gdb-heap-analysis

Files (7)

• SKILL.md
• openai.yaml · agents/
• diagnostic-patterns.md · references/
• glibc-offsets.md · references/
• heap-structures.md · references/
• arena-walk-output.md · templates/
• diagnostic-decision.md · templates/

SKILL.md (first lines)

# GDB 堆内存分析（glibc ptmalloc）

Analyze glibc ptmalloc heap structures in core dumps. Human judgment required at each decision point.

## Workflow

```
Load core → Confirm symbols → Walk arenas → Analyze malloc_state → Check distribution → Locate allocations
```

## Step 1: Confirm Debug Symbols

```gdb
ptype struct malloc_state
ptype struct malloc_chunk
```

- Struct definition output → Has symbols, use struct access
- "No symbol table" → No symbols, need manual offsets

### No Symbols

```bash
ldd --version
```

```gdb
info sharedlibrary libc
```

Read [references/glibc-offsets.md](references/glibc-offsets.md) for known offsets by version.

## Step 2: Walk All Arenas

### With Symbols

```gdb
p &main_arena
p main_arena.system_mem
set $a = main_arena.next
while $a != &main_arena && $a != 0
  printf "Arena @ %p, sys_mem=%lu MB\n", $a, $a->system_mem / 1024 / 1024
  set $a = $a->next
end
```

### Without Symbols

```gdb
set $arena = 0xfffd8c000020
x/gx $arena+0x888    # system_mem (glibc 2.28)
x/gx $arena+0x870    # next
```

**Judgment**: Arena size thresholds — typical <100MB, suspicious >500MB, abnormal >1GB. Record largest arena address.

## Step 3: Analyze malloc_state

```gdb
p *(struct malloc_state *)$arena_addr
```

Key fields: `top`, `system_mem`, `bins[]`, `fastbinsY`

### Top Chunk Location

```gdb
set $top = ((struct malloc_state *)$arena)->top
```

- `$top` near `$arena_addr` (within 64MB) → Subheap mode
- `$top` in different address range → **Direct mmap mode**

## Step 4: Check Memory Distribution

### Subheap Chain

```gdb
set $heap = $arena_addr - 32
while $heap != 0
  set $ar = *(void**)$heap
  if $ar != $arena_addr
    break
  end
  set $size = *(size_t*)($heap+16)
  printf "Subheap @ %p, size=%lu MB\n", $heap, $size/1024/1024
  set $heap = *(void**)($heap+8)
end
```

**Judgment**: Sum subheap sizes, compare with `system_mem`. Gap >1GB → large direct mmap allocations.

### Mmap Mode

```gdb
info proc mappings
```

Look for anonymous mappings not covered by subheaps.

## Step 5: Locate Specific Allocations

### Chunk Header

```gdb
set $chunk = 0xfffcab6d86b0
x/gx $chunk-8   # prev_size + size with flags
```

Size field flags (lowest 3 bits): PREV_INUSE(bit 0), IS_MMAPPED(bit 1), NON_MAIN_ARENA(bit 2)

### Bins

```gdb
p ((struct malloc_state *)$arena)->bins[0]@10
p ((struct malloc_state *)$arena)->fastbinsY
```

## Judgment Summary

From hellyguo/self-ai-spec, Apache-2.0.

More from hellyguo/self-ai-spec