| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "chrome/browser/crash_handler_host_linux.h" | |
| 6 | |
| 7 #include <stdint.h> | |
| 8 #include <stdlib.h> | |
| 9 #include <sys/socket.h> | |
| 10 #include <sys/syscall.h> | |
| 11 #include <unistd.h> | |
| 12 | |
| 13 #include "base/bind.h" | |
| 14 #include "base/bind_helpers.h" | |
| 15 #include "base/files/file_path.h" | |
| 16 #include "base/format_macros.h" | |
| 17 #include "base/linux_util.h" | |
| 18 #include "base/logging.h" | |
| 19 #include "base/memory/singleton.h" | |
| 20 #include "base/message_loop/message_loop.h" | |
| 21 #include "base/path_service.h" | |
| 22 #include "base/posix/eintr_wrapper.h" | |
| 23 #include "base/rand_util.h" | |
| 24 #include "base/strings/string_util.h" | |
| 25 #include "base/strings/stringprintf.h" | |
| 26 #include "base/threading/thread.h" | |
| 27 #include "breakpad/src/client/linux/handler/exception_handler.h" | |
| 28 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h" | |
| 29 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h" | |
| 30 #include "chrome/app/breakpad_linux_impl.h" | |
| 31 #include "content/public/browser/browser_thread.h" | |
| 32 | |
| 33 #if defined(OS_ANDROID) | |
| 34 #include <sys/linux-syscalls.h> | |
| 35 | |
| 36 #define SYS_read __NR_read | |
| 37 #endif | |
| 38 | |
| 39 using content::BrowserThread; | |
| 40 using google_breakpad::ExceptionHandler; | |
| 41 | |
| 42 namespace { | |
| 43 | |
| 44 // The length of the control message: | |
| 45 const unsigned kControlMsgSize = | |
| 46 CMSG_SPACE(2*sizeof(int)) + CMSG_SPACE(sizeof(struct ucred)); | |
| 47 // The length of the regular payload: | |
| 48 const unsigned kCrashContextSize = sizeof(ExceptionHandler::CrashContext); | |
| 49 | |
| 50 // Handles the crash dump and frees the allocated BreakpadInfo struct. | |
| 51 void CrashDumpTask(CrashHandlerHostLinux* handler, BreakpadInfo* info) { | |
| 52 if (handler->IsShuttingDown()) | |
| 53 return; | |
| 54 | |
| 55 HandleCrashDump(*info); | |
| 56 delete[] info->filename; | |
| 57 delete[] info->process_type; | |
| 58 delete[] info->distro; | |
| 59 delete info->crash_keys; | |
| 60 delete info; | |
| 61 } | |
| 62 | |
| 63 } // namespace | |
| 64 | |
| 65 // Since instances of CrashHandlerHostLinux are leaked, they are only destroyed | |
| 66 // at the end of the processes lifetime, which is greater in span than the | |
| 67 // lifetime of the IO message loop. Thus, all calls to base::Bind() use | |
| 68 // non-refcounted pointers. | |
| 69 | |
| 70 CrashHandlerHostLinux::CrashHandlerHostLinux(const std::string& process_type, | |
| 71 const base::FilePath& dumps_path, | |
| 72 bool upload) | |
| 73 : process_type_(process_type), | |
| 74 dumps_path_(dumps_path), | |
| 75 upload_(upload), | |
| 76 shutting_down_(false), | |
| 77 worker_pool_token_(BrowserThread::GetBlockingPool()->GetSequenceToken()) { | |
| 78 int fds[2]; | |
| 79 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from | |
| 80 // sending datagrams to other sockets on the system. The sandbox may prevent | |
| 81 // the process from calling socket() to create new sockets, but it'll still | |
| 82 // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send | |
| 83 // a datagram to any (abstract) socket on the same system. With | |
| 84 // SOCK_SEQPACKET, this is prevented. | |
| 85 CHECK_EQ(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds), 0); | |
| 86 static const int on = 1; | |
| 87 | |
| 88 // Enable passcred on the server end of the socket | |
| 89 CHECK_EQ(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)), 0); | |
| 90 | |
| 91 process_socket_ = fds[0]; | |
| 92 browser_socket_ = fds[1]; | |
| 93 | |
| 94 BrowserThread::PostTask( | |
| 95 BrowserThread::IO, FROM_HERE, | |
| 96 base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this))); | |
