OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/process_util.h" | 5 #include "base/process/memory.h" |
6 | 6 |
7 #import <Cocoa/Cocoa.h> | 7 #include <CoreFoundation/CoreFoundation.h> |
8 #include <crt_externs.h> | |
9 #include <errno.h> | 8 #include <errno.h> |
10 #include <mach/mach.h> | 9 #include <mach/mach.h> |
11 #include <mach/mach_init.h> | |
12 #include <mach/mach_vm.h> | 10 #include <mach/mach_vm.h> |
13 #include <mach/shared_region.h> | |
14 #include <mach/task.h> | |
15 #include <malloc/malloc.h> | 11 #include <malloc/malloc.h> |
16 #import <objc/runtime.h> | 12 #import <objc/runtime.h> |
17 #include <signal.h> | |
18 #include <spawn.h> | |
19 #include <sys/event.h> | |
20 #include <sys/sysctl.h> | |
21 #include <sys/types.h> | |
22 #include <sys/wait.h> | |
23 | 13 |
24 #include <new> | 14 #include <new> |
25 #include <string> | |
26 | 15 |
27 #include "base/containers/hash_tables.h" | |
28 #include "base/debug/debugger.h" | |
29 #include "base/file_util.h" | |
30 #include "base/lazy_instance.h" | 16 #include "base/lazy_instance.h" |
31 #include "base/logging.h" | 17 #include "base/logging.h" |
32 #include "base/mac/mac_util.h" | 18 #include "base/mac/mac_util.h" |
33 #include "base/mac/scoped_mach_port.h" | |
34 #include "base/posix/eintr_wrapper.h" | |
35 #include "base/scoped_clear_errno.h" | 19 #include "base/scoped_clear_errno.h" |
36 #include "base/strings/string_util.h" | |
37 #include "base/sys_info.h" | |
38 #include "third_party/apple_apsl/CFBase.h" | 20 #include "third_party/apple_apsl/CFBase.h" |
39 #include "third_party/apple_apsl/malloc.h" | 21 #include "third_party/apple_apsl/malloc.h" |
40 | 22 |
41 #if ARCH_CPU_32_BITS | 23 #if ARCH_CPU_32_BITS |
42 #include <dlfcn.h> | 24 #include <dlfcn.h> |
43 #include <mach-o/nlist.h> | 25 #include <mach-o/nlist.h> |
44 | 26 |
45 #include "base/threading/thread_local.h" | 27 #include "base/threading/thread_local.h" |
46 #include "third_party/mach_override/mach_override.h" | 28 #include "third_party/mach_override/mach_override.h" |
47 #endif // ARCH_CPU_32_BITS | 29 #endif // ARCH_CPU_32_BITS |
48 | 30 |
49 namespace base { | 31 namespace base { |
50 | 32 |
51 void RestoreDefaultExceptionHandler() { | |
52 // This function is tailored to remove the Breakpad exception handler. | |
53 // exception_mask matches s_exception_mask in | |
54 // breakpad/src/client/mac/handler/exception_handler.cc | |
55 const exception_mask_t exception_mask = EXC_MASK_BAD_ACCESS | | |
56 EXC_MASK_BAD_INSTRUCTION | | |
57 EXC_MASK_ARITHMETIC | | |
58 EXC_MASK_BREAKPOINT; | |
59 | |
60 // Setting the exception port to MACH_PORT_NULL may not be entirely | |
61 // kosher to restore the default exception handler, but in practice, | |
62 // it results in the exception port being set to Apple Crash Reporter, | |
63 // the desired behavior. | |
64 task_set_exception_ports(mach_task_self(), exception_mask, MACH_PORT_NULL, | |
65 EXCEPTION_DEFAULT, THREAD_STATE_NONE); | |
66 } | |
67 | |
68 | |
69 | |
70 // These are helpers for EnableTerminationOnHeapCorruption, which is a no-op | 33 // These are helpers for EnableTerminationOnHeapCorruption, which is a no-op |
71 // on 64 bit Macs. | 34 // on 64 bit Macs. |
72 #if ARCH_CPU_32_BITS | 35 #if ARCH_CPU_32_BITS |
73 namespace { | 36 namespace { |
74 | 37 |
75 // Finds the library path for malloc() and thus the libC part of libSystem, | 38 // Finds the library path for malloc() and thus the libC part of libSystem, |
76 // which in Lion is in a separate image. | 39 // which in Lion is in a separate image. |
77 const char* LookUpLibCPath() { | 40 const char* LookUpLibCPath() { |
78 const void* addr = reinterpret_cast<void*>(&malloc); | 41 const void* addr = reinterpret_cast<void*>(&malloc); |
79 | 42 |
(...skipping 651 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
731 Method orig_method = class_getClassMethod(nsobject_class, | 694 Method orig_method = class_getClassMethod(nsobject_class, |
732 @selector(allocWithZone:)); | 695 @selector(allocWithZone:)); |
733 g_old_allocWithZone = reinterpret_cast<allocWithZone_t>( | 696 g_old_allocWithZone = reinterpret_cast<allocWithZone_t>( |
