| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "components/breakpad/browser/crash_handler_host_linux.h" | |
| 6 | |
| 7 #include <stdint.h> | |
| 8 #include <stdlib.h> | |
| 9 #include <sys/socket.h> | |
| 10 #include <sys/syscall.h> | |
| 11 #include <unistd.h> | |
| 12 | |
| 13 #include "base/bind.h" | |
| 14 #include "base/bind_helpers.h" | |
| 15 #include "base/file_util.h" | |
| 16 #include "base/files/file_path.h" | |
| 17 #include "base/files/scoped_file.h" | |
| 18 #include "base/format_macros.h" | |
| 19 #include "base/linux_util.h" | |
| 20 #include "base/logging.h" | |
| 21 #include "base/message_loop/message_loop.h" | |
| 22 #include "base/path_service.h" | |
| 23 #include "base/posix/eintr_wrapper.h" | |
| 24 #include "base/rand_util.h" | |
| 25 #include "base/strings/string_util.h" | |
| 26 #include "base/strings/stringprintf.h" | |
| 27 #include "base/threading/thread.h" | |
| 28 #include "breakpad/src/client/linux/handler/exception_handler.h" | |
| 29 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h" | |
| 30 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h" | |
| 31 #include "components/breakpad/app/breakpad_linux_impl.h" | |
| 32 #include "content/public/browser/browser_thread.h" | |
| 33 | |
| 34 #if defined(OS_ANDROID) && !defined(__LP64__) | |
| 35 #include <sys/linux-syscalls.h> | |
| 36 | |
| 37 #define SYS_read __NR_read | |
| 38 #endif | |
| 39 | |
| 40 using content::BrowserThread; | |
| 41 using google_breakpad::ExceptionHandler; | |
| 42 | |
| 43 namespace breakpad { | |
| 44 | |
| 45 namespace { | |
| 46 | |
| 47 const size_t kNumFDs = 1; | |
| 48 // The length of the control message: | |
| 49 const size_t kControlMsgSize = | |
| 50 CMSG_SPACE(kNumFDs * sizeof(int)) + CMSG_SPACE(sizeof(struct ucred)); | |
| 51 // The length of the regular payload: | |
| 52 const size_t kCrashContextSize = sizeof(ExceptionHandler::CrashContext); | |
| 53 | |
| 54 // Handles the crash dump and frees the allocated BreakpadInfo struct. | |
| 55 void CrashDumpTask(CrashHandlerHostLinux* handler, | |
| 56 scoped_ptr<BreakpadInfo> info) { | |
| 57 if (handler->IsShuttingDown() && info->upload) { | |
| 58 base::DeleteFile(base::FilePath(info->filename), false); | |
| 59 #if defined(ADDRESS_SANITIZER) | |
| 60 base::DeleteFile(base::FilePath(info->log_filename), false); | |
| 61 #endif | |
| 62 return; | |
| 63 } | |
| 64 | |
| 65 HandleCrashDump(*info); | |
| 66 delete[] info->filename; | |
| 67 #if defined(ADDRESS_SANITIZER) | |
| 68 delete[] info->log_filename; | |
| 69 delete[] info->asan_report_str; | |
| 70 #endif | |
| 71 delete[] info->process_type; | |
| 72 delete[] info->distro; | |
| 73 delete info->crash_keys; | |
| 74 } | |
| 75 | |
| 76 } // namespace | |
| 77 | |
| 78 // Since instances of CrashHandlerHostLinux are leaked, they are only destroyed | |
| 79 // at the end of the processes lifetime, which is greater in span than the | |
| 80 // lifetime of the IO message loop. Thus, all calls to base::Bind() use | |
| 81 // non-refcounted pointers. | |
| 82 | |
| 83 CrashHandlerHostLinux::CrashHandlerHostLinux(const std::string& process_type, | |
| 84 const base::FilePath& dumps_path, | |
| 85 bool upload) | |
| 86 : process_type_(process_type), | |
| 87 dumps_path_(dumps_path), | |
| 88 upload_(upload), | |
| 89 shutting_down_(false), | |
| 90 worker_pool_token_(BrowserThread::GetBlockingPool()->GetSequenceToken()) { | |
| 91 int fds[2]; | |
| 92 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from | |
| 93 // sending datagrams to other sockets on the system. The sandbox may prevent | |
| 94 // the process from calling socket() to create new sockets, but it'll still | |
