Breakpad support for ASan: take 2.

chrome/app/breakpad_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // For linux_syscall_support.h. This makes it safe to call embedded system
 // calls when in seccomp mode.
 #define SYS_SYSCALL_ENTRYPOINT "playground$syscallEntryPoint"
 
 #include "chrome/app/breakpad_linux.h"
 
 #include <fcntl.h>
 #include <poll.h>
+#include <signal.h>
 #include <stdlib.h>
 #include <sys/socket.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <sys/uio.h>
 #include <time.h>
 #include <unistd.h>
 
 #include <algorithm>
@@ skipping 24 matching lines @@
 #include <android/log.h>
 #include <sys/stat.h>
 
 #include "base/android/build_info.h"
 #include "base/android/path_utils.h"
 #include "third_party/lss/linux_syscall_support.h"
 #else
 #include "sandbox/linux/seccomp-legacy/linux_syscall_support.h"
 #endif
 
+#if defined(ADDRESS_SANITIZER)
+#include <ucontext.h> // for getcontext().
+#endif
+
 #if defined(OS_ANDROID)
 #define STAT_STRUCT struct stat
 #define FSTAT_FUNC fstat
 #else
 #define STAT_STRUCT struct kernel_stat
 #define FSTAT_FUNC sys_fstat
 #endif
 
 // Some versions of gcc are prone to warn about unused return values. In cases
 // where we either a) know the call cannot fail, or b) there is nothing we
 // can do when a call fails, we mark the return code as ignored. This avoids
 // spurious compiler warnings.
 #define IGNORE_RET(x) do { if (x); } while (0)
 
 using google_breakpad::ExceptionHandler;
 using google_breakpad::MinidumpDescriptor;
 
 namespace {
 
+#if !defined(ADDRESS_SANITIZER)
 const char kUploadURL[] = "https://clients2.google.com/cr/report";
+#else
+// AddressSanitizer should currently upload the crash reports to the staging
+// crash server.
+const char kUploadURL[] = "https://clients2.google.com/cr/staging_report";
+#endif
 
 bool g_is_crash_reporter_enabled = false;
 uint64_t g_process_start_time = 0;
 char* g_crash_log_path = NULL;
 ExceptionHandler* g_breakpad = NULL;
+#if defined(ADDRESS_SANITIZER)
+const char* g_asan_report_str = NULL;
+#endif
 
 // Writes the value |v| as 16 hex characters to the memory pointed at by
 // |output|.
 void write_uint64_hex(char* output, uint64_t v) {
   static const char hextable[] = "0123456789abcdef";
 
   for (int i = 15; i >= 0; --i) {
     output[i] = hextable[v & 15];
     v >>= 4;
   }
@@ skipping 72 matching lines @@
   return ret;
 }
 #endif
 
 // MIME substrings.
 const char g_rn[] = "\r\n";
 const char g_form_data_msg[] = "Content-Disposition: form-data; name=\"";
 const char g_quote_msg[] = "\"";
 const char g_dashdash_msg[] = "--";
 const char g_dump_msg[] = "upload_file_minidump\"; filename=\"dump\"";
+#if defined(ADDRESS_SANITIZER)
+const char g_log_msg[] = "upload_file_log\"; filename=\"log\"";
+#endif
 const char g_content_type_msg[] = "Content-Type: application/octet-stream";
 
 // MimeWriter manages an iovec for writing MIMEs to a file.
 class MimeWriter {
  public:
   static const int kIovCapacity = 30;
   static const size_t kMaxCrashChunkSize = 64;
 
   MimeWriter(int fd, const char* const mime_boundary);
   ~MimeWriter();
@@ skipping 19 matching lines @@
   // Append key/value pair, splitting value into chunks no larger than
   // |chunk_size|. |chunk_size| cannot be greater than |kMaxCrashChunkSize|.
   // The msg_type string will have a counter suffix to distinguish each chunk.
   void AddPairDataInChunks(const char* msg_type,
                            size_t msg_type_size,
                            const char* msg_data,
                            size_t msg_data_size,
                            size_t chunk_size,
                            bool strip_trailing_spaces);
 
