为什么x86中的这个链表相关程序会出现分段故障

Question

我想为链表分配一些节点。我有一个alloc_pair函数，它似乎可以工作。我附上评论，解释每一行关于链接列表的意图。我的代码在某个地方给了我一个分段错误，但我不知道在哪里。如图所示，GDB毫无帮助：

Thread 2 hit Breakpoint 1, 0x0000000100003f63 in main ()
(gdb) c
Continuing.
Thread 2 hit Breakpoint 2, 0x0000000100003f4e in alloc_pair ()
(gdb) ni
0x0000000100003f55 in alloc_pair ()
(gdb) ni
0x0000000100003f59 in alloc_pair ()
(gdb) disassemble
Dump of assembler code for function alloc_pair:
0x0000000100003f4e <+0>: mov    rdi,0x10
0x0000000100003f55 <+7>: sub    rsp,0x8
=> 0x0000000100003f59 <+11>:    call   0x100003f96
0x0000000100003f5e <+16>:    add    rsp,0x8
0x0000000100003f62 <+20>:    ret    
End of assembler dump.
(gdb) c
Continuing.
Thread 2 received signal SIGSEGV, Segmentation fault.
0x00007fff731d970a in ?? ()
(gdb) bt
#0  0x00007fff731d970a in ?? ()
#1  0x00007ffeefbff828 in ?? ()
#2  0x0000000100008008 in ?? ()
#3  0x0000000000000000 in ?? ()
(gdb) 

如果你知道我犯的错误，请告诉我。

.global _main
.text
alloc_pair:
push rbp
mov rbp, rsp
mov rdi, 16
sub rsp, 8
call _malloc
add rsp, 8
mov rsp, rbp
pop rbp
ret
_main:
call alloc_pair
mov r13, rax  # r13 stores the initial pair allocated
mov qword ptr [rax], 29  # the node 1 head contains 29
mov r12, [rax + 8]  # r12 stores the memory location of the node 1 tail
call alloc_pair
mov qword ptr [rax], 7  # the node 2 head contains 7
mov qword ptr [r12], rax  # the node 1 tail points to the node 2 head
mov rdi, 0
mov rax, 0x2000001
syscall

Answer 1

此行：

mov r12, [rax + 8]  # r12 stores the memory location of the node 1 tail

不要按照你的评论说的去做。此指令将[rax+8]处的64位内存内容移动到R12。它不会将[rax+8]的地址移动到R12。您想要的是加载有效地址(LEA(以将[rax+8]的地址获取到R12中。指令看起来像：

lea r12, [rax + 8]  # r12 stores the memory location of the node 1 tail