Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(41)

Side by Side Diff: chrome/browser/crash_handler_host_linux.cc

Issue 9960072: Upstream crash changes for android. (Closed) Base URL: http://git.chromium.org/git/chromium.git@trunk
Patch Set: Fixes to gyp and a typo in breakpad_linuxish.cc Created 8 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
(Empty)
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "chrome/browser/crash_handler_host_linux.h"
6
7 #include <stdint.h>
8 #include <stdlib.h>
9 #include <sys/socket.h>
10 #include <sys/syscall.h>
11 #include <unistd.h>
12
13 #include "base/bind.h"
14 #include "base/bind_helpers.h"
15 #include "base/eintr_wrapper.h"
16 #include "base/file_path.h"
17 #include "base/format_macros.h"
18 #include "base/linux_util.h"
19 #include "base/logging.h"
20 #include "base/memory/singleton.h"
21 #include "base/message_loop.h"
22 #include "base/path_service.h"
23 #include "base/rand_util.h"
24 #include "base/string_util.h"
25 #include "base/stringprintf.h"
26 #include "base/threading/thread.h"
27 #include "breakpad/src/client/linux/handler/exception_handler.h"
28 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h"
29 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h"
30 #include "chrome/app/breakpad_linux.h"
31 #include "chrome/common/chrome_paths.h"
32 #include "chrome/common/env_vars.h"
33 #include "content/public/browser/browser_thread.h"
34
35 using content::BrowserThread;
36 using google_breakpad::ExceptionHandler;
37
38 namespace {
39
40 // The length of the control message:
41 const unsigned kControlMsgSize =
42 CMSG_SPACE(2*sizeof(int)) + CMSG_SPACE(sizeof(struct ucred));
43 // The length of the regular payload:
44 const unsigned kCrashContextSize = sizeof(ExceptionHandler::CrashContext);
45
46 // Handles the crash dump and frees the allocated BreakpadInfo struct.
47 void CrashDumpTask(CrashHandlerHostLinux* handler, BreakpadInfo* info) {
48 if (handler->IsShuttingDown())
49 return;
50
51 HandleCrashDump(*info);
52 delete[] info->filename;
53 delete[] info->process_type;
54 delete[] info->crash_url;
55 delete[] info->guid;
56 delete[] info->distro;
57 delete info;
58 }
59
60 } // namespace
61
62 // Since classes derived from CrashHandlerHostLinux are singletons, it's only
63 // destroyed at the end of the processes lifetime, which is greater in span than
64 // the lifetime of the IO message loop. Thus, all calls to base::Bind() use
65 // non-refcounted pointers.
66
67 CrashHandlerHostLinux::CrashHandlerHostLinux()
68 : shutting_down_(false) {
69 int fds[2];
70 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from
71 // sending datagrams to other sockets on the system. The sandbox may prevent
72 // the process from calling socket() to create new sockets, but it'll still
73 // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
74 // a datagram to any (abstract) socket on the same system. With
75 // SOCK_SEQPACKET, this is prevented.
76 CHECK_EQ(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds), 0);
77 static const int on = 1;
78
79 // Enable passcred on the server end of the socket
80 CHECK_EQ(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)), 0);
81
82 process_socket_ = fds[0];
83 browser_socket_ = fds[1];
84
85 BrowserThread::PostTask(
86 BrowserThread::IO, FROM_HERE,
87 base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this)));
88 }
89
90 CrashHandlerHostLinux::~CrashHandlerHostLinux() {
91 HANDLE_EINTR(close(process_socket_));
92 HANDLE_EINTR(close(browser_socket_));
93 }
94
95 void CrashHandlerHostLinux::Init() {
96 MessageLoopForIO* ml = MessageLoopForIO::current();
97 CHECK(ml->WatchFileDescriptor(
98 browser_socket_, true /* persistent */,
99 MessageLoopForIO::WATCH_READ,
100 &file_descriptor_watcher_, this));
101 ml->AddDestructionObserver(this);
102 }
103
104 void CrashHandlerHostLinux::InitCrashUploaderThread() {
105 SetProcessType();
106 uploader_thread_.reset(
107 new base::Thread(std::string(process_type_ + "_crash_uploader").c_str()));
108 uploader_thread_->Start();
109 }
110
111 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
112 NOTREACHED();
113 }
114
115 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
116 DCHECK_EQ(fd, browser_socket_);
117
118 // A process has crashed and has signaled us by writing a datagram
119 // to the death signal socket. The datagram contains the crash context needed
120 // for writing the minidump as well as a file descriptor and a credentials
121 // block so that they can't lie about their pid.
122 //
123 // The message sender is in chrome/app/breakpad_linux.cc.