-  // Add binary file dump. Currently this is only done once, so the name is
-  // fixed.
-  void AddFileDump(uint8_t* file_data,
-                   size_t file_size);
+  // Add binary file contents to be uploaded with the specified filename.
+  void AddFileContents(const char* filename_msg,
+                       uint8_t* file_data,
+                       size_t file_size);
 
   // Flush any pending iovecs to the output file.
   void Flush() {
     IGNORE_RET(sys_writev(fd_, iov_, iov_index_));
     iov_index_ = 0;
   }
 
  private:
   void AddItem(const void* base, size_t size);
   // Minor performance trade-off for easier-to-maintain code.
@@ skipping 78 matching lines @@
     }
     AddString(g_rn);
     AddBoundary();
     Flush();
 
     done += chunk_len;
     msg_length -= chunk_len;
   }
 }
 
-void MimeWriter::AddFileDump(uint8_t* file_data,
-                             size_t file_size) {
+void MimeWriter::AddFileContents(const char* filename_msg, uint8_t* file_data,
+                                 size_t file_size) {
   AddString(g_form_data_msg);
-  AddString(g_dump_msg);
+  AddString(filename_msg);
   AddString(g_rn);
   AddString(g_content_type_msg);
   AddString(g_rn);
   AddString(g_rn);
   AddItem(file_data, file_size);
   AddString(g_rn);
 }
 
 void MimeWriter::AddItem(const void* base, size_t size) {
   // Check if the iovec is full and needs to be flushed to output file.
@@ skipping 36 matching lines @@
                const bool succeeded) {
   // WARNING: this code runs in a compromised context. It may not call into
   // libc nor allocate memory normally.
   if (!succeeded)
     return false;
 
   DCHECK(!minidump.IsFD());
 
   BreakpadInfo info;
   info.filename = minidump.path();
+#if defined(ADDRESS_SANITIZER)
+  google_breakpad::PageAllocator allocator;
+  const size_t log_path_len = my_strlen(minidump.path());
+  char* log_path = reinterpret_cast<char*>(allocator.Alloc(log_path_len + 1));
+  my_memcpy(log_path, minidump.path(), log_path_len);
+  my_memcpy(log_path + log_path_len - 4, ".log", 4);
+  log_path[log_path_len] = '\0';
+  info.log_filename = log_path;
+#endif
   info.process_type = "browser";
   info.process_type_length = 7;
   info.crash_url = NULL;
   info.crash_url_length = 0;
   info.guid = child_process_logging::g_client_id;
   info.guid_length = my_strlen(child_process_logging::g_client_id);
   info.distro = base::g_linux_distro;
   info.distro_length = my_strlen(base::g_linux_distro);
   info.upload = upload;
   info.process_start_time = g_process_start_time;
@@ skipping 12 matching lines @@
 
 #if !defined(OS_ANDROID)
 // Wrapper function, do not add more code here.
 bool CrashDoneUpload(const MinidumpDescriptor& minidump,
                      void* context,
                      bool succeeded) {
   return CrashDone(minidump, true, succeeded);
 }
 #endif
 
+#if defined(ADDRESS_SANITIZER)
+extern "C"
+void __asan_set_error_report_callback(void (*cb)(const char*));
+
+extern "C"
+void AsanLinuxBreakpadCallback(const char* report) {
+  g_asan_report_str = report;
+  // Send minidump here.
+  g_breakpad->SimulateSignalDelivery(SIGKILL);
+}
+#endif
+
 void EnableCrashDumping(bool unattended) {
   g_is_crash_reporter_enabled = true;
 
   FilePath tmp_path("/tmp");
   PathService::Get(base::DIR_TEMP, &tmp_path);
 
   FilePath dumps_path(tmp_path);
   if (PathService::Get(chrome::DIR_CRASH_DUMPS, &dumps_path)) {
     FilePath logfile =
         dumps_path.AppendASCII(CrashUploadList::kReporterLogFilename);
@@ skipping 59 matching lines @@
   char b;  // Dummy variable for sys_read below.
   const char* b_addr = &b;  // Get the address of |b| so we can create the
                             // expected /proc/[pid]/syscall content in the
                             // browser to convert namespace tids.
 
