Change UnixDomainSocket::RecvMsg to return ScopedVector<base::ScopedFD>

components/nacl/loader/nacl_helper_linux.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // A mini-zygote specifically for Native Client.
 
 #include "components/nacl/loader/nacl_helper_linux.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <link.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 
 #include <string>
 #include <vector>
 
 #include "base/at_exit.h"
 #include "base/command_line.h"
+#include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/scoped_vector.h"
 #include "base/message_loop/message_loop.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/posix/global_descriptors.h"
 #include "base/posix/unix_domain_socket_linux.h"
 #include "base/process/kill.h"
 #include "base/process/process_handle.h"
 #include "base/rand_util.h"
 #include "components/nacl/common/nacl_switches.h"
 #include "components/nacl/loader/nacl_listener.h"
 #include "components/nacl/loader/nacl_sandbox_linux.h"
@@ skipping 85 matching lines @@
   int pipefd[2];
   PCHECK(0 == pipe(pipefd));
   PCHECK(-1 != dup2(pipefd[0], file_descriptor));
   PCHECK(0 == IGNORE_EINTR(close(pipefd[0])));
   PCHECK(0 == IGNORE_EINTR(close(pipefd[1])));
 }
 
 // The child must mimic the behavior of zygote_main_linux.cc on the child
 // side of the fork. See zygote_main_linux.cc:HandleForkRequest from
 //   if (!child) {
-void BecomeNaClLoader(const std::vector<int>& child_fds,
+void BecomeNaClLoader(base::ScopedFD browser_fd,
                       const NaClLoaderSystemInfo& system_info,
                       bool uses_nonsfi_mode) {
   VLOG(1) << "NaCl loader: setting up IPC descriptor";
   // Close or shutdown IPC channels that we don't need anymore.
   PCHECK(0 == IGNORE_EINTR(close(kNaClZygoteDescriptor)));
   // In Non-SFI mode, it's important to close any non-expected IPC channels.
   if (uses_nonsfi_mode) {
     // The low-level kSandboxIPCChannel is used by renderers and NaCl for
     // various operations. See the LinuxSandbox::METHOD_* methods. NaCl uses
     // LinuxSandbox::METHOD_MAKE_SHARED_MEMORY_SEGMENT in SFI mode, so this
     // should only be closed in Non-SFI mode.
     // This file descriptor is insidiously used by a number of APIs. Closing it
     // could lead to difficult to debug issues. Instead of closing it, replace
     // it with a dummy.
     const int sandbox_ipc_channel =
         base::GlobalDescriptors::kBaseDescriptor + kSandboxIPCChannel;
 
     ReplaceFDWithDummy(sandbox_ipc_channel);
   }
 
   InitializeLayerTwoSandbox(uses_nonsfi_mode);
-  base::GlobalDescriptors::GetInstance()->Set(
-      kPrimaryIPCChannel,
-      child_fds[content::ZygoteForkDelegate::kBrowserFDIndex]);
+  base::GlobalDescriptors::GetInstance()->Set(kPrimaryIPCChannel,
+                                              browser_fd.release());
 
   base::MessageLoopForIO main_message_loop;
   NaClListener listener;
   listener.set_uses_nonsfi_mode(uses_nonsfi_mode);
   listener.set_prereserved_sandbox_size(system_info.prereserved_sandbox_size);
   listener.set_number_of_cores(system_info.number_of_cores);
   listener.Listen();
   _exit(0);
 }
 
 // Start the NaCl loader in a child created by the NaCl loader Zygote.
-void ChildNaClLoaderInit(const std::vector<int>& child_fds,
+void ChildNaClLoaderInit(ScopedVector<base::ScopedFD> child_fds,
                          const NaClLoaderSystemInfo& system_info,
                          bool uses_nonsfi_mode,
                          const std::string& channel_id) {
-  const int parent_fd = child_fds[content::ZygoteForkDelegate::kParentFDIndex];
-  const int dummy_fd = child_fds[content::ZygoteForkDelegate::kDummyFDIndex];
-
   bool validack = false;
   base::ProcessId real_pid;
   // Wait until the parent process has discovered our PID.  We
   // should not fork any child processes (which the seccomp
   // sandbox does) until then, because that can interfere with the
   // parent's discovery of our PID.
-  const ssize_t nread =
-      HANDLE_EINTR(read(parent_fd, &real_pid, sizeof(real_pid)));
+  const ssize_t nread = HANDLE_EINTR(
+      read(child_fds[content::ZygoteForkDelegate::kParentFDIndex]->get(),
+           &real_pid,
+           sizeof(real_pid)));
   if (static_cast<size_t>(nread) == sizeof(real_pid)) {
     // Make sure the parent didn't accidentally send us our real PID.
     // We don't want it to be discoverable anywhere in our address space
     // when we start running untrusted code.
     CHECK(real_pid == 0);
 
