| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "components/crash/content/browser/crash_handler_host_linux.h" | |
| 6 | |
| 7 #include <stdint.h> | |
| 8 #include <stdlib.h> | |
| 9 #include <sys/socket.h> | |
| 10 #include <sys/syscall.h> | |
| 11 #include <unistd.h> | |
| 12 | |
| 13 #include "base/bind.h" | |
| 14 #include "base/bind_helpers.h" | |
| 15 #include "base/files/file_path.h" | |
| 16 #include "base/files/file_util.h" | |
| 17 #include "base/files/scoped_file.h" | |
| 18 #include "base/format_macros.h" | |
| 19 #include "base/linux_util.h" | |
| 20 #include "base/location.h" | |
| 21 #include "base/logging.h" | |
| 22 #include "base/path_service.h" | |
| 23 #include "base/posix/eintr_wrapper.h" | |
| 24 #include "base/rand_util.h" | |
| 25 #include "base/single_thread_task_runner.h" | |
| 26 #include "base/strings/string_util.h" | |
| 27 #include "base/strings/stringprintf.h" | |
| 28 #include "base/threading/thread.h" | |
| 29 #include "breakpad/src/client/linux/handler/exception_handler.h" | |
| 30 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h" | |
| 31 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h" | |
| 32 #include "components/crash/content/app/breakpad_linux_impl.h" | |
| 33 #include "content/public/browser/browser_thread.h" | |
| 34 | |
| 35 #if defined(OS_ANDROID) && !defined(__LP64__) | |
| 36 #include <sys/linux-syscalls.h> | |
| 37 | |
| 38 #define SYS_read __NR_read | |
| 39 #endif | |
| 40 | |
| 41 using content::BrowserThread; | |
| 42 using google_breakpad::ExceptionHandler; | |
| 43 | |
| 44 namespace breakpad { | |
| 45 | |
| 46 namespace { | |
| 47 | |
| 48 const size_t kNumFDs = 1; | |
| 49 // The length of the control message: | |
| 50 const size_t kControlMsgSize = | |
| 51 CMSG_SPACE(kNumFDs * sizeof(int)) + CMSG_SPACE(sizeof(struct ucred)); | |
| 52 // The length of the regular payload: | |
| 53 const size_t kCrashContextSize = sizeof(ExceptionHandler::CrashContext); | |
| 54 | |
| 55 // Handles the crash dump and frees the allocated BreakpadInfo struct. | |
| 56 void CrashDumpTask(CrashHandlerHostLinux* handler, | |
| 57 scoped_ptr<BreakpadInfo> info) { | |
| 58 if (handler->IsShuttingDown() && info->upload) { | |
| 59 base::DeleteFile(base::FilePath(info->filename), false); | |
| 60 #if defined(ADDRESS_SANITIZER) | |
| 61 base::DeleteFile(base::FilePath(info->log_filename), false); | |
| 62 #endif | |
| 63 return; | |
| 64 } | |
| 65 | |
| 66 HandleCrashDump(*info); | |
| 67 delete[] info->filename; | |
| 68 #if defined(ADDRESS_SANITIZER) | |
| 69 delete[] info->log_filename; | |
| 70 delete[] info->asan_report_str; | |
| 71 #endif | |
| 72 delete[] info->process_type; | |
| 73 delete[] info->distro; | |
| 74 delete info->crash_keys; | |
| 75 } | |
| 76 | |
| 77 } // namespace | |
| 78 | |
| 79 // Since instances of CrashHandlerHostLinux are leaked, they are only destroyed | |
| 80 // at the end of the processes lifetime, which is greater in span than the | |
| 81 // lifetime of the IO message loop. Thus, all calls to base::Bind() use | |
| 82 // non-refcounted pointers. | |
| 83 | |
| 84 CrashHandlerHostLinux::CrashHandlerHostLinux(const std::string& process_type, | |
| 85 const base::FilePath& dumps_path, | |
| 86 bool upload) | |
| 87 : process_type_(process_type), | |
| 88 dumps_path_(dumps_path), | |
| 89 upload_(upload), | |
| 90 shutting_down_(false), | |
| 91 worker_pool_token_(BrowserThread::GetBlockingPool()->GetSequenceToken()) { | |
| 92 int fds[2]; | |
| 93 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from | |
| 94 // sending datagrams to other sockets on the system. The sandbox may prevent | |
| 95 // the process from calling socket() to create new sockets, but it'll still | |