| 97 } | |
| 98 | |
| 99 CrashHandlerHostLinux::~CrashHandlerHostLinux() { | |
| 100 (void) HANDLE_EINTR(close(process_socket_)); | |
| 101 (void) HANDLE_EINTR(close(browser_socket_)); | |
| 102 } | |
| 103 | |
| 104 void CrashHandlerHostLinux::StartUploaderThread() { | |
| 105 uploader_thread_.reset( | |
| 106 new base::Thread(std::string(process_type_ + "_crash_uploader").c_str())); | |
| 107 uploader_thread_->Start(); | |
| 108 } | |
| 109 | |
| 110 void CrashHandlerHostLinux::Init() { | |
| 111 base::MessageLoopForIO* ml = base::MessageLoopForIO::current(); | |
| 112 CHECK(ml->WatchFileDescriptor( | |
| 113 browser_socket_, true /* persistent */, | |
| 114 base::MessageLoopForIO::WATCH_READ, | |
| 115 &file_descriptor_watcher_, this)); | |
| 116 ml->AddDestructionObserver(this); | |
| 117 } | |
| 118 | |
| 119 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) { | |
| 120 NOTREACHED(); | |
| 121 } | |
| 122 | |
| 123 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) { | |
| 124 DCHECK_EQ(fd, browser_socket_); | |
| 125 | |
| 126 // A process has crashed and has signaled us by writing a datagram | |
| 127 // to the death signal socket. The datagram contains the crash context needed | |
| 128 // for writing the minidump as well as a file descriptor and a credentials | |
| 129 // block so that they can't lie about their pid. | |
| 130 // | |
| 131 // The message sender is in chrome/app/breakpad_linux.cc. | |
| 132 | |
| 133 struct msghdr msg = {0}; | |
| 134 struct iovec iov[kCrashIovSize]; | |
| 135 | |
| 136 // Freed in WriteDumpFile(); | |
| 137 char* crash_context = new char[kCrashContextSize]; | |
| 138 // Freed in CrashDumpTask(); | |
| 139 char* distro = new char[kDistroSize + 1]; | |
| 140 #if defined(ADDRESS_SANITIZER) | |
| 141 asan_report_str_ = new char[kMaxAsanReportSize + 1]; | |
| 142 #endif | |
| 143 | |
| 144 // Freed in CrashDumpTask(). | |
| 145 CrashKeyStorage* crash_keys = new CrashKeyStorage; | |
| 146 google_breakpad::SerializedNonAllocatingMap* serialized_crash_keys; | |
| 147 size_t crash_keys_size = crash_keys->Serialize( | |
| 148 const_cast<const google_breakpad::SerializedNonAllocatingMap**>( | |
| 149 &serialized_crash_keys)); | |
| 150 | |
| 151 char* tid_buf_addr = NULL; | |
| 152 int tid_fd = -1; | |
| 153 uint64_t uptime; | |
| 154 size_t oom_size; | |
| 155 char control[kControlMsgSize]; | |
| 156 const ssize_t expected_msg_size = | |
| 157 kCrashContextSize + | |
| 158 kDistroSize + 1 + | |
| 159 sizeof(tid_buf_addr) + sizeof(tid_fd) + | |
| 160 sizeof(uptime) + | |
| 161 #if defined(ADDRESS_SANITIZER) | |
| 162 kMaxAsanReportSize + 1 + | |
| 163 #endif | |
| 164 sizeof(oom_size) + | |
| 165 crash_keys_size; | |
| 166 iov[0].iov_base = crash_context; | |
| 167 iov[0].iov_len = kCrashContextSize; | |
| 168 iov[1].iov_base = distro; | |
| 169 iov[1].iov_len = kDistroSize + 1; | |
| 170 iov[2].iov_base = &tid_buf_addr; | |
| 171 iov[2].iov_len = sizeof(tid_buf_addr); | |
| 172 iov[3].iov_base = &tid_fd; | |
| 173 iov[3].iov_len = sizeof(tid_fd); | |
| 174 iov[4].iov_base = &uptime; | |
| 175 iov[4].iov_len = sizeof(uptime); | |
| 176 iov[5].iov_base = &oom_size; | |
| 177 iov[5].iov_len = sizeof(oom_size); | |
| 178 iov[6].iov_base = serialized_crash_keys; | |
| 179 iov[6].iov_len = crash_keys_size; | |
| 180 #if defined(ADDRESS_SANITIZER) | |
| 181 iov[7].iov_base = asan_report_str_; | |
| 182 iov[7].iov_len = kMaxAsanReportSize + 1; | |
| 183 #endif | |
| 184 msg.msg_iov = iov; | |
| 185 msg.msg_iovlen = kCrashIovSize; | |
| 186 msg.msg_control = control; | |
| 187 msg.msg_controllen = kControlMsgSize; | |
| 188 | |
| 189 const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0)); | |
| 190 if (msg_size != expected_msg_size) { | |
| 191 LOG(ERROR) << "Error reading from death signal socket. Crash dumping" | |