734 method_getImplementation(orig_method)); | 697 method_getImplementation(orig_method)); |
735 CHECK(g_old_allocWithZone) | 698 CHECK(g_old_allocWithZone) |
736 << "Failed to get allocWithZone allocation function."; | 699 << "Failed to get allocWithZone allocation function."; |
737 method_setImplementation(orig_method, | 700 method_setImplementation(orig_method, |
738 reinterpret_cast<IMP>(oom_killer_allocWithZone)); | 701 reinterpret_cast<IMP>(oom_killer_allocWithZone)); |
739 } | 702 } |
740 | 703 |
741 ProcessId GetParentProcessId(ProcessHandle process) { | |
742 struct kinfo_proc info; | |
743 size_t length = sizeof(struct kinfo_proc); | |
744 int mib[4] = { CTL_KERN, KERN_PROC, KERN_PROC_PID, process }; | |
745 if (sysctl(mib, 4, &info, &length, NULL, 0) < 0) { | |
746 DPLOG(ERROR) << "sysctl"; | |
747 return -1; | |
748 } | |
749 if (length == 0) | |
750 return -1; | |
751 return info.kp_eproc.e_ppid; | |
752 } | |
753 | |
754 namespace { | |
755 | |
756 const int kWaitBeforeKillSeconds = 2; | |
757 | |
758 // Reap |child| process. This call blocks until completion. | |
759 void BlockingReap(pid_t child) { | |
760 const pid_t result = HANDLE_EINTR(waitpid(child, NULL, 0)); | |
761 if (result == -1) { | |
762 DPLOG(ERROR) << "waitpid(" << child << ", NULL, 0)"; | |
763 } | |
764 } | |
765 | |
766 // Waits for |timeout| seconds for the given |child| to exit and reap it. If | |
767 // the child doesn't exit within the time specified, kills it. | |
768 // | |
769 // This function takes two approaches: first, it tries to use kqueue to | |
770 // observe when the process exits. kevent can monitor a kqueue with a | |
771 // timeout, so this method is preferred to wait for a specified period of | |
772 // time. Once the kqueue indicates the process has exited, waitpid will reap | |
773 // the exited child. If the kqueue doesn't provide an exit event notification, | |
774 // before the timeout expires, or if the kqueue fails or misbehaves, the | |
775 // process will be mercilessly killed and reaped. | |
776 // | |
777 // A child process passed to this function may be in one of several states: | |
778 // running, terminated and not yet reaped, and (apparently, and unfortunately) | |
779 // terminated and already reaped. Normally, a process will at least have been | |
780 // asked to exit before this function is called, but this is not required. | |
781 // If a process is terminating and unreaped, there may be a window between the | |
782 // time that kqueue will no longer recognize it and when it becomes an actual | |
783 // zombie that a non-blocking (WNOHANG) waitpid can reap. This condition is | |
784 // detected when kqueue indicates that the process is not running and a | |
785 // non-blocking waitpid fails to reap the process but indicates that it is | |
786 // still running. In this event, a blocking attempt to reap the process | |
787 // collects the known-dying child, preventing zombies from congregating. | |
788 // | |
789 // In the event that the kqueue misbehaves entirely, as it might under a | |
790 // EMFILE condition ("too many open files", or out of file descriptors), this | |
791 // function will forcibly kill and reap the child without delay. This | |
792 // eliminates another potential zombie vector. (If you're out of file | |
793 // descriptors, you're probably deep into something else, but that doesn't | |
794 // mean that zombies be allowed to kick you while you're down.) | |
795 // | |
796 // The fact that this function seemingly can be called to wait on a child | |
797 // that's not only already terminated but already reaped is a bit of a | |
798 // problem: a reaped child's pid can be reclaimed and may refer to a distinct | |
799 // process in that case. The fact that this function can seemingly be called | |
800 // to wait on a process that's not even a child is also a problem: kqueue will | |
801 // work in that case, but waitpid won't, and killing a non-child might not be | |
802 // the best approach. | |
803 void WaitForChildToDie(pid_t child, int timeout) { | |
804 DCHECK(child > 0); | |