| 96 // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send | |
| 97 // a datagram to any (abstract) socket on the same system. With | |
| 98 // SOCK_SEQPACKET, this is prevented. | |
| 99 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); | |
| 100 static const int on = 1; | |
| 101 | |
| 102 // Enable passcred on the server end of the socket | |
| 103 CHECK_EQ(0, setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on))); | |
| 104 | |
| 105 process_socket_ = fds[0]; | |
| 106 browser_socket_ = fds[1]; | |
| 107 | |
| 108 BrowserThread::PostTask( | |
| 109 BrowserThread::IO, FROM_HERE, | |
| 110 base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this))); | |
| 111 } | |
| 112 | |
| 113 CrashHandlerHostLinux::~CrashHandlerHostLinux() { | |
| 114 close(process_socket_); | |
| 115 close(browser_socket_); | |
| 116 } | |
| 117 | |
| 118 void CrashHandlerHostLinux::StartUploaderThread() { | |
| 119 uploader_thread_.reset( | |
| 120 new base::Thread(process_type_ + "_crash_uploader")); | |
| 121 uploader_thread_->Start(); | |
| 122 } | |
| 123 | |
| 124 void CrashHandlerHostLinux::Init() { | |
| 125 base::MessageLoopForIO* ml = base::MessageLoopForIO::current(); | |
| 126 CHECK(ml->WatchFileDescriptor( | |
| 127 browser_socket_, true /* persistent */, | |
| 128 base::MessageLoopForIO::WATCH_READ, | |
| 129 &file_descriptor_watcher_, this)); | |
| 130 ml->AddDestructionObserver(this); | |
| 131 } | |
| 132 | |
| 133 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) { | |
| 134 NOTREACHED(); | |
| 135 } | |
| 136 | |
| 137 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) { | |
| 138 DCHECK_EQ(browser_socket_, fd); | |
| 139 | |
| 140 // A process has crashed and has signaled us by writing a datagram | |
| 141 // to the death signal socket. The datagram contains the crash context needed | |
| 142 // for writing the minidump as well as a file descriptor and a credentials | |
| 143 // block so that they can't lie about their pid. | |
| 144 // | |
| 145 // The message sender is in components/crash/content/app/breakpad_linux.cc. | |
| 146 | |
| 147 struct msghdr msg = {0}; | |
| 148 struct iovec iov[kCrashIovSize]; | |
| 149 | |
| 150 scoped_ptr<char[]> crash_context(new char[kCrashContextSize]); | |
| 151 #if defined(ADDRESS_SANITIZER) | |
| 152 scoped_ptr<char[]> asan_report(new char[kMaxAsanReportSize + 1]); | |
| 153 #endif | |
| 154 | |
| 155 scoped_ptr<CrashKeyStorage> crash_keys(new CrashKeyStorage); | |
| 156 google_breakpad::SerializedNonAllocatingMap* serialized_crash_keys; | |
| 157 size_t crash_keys_size = crash_keys->Serialize( | |
| 158 const_cast<const google_breakpad::SerializedNonAllocatingMap**>( | |
| 159 &serialized_crash_keys)); | |
| 160 | |
| 161 char* tid_buf_addr = NULL; | |
| 162 int tid_fd = -1; | |
| 163 uint64_t uptime; | |
| 164 size_t oom_size; | |
| 165 char control[kControlMsgSize]; | |
| 166 const ssize_t expected_msg_size = | |
| 167 kCrashContextSize + | |
| 168 sizeof(tid_buf_addr) + sizeof(tid_fd) + | |
| 169 sizeof(uptime) + | |
| 170 #if defined(ADDRESS_SANITIZER) | |
| 171 kMaxAsanReportSize + 1 + | |
| 172 #endif | |
| 173 sizeof(oom_size) + | |
| 174 crash_keys_size; | |
| 175 iov[0].iov_base = crash_context.get(); | |
| 176 iov[0].iov_len = kCrashContextSize; | |
| 177 iov[1].iov_base = &tid_buf_addr; | |
| 178 iov[1].iov_len = sizeof(tid_buf_addr); | |
| 179 iov[2].iov_base = &tid_fd; | |
| 180 iov[2].iov_len = sizeof(tid_fd); | |
| 181 iov[3].iov_base = &uptime; | |
| 182 iov[3].iov_len = sizeof(uptime); | |
| 183 iov[4].iov_base = &oom_size; | |
| 184 iov[4].iov_len = sizeof(oom_size); | |
| 185 iov[5].iov_base = serialized_crash_keys; | |