124
125 const size_t kIovSize = 8;
126 struct msghdr msg = {0};
127 struct iovec iov[kIovSize];
128
129 // Freed in WriteDumpFile();
130 char* crash_context = new char[kCrashContextSize];
131 // Freed in CrashDumpTask();
132 char* guid = new char[kGuidSize + 1];
133 char* crash_url = new char[kMaxActiveURLSize + 1];
134 char* distro = new char[kDistroSize + 1];
135
136 char* tid_buf_addr = NULL;
137 int tid_fd = -1;
138 uint64_t uptime;
139 size_t oom_size;
140 char control[kControlMsgSize];
141 const ssize_t expected_msg_size =
142 kCrashContextSize +
143 kGuidSize + 1 +
144 kMaxActiveURLSize + 1 +
145 kDistroSize + 1 +
146 sizeof(tid_buf_addr) + sizeof(tid_fd) +
147 sizeof(uptime) +
148 sizeof(oom_size);
149
150 iov[0].iov_base = crash_context;
151 iov[0].iov_len = kCrashContextSize;
152 iov[1].iov_base = guid;
153 iov[1].iov_len = kGuidSize + 1;
154 iov[2].iov_base = crash_url;
155 iov[2].iov_len = kMaxActiveURLSize + 1;
156 iov[3].iov_base = distro;
157 iov[3].iov_len = kDistroSize + 1;
158 iov[4].iov_base = &tid_buf_addr;
159 iov[4].iov_len = sizeof(tid_buf_addr);
160 iov[5].iov_base = &tid_fd;
161 iov[5].iov_len = sizeof(tid_fd);
162 iov[6].iov_base = &uptime;
163 iov[6].iov_len = sizeof(uptime);
164 iov[7].iov_base = &oom_size;
165 iov[7].iov_len = sizeof(oom_size);
166 msg.msg_iov = iov;
167 msg.msg_iovlen = kIovSize;
168 msg.msg_control = control;
169 msg.msg_controllen = kControlMsgSize;
170
171 const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0));
172 if (msg_size != expected_msg_size) {
173 LOG(ERROR) << "Error reading from death signal socket. Crash dumping"
174 << " is disabled."
175 << " msg_size:" << msg_size
176 << " errno:" << errno;
177 file_descriptor_watcher_.StopWatchingFileDescriptor();
178 return;
179 }
180
181 if (msg.msg_controllen != kControlMsgSize ||
182 msg.msg_flags & ~MSG_TRUNC) {
183 LOG(ERROR) << "Received death signal message with the wrong size;"
184 << " msg.msg_controllen:" << msg.msg_controllen
185 << " msg.msg_flags:" << msg.msg_flags
186 << " kCrashContextSize:" << kCrashContextSize
187 << " kControlMsgSize:" << kControlMsgSize;
188 return;
189 }
190
191 // Walk the control payload an extract the file descriptor and validated pid.
192 pid_t crashing_pid = -1;
193 int partner_fd = -1;
194 int signal_fd = -1;
195 for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr;
196 hdr = CMSG_NXTHDR(&msg, hdr)) {
197 if (hdr->cmsg_level != SOL_SOCKET)
198 continue;
199 if (hdr->cmsg_type == SCM_RIGHTS) {
200 const unsigned len = hdr->cmsg_len -
201 (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr);
202 DCHECK_EQ(len % sizeof(int), 0u);
203 const unsigned num_fds = len / sizeof(int);
204 if (num_fds != 2) {
205 // A nasty process could try and send us too many descriptors and
206 // force a leak.
207 LOG(ERROR) << "Death signal contained wrong number of descriptors;"
208 << " num_fds:" << num_fds;
209 for (unsigned i = 0; i < num_fds; ++i)
210 HANDLE_EINTR(close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]));
211 return;
212 } else {
213 partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
214 signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1];
215 }
216 } else if (hdr->cmsg_type == SCM_CREDENTIALS) {
217 const struct ucred *cred =
218 reinterpret_cast<struct ucred*>(CMSG_DATA(hdr));
219 crashing_pid = cred->pid;
220 }
221 }
222
223 if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) {
224 LOG(ERROR) << "Death signal message didn't contain all expected control"
225 << " messages";
226 if (partner_fd >= 0)
227 HANDLE_EINTR(close(partner_fd));
228 if (signal_fd >= 0)
229 HANDLE_EINTR(close(signal_fd));
230 return;
231 }
232
233 // Kernel bug workaround (broken in 2.6.30 and 2.6.32, working in 2.6.38).
234 // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID
235 // namespaces. Thus |crashing_pid| might be garbage from our point of view.
236 // In the future we can remove this workaround, but we have to wait a couple
237 // of years to be sure that it's worked its way out into the world.
