----goodix_tool_read,说明是tp驱动对应的proc文件读函数出错了。如下diff，无struct file *flie这个参数，

goodix_tool_read原型有出错。修改后不崩溃。vfs_read里面刚好有调用到fsnotify_access。

-static s32 goodix_tool_read( char *page, char **start, off_t off, int count, int *eof, void *data );

+//static s32 goodix_tool_read( char *page, char **start, off_t off, int count, int *eof, void *data );

+static s32 goodix_tool_read( struct file *flie, char __user *page, unsigned long size, long long *ppos );

还有一方法。

1：用指令直接生成汇编c代码

arm-linux-androideabi-obj -Slz out/target/product/sd5031/obj/KERNEL/vmlinux > hui_c.S

下面log可以定位到编译地址e5917028出错，出错函数是运行是地址就是vfs_read+0xd4的位置

通过查找hui_c.S文件定位到出错代码位置，在定位出错原因。

[ 45.523284] c2 [<c0113080>] (vfs_read+0xd4/0x148) from [<c0113670>] (SyS_read+0x4c/0x7c)

[ 45.523284] c2 [<c0113670>] (SyS_read+0x4c/0x7c) from [<c000f880>] (ret_fast_syscall+0x0/0x48)

[ 45.523284] c2 Code: e1a05000 da00001b e594100c e5948028 (e5917028)