| 186 iov[5].iov_len = crash_keys_size; | |
| 187 #if !defined(ADDRESS_SANITIZER) | |
| 188 static_assert(5 == kCrashIovSize - 1, "kCrashIovSize should equal 6"); | |
| 189 #else | |
| 190 iov[6].iov_base = asan_report.get(); | |
| 191 iov[6].iov_len = kMaxAsanReportSize + 1; | |
| 192 static_assert(6 == kCrashIovSize - 1, "kCrashIovSize should equal 7"); | |
| 193 #endif | |
| 194 msg.msg_iov = iov; | |
| 195 msg.msg_iovlen = kCrashIovSize; | |
| 196 msg.msg_control = control; | |
| 197 msg.msg_controllen = kControlMsgSize; | |
| 198 | |
| 199 const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0)); | |
| 200 if (msg_size < 0) { | |
| 201 LOG(ERROR) << "Error reading from death signal socket. Crash dumping" | |
| 202 << " is disabled." | |
| 203 << " msg_size:" << msg_size | |
| 204 << " errno:" << errno; | |
| 205 file_descriptor_watcher_.StopWatchingFileDescriptor(); | |
| 206 return; | |
| 207 } | |
| 208 const bool bad_message = (msg_size != expected_msg_size || | |
| 209 msg.msg_controllen != kControlMsgSize || | |
| 210 msg.msg_flags & ~MSG_TRUNC); | |
| 211 base::ScopedFD signal_fd; | |
| 212 pid_t crashing_pid = -1; | |
| 213 if (msg.msg_controllen > 0) { | |
| 214 // Walk the control payload and extract the file descriptor and | |
| 215 // validated pid. | |
| 216 for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr; | |
| 217 hdr = CMSG_NXTHDR(&msg, hdr)) { | |
| 218 if (hdr->cmsg_level != SOL_SOCKET) | |
| 219 continue; | |
| 220 if (hdr->cmsg_type == SCM_RIGHTS) { | |
| 221 const size_t len = hdr->cmsg_len - | |
| 222 (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr); | |
| 223 DCHECK_EQ(0U, len % sizeof(int)); | |
| 224 const size_t num_fds = len / sizeof(int); | |
| 225 if (num_fds != kNumFDs) { | |
| 226 // A nasty process could try and send us too many descriptors and | |
| 227 // force a leak. | |
| 228 LOG(ERROR) << "Death signal contained wrong number of descriptors;" | |
| 229 << " num_fds:" << num_fds; | |
| 230 for (size_t i = 0; i < num_fds; ++i) | |
| 231 close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]); | |
| 232 return; | |
| 233 } | |
| 234 DCHECK(!signal_fd.is_valid()); | |
| 235 int fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0]; | |
| 236 DCHECK_GE(fd, 0); // The kernel should never send a negative fd. | |
| 237 signal_fd.reset(fd); | |
| 238 } else if (hdr->cmsg_type == SCM_CREDENTIALS) { | |
| 239 DCHECK_EQ(-1, crashing_pid); | |
| 240 const struct ucred *cred = | |
| 241 reinterpret_cast<struct ucred*>(CMSG_DATA(hdr)); | |
| 242 crashing_pid = cred->pid; | |
| 243 } | |
| 244 } | |
| 245 } | |
| 246 | |
| 247 if (bad_message) { | |
| 248 LOG(ERROR) << "Received death signal message with the wrong size;" | |
| 249 << " msg.msg_controllen:" << msg.msg_controllen | |
| 250 << " msg.msg_flags:" << msg.msg_flags | |
| 251 << " kCrashContextSize:" << kCrashContextSize | |
| 252 << " kControlMsgSize:" << kControlMsgSize; | |
| 253 return; | |
| 254 } | |
| 255 if (crashing_pid == -1 || !signal_fd.is_valid()) { | |
| 256 LOG(ERROR) << "Death signal message didn't contain all expected control" | |
| 257 << " messages"; | |
| 258 return; | |
| 259 } | |
| 260 | |
| 261 // The crashing TID set inside the compromised context via | |
| 262 // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if | |
| 263 // the kernel supports PID namespacing) and may need to be | |
| 264 // translated. | |
| 265 // | |
| 266 // We expect the crashing thread to be in sys_read(), waiting for us to | |
| 267 // write to |signal_fd|. Most newer kernels where we have the different pid | |
| 268 // namespaces also have /proc/[pid]/syscall, so we can look through | |
| 269 // |actual_crashing_pid|'s thread group and find the thread that's in the | |