| 95 // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send | |
| 96 // a datagram to any (abstract) socket on the same system. With | |
| 97 // SOCK_SEQPACKET, this is prevented. | |
| 98 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); | |
| 99 static const int on = 1; | |
| 100 | |
| 101 // Enable passcred on the server end of the socket | |
| 102 CHECK_EQ(0, setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on))); | |
| 103 | |
| 104 process_socket_ = fds[0]; | |
| 105 browser_socket_ = fds[1]; | |
| 106 | |
| 107 BrowserThread::PostTask( | |
| 108 BrowserThread::IO, FROM_HERE, | |
| 109 base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this))); | |
| 110 } | |
| 111 | |
| 112 CrashHandlerHostLinux::~CrashHandlerHostLinux() { | |
| 113 close(process_socket_); | |
| 114 close(browser_socket_); | |
| 115 } | |
| 116 | |
| 117 void CrashHandlerHostLinux::StartUploaderThread() { | |
| 118 uploader_thread_.reset( | |
| 119 new base::Thread(process_type_ + "_crash_uploader")); | |
| 120 uploader_thread_->Start(); | |
| 121 } | |
| 122 | |
| 123 void CrashHandlerHostLinux::Init() { | |
| 124 base::MessageLoopForIO* ml = base::MessageLoopForIO::current(); | |
| 125 CHECK(ml->WatchFileDescriptor( | |
| 126 browser_socket_, true /* persistent */, | |
| 127 base::MessageLoopForIO::WATCH_READ, | |
| 128 &file_descriptor_watcher_, this)); | |
| 129 ml->AddDestructionObserver(this); | |
| 130 } | |
| 131 | |
| 132 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) { | |
| 133 NOTREACHED(); | |
| 134 } | |
| 135 | |
| 136 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) { | |
| 137 DCHECK_EQ(browser_socket_, fd); | |
| 138 | |
| 139 // A process has crashed and has signaled us by writing a datagram | |
| 140 // to the death signal socket. The datagram contains the crash context needed | |
| 141 // for writing the minidump as well as a file descriptor and a credentials | |
| 142 // block so that they can't lie about their pid. | |
| 143 // | |
| 144 // The message sender is in components/breakpad/app/breakpad_linux.cc. | |
| 145 | |
| 146 struct msghdr msg = {0}; | |
| 147 struct iovec iov[kCrashIovSize]; | |
| 148 | |
| 149 scoped_ptr<char[]> crash_context(new char[kCrashContextSize]); | |
| 150 #if defined(ADDRESS_SANITIZER) | |
| 151 scoped_ptr<char[]> asan_report(new char[kMaxAsanReportSize + 1]); | |
| 152 #endif | |
| 153 | |
| 154 scoped_ptr<CrashKeyStorage> crash_keys(new CrashKeyStorage); | |
| 155 google_breakpad::SerializedNonAllocatingMap* serialized_crash_keys; | |
| 156 size_t crash_keys_size = crash_keys->Serialize( | |
| 157 const_cast<const google_breakpad::SerializedNonAllocatingMap**>( | |
| 158 &serialized_crash_keys)); | |
| 159 | |
| 160 char* tid_buf_addr = NULL; | |
| 161 int tid_fd = -1; | |
| 162 uint64_t uptime; | |
| 163 size_t oom_size; | |
| 164 char control[kControlMsgSize]; | |
| 165 const ssize_t expected_msg_size = | |
| 166 kCrashContextSize + | |
| 167 sizeof(tid_buf_addr) + sizeof(tid_fd) + | |
| 168 sizeof(uptime) + | |
| 169 #if defined(ADDRESS_SANITIZER) | |
| 170 kMaxAsanReportSize + 1 + | |
| 171 #endif | |
| 172 sizeof(oom_size) + | |
| 173 crash_keys_size; | |
| 174 iov[0].iov_base = crash_context.get(); | |
| 175 iov[0].iov_len = kCrashContextSize; | |
| 176 iov[1].iov_base = &tid_buf_addr; | |
| 177 iov[1].iov_len = sizeof(tid_buf_addr); | |
| 178 iov[2].iov_base = &tid_fd; | |
| 179 iov[2].iov_len = sizeof(tid_fd); | |
| 180 iov[3].iov_base = &uptime; | |
| 181 iov[3].iov_len = sizeof(uptime); | |
| 182 iov[4].iov_base = &oom_size; | |
| 183 iov[4].iov_len = sizeof(oom_size); | |
| 184 iov[5].iov_base = serialized_crash_keys; | |
| 185 iov[5].iov_len = crash_keys_size; | |
