OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/process_util.h" | 5 #include "base/process_util.h" |
6 | 6 |
7 #import <Cocoa/Cocoa.h> | 7 #import <Cocoa/Cocoa.h> |
8 #include <crt_externs.h> | 8 #include <crt_externs.h> |
9 #include <dlfcn.h> | 9 #include <dlfcn.h> |
| 10 #include <errno.h> |
10 #include <mach/mach.h> | 11 #include <mach/mach.h> |
11 #include <mach/mach_init.h> | 12 #include <mach/mach_init.h> |
12 #include <mach/mach_vm.h> | 13 #include <mach/mach_vm.h> |
13 #include <mach/shared_region.h> | 14 #include <mach/shared_region.h> |
14 #include <mach/task.h> | 15 #include <mach/task.h> |
15 #include <mach-o/dyld.h> | 16 #include <mach-o/dyld.h> |
16 #include <mach-o/nlist.h> | 17 #include <mach-o/nlist.h> |
17 #include <malloc/malloc.h> | 18 #include <malloc/malloc.h> |
18 #import <objc/runtime.h> | 19 #import <objc/runtime.h> |
| 20 #include <signal.h> |
19 #include <spawn.h> | 21 #include <spawn.h> |
| 22 #include <sys/event.h> |
20 #include <sys/mman.h> | 23 #include <sys/mman.h> |
21 #include <sys/sysctl.h> | 24 #include <sys/sysctl.h> |
22 #include <sys/types.h> | 25 #include <sys/types.h> |
23 #include <sys/wait.h> | 26 #include <sys/wait.h> |
24 | 27 |
25 #include <new> | 28 #include <new> |
26 #include <string> | 29 #include <string> |
27 | 30 |
28 #include "base/debug/debugger.h" | 31 #include "base/debug/debugger.h" |
29 #include "base/eintr_wrapper.h" | 32 #include "base/eintr_wrapper.h" |
| 33 #include "base/file_util.h" |
30 #include "base/hash_tables.h" | 34 #include "base/hash_tables.h" |
31 #include "base/logging.h" | 35 #include "base/logging.h" |
32 #include "base/mac/mac_util.h" | 36 #include "base/mac/mac_util.h" |
33 #include "base/string_util.h" | 37 #include "base/string_util.h" |
34 #include "base/sys_info.h" | 38 #include "base/sys_info.h" |
35 #include "base/sys_string_conversions.h" | 39 #include "base/sys_string_conversions.h" |
36 #include "base/time.h" | 40 #include "base/time.h" |
37 #include "third_party/apple_apsl/CFBase.h" | 41 #include "third_party/apple_apsl/CFBase.h" |
38 #include "third_party/apple_apsl/malloc.h" | 42 #include "third_party/apple_apsl/malloc.h" |
39 #include "third_party/mach_override/mach_override.h" | 43 #include "third_party/mach_override/mach_override.h" |
(...skipping 943 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
983 int mib[4] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, process }; | 987 int mib[4] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, process }; |
984 if (sysctl(mib, 4, &info, &length, NULL, 0) < 0) { | 988 if (sysctl(mib, 4, &info, &length, NULL, 0) < 0) { |
985 DPLOG(ERROR) << "sysctl"; | 989 DPLOG(ERROR) << "sysctl"; |
986 return -1; | 990 return -1; |
987 } | 991 } |
988 if (length == 0) | 992 if (length == 0) |
989 return -1; | 993 return -1; |
990 return info.kp_eproc.e_ppid; | 994 return info.kp_eproc.e_ppid; |
991 } | 995 } |
992 | 996 |
| 997 namespace { |
| 998 |
| 999 const int kWaitBeforeKillSeconds = 2; |
| 1000 |
| 1001 // Reap |child| process. This call blocks until completion. |
| 1002 void BlockingReap(pid_t child) { |
| 1003 const pid_t result = HANDLE_EINTR(waitpid(child, NULL, 0)); |
| 1004 if (result == -1) { |
| 1005 DPLOG(ERROR) << "waitpid(" << child << ", NULL, 0)"; |
| 1006 } |
| 1007 } |
| 1008 |
| 1009 // Waits for |timeout| seconds for the given |child| to exit and reap it. If |
| 1010 // the child doesn't exit within the time specified, kills it. |