| 270 // read syscall with the right arguments. | |
| 271 | |
| 272 std::string expected_syscall_data; | |
| 273 // /proc/[pid]/syscall is formatted as follows: | |
| 274 // syscall_number arg1 ... arg6 sp pc | |
| 275 // but we just check syscall_number through arg3. | |
| 276 base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ", | |
| 277 SYS_read, tid_fd, tid_buf_addr); | |
| 278 bool syscall_supported = false; | |
| 279 pid_t crashing_tid = | |
| 280 base::FindThreadIDWithSyscall(crashing_pid, | |
| 281 expected_syscall_data, | |
| 282 &syscall_supported); | |
| 283 if (crashing_tid == -1) { | |
| 284 // We didn't find the thread we want. Maybe it didn't reach | |
| 285 // sys_read() yet or the thread went away. We'll just take a | |
| 286 // guess here and assume the crashing thread is the thread group | |
| 287 // leader. If procfs syscall is not supported by the kernel, then | |
| 288 // we assume the kernel also does not support TID namespacing and | |
| 289 // trust the TID passed by the crashing process. | |
| 290 LOG(WARNING) << "Could not translate tid - assuming crashing thread is " | |
| 291 "thread group leader; syscall_supported=" << syscall_supported; | |
| 292 crashing_tid = crashing_pid; | |
| 293 } | |
| 294 | |
| 295 ExceptionHandler::CrashContext* bad_context = | |
| 296 reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context.get()); | |
| 297 bad_context->tid = crashing_tid; | |
| 298 | |
| 299 scoped_ptr<BreakpadInfo> info(new BreakpadInfo); | |
| 300 | |
| 301 info->fd = -1; | |
| 302 info->process_type_length = process_type_.length(); | |
| 303 // Freed in CrashDumpTask(). | |
| 304 char* process_type_str = new char[info->process_type_length + 1]; | |
| 305 process_type_.copy(process_type_str, info->process_type_length); | |
| 306 process_type_str[info->process_type_length] = '\0'; | |
| 307 info->process_type = process_type_str; | |
| 308 | |
| 309 // Memory released from scoped_ptrs below are also freed in CrashDumpTask(). | |
| 310 info->crash_keys = crash_keys.release(); | |
| 311 #if defined(ADDRESS_SANITIZER) | |
| 312 asan_report[kMaxAsanReportSize] = '\0'; | |
| 313 info->asan_report_str = asan_report.release(); | |
| 314 info->asan_report_length = strlen(info->asan_report_str); | |
| 315 #endif | |
| 316 | |
| 317 info->process_start_time = uptime; | |
| 318 info->oom_size = oom_size; | |
| 319 #if defined(OS_ANDROID) | |
| 320 // Nothing gets uploaded in android. | |
| 321 info->upload = false; | |
| 322 #else | |
| 323 info->upload = upload_; | |
| 324 #endif | |
| 325 | |
| 326 | |
| 327 BrowserThread::GetBlockingPool()->PostSequencedWorkerTask( | |
| 328 worker_pool_token_, | |
| 329 FROM_HERE, | |
| 330 base::Bind(&CrashHandlerHostLinux::WriteDumpFile, | |
| 331 base::Unretained(this), | |
| 332 base::Passed(&info), | |
| 333 base::Passed(&crash_context), | |
| 334 crashing_pid, | |
| 335 signal_fd.release())); | |
| 336 } | |
| 337 | |
| 338 void CrashHandlerHostLinux::WriteDumpFile(scoped_ptr<BreakpadInfo> info, | |
| 339 scoped_ptr<char[]> crash_context, | |
| 340 pid_t crashing_pid, | |
| 341 int signal_fd) { | |
| 342 DCHECK(BrowserThread::GetBlockingPool()->IsRunningSequenceOnCurrentThread( | |
| 343 worker_pool_token_)); | |
| 344 | |
| 345 // Set |info->distro| here because base::GetLinuxDistro() needs to run on a | |
| 346 // blocking thread. | |
| 347 std::string distro = base::GetLinuxDistro(); | |
| 348 info->distro_length = distro.length(); | |
| 349 // Freed in CrashDumpTask(). | |
| 350 char* distro_str = new char[info->distro_length + 1]; | |
| 351 distro.copy(distro_str, info->distro_length); | |
| 352 distro_str[info->distro_length] = '\0'; | |