| 192 << " is disabled." | |
| 193 << " msg_size:" << msg_size | |
| 194 << " errno:" << errno; | |
| 195 file_descriptor_watcher_.StopWatchingFileDescriptor(); | |
| 196 return; | |
| 197 } | |
| 198 | |
| 199 if (msg.msg_controllen != kControlMsgSize || | |
| 200 msg.msg_flags & ~MSG_TRUNC) { | |
| 201 LOG(ERROR) << "Received death signal message with the wrong size;" | |
| 202 << " msg.msg_controllen:" << msg.msg_controllen | |
| 203 << " msg.msg_flags:" << msg.msg_flags | |
| 204 << " kCrashContextSize:" << kCrashContextSize | |
| 205 << " kControlMsgSize:" << kControlMsgSize; | |
| 206 return; | |
| 207 } | |
| 208 | |
| 209 // Walk the control payload an extract the file descriptor and validated pid. | |
| 210 pid_t crashing_pid = -1; | |
| 211 int partner_fd = -1; | |
| 212 int signal_fd = -1; | |
| 213 for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr; | |
| 214 hdr = CMSG_NXTHDR(&msg, hdr)) { | |
| 215 if (hdr->cmsg_level != SOL_SOCKET) | |
| 216 continue; | |
| 217 if (hdr->cmsg_type == SCM_RIGHTS) { | |
| 218 const unsigned len = hdr->cmsg_len - | |
| 219 (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr); | |
| 220 DCHECK_EQ(len % sizeof(int), 0u); | |
| 221 const unsigned num_fds = len / sizeof(int); | |
| 222 if (num_fds != 2) { | |
| 223 // A nasty process could try and send us too many descriptors and | |
| 224 // force a leak. | |
| 225 LOG(ERROR) << "Death signal contained wrong number of descriptors;" | |
| 226 << " num_fds:" << num_fds; | |
| 227 for (unsigned i = 0; i < num_fds; ++i) | |
| 228 (void) HANDLE_EINTR(close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i])); | |
| 229 return; | |
| 230 } else { | |
| 231 partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0]; | |
| 232 signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1]; | |
| 233 } | |
| 234 } else if (hdr->cmsg_type == SCM_CREDENTIALS) { | |
| 235 const struct ucred *cred = | |
| 236 reinterpret_cast<struct ucred*>(CMSG_DATA(hdr)); | |
| 237 crashing_pid = cred->pid; | |
| 238 } | |
| 239 } | |
| 240 | |
| 241 if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) { | |
| 242 LOG(ERROR) << "Death signal message didn't contain all expected control" | |
| 243 << " messages"; | |
| 244 if (partner_fd >= 0) | |
| 245 (void) HANDLE_EINTR(close(partner_fd)); | |
| 246 if (signal_fd >= 0) | |
| 247 (void) HANDLE_EINTR(close(signal_fd)); | |
| 248 return; | |
| 249 } | |
| 250 | |
| 251 // Kernel bug workaround (broken in 2.6.30 and 2.6.32, working in 2.6.38). | |
| 252 // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID | |
| 253 // namespaces. Thus |crashing_pid| might be garbage from our point of view. | |
| 254 // In the future we can remove this workaround, but we have to wait a couple | |
| 255 // of years to be sure that it's worked its way out into the world. | |
| 256 // TODO(thestig) Remove the workaround when Ubuntu Lucid is deprecated. | |
| 257 | |
| 258 // The crashing process closes its copy of the signal_fd immediately after | |
| 259 // calling sendmsg(). We can thus not reliably look for with with | |
| 260 // FindProcessHoldingSocket(). But by necessity, it has to keep the | |
| 261 // partner_fd open until the crashdump is complete. | |
| 262 ino_t inode_number; | |
| 263 if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) { | |
| 264 LOG(WARNING) << "Failed to get inode number for passed socket"; | |
| 265 (void) HANDLE_EINTR(close(partner_fd)); | |
| 266 (void) HANDLE_EINTR(close(signal_fd)); | |
| 267 return; | |
| 268 } | |
| 269 (void) HANDLE_EINTR(close(partner_fd)); | |
| 270 | |
| 271 pid_t actual_crashing_pid = -1; | |
| 272 if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) { | |
| 273 LOG(WARNING) << "Failed to find process holding other end of crash reply " | |