| 186 #if !defined(ADDRESS_SANITIZER) | |
| 187 COMPILE_ASSERT(5 == kCrashIovSize - 1, Incorrect_Number_Of_Iovec_Members); | |
| 188 #else | |
| 189 iov[6].iov_base = asan_report.get(); | |
| 190 iov[6].iov_len = kMaxAsanReportSize + 1; | |
| 191 COMPILE_ASSERT(6 == kCrashIovSize - 1, Incorrect_Number_Of_Iovec_Members); | |
| 192 #endif | |
| 193 msg.msg_iov = iov; | |
| 194 msg.msg_iovlen = kCrashIovSize; | |
| 195 msg.msg_control = control; | |
| 196 msg.msg_controllen = kControlMsgSize; | |
| 197 | |
| 198 const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0)); | |
| 199 if (msg_size < 0) { | |
| 200 LOG(ERROR) << "Error reading from death signal socket. Crash dumping" | |
| 201 << " is disabled." | |
| 202 << " msg_size:" << msg_size | |
| 203 << " errno:" << errno; | |
| 204 file_descriptor_watcher_.StopWatchingFileDescriptor(); | |
| 205 return; | |
| 206 } | |
| 207 const bool bad_message = (msg_size != expected_msg_size || | |
| 208 msg.msg_controllen != kControlMsgSize || | |
| 209 msg.msg_flags & ~MSG_TRUNC); | |
| 210 base::ScopedFD signal_fd; | |
| 211 pid_t crashing_pid = -1; | |
| 212 if (msg.msg_controllen > 0) { | |
| 213 // Walk the control payload and extract the file descriptor and | |
| 214 // validated pid. | |
| 215 for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr; | |
| 216 hdr = CMSG_NXTHDR(&msg, hdr)) { | |
| 217 if (hdr->cmsg_level != SOL_SOCKET) | |
| 218 continue; | |
| 219 if (hdr->cmsg_type == SCM_RIGHTS) { | |
| 220 const size_t len = hdr->cmsg_len - | |
| 221 (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr); | |
| 222 DCHECK_EQ(0U, len % sizeof(int)); | |
| 223 const size_t num_fds = len / sizeof(int); | |
| 224 if (num_fds != kNumFDs) { | |
| 225 // A nasty process could try and send us too many descriptors and | |
| 226 // force a leak. | |
| 227 LOG(ERROR) << "Death signal contained wrong number of descriptors;" | |
| 228 << " num_fds:" << num_fds; | |
| 229 for (size_t i = 0; i < num_fds; ++i) | |
| 230 close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]); | |
| 231 return; | |
| 232 } | |
| 233 DCHECK(!signal_fd.is_valid()); | |
| 234 int fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0]; | |
| 235 DCHECK_GE(fd, 0); // The kernel should never send a negative fd. | |
| 236 signal_fd.reset(fd); | |
| 237 } else if (hdr->cmsg_type == SCM_CREDENTIALS) { | |
| 238 DCHECK_EQ(-1, crashing_pid); | |
| 239 const struct ucred *cred = | |
| 240 reinterpret_cast<struct ucred*>(CMSG_DATA(hdr)); | |
| 241 crashing_pid = cred->pid; | |
| 242 } | |
| 243 } | |
| 244 } | |
| 245 | |
| 246 if (bad_message) { | |
| 247 LOG(ERROR) << "Received death signal message with the wrong size;" | |
| 248 << " msg.msg_controllen:" << msg.msg_controllen | |
| 249 << " msg.msg_flags:" << msg.msg_flags | |
| 250 << " kCrashContextSize:" << kCrashContextSize | |
| 251 << " kControlMsgSize:" << kControlMsgSize; | |
| 252 return; | |
| 253 } | |
| 254 if (crashing_pid == -1 || !signal_fd.is_valid()) { | |
| 255 LOG(ERROR) << "Death signal message didn't contain all expected control" | |
| 256 << " messages"; | |
| 257 return; | |
| 258 } | |
| 259 | |
| 260 // The crashing TID set inside the compromised context via | |
| 261 // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if | |
| 262 // the kernel supports PID namespacing) and may need to be | |
| 263 // translated. | |
| 264 // | |
| 265 // We expect the crashing thread to be in sys_read(), waiting for us to | |
| 266 // write to |signal_fd|. Most newer kernels where we have the different pid | |
| 267 // namespaces also have /proc/[pid]/syscall, so we can look through | |
| 268 // |actual_crashing_pid|'s thread group and find the thread that's in the | |
