Update ReadProcMaps() to reflect lack of atomicity when reading /proc/self/maps.

base/debug/proc_maps_linux.cc

Index: base/debug/proc_maps_linux.cc
diff --git a/base/debug/proc_maps_linux.cc b/base/debug/proc_maps_linux.cc
index 9557feb025994b1e88763b3c52f855127eaeda81..64aad733422735d0fbc69fd680410a9d6f0b1c9e 100644
--- a/base/debug/proc_maps_linux.cc
+++ b/base/debug/proc_maps_linux.cc
@@ -4,6 +4,8 @@
 
 #include "base/debug/proc_maps_linux.h"
 
+#include <fcntl.h>
+
 #if defined(OS_LINUX)
 #include <inttypes.h>
 #endif
@@ -22,9 +24,62 @@
 namespace base {
 namespace debug {
 
+// Scans |proc_maps| starting from |pos| returning true if the gate VMA was
+// found, otherwise returns false.
+static bool ContainsGateVMA(std::string* proc_maps, size_t pos) {
+#if defined(ARCH_CPU_ARM_FAMILY)
+  // The gate VMA on ARM kernels is the interrupt vectors page.
+  return proc_maps->find("[vectors]", pos) != std::string::npos;
+#elif defined(ARCH_CPU_X86_64)
+  // The gate VMA on x86 64-bit kernels is the virtual system call page.
+  return proc_maps->find("[vsyscall]", pos) != std::string::npos;
+#else
+  // Otherwise assume there is no gate VMA and that we won't hit the kernel bug.
+  return false;
+#endif
+}
+
 bool ReadProcMaps(std::string* proc_maps) {
-  FilePath proc_maps_path("/proc/self/maps");
-  return file_util::ReadFileToString(proc_maps_path, proc_maps);
+  // There's no point calling read() on procfs with a large buffer as seq_file
+  // only writes out a page-sized amount of data each call.
+  //
+  // Unfortunately this means we are unable to atomically read the entire
+  // contents of /proc/self/maps in a single read().
+  const long kBufferSize = sysconf(_SC_PAGESIZE);
+  scoped_ptr<char[]> buffer(new char[kBufferSize]);
+
+  int fd = HANDLE_EINTR(open("/proc/self/maps", O_RDONLY));
+  if (fd == -1) {
+    DPLOG(ERROR) << "Couldn't open /proc/self/maps";
+    return false;
+  }
+  file_util::ScopedFD fd_closer(&fd);
+
+  while (true) {
+    ssize_t bytes_read = HANDLE_EINTR(read(fd, buffer.get(), kBufferSize));

[Alexander Potapenko, 2013/07/15 08:17:19]

I wonder what should we do in the case the last line is split into two halves.
In general the subsequent read() call isn't guaranteed to contain the other
half.

[scherkus (not reviewing), 2013/07/15 17:46:55]

seq_file protects against that by only allowing whole entries to be copied to
usermode at a time:
http://lxr.linux.no/linux+v2.6.37/fs/seq_file.c#L224

(check out lines 234-235 -- basically if the result of calling show() fills up
the entire seq_file internal buffer, it resets m->count and breaks out of the
loop)

+    if (bytes_read < 0) {
+      DPLOG(ERROR) << "Couldn't read /proc/self/maps";
+      return false;
+    }
+
+    if (bytes_read == 0)
+      break;
+
+    // Use 2-arg version of append() as |buffer| *is not* NUL-terminated. This
+    // also avoids an unnecessary length computation.
+    size_t pos = proc_maps->size();
+    proc_maps->append(buffer.get(), bytes_read);
+
+    // Break early if we find the gate VMA.
+    //
+    // Otherwise we risk running into a kernel bug where if additional virtual
+    // memory table entries are added before the next call to read(), we will
+    // duplicate the last few entries including the gate VMA.
+    if (ContainsGateVMA(proc_maps, pos))
+      break;
+  }
+
+  return true;
 }
 
 bool ParseProcMaps(const std::string& input,