| 274 "socket"; | |
| 275 (void) HANDLE_EINTR(close(signal_fd)); | |
| 276 return; | |
| 277 } | |
| 278 | |
| 279 crashing_pid = actual_crashing_pid; | |
| 280 | |
| 281 // The crashing TID set inside the compromised context via | |
| 282 // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if | |
| 283 // the kernel supports PID namespacing) and may need to be | |
| 284 // translated. | |
| 285 // | |
| 286 // We expect the crashing thread to be in sys_read(), waiting for us to | |
| 287 // write to |signal_fd|. Most newer kernels where we have the different pid | |
| 288 // namespaces also have /proc/[pid]/syscall, so we can look through | |
| 289 // |actual_crashing_pid|'s thread group and find the thread that's in the | |
| 290 // read syscall with the right arguments. | |
| 291 | |
| 292 std::string expected_syscall_data; | |
| 293 // /proc/[pid]/syscall is formatted as follows: | |
| 294 // syscall_number arg1 ... arg6 sp pc | |
| 295 // but we just check syscall_number through arg3. | |
| 296 base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ", | |
| 297 SYS_read, tid_fd, tid_buf_addr); | |
| 298 bool syscall_supported = false; | |
| 299 pid_t crashing_tid = | |
| 300 base::FindThreadIDWithSyscall(crashing_pid, | |
| 301 expected_syscall_data, | |
| 302 &syscall_supported); | |
| 303 if (crashing_tid == -1) { | |
| 304 // We didn't find the thread we want. Maybe it didn't reach | |
| 305 // sys_read() yet or the thread went away. We'll just take a | |
| 306 // guess here and assume the crashing thread is the thread group | |
| 307 // leader. If procfs syscall is not supported by the kernel, then | |
| 308 // we assume the kernel also does not support TID namespacing and | |
| 309 // trust the TID passed by the crashing process. | |
| 310 LOG(WARNING) << "Could not translate tid - assuming crashing thread is " | |
| 311 "thread group leader; syscall_supported=" << syscall_supported; | |
| 312 crashing_tid = crashing_pid; | |
| 313 } | |
| 314 | |
| 315 ExceptionHandler::CrashContext* bad_context = | |
| 316 reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context); | |
| 317 bad_context->tid = crashing_tid; | |
| 318 | |
| 319 // Freed in CrashDumpTask(); | |
| 320 BreakpadInfo* info = new BreakpadInfo; | |
| 321 | |
| 322 info->fd = -1; | |
| 323 info->process_type_length = process_type_.length(); | |
| 324 char* process_type_str = new char[info->process_type_length + 1]; | |
| 325 process_type_.copy(process_type_str, info->process_type_length); | |
| 326 process_type_str[info->process_type_length] = '\0'; | |
| 327 info->process_type = process_type_str; | |
| 328 | |
| 329 info->distro_length = strlen(distro); | |
| 330 info->distro = distro; | |
| 331 #if defined(OS_ANDROID) | |
| 332 // Nothing gets uploaded in android. | |
| 333 info->upload = false; | |
| 334 #else | |
| 335 info->upload = upload_; | |
| 336 #endif | |
| 337 | |
| 338 info->crash_keys = crash_keys; | |
| 339 | |
| 340 #if defined(ADDRESS_SANITIZER) | |
| 341 info->asan_report_str = asan_report_str_; | |
| 342 info->asan_report_length = strlen(asan_report_str_); | |
| 343 #endif | |
| 344 info->process_start_time = uptime; | |
| 345 info->oom_size = oom_size; | |
| 346 | |
| 347 BrowserThread::GetBlockingPool()->PostSequencedWorkerTask( | |
| 348 worker_pool_token_, | |
| 349 FROM_HERE, | |
| 350 base::Bind(&CrashHandlerHostLinux::WriteDumpFile, | |
| 351 base::Unretained(this), | |
| 352 info, | |
| 353 crashing_pid, | |
| 354 crash_context, | |
| 355 signal_fd)); | |
| 356 } | |
| 357 | |
| 358 void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info, | |
| 359 pid_t crashing_pid, | |
| 360 char* crash_context, | |
| 361 int signal_fd) { | |
| 362 DCHECK(BrowserThread::GetBlockingPool()->IsRunningSequenceOnCurrentThread( | |
| 363 worker_pool_token_)); | |
