Revert 270173 "Remove SCM_CREDENTIALS fallback code from breakpad"

trunk/src/components/breakpad/browser/crash_handler_host_linux.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/breakpad/browser/crash_handler_host_linux.h"
 
 #include <stdint.h>
 #include <stdlib.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
@@ skipping 201 matching lines @@
     LOG(ERROR) << "Received death signal message with the wrong size;"
                << " msg.msg_controllen:" << msg.msg_controllen
                << " msg.msg_flags:" << msg.msg_flags
                << " kCrashContextSize:" << kCrashContextSize
                << " kControlMsgSize:" << kControlMsgSize;
     return;
   }
 
   // Walk the control payload an extract the file descriptor and validated pid.
   pid_t crashing_pid = -1;
+  int partner_fd = -1;
   int signal_fd = -1;
   for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr;
        hdr = CMSG_NXTHDR(&msg, hdr)) {
     if (hdr->cmsg_level != SOL_SOCKET)
       continue;
     if (hdr->cmsg_type == SCM_RIGHTS) {
       const unsigned len = hdr->cmsg_len -
           (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr);
       DCHECK_EQ(len % sizeof(int), 0u);
       const unsigned num_fds = len / sizeof(int);
-      if (num_fds != 1) {
+      if (num_fds != 2) {
         // A nasty process could try and send us too many descriptors and
         // force a leak.
         LOG(ERROR) << "Death signal contained wrong number of descriptors;"
                    << " num_fds:" << num_fds;
         for (unsigned i = 0; i < num_fds; ++i)
           close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]);
         return;
       } else {
-        signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
+        partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
+        signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1];
       }
     } else if (hdr->cmsg_type == SCM_CREDENTIALS) {
       const struct ucred *cred =
           reinterpret_cast<struct ucred*>(CMSG_DATA(hdr));
       crashing_pid = cred->pid;
     }
   }
 
-  if (crashing_pid == -1 || signal_fd == -1) {
+  if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) {
     LOG(ERROR) << "Death signal message didn't contain all expected control"
                << " messages";
+    if (partner_fd >= 0)
+      close(partner_fd);
     if (signal_fd >= 0)
       close(signal_fd);
     return;
   }
 
+  // Kernel bug workaround (broken in 2.6.30 and 2.6.32, working in 2.6.38).
+  // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID
+  // namespaces. Thus |crashing_pid| might be garbage from our point of view.
+  // In the future we can remove this workaround, but we have to wait a couple
+  // of years to be sure that it's worked its way out into the world.
+  // TODO(thestig) Remove the workaround when Ubuntu Lucid is deprecated.
+
+  // The crashing process closes its copy of the signal_fd immediately after
+  // calling sendmsg(). We can thus not reliably look for with with
+  // FindProcessHoldingSocket(). But by necessity, it has to keep the
+  // partner_fd open until the crashdump is complete.
+  ino_t inode_number;
+  if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) {
+    LOG(WARNING) << "Failed to get inode number for passed socket";
+    close(partner_fd);
+    close(signal_fd);
+    return;
+  }
+  close(partner_fd);
+
+  pid_t actual_crashing_pid = -1;
+  if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) {
+    LOG(WARNING) << "Failed to find process holding other end of crash reply "
+                    "socket";
+    close(signal_fd);
+    return;
+  }
+
+  crashing_pid = actual_crashing_pid;
+
   // The crashing TID set inside the compromised context via
   // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if
   // the kernel supports PID namespacing) and may need to be
   // translated.
   //
   // We expect the crashing thread to be in sys_read(), waiting for us to
   // write to |signal_fd|. Most newer kernels where we have the different pid
   // namespaces also have /proc/[pid]/syscall, so we can look through
   // |actual_crashing_pid|'s thread group and find the thread that's in the
   // read syscall with the right arguments.
@@ skipping 154 matching lines @@
   // no-ops.
   shutting_down_ = true;
   uploader_thread_->Stop();
 }
 
 bool CrashHandlerHostLinux::IsShuttingDown() const {
   return shutting_down_;
 }
 
 }  // namespace breakpad