     CommandLine::ForCurrentProcess()->AppendSwitchASCII(
         switches::kProcessChannelID, channel_id);
     validack = true;
   } else {
     if (nread < 0)
       perror("read");
     LOG(ERROR) << "read returned " << nread;
   }
 

[jln (very slow on Chromium), 2014/04/28 23:48:55]

We can't rely on the ScopedVector to release
child_fds[content::ZygoteForkDelegate::kDummyFDIndex] as this function will
never return.

More importantly, this is also true for kParentFDIndex.

Please reset() these FDs explicitly.

[mdempsky, 2014/04/29 00:10:33]

As we discussed and you pointed out below, child_fds.clear() already frees the
other descriptors.

-  if (IGNORE_EINTR(close(dummy_fd)) != 0)
-    LOG(ERROR) << "close(dummy_fd) failed";
-  if (IGNORE_EINTR(close(parent_fd)) != 0)
-    LOG(ERROR) << "close(parent_fd) failed";
+  base::ScopedFD browser_fd(
+      child_fds[content::ZygoteForkDelegate::kBrowserFDIndex]->Pass());
+  child_fds.clear();

[jln (very slow on Chromium), 2014/04/28 23:57:19]

I had missed this one, so there is no leak.

+
   if (validack) {
-    BecomeNaClLoader(child_fds, system_info, uses_nonsfi_mode);
+    BecomeNaClLoader(browser_fd.Pass(), system_info, uses_nonsfi_mode);
   } else {
     LOG(ERROR) << "Failed to synch with zygote";
   }
   _exit(1);
 }
 
 // Handle a fork request from the Zygote.
 // Some of this code was lifted from
 // content/browser/zygote_main_linux.cc:ForkWithRealPid()
-bool HandleForkRequest(const std::vector<int>& child_fds,
+bool HandleForkRequest(ScopedVector<base::ScopedFD> child_fds,
                        const NaClLoaderSystemInfo& system_info,
                        PickleIterator* input_iter,
                        Pickle* output_pickle) {
   bool uses_nonsfi_mode;
   if (!input_iter->ReadBool(&uses_nonsfi_mode)) {
     LOG(ERROR) << "Could not read uses_nonsfi_mode status";
     return false;
   }
 
   std::string channel_id;
   if (!input_iter->ReadString(&channel_id)) {
     LOG(ERROR) << "Could not read channel_id string";
     return false;
   }
 
   if (content::ZygoteForkDelegate::kNumPassedFDs != child_fds.size()) {
     LOG(ERROR) << "nacl_helper: unexpected number of fds, got "
         << child_fds.size();
     return false;
   }
 
   VLOG(1) << "nacl_helper: forking";
   pid_t child_pid = fork();
   if (child_pid < 0) {
     PLOG(ERROR) << "*** fork() failed.";
   }
 
   if (child_pid == 0) {
-    ChildNaClLoaderInit(child_fds, system_info, uses_nonsfi_mode, channel_id);
+    ChildNaClLoaderInit(
+        child_fds.Pass(), system_info, uses_nonsfi_mode, channel_id);
     NOTREACHED();
   }
 
   // I am the parent.
   // First, close the dummy_fd so the sandbox won't find me when
   // looking for the child's pid in /proc. Also close other fds.
-  for (size_t i = 0; i < child_fds.size(); i++) {
-    if (IGNORE_EINTR(close(child_fds[i])) != 0)
-      LOG(ERROR) << "close(child_fds[i]) failed";
-  }
+  child_fds.clear();
   VLOG(1) << "nacl_helper: child_pid is " << child_pid;
 