| 1011 // |
| 1012 // This function takes two approaches: first, it tries to use kqueue to |
| 1013 // observe when the process exits. kevent can monitor a kqueue with a |
| 1014 // timeout, so this method is preferred to wait for a specified period of |
| 1015 // time. Once the kqueue indicates the process has exited, waitpid will reap |
| 1016 // the exited child. If the kqueue doesn't provide an exit event notification, |
| 1017 // before the timeout expires, or if the kqueue fails or misbehaves, the |
| 1018 // process will be mercilessly killed and reaped. |
| 1019 // |
| 1020 // A child process passed to this function may be in one of several states: |
| 1021 // running, terminated and not yet reaped, and (apparently, and unfortunately) |
| 1022 // terminated and already reaped. Normally, a process will at least have been |
| 1023 // asked to exit before this function is called, but this is not required. |
| 1024 // If a process is terminating and unreaped, there may be a window between the |
| 1025 // time that kqueue will no longer recognize it and when it becomes an actual |
| 1026 // zombie that a non-blocking (WNOHANG) waitpid can reap. This condition is |
| 1027 // detected when kqueue indicates that the process is not running and a |
| 1028 // non-blocking waitpid fails to reap the process but indicates that it is |
| 1029 // still running. In this event, a blocking attempt to reap the process |
| 1030 // collects the known-dying child, preventing zombies from congregating. |
| 1031 // |
| 1032 // In the event that the kqueue misbehaves entirely, as it might under a |
| 1033 // EMFILE condition ("too many open files", or out of file descriptors), this |
| 1034 // function will forcibly kill and reap the child without delay. This |
| 1035 // eliminates another potential zombie vector. (If you're out of file |
| 1036 // descriptors, you're probably deep into something else, but that doesn't |
| 1037 // mean that zombies be allowed to kick you while you're down.) |
| 1038 // |
| 1039 // The fact that this function seemingly can be called to wait on a child |
| 1040 // that's not only already terminated but already reaped is a bit of a |
| 1041 // problem: a reaped child's pid can be reclaimed and may refer to a distinct |
| 1042 // process in that case. The fact that this function can seemingly be called |
| 1043 // to wait on a process that's not even a child is also a problem: kqueue will |
| 1044 // work in that case, but waitpid won't, and killing a non-child might not be |
| 1045 // the best approach. |
| 1046 void WaitForChildToDie(pid_t child, int timeout) { |
| 1047 DCHECK(child > 0); |
| 1048 DCHECK(timeout > 0); |
| 1049 |
| 1050 // DON'T ADD ANY EARLY RETURNS TO THIS FUNCTION without ensuring that |
| 1051 // |child| has been reaped. Specifically, even if a kqueue, kevent, or other |
| 1052 // call fails, this function should fall back to the last resort of trying |
| 1053 // to kill and reap the process. Not observing this rule will resurrect |
| 1054 // zombies. |
| 1055 |
| 1056 int result; |
| 1057 |
| 1058 int kq = HANDLE_EINTR(kqueue()); |
| 1059 if (kq == -1) { |
| 1060 DPLOG(ERROR) << "kqueue()"; |
| 1061 } else { |
| 1062 file_util::ScopedFD auto_close_kq(&kq); |
| 1063 |
| 1064 struct kevent change = {0}; |
| 1065 EV_SET(&change, child, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL); |
| 1066 result = HANDLE_EINTR(kevent(kq, &change, 1, NULL, 0, NULL)); |
