Update ReadProcMaps() to reflect lack of atomicity when reading /proc/self/maps.

base/debug/proc_maps_linux.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/debug/proc_maps_linux.h"
 
+#include <fcntl.h>
+
 #if defined(OS_LINUX)
 #include <inttypes.h>
 #endif
 
 #include "base/file_util.h"
 #include "base/strings/string_split.h"
 
 #if defined(OS_ANDROID)
 // Bionic's inttypes.h defines PRI/SCNxPTR as an unsigned long int, which
 // is incompatible with Bionic's stdint.h defining uintptr_t as a unsigned int:
 // https://code.google.com/p/android/issues/detail?id=57218
 #undef SCNxPTR
 #define SCNxPTR "x"
 #endif
 
 namespace base {
 namespace debug {
 
+// Scans |proc_maps| starting from |pos| returning true if the gate VMA was
+// found, otherwise returns false.
+static bool ContainsGateVMA(std::string* proc_maps, size_t pos) {
+#if defined(ARCH_CPU_ARM_FAMILY)
+  // The gate VMA on ARM kernels is the interrupt vectors page.
+  return proc_maps->find("[vectors]", pos) != std::string::npos;
+#elif defined(ARCH_CPU_X86_64)
+  // The gate VMA on x86 64-bit kernels is the virtual system call page.
+  return proc_maps->find("[vsyscall]", pos) != std::string::npos;
+#else
+  // Otherwise assume there is no gate VMA and that we won't hit the kernel bug.
+  return false;
+#endif
+}
+
 bool ReadProcMaps(std::string* proc_maps) {
-  FilePath proc_maps_path("/proc/self/maps");
-  return file_util::ReadFileToString(proc_maps_path, proc_maps);
+  // There's no point calling read() on procfs with a large buffer as seq_file
+  // only writes out a page-sized amount of data each call.
+  //
+  // Unfortunately this means we are unable to atomically read the entire
+  // contents of /proc/self/maps in a single read().
+  const long kBufferSize = sysconf(_SC_PAGESIZE);
+  scoped_ptr<char[]> buffer(new char[kBufferSize]);
+
+  int fd = HANDLE_EINTR(open("/proc/self/maps", O_RDONLY));
+  if (fd == -1) {
+    DPLOG(ERROR) << "Couldn't open /proc/self/maps";
+    return false;
+  }
+  file_util::ScopedFD fd_closer(&fd);
+
+  while (true) {
+    ssize_t bytes_read = HANDLE_EINTR(read(fd, buffer.get(), kBufferSize));

[Alexander Potapenko, 2013/07/15 08:17:19]

I wonder what should we do in the case the last line is split into two halves.
In general the subsequent read() call isn't guaranteed to contain the other
half.

[scherkus (not reviewing), 2013/07/15 17:46:55]

seq_file protects against that by only allowing whole entries to be copied to
usermode at a time:
http://lxr.linux.no/linux+v2.6.37/fs/seq_file.c#L224

(check out lines 234-235 -- basically if the result of calling show() fills up
the entire seq_file internal buffer, it resets m->count and breaks out of the
loop)

+    if (bytes_read < 0) {
+      DPLOG(ERROR) << "Couldn't read /proc/self/maps";
+      return false;
+    }
+
+    if (bytes_read == 0)
+      break;
+
+    // Use 2-arg version of append() as |buffer| *is not* NUL-terminated. This
+    // also avoids an unnecessary length computation.
+    size_t pos = proc_maps->size();
+    proc_maps->append(buffer.get(), bytes_read);
+
+    // Break early if we find the gate VMA.
+    //
+    // Otherwise we risk running into a kernel bug where if additional virtual
+    // memory table entries are added before the next call to read(), we will
+    // duplicate the last few entries including the gate VMA.
+    if (ContainsGateVMA(proc_maps, pos))
+      break;
+  }
+
+  return true;
 }
 
 bool ParseProcMaps(const std::string& input,
                    std::vector<MappedMemoryRegion>* regions_out) {
   std::vector<MappedMemoryRegion> regions;
 
   // This isn't async safe nor terribly efficient, but it doesn't need to be at
   // this point in time.
   std::vector<std::string> lines;
   SplitString(input, '\n', &lines);
@@ skipping 54 matching lines @@
     regions.push_back(region);
     regions.back().path.assign(line + path_index);
   }
 
   regions_out->swap(regions);
   return true;
 }
 
 }  // namespace debug
 }  // namespace base