| 269 // read syscall with the right arguments. | |
| 270 | |
| 271 std::string expected_syscall_data; | |
| 272 // /proc/[pid]/syscall is formatted as follows: | |
| 273 // syscall_number arg1 ... arg6 sp pc | |
| 274 // but we just check syscall_number through arg3. | |
| 275 base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ", | |
| 276 SYS_read, tid_fd, tid_buf_addr); | |
| 277 bool syscall_supported = false; | |
| 278 pid_t crashing_tid = | |
| 279 base::FindThreadIDWithSyscall(crashing_pid, | |
| 280 expected_syscall_data, | |
| 281 &syscall_supported); | |
| 282 if (crashing_tid == -1) { | |
| 283 // We didn't find the thread we want. Maybe it didn't reach | |
| 284 // sys_read() yet or the thread went away. We'll just take a | |
| 285 // guess here and assume the crashing thread is the thread group | |
| 286 // leader. If procfs syscall is not supported by the kernel, then | |
| 287 // we assume the kernel also does not support TID namespacing and | |
| 288 // trust the TID passed by the crashing process. | |
| 289 LOG(WARNING) << "Could not translate tid - assuming crashing thread is " | |
| 290 "thread group leader; syscall_supported=" << syscall_supported; | |
| 291 crashing_tid = crashing_pid; | |
| 292 } | |
| 293 | |
| 294 ExceptionHandler::CrashContext* bad_context = | |
| 295 reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context.get()); | |
| 296 bad_context->tid = crashing_tid; | |
| 297 | |
| 298 scoped_ptr<BreakpadInfo> info(new BreakpadInfo); | |
| 299 | |
| 300 info->fd = -1; | |
| 301 info->process_type_length = process_type_.length(); | |
| 302 // Freed in CrashDumpTask(). | |
| 303 char* process_type_str = new char[info->process_type_length + 1]; | |
| 304 process_type_.copy(process_type_str, info->process_type_length); | |
| 305 process_type_str[info->process_type_length] = '\0'; | |
| 306 info->process_type = process_type_str; | |
| 307 | |
| 308 // Memory released from scoped_ptrs below are also freed in CrashDumpTask(). | |
| 309 info->crash_keys = crash_keys.release(); | |
| 310 #if defined(ADDRESS_SANITIZER) | |
| 311 asan_report[kMaxAsanReportSize] = '\0'; | |
| 312 info->asan_report_str = asan_report.release(); | |
| 313 info->asan_report_length = strlen(info->asan_report_str); | |
| 314 #endif | |
| 315 | |
| 316 info->process_start_time = uptime; | |
| 317 info->oom_size = oom_size; | |
| 318 #if defined(OS_ANDROID) | |
| 319 // Nothing gets uploaded in android. | |
| 320 info->upload = false; | |
| 321 #else | |
| 322 info->upload = upload_; | |
| 323 #endif | |
| 324 | |
| 325 | |
| 326 BrowserThread::GetBlockingPool()->PostSequencedWorkerTask( | |
| 327 worker_pool_token_, | |
| 328 FROM_HERE, | |
| 329 base::Bind(&CrashHandlerHostLinux::WriteDumpFile, | |
| 330 base::Unretained(this), | |
| 331 base::Passed(&info), | |
| 332 base::Passed(&crash_context), | |
| 333 crashing_pid, | |
| 334 signal_fd.release())); | |
| 335 } | |
| 336 | |
| 337 void CrashHandlerHostLinux::WriteDumpFile(scoped_ptr<BreakpadInfo> info, | |
| 338 scoped_ptr<char[]> crash_context, | |
| 339 pid_t crashing_pid, | |
| 340 int signal_fd) { | |
| 341 DCHECK(BrowserThread::GetBlockingPool()->IsRunningSequenceOnCurrentThread( | |
| 342 worker_pool_token_)); | |
| 343 | |
| 344 // Set |info->distro| here because base::GetLinuxDistro() needs to run on a | |
| 345 // blocking thread. | |
| 346 std::string distro = base::GetLinuxDistro(); | |
| 347 info->distro_length = distro.length(); | |
| 348 // Freed in CrashDumpTask(). | |
| 349 char* distro_str = new char[info->distro_length + 1]; | |
| 350 distro.copy(distro_str, info->distro_length); | |
| 351 distro_str[info->distro_length] = '\0'; | |