805 DCHECK(timeout > 0); | |
806 | |
807 // DON'T ADD ANY EARLY RETURNS TO THIS FUNCTION without ensuring that | |
808 // |child| has been reaped. Specifically, even if a kqueue, kevent, or other | |
809 // call fails, this function should fall back to the last resort of trying | |
810 // to kill and reap the process. Not observing this rule will resurrect | |
811 // zombies. | |
812 | |
813 int result; | |
814 | |
815 int kq = HANDLE_EINTR(kqueue()); | |
816 if (kq == -1) { | |
817 DPLOG(ERROR) << "kqueue()"; | |
818 } else { | |
819 file_util::ScopedFD auto_close_kq(&kq); | |
820 | |
821 struct kevent change = {0}; | |
822 EV_SET(&change, child, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL); | |
823 result = HANDLE_EINTR(kevent(kq, &change, 1, NULL, 0, NULL)); | |
824 | |
825 if (result == -1) { | |
826 if (errno != ESRCH) { | |
827 DPLOG(ERROR) << "kevent (setup " << child << ")"; | |
828 } else { | |
829 // At this point, one of the following has occurred: | |
830 // 1. The process has died but has not yet been reaped. | |
831 // 2. The process has died and has already been reaped. | |
832 // 3. The process is in the process of dying. It's no longer | |
833 // kqueueable, but it may not be waitable yet either. Mark calls | |
834 // this case the "zombie death race". | |
835 | |
836 result = HANDLE_EINTR(waitpid(child, NULL, WNOHANG)); | |
837 | |
838 if (result != 0) { | |
839 // A positive result indicates case 1. waitpid succeeded and reaped | |
840 // the child. A result of -1 indicates case 2. The child has already | |
841 // been reaped. In both of these cases, no further action is | |
842 // necessary. | |
843 return; | |
844 } | |
845 | |
846 // |result| is 0, indicating case 3. The process will be waitable in | |
847 // short order. Fall back out of the kqueue code to kill it (for good | |
848 // measure) and reap it. | |
849 } | |
850 } else { | |
851 // Keep track of the elapsed time to be able to restart kevent if it's | |
852 // interrupted. | |
853 TimeDelta remaining_delta = TimeDelta::FromSeconds(timeout); | |
854 TimeTicks deadline = TimeTicks::Now() + remaining_delta; | |
855 result = -1; | |
856 struct kevent event = {0}; | |
857 while (remaining_delta.InMilliseconds() > 0) { | |
858 const struct timespec remaining_timespec = remaining_delta.ToTimeSpec(); | |
859 result = kevent(kq, NULL, 0, &event, 1, &remaining_timespec); | |
860 if (result == -1 && errno == EINTR) { | |
861 remaining_delta = deadline - TimeTicks::Now(); | |
862 result = 0; | |
863 } else { | |
864 break; | |
865 } | |
866 } | |
867 | |
868 if (result == -1) { | |
869 DPLOG(ERROR) << "kevent (wait " << child << ")"; | |
870 } else if (result > 1) { | |
871 DLOG(ERROR) << "kevent (wait " << child << "): unexpected result " | |
872 << result; | |
873 } else if (result == 1) { | |
874 if ((event.fflags & NOTE_EXIT) && | |
875 (event.ident == static_cast<uintptr_t>(child))) { | |
876 // The process is dead or dying. This won't block for long, if at | |
877 // all. | |
878 BlockingReap(child); | |
879 return; | |
880 } else { | |
881 DLOG(ERROR) << "kevent (wait " << child | |
882 << "): unexpected event: fflags=" << event.fflags | |
883 << ", ident=" << event.ident; | |
884 } | |
885 } | |
886 } | |
887 } | |
888 | |
889 // The child is still alive, or is very freshly dead. Be sure by sending it | |
890 // a signal. This is safe even if it's freshly dead, because it will be a | |
891 // zombie (or on the way to zombiedom) and kill will return 0 even if the | |
892 // signal is not delivered to a live process. | |
893 result = kill(child, SIGKILL); | |
894 if (result == -1) { | |
895 DPLOG(ERROR) << "kill(" << child << ", SIGKILL)"; | |
896 } else { | |
897 // The child is definitely on the way out now. BlockingReap won't need to | |
898 // wait for long, if at all. | |
899 BlockingReap(child); | |
900 } | |
901 } | |
902 | |
903 } // namespace | |
904 | |
905 void EnsureProcessTerminated(ProcessHandle process) { | |
906 WaitForChildToDie(process, kWaitBeforeKillSeconds); | |
907 } | |
908 | |
909 } // namespace base | 704 } // namespace base |
OLD | NEW |