   // The length of the control message:
   static const unsigned kControlMsgSize = sizeof(fds);
   static const unsigned kControlMsgSpaceSize = CMSG_SPACE(kControlMsgSize);
   static const unsigned kControlMsgLenSize = CMSG_LEN(kControlMsgSize);
 
+#if !defined(ADDRESS_SANITIZER)
   const size_t kIovSize = 8;
+#else
+  // Additional field to pass the AddressSanitizer log to the crash handler.
+  const size_t kIovSize = 9;
+#endif
   struct kernel_msghdr msg;
   my_memset(&msg, 0, sizeof(struct kernel_msghdr));
   struct kernel_iovec iov[kIovSize];
   iov[0].iov_base = const_cast<void*>(crash_context);
   iov[0].iov_len = crash_context_size;
   iov[1].iov_base = guid;
   iov[1].iov_len = kGuidSize + 1;
   iov[2].iov_base = crash_url;
   iov[2].iov_len = kMaxActiveURLSize + 1;
   iov[3].iov_base = distro;
   iov[3].iov_len = kDistroSize + 1;
   iov[4].iov_base = &b_addr;
   iov[4].iov_len = sizeof(b_addr);
   iov[5].iov_base = &fds[0];
   iov[5].iov_len = sizeof(fds[0]);
   iov[6].iov_base = &g_process_start_time;
   iov[6].iov_len = sizeof(g_process_start_time);
   iov[7].iov_base = &base::g_oom_size;
   iov[7].iov_len = sizeof(base::g_oom_size);
+#if defined(ADDRESS_SANITIZER)
+  iov[8].iov_base = const_cast<char*>(g_asan_report_str);
+  iov[8].iov_len = kMaxAsanReportSize + 1;
+#endif
 
   msg.msg_iov = iov;
   msg.msg_iovlen = kIovSize;
   char cmsg[kControlMsgSpaceSize];
   my_memset(cmsg, 0, kControlMsgSpaceSize);
   msg.msg_control = cmsg;
   msg.msg_controllen = sizeof(cmsg);
 
   struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
   hdr->cmsg_level = SOL_SOCKET;
@@ skipping 28 matching lines @@
       NULL,
       NULL,
       reinterpret_cast<void*>(fd),  // Param passed to the crash handler.
       true,
       -1);
   g_breakpad->set_crash_handler(NonBrowserCrashHandler);
 }
 
 }  // namespace
 
-void HandleCrashDump(const BreakpadInfo& info) {
+void LoadDataFromFile(google_breakpad::PageAllocator& allocator,
+                      const BreakpadInfo& info, const char* filename,
+                      int* fd, uint8_t** file_data, size_t* size) {
   // WARNING: this code runs in a compromised context. It may not call into
   // libc nor allocate memory normally.
+  *fd = sys_open(filename, O_RDONLY, 0);
+  *size = 0;
 
-  const int dumpfd = sys_open(info.filename, O_RDONLY, 0);
-  if (dumpfd < 0) {
+  if (*fd < 0) {
     static const char msg[] = "Cannot upload crash dump: failed to open\n";
     WriteLog(msg, sizeof(msg));
     return;
   }
   STAT_STRUCT st;
-  if (FSTAT_FUNC(dumpfd, &st) != 0) {
+  if (FSTAT_FUNC(*fd, &st) != 0) {
     static const char msg[] = "Cannot upload crash dump: stat failed\n";
     WriteLog(msg, sizeof(msg));
-    IGNORE_RET(sys_close(dumpfd));
+    IGNORE_RET(sys_close(*fd));
     return;
   }
 
-  google_breakpad::PageAllocator allocator;
-
-  uint8_t* dump_data = reinterpret_cast<uint8_t*>(allocator.Alloc(st.st_size));
-  if (!dump_data) {
+  *file_data = reinterpret_cast<uint8_t*>(allocator.Alloc(st.st_size));
+  if (!(*file_data)) {
     static const char msg[] = "Cannot upload crash dump: cannot alloc\n";
     WriteLog(msg, sizeof(msg));
-    IGNORE_RET(sys_close(dumpfd));
+    IGNORE_RET(sys_close(*fd));
     return;
   }
+  my_memset(*file_data, 0xf, st.st_size);
 