| 352 info->distro = distro_str; | |
| 353 | |
| 354 base::FilePath dumps_path("/tmp"); | |
| 355 PathService::Get(base::DIR_TEMP, &dumps_path); | |
| 356 if (!info->upload) | |
| 357 dumps_path = dumps_path_; | |
| 358 const std::string minidump_filename = | |
| 359 base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp", | |
| 360 dumps_path.value().c_str(), | |
| 361 process_type_.c_str(), | |
| 362 base::RandUint64()); | |
| 363 | |
| 364 if (!google_breakpad::WriteMinidump(minidump_filename.c_str(), | |
| 365 kMaxMinidumpFileSize, | |
| 366 crashing_pid, | |
| 367 crash_context.get(), | |
| 368 kCrashContextSize, | |
| 369 google_breakpad::MappingList(), | |
| 370 google_breakpad::AppMemoryList())) { | |
| 371 LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid; | |
| 372 } | |
| 373 #if defined(ADDRESS_SANITIZER) | |
| 374 // Create a temporary file holding the AddressSanitizer report. | |
| 375 const base::FilePath log_path = | |
| 376 base::FilePath(minidump_filename).ReplaceExtension("log"); | |
| 377 base::WriteFile(log_path, info->asan_report_str, info->asan_report_length); | |
| 378 #endif | |
| 379 | |
| 380 // Freed in CrashDumpTask(). | |
| 381 char* minidump_filename_str = new char[minidump_filename.length() + 1]; | |
| 382 minidump_filename.copy(minidump_filename_str, minidump_filename.length()); | |
| 383 minidump_filename_str[minidump_filename.length()] = '\0'; | |
| 384 info->filename = minidump_filename_str; | |
| 385 #if defined(ADDRESS_SANITIZER) | |
| 386 // Freed in CrashDumpTask(). | |
| 387 char* minidump_log_filename_str = new char[minidump_filename.length() + 1]; | |
| 388 minidump_filename.copy(minidump_log_filename_str, minidump_filename.length()); | |
| 389 memcpy(minidump_log_filename_str + minidump_filename.length() - 3, "log", 3); | |
| 390 minidump_log_filename_str[minidump_filename.length()] = '\0'; | |
| 391 info->log_filename = minidump_log_filename_str; | |
| 392 #endif | |
| 393 info->pid = crashing_pid; | |
| 394 | |
| 395 BrowserThread::PostTask( | |
| 396 BrowserThread::IO, FROM_HERE, | |
| 397 base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask, | |
| 398 base::Unretained(this), | |
| 399 base::Passed(&info), | |
| 400 signal_fd)); | |
| 401 } | |
| 402 | |
| 403 void CrashHandlerHostLinux::QueueCrashDumpTask(scoped_ptr<BreakpadInfo> info, | |
| 404 int signal_fd) { | |
| 405 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); | |
| 406 | |
| 407 // Send the done signal to the process: it can exit now. | |
| 408 struct msghdr msg = {0}; | |
| 409 struct iovec done_iov; | |
| 410 done_iov.iov_base = const_cast<char*>("\x42"); | |
| 411 done_iov.iov_len = 1; | |
| 412 msg.msg_iov = &done_iov; | |
| 413 msg.msg_iovlen = 1; | |
| 414 | |
| 415 HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL)); | |
| 416 close(signal_fd); | |
| 417 | |
| 418 uploader_thread_->message_loop()->PostTask( | |
| 419 FROM_HERE, | |
| 420 base::Bind(&CrashDumpTask, base::Unretained(this), base::Passed(&info))); | |
| 421 } | |
| 422 | |
| 423 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() { | |
| 424 file_descriptor_watcher_.StopWatchingFileDescriptor(); | |
| 425 | |
| 426 // If we are quitting and there are crash dumps in the queue, turn them into | |
| 427 // no-ops. | |
| 428 shutting_down_ = true; | |
| 429 uploader_thread_->Stop(); | |
| 430 } | |
| 431 | |
| 432 bool CrashHandlerHostLinux::IsShuttingDown() const { | |
| 433 return shutting_down_; | |
| 434 } | |
| 435 | |
| 436 } // namespace breakpad | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 485893007:
Rename components/breakpad to components/crash. (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src