238 // TODO(thestig) Remove the workaround when Ubuntu Lucid is deprecated.
239
240 // The crashing process closes its copy of the signal_fd immediately after
241 // calling sendmsg(). We can thus not reliably look for with with
242 // FindProcessHoldingSocket(). But by necessity, it has to keep the
243 // partner_fd open until the crashdump is complete.
244 uint64_t inode_number;
245 if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) {
246 LOG(WARNING) << "Failed to get inode number for passed socket";
247 HANDLE_EINTR(close(partner_fd));
248 HANDLE_EINTR(close(signal_fd));
249 return;
250 }
251 HANDLE_EINTR(close(partner_fd));
252
253 pid_t actual_crashing_pid = -1;
254 if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) {
255 LOG(WARNING) << "Failed to find process holding other end of crash reply "
256 "socket";
257 HANDLE_EINTR(close(signal_fd));
258 return;
259 }
260
261 crashing_pid = actual_crashing_pid;
262
263 // The crashing TID set inside the compromised context via
264 // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if
265 // the kernel supports PID namespacing) and may need to be
266 // translated.
267 //
268 // We expect the crashing thread to be in sys_read(), waiting for us to
269 // write to |signal_fd|. Most newer kernels where we have the different pid
270 // namespaces also have /proc/[pid]/syscall, so we can look through
271 // |actual_crashing_pid|'s thread group and find the thread that's in the
272 // read syscall with the right arguments.
273
274 std::string expected_syscall_data;
275 // /proc/[pid]/syscall is formatted as follows:
276 // syscall_number arg1 ... arg6 sp pc
277 // but we just check syscall_number through arg3.
278 base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ",
279 SYS_read, tid_fd, tid_buf_addr);
280 bool syscall_supported = false;
281 pid_t crashing_tid =
282 base::FindThreadIDWithSyscall(crashing_pid,
283 expected_syscall_data,
284 &syscall_supported);
285 if (crashing_tid == -1) {
286 // We didn't find the thread we want. Maybe it didn't reach
287 // sys_read() yet or the thread went away. We'll just take a
288 // guess here and assume the crashing thread is the thread group
289 // leader. If procfs syscall is not supported by the kernel, then
290 // we assume the kernel also does not support TID namespacing and
291 // trust the TID passed by the crashing process.
292 LOG(WARNING) << "Could not translate tid - assuming crashing thread is "
293 "thread group leader; syscall_supported=" << syscall_supported;
294 crashing_tid = crashing_pid;
295 }
296
297 ExceptionHandler::CrashContext* bad_context =
298 reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context);
299 bad_context->tid = crashing_tid;
300
301 // Sanitize the string data a bit more
302 guid[kGuidSize] = crash_url[kMaxActiveURLSize] = distro[kDistroSize] = 0;
303
304 // Freed in CrashDumpTask();
305 BreakpadInfo* info = new BreakpadInfo;
306
307 info->process_type_length = process_type_.length();
308 char* process_type_str = new char[info->process_type_length + 1];
309 process_type_.copy(process_type_str, info->process_type_length);
310 process_type_str[info->process_type_length] = '\0';
311 info->process_type = process_type_str;
312
313 info->crash_url_length = strlen(crash_url);
314 info->crash_url = crash_url;
315
316 info->guid_length = strlen(guid);
317 info->guid = guid;
318
319 info->distro_length = strlen(distro);
320 info->distro = distro;
321
322 info->upload = (getenv(env_vars::kHeadless) == NULL);
323 info->process_start_time = uptime;
324 info->oom_size = oom_size;
325
326 BrowserThread::PostTask(
327 BrowserThread::FILE, FROM_HERE,
328 base::Bind(&CrashHandlerHostLinux::WriteDumpFile,
329 base::Unretained(this),
330 info,
331 crashing_pid,
332 crash_context,
333 signal_fd));
334 }
335
336 void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info,
337 pid_t crashing_pid,
338 char* crash_context,
339 int signal_fd) {
340 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
341
342 FilePath dumps_path("/tmp");
343 PathService::Get(base::DIR_TEMP, &dumps_path);
344 if (!info->upload)
345 PathService::Get(chrome::DIR_CRASH_DUMPS, &dumps_path);
346 const uint64 rand = base::RandUint64();
347 const std::string minidump_filename =
348 base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp",
349 dumps_path.value().c_str(),
350 process_type_.c_str(),
351 rand);
352 if (!google_breakpad::WriteMinidump(minidump_filename.c_str(),
353 crashing_pid, crash_context,
354 kCrashContextSize)) {
355 LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid;
356 }
357 delete[] crash_context;
358
359 // Freed in CrashDumpTask();
360 char* minidump_filename_str = new char[minidump_filename.length() + 1];
361 minidump_filename.copy(minidump_filename_str, minidump_filename.length());
362 minidump_filename_str[minidump_filename.length()] = '\0';
363 info->filename = minidump_filename_str;
364
365 BrowserThread::PostTask(
366 BrowserThread::IO, FROM_HERE,
367 base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask,
368 base::Unretained(this),
369 info,
370 signal_fd));
371 }
372
373 void CrashHandlerHostLinux::QueueCrashDumpTask(BreakpadInfo* info,
374 int signal_fd) {
375 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
376
377 // Send the done signal to the process: it can exit now.