| 1067 |
| 1068 if (result == -1) { |
| 1069 if (errno != ESRCH) { |
| 1070 DPLOG(ERROR) << "kevent (setup " << child << ")"; |
| 1071 } else { |
| 1072 // At this point, one of the following has occurred: |
| 1073 // 1. The process has died but has not yet been reaped. |
| 1074 // 2. The process has died and has already been reaped. |
| 1075 // 3. The process is in the process of dying. It's no longer |
| 1076 // kqueueable, but it may not be waitable yet either. Mark calls |
| 1077 // this case the "zombie death race". |
| 1078 |
| 1079 result = HANDLE_EINTR(waitpid(child, NULL, WNOHANG)); |
| 1080 |
| 1081 if (result != 0) { |
| 1082 // A positive result indicates case 1. waitpid succeeded and reaped |
| 1083 // the child. A result of -1 indicates case 2. The child has already |
| 1084 // been reaped. In both of these cases, no further action is |
| 1085 // necessary. |
| 1086 return; |
| 1087 } |
| 1088 |
| 1089 // |result| is 0, indicating case 3. The process will be waitable in |
| 1090 // short order. Fall back out of the kqueue code to kill it (for good |
| 1091 // measure) and reap it. |
| 1092 } |
| 1093 } else { |
| 1094 // Keep track of the elapsed time to be able to restart kevent if it's |
| 1095 // interrupted. |
| 1096 TimeDelta remaining_delta = TimeDelta::FromSeconds(timeout); |
| 1097 Time deadline = Time::Now() + remaining_delta; |
| 1098 result = -1; |
| 1099 struct kevent event = {0}; |
| 1100 while (remaining_delta.InMilliseconds() > 0) { |
| 1101 const struct timespec remaining_timespec = remaining_delta.ToTimeSpec(); |
| 1102 result = kevent(kq, NULL, 0, &event, 1, &remaining_timespec); |
| 1103 if (result == -1 && errno == EINTR) { |
| 1104 remaining_delta = deadline - Time::Now(); |
| 1105 result = 0; |
| 1106 } else { |
| 1107 break; |
| 1108 } |
| 1109 } |
| 1110 |
| 1111 if (result == -1) { |
| 1112 DPLOG(ERROR) << "kevent (wait " << child << ")"; |
| 1113 } else if (result > 1) { |
| 1114 DLOG(ERROR) << "kevent (wait " << child << "): unexpected result " |
| 1115 << result; |
| 1116 } else if (result == 1) { |
| 1117 if ((event.fflags & NOTE_EXIT) && |
| 1118 (event.ident == static_cast<uintptr_t>(child))) { |
| 1119 // The process is dead or dying. This won't block for long, if at |
| 1120 // all. |
| 1121 BlockingReap(child); |
| 1122 return; |
| 1123 } else { |
| 1124 DLOG(ERROR) << "kevent (wait " << child |
| 1125 << "): unexpected event: fflags=" << event.fflags |
| 1126 << ", ident=" << event.ident; |
| 1127 } |
| 1128 } |
| 1129 } |
| 1130 } |
| 1131 |
| 1132 // The child is still alive, or is very freshly dead. Be sure by sending it |
| 1133 // a signal. This is safe even if it's freshly dead, because it will be a |
| 1134 // zombie (or on the way to zombiedom) and kill will return 0 even if the |
| 1135 // signal is not delivered to a live process. |
| 1136 result = kill(child, SIGKILL); |
| 1137 if (result == -1) { |
| 1138 DPLOG(ERROR) << "kill(" << child << ", SIGKILL)"; |
| 1139 } else { |
| 1140 // The child is definitely on the way out now. BlockingReap won't need to |
| 1141 // wait for long, if at all. |
| 1142 BlockingReap(child); |
| 1143 } |
| 1144 } |
| 1145 |
| 1146 } // namespace |
| 1147 |
| 1148 void EnsureProcessTerminated(ProcessHandle process) { |
| 1149 WaitForChildToDie(process, kWaitBeforeKillSeconds); |
| 1150 } |
| 1151 |
993 } // namespace base | 1152 } // namespace base |
OLD | NEW |