| 353 info->distro = distro_str; | |
| 354 | |
| 355 base::FilePath dumps_path("/tmp"); | |
| 356 PathService::Get(base::DIR_TEMP, &dumps_path); | |
| 357 if (!info->upload) | |
| 358 dumps_path = dumps_path_; | |
| 359 const std::string minidump_filename = | |
| 360 base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp", | |
| 361 dumps_path.value().c_str(), | |
| 362 process_type_.c_str(), | |
| 363 base::RandUint64()); | |
| 364 | |
| 365 if (!google_breakpad::WriteMinidump(minidump_filename.c_str(), | |
| 366 kMaxMinidumpFileSize, | |
| 367 crashing_pid, | |
| 368 crash_context.get(), | |
| 369 kCrashContextSize, | |
| 370 google_breakpad::MappingList(), | |
| 371 google_breakpad::AppMemoryList())) { | |
| 372 LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid; | |
| 373 } | |
| 374 #if defined(ADDRESS_SANITIZER) | |
| 375 // Create a temporary file holding the AddressSanitizer report. | |
| 376 const base::FilePath log_path = | |
| 377 base::FilePath(minidump_filename).ReplaceExtension("log"); | |
| 378 base::WriteFile(log_path, info->asan_report_str, info->asan_report_length); | |
| 379 #endif | |
| 380 | |
| 381 // Freed in CrashDumpTask(). | |
| 382 char* minidump_filename_str = new char[minidump_filename.length() + 1]; | |
| 383 minidump_filename.copy(minidump_filename_str, minidump_filename.length()); | |
| 384 minidump_filename_str[minidump_filename.length()] = '\0'; | |
| 385 info->filename = minidump_filename_str; | |
| 386 #if defined(ADDRESS_SANITIZER) | |
| 387 // Freed in CrashDumpTask(). | |
| 388 char* minidump_log_filename_str = new char[minidump_filename.length() + 1]; | |
| 389 minidump_filename.copy(minidump_log_filename_str, minidump_filename.length()); | |
| 390 memcpy(minidump_log_filename_str + minidump_filename.length() - 3, "log", 3); | |
| 391 minidump_log_filename_str[minidump_filename.length()] = '\0'; | |
| 392 info->log_filename = minidump_log_filename_str; | |
| 393 #endif | |
| 394 info->pid = crashing_pid; | |
| 395 | |
| 396 BrowserThread::PostTask( | |
| 397 BrowserThread::IO, FROM_HERE, | |
| 398 base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask, | |
| 399 base::Unretained(this), | |
| 400 base::Passed(&info), | |
| 401 signal_fd)); | |
| 402 } | |
| 403 | |
| 404 void CrashHandlerHostLinux::QueueCrashDumpTask(scoped_ptr<BreakpadInfo> info, | |
| 405 int signal_fd) { | |
| 406 DCHECK_CURRENTLY_ON(BrowserThread::IO); | |
| 407 | |
| 408 // Send the done signal to the process: it can exit now. | |
| 409 struct msghdr msg = {0}; | |
| 410 struct iovec done_iov; | |
| 411 done_iov.iov_base = const_cast<char*>("\x42"); | |
| 412 done_iov.iov_len = 1; | |
| 413 msg.msg_iov = &done_iov; | |
| 414 msg.msg_iovlen = 1; | |
| 415 | |
| 416 HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL)); | |
| 417 close(signal_fd); | |
| 418 | |
| 419 uploader_thread_->task_runner()->PostTask( | |
| 420 FROM_HERE, | |
| 421 base::Bind(&CrashDumpTask, base::Unretained(this), base::Passed(&info))); | |
| 422 } | |
| 423 | |
| 424 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() { | |
| 425 file_descriptor_watcher_.StopWatchingFileDescriptor(); | |
| 426 | |
| 427 // If we are quitting and there are crash dumps in the queue, turn them into | |
| 428 // no-ops. | |
| 429 shutting_down_ = true; | |
| 430 uploader_thread_->Stop(); | |
| 431 } | |
| 432 | |
| 433 bool CrashHandlerHostLinux::IsShuttingDown() const { | |
| 434 return shutting_down_; | |
| 435 } | |
| 436 | |
| 437 } // namespace breakpad | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1351923002:
Revert of Turn components/crash into a layered component. (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master