   // Now send child_pid (eventually -1 if fork failed) to the Chrome Zygote.
   output_pickle->WriteInt(child_pid);
   return true;
 }
 
 bool HandleGetTerminationStatusRequest(PickleIterator* input_iter,
                                        Pickle* output_pickle) {
   pid_t child_to_wait;
@@ skipping 22 matching lines @@
   output_pickle->WriteInt(exit_code);
   return true;
 }
 
 // Honor a command |command_type|. Eventual command parameters are
 // available in |input_iter| and eventual file descriptors attached to
 // the command are in |attached_fds|.
 // Reply to the command on |reply_fds|.
 bool HonorRequestAndReply(int reply_fd,
                           int command_type,
-                          const std::vector<int>& attached_fds,
+                          ScopedVector<base::ScopedFD> attached_fds,
                           const NaClLoaderSystemInfo& system_info,
                           PickleIterator* input_iter) {
   Pickle write_pickle;
   bool have_to_reply = false;
   // Commands must write anything to send back to |write_pickle|.
   switch (command_type) {
     case nacl::kNaClForkRequest:
-      have_to_reply = HandleForkRequest(attached_fds, system_info,
-                                        input_iter, &write_pickle);
+      have_to_reply = HandleForkRequest(
+          attached_fds.Pass(), system_info, input_iter, &write_pickle);
       break;
     case nacl::kNaClGetTerminationStatusRequest:
       have_to_reply =
           HandleGetTerminationStatusRequest(input_iter, &write_pickle);
       break;
     default:
       LOG(ERROR) << "Unsupported command from Zygote";
       return false;
   }
   if (!have_to_reply)
     return false;
   const std::vector<int> empty;  // We never send file descriptors back.
   if (!UnixDomainSocket::SendMsg(reply_fd, write_pickle.data(),
                                  write_pickle.size(), empty)) {
     LOG(ERROR) << "*** send() to zygote failed";
     return false;
   }
   return true;
 }
 
 // Read a request from the Zygote from |zygote_ipc_fd| and handle it.
 // Die on EOF from |zygote_ipc_fd|.
 bool HandleZygoteRequest(int zygote_ipc_fd,
                          const NaClLoaderSystemInfo& system_info) {
-  std::vector<int> fds;
+  ScopedVector<base::ScopedFD> fds;
   char buf[kNaClMaxIPCMessageLength];
   const ssize_t msglen = UnixDomainSocket::RecvMsg(zygote_ipc_fd,
       &buf, sizeof(buf), &fds);
   // If the Zygote has started handling requests, we should be sandboxed via
   // the setuid sandbox.
   if (!IsSandboxed()) {
     LOG(ERROR) << "NaCl helper process running without a sandbox!\n"
       << "Most likely you need to configure your SUID sandbox "
       << "correctly";
   }
   if (msglen == 0 || (msglen == -1 && errno == ECONNRESET)) {
     // EOF from the browser. Goodbye!
     _exit(0);
   }
   if (msglen < 0) {
     PLOG(ERROR) << "nacl_helper: receive from zygote failed";
     return false;
   }
 
   Pickle read_pickle(buf, msglen);
   PickleIterator read_iter(read_pickle);
   int command_type;
   if (!read_iter.ReadInt(&command_type)) {
     LOG(ERROR) << "Unable to read command from Zygote";
     return false;
   }
-  return HonorRequestAndReply(zygote_ipc_fd, command_type, fds, system_info,
-                              &read_iter);
+  return HonorRequestAndReply(
+      zygote_ipc_fd, command_type, fds.Pass(), system_info, &read_iter);
 }
 
 static const char kNaClHelperReservedAtZero[] = "reserved_at_zero";
 static const char kNaClHelperRDebug[] = "r_debug";
 
 // Since we were started by nacl_helper_bootstrap rather than in the
 // usual way, the debugger cannot figure out where our executable
 // or the dynamic linker or the shared libraries are in memory,
 // so it won't find any symbols.  But we can fake it out to find us.
 //
@@ skipping 122 matching lines @@
   // Now handle requests from the Zygote.
   while (true) {
     bool request_handled = HandleZygoteRequest(kNaClZygoteDescriptor,
                                                system_info);
     // Do not turn this into a CHECK() without thinking about robustness
     // against malicious IPC requests.
     DCHECK(request_handled);
   }
   NOTREACHED();
 }