| 364 | |
| 365 base::FilePath dumps_path("/tmp"); | |
| 366 PathService::Get(base::DIR_TEMP, &dumps_path); | |
| 367 if (!info->upload) | |
| 368 dumps_path = dumps_path_; | |
| 369 const uint64 rand = base::RandUint64(); | |
| 370 const std::string minidump_filename = | |
| 371 base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp", | |
| 372 dumps_path.value().c_str(), | |
| 373 process_type_.c_str(), | |
| 374 rand); | |
| 375 | |
| 376 if (!google_breakpad::WriteMinidump(minidump_filename.c_str(), | |
| 377 kMaxMinidumpFileSize, | |
| 378 crashing_pid, crash_context, | |
| 379 kCrashContextSize, | |
| 380 google_breakpad::MappingList(), | |
| 381 google_breakpad::AppMemoryList())) { | |
| 382 LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid; | |
| 383 } | |
| 384 #if defined(ADDRESS_SANITIZER) | |
| 385 // Create a temporary file holding the AddressSanitizer report. | |
| 386 const std::string log_filename = | |
| 387 base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".log", | |
| 388 dumps_path.value().c_str(), | |
| 389 process_type_.c_str(), | |
| 390 rand); | |
| 391 FILE* logfile = fopen(log_filename.c_str(), "w"); | |
| 392 CHECK(logfile); | |
| 393 fprintf(logfile, "%s", asan_report_str_); | |
| 394 fclose(logfile); | |
| 395 #endif | |
| 396 | |
| 397 delete[] crash_context; | |
| 398 | |
| 399 // Freed in CrashDumpTask(); | |
| 400 char* minidump_filename_str = new char[minidump_filename.length() + 1]; | |
| 401 minidump_filename.copy(minidump_filename_str, minidump_filename.length()); | |
| 402 minidump_filename_str[minidump_filename.length()] = '\0'; | |
| 403 info->filename = minidump_filename_str; | |
| 404 #if defined(ADDRESS_SANITIZER) | |
| 405 char* minidump_log_filename_str = new char[minidump_filename.length() + 1]; | |
| 406 minidump_filename.copy(minidump_log_filename_str, minidump_filename.length()); | |
| 407 memcpy(minidump_log_filename_str + minidump_filename.length() - 3, "log", 3); | |
| 408 minidump_log_filename_str[minidump_filename.length()] = '\0'; | |
| 409 info->log_filename = minidump_log_filename_str; | |
| 410 #endif | |
| 411 info->pid = crashing_pid; | |
| 412 | |
| 413 BrowserThread::PostTask( | |
| 414 BrowserThread::IO, FROM_HERE, | |
| 415 base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask, | |
| 416 base::Unretained(this), | |
| 417 info, | |
| 418 signal_fd)); | |
| 419 } | |
| 420 | |
| 421 void CrashHandlerHostLinux::QueueCrashDumpTask(BreakpadInfo* info, | |
| 422 int signal_fd) { | |
| 423 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); | |
| 424 | |
| 425 // Send the done signal to the process: it can exit now. | |
| 426 struct msghdr msg = {0}; | |
| 427 struct iovec done_iov; | |
| 428 done_iov.iov_base = const_cast<char*>("\x42"); | |
| 429 done_iov.iov_len = 1; | |
| 430 msg.msg_iov = &done_iov; | |
| 431 msg.msg_iovlen = 1; | |
| 432 | |
| 433 (void) HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL)); | |
| 434 (void) HANDLE_EINTR(close(signal_fd)); | |
| 435 | |
| 436 uploader_thread_->message_loop()->PostTask( | |
| 437 FROM_HERE, | |
| 438 base::Bind(&CrashDumpTask, base::Unretained(this), info)); | |
| 439 } | |
| 440 | |
| 441 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() { | |
| 442 file_descriptor_watcher_.StopWatchingFileDescriptor(); | |
| 443 | |
| 444 // If we are quitting and there are crash dumps in the queue, turn them into | |
| 445 // no-ops. | |
| 446 shutting_down_ = true; | |
| 447 uploader_thread_->Stop(); | |
| 448 } | |
| 449 | |
| 450 bool CrashHandlerHostLinux::IsShuttingDown() const { | |
| 451 return shutting_down_; | |
| 452 } | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 31243002:
Move Linux/Android breakpad implementation to breakpad component (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src