378 struct msghdr msg = {0};
379 struct iovec done_iov;
380 done_iov.iov_base = const_cast<char*>("\x42");
381 done_iov.iov_len = 1;
382 msg.msg_iov = &done_iov;
383 msg.msg_iovlen = 1;
384
385 HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL));
386 HANDLE_EINTR(close(signal_fd));
387
388 uploader_thread_->message_loop()->PostTask(
389 FROM_HERE,
390 base::Bind(&CrashDumpTask, base::Unretained(this), info));
391 }
392
393 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
394 file_descriptor_watcher_.StopWatchingFileDescriptor();
395
396 // If we are quitting and there are crash dumps in the queue, turn them into
397 // no-ops.
398 shutting_down_ = true;
399 uploader_thread_->Stop();
400 }
401
402 bool CrashHandlerHostLinux::IsShuttingDown() const {
403 return shutting_down_;
404 }
405
406 ExtensionCrashHandlerHostLinux::ExtensionCrashHandlerHostLinux() {
407 InitCrashUploaderThread();
408 }
409
410 ExtensionCrashHandlerHostLinux::~ExtensionCrashHandlerHostLinux() {
411 }
412
413 void ExtensionCrashHandlerHostLinux::SetProcessType() {
414 process_type_ = "extension";
415 }
416
417 // static
418 ExtensionCrashHandlerHostLinux* ExtensionCrashHandlerHostLinux::GetInstance() {
419 return Singleton<ExtensionCrashHandlerHostLinux>::get();
420 }
421
422 GpuCrashHandlerHostLinux::GpuCrashHandlerHostLinux() {
423 InitCrashUploaderThread();
424 }
425
426 GpuCrashHandlerHostLinux::~GpuCrashHandlerHostLinux() {
427 }
428
429 void GpuCrashHandlerHostLinux::SetProcessType() {
430 process_type_ = "gpu-process";
431 }
432
433 // static
434 GpuCrashHandlerHostLinux* GpuCrashHandlerHostLinux::GetInstance() {
435 return Singleton<GpuCrashHandlerHostLinux>::get();
436 }
437
438 PluginCrashHandlerHostLinux::PluginCrashHandlerHostLinux() {
439 InitCrashUploaderThread();
440 }
441
442 PluginCrashHandlerHostLinux::~PluginCrashHandlerHostLinux() {
443 }
444
445 void PluginCrashHandlerHostLinux::SetProcessType() {
446 process_type_ = "plugin";
447 }
448
449 // static
450 PluginCrashHandlerHostLinux* PluginCrashHandlerHostLinux::GetInstance() {
451 return Singleton<PluginCrashHandlerHostLinux>::get();
452 }
453
454 PpapiCrashHandlerHostLinux::PpapiCrashHandlerHostLinux() {
455 InitCrashUploaderThread();
456 }
457
458 PpapiCrashHandlerHostLinux::~PpapiCrashHandlerHostLinux() {
459 }
460
461 void PpapiCrashHandlerHostLinux::SetProcessType() {
462 process_type_ = "ppapi";
463 }
464
465 // static
466 PpapiCrashHandlerHostLinux* PpapiCrashHandlerHostLinux::GetInstance() {
467 return Singleton<PpapiCrashHandlerHostLinux>::get();
468 }
469
470 RendererCrashHandlerHostLinux::RendererCrashHandlerHostLinux() {
471 InitCrashUploaderThread();
472 }
473
474 RendererCrashHandlerHostLinux::~RendererCrashHandlerHostLinux() {
475 }
476
477 void RendererCrashHandlerHostLinux::SetProcessType() {
478 process_type_ = "renderer";
479 }
480
481 // static
482 RendererCrashHandlerHostLinux* RendererCrashHandlerHostLinux::GetInstance() {
483 return Singleton<RendererCrashHandlerHostLinux>::get();
484 }
OLDNEW
« no previous file with comments | « chrome/browser/crash_handler_host_linux.h ('k') | chrome/browser/crash_handler_host_linux_stub.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698