-  sys_read(dumpfd, dump_data, st.st_size);
-  IGNORE_RET(sys_close(dumpfd));
+  *size = st.st_size;
+  sys_read(*fd, *file_data, *size);
+  IGNORE_RET(sys_close(*fd));
+}
+
+void HandleCrashDump(const BreakpadInfo& info) {
+  int dumpfd;
+  size_t dump_size;
+  uint8_t *dump_data;
+  google_breakpad::PageAllocator allocator;
+  LoadDataFromFile(allocator, info, info.filename,
+                   &dumpfd, &dump_data, &dump_size);
+#if defined(ADDRESS_SANITIZER)
+  int logfd;
+  size_t log_size;
+  uint8_t *log_data;
+  // Load the AddressSanitizer log into log_data.
+  LoadDataFromFile(allocator, info, info.log_filename,
+                   &logfd, &log_data, &log_size);
+#endif
 
   // We need to build a MIME block for uploading to the server. Since we are
   // going to fork and run wget, it needs to be written to a temp file.
-
   const int ufd = sys_open("/dev/urandom", O_RDONLY, 0);
   if (ufd < 0) {
     static const char msg[] = "Cannot upload crash dump because /dev/urandom"
                               " is missing\n";
     WriteLog(msg, sizeof(msg) - 1);
     return;
   }
 
   static const char temp_file_template[] =
       "/tmp/chromium-upload-XXXXXXXXXXXXXXXX";
@@ skipping 311 matching lines @@
     char oom_size_str[kUint64StringSize];
     const unsigned oom_size_len = my_uint64_len(info.oom_size);
     my_uint64tos(oom_size_str, info.oom_size, oom_size_len);
     static const char oom_size_msg[] = "oom-size";
     writer.AddPairData(oom_size_msg, sizeof(oom_size_msg) - 1,
                        oom_size_str, oom_size_len);
     writer.AddBoundary();
     writer.Flush();
   }
 
-  writer.AddFileDump(dump_data, st.st_size);
+  writer.AddFileContents(g_dump_msg, dump_data, dump_size);
+#if defined(ADDRESS_SANITIZER)
+  // Append a multipart boundary and the contents of the AddressSanitizer log.
+  writer.AddBoundary();
+  writer.AddFileContents(g_log_msg, log_data, log_size);
+#endif
   writer.AddEnd();
   writer.Flush();
 
   IGNORE_RET(sys_close(temp_file_fd));
 
 #if defined(OS_ANDROID)
   __android_log_write(ANDROID_LOG_WARN,
                       kGoogleBreakpad,
                       "Output crash dump file:");
   __android_log_write(ANDROID_LOG_WARN, kGoogleBreakpad, info.filename);
@@ skipping 160 matching lines @@
         }
         if (sys_waitpid(wget_child, NULL, WNOHANG) == 0) {
           // Wget process is still around, kill it.
           sys_kill(wget_child, SIGKILL);
         }
       }
     }
 
     // Helper process.
     IGNORE_RET(sys_unlink(info.filename));
+#if defined(ADDRESS_SANITIZER)
+    IGNORE_RET(sys_unlink(info.log_filename));
+#endif
     IGNORE_RET(sys_unlink(temp_file));
     sys__exit(0);
   }
 
   // Main browser process.
   if (child <= 0)
     return;
   (void) HANDLE_EINTR(sys_waitpid(child, NULL, 0));
 }
 
@@ skipping 41 matching lines @@
   }
 
   // Set the base process start time value.
   struct timeval tv;
   if (!gettimeofday(&tv, NULL))
     g_process_start_time = timeval_to_ms(&tv);
   else
     g_process_start_time = 0;
 
   logging::SetDumpWithoutCrashingFunction(&DumpProcess);
+#if defined(ADDRESS_SANITIZER)
+  // Register the callback for AddressSanitizer error reporting.
+  __asan_set_error_report_callback(AsanLinuxBreakpadCallback);
+#endif
 }
 
 bool IsCrashReporterEnabled() {
   return g_is_crash_reporter_enabled;
 }