OLD | NEW |
| (Empty) |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "chrome/browser/crash_handler_host_linuxish.h" | |
6 | |
7 #include <stdint.h> | |
8 #include <stdlib.h> | |
9 #include <sys/socket.h> | |
10 #include <sys/syscall.h> | |
11 #include <unistd.h> | |
12 | |
13 #include "base/bind.h" | |
14 #include "base/bind_helpers.h" | |
15 #include "base/eintr_wrapper.h" | |
16 #include "base/file_path.h" | |
17 #include "base/format_macros.h" | |
18 #include "base/linux_util.h" | |
19 #include "base/logging.h" | |
20 #include "base/memory/singleton.h" | |
21 #include "base/message_loop.h" | |
22 #include "base/path_service.h" | |
23 #include "base/rand_util.h" | |
24 #include "base/string_util.h" | |
25 #include "base/stringprintf.h" | |
26 #include "base/threading/thread.h" | |
27 #include "breakpad/src/client/linux/handler/exception_handler.h" | |
28 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h" | |
29 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h" | |
30 #include "chrome/app/breakpad_linuxish.h" | |
31 #include "chrome/common/chrome_paths.h" | |
32 #include "chrome/common/env_vars.h" | |
33 #include "content/public/browser/browser_thread.h" | |
34 | |
35 #if defined(OS_ANDROID) | |
36 #include <sys/linux-syscalls.h> | |
37 | |
38 #define SYS_read __NR_read | |
39 #endif | |
40 | |
41 using content::BrowserThread; | |
42 using google_breakpad::ExceptionHandler; | |
43 | |
44 namespace { | |
45 | |
46 // The length of the control message: | |
47 const unsigned kControlMsgSize = | |
48 CMSG_SPACE(2*sizeof(int)) + CMSG_SPACE(sizeof(struct ucred)); | |
49 // The length of the regular payload: | |
50 const unsigned kCrashContextSize = sizeof(ExceptionHandler::CrashContext); | |
51 | |
52 // Handles the crash dump and frees the allocated BreakpadInfo struct. | |
53 void CrashDumpTask(CrashHandlerHostLinux* handler, BreakpadInfo* info) { | |
54 if (handler->IsShuttingDown()) | |
55 return; | |
56 | |
57 HandleCrashDump(*info); | |
58 delete[] info->filename; | |
59 delete[] info->process_type; | |
60 delete[] info->crash_url; | |
61 delete[] info->guid; | |
62 delete[] info->distro; | |
63 delete info; | |
64 } | |
65 | |
66 } // namespace | |
67 | |
68 // Since classes derived from CrashHandlerHostLinux are singletons, it's only | |
69 // destroyed at the end of the processes lifetime, which is greater in span than | |
70 // the lifetime of the IO message loop. Thus, all calls to base::Bind() use | |
71 // non-refcounted pointers. | |
72 | |
73 CrashHandlerHostLinux::CrashHandlerHostLinux() | |
74 : shutting_down_(false) { | |
75 int fds[2]; | |
76 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from | |
77 // sending datagrams to other sockets on the system. The sandbox may prevent | |
78 // the process from calling socket() to create new sockets, but it'll still | |
79 // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send | |
80 // a datagram to any (abstract) socket on the same system. With | |
81 // SOCK_SEQPACKET, this is prevented. | |
82 CHECK_EQ(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds), 0); | |
83 static const int on = 1; | |
84 | |
85 // Enable passcred on the server end of the socket | |
86 CHECK_EQ(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)), 0); | |
87 | |
88 process_socket_ = fds[0]; | |
89 browser_socket_ = fds[1]; | |
90 | |
91 BrowserThread::PostTask( | |
92 BrowserThread::IO, FROM_HERE, | |
93 base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this))); | |
94 } | |
95 | |
96 CrashHandlerHostLinux::~CrashHandlerHostLinux() { | |
97 (void) HANDLE_EINTR(close(process_socket_)); | |
98 (void) HANDLE_EINTR(close(browser_socket_)); | |
99 } | |
100 | |
101 void CrashHandlerHostLinux::Init() { | |
102 MessageLoopForIO* ml = MessageLoopForIO::current(); | |
103 CHECK(ml->WatchFileDescriptor( | |
104 browser_socket_, true /* persistent */, | |
105 MessageLoopForIO::WATCH_READ, | |
106 &file_descriptor_watcher_, this)); | |
107 ml->AddDestructionObserver(this); | |
108 } | |
109 | |
110 void CrashHandlerHostLinux::InitCrashUploaderThread() { | |
111 SetProcessType(); | |
112 uploader_thread_.reset( | |
113 new base::Thread(std::string(process_type_ + "_crash_uploader").c_str())); | |
114 uploader_thread_->Start(); | |
115 } | |
116 | |
117 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) { | |
118 NOTREACHED(); | |
119 } | |
120 | |
121 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) { | |
122 DCHECK_EQ(fd, browser_socket_); | |
123 | |
124 // A process has crashed and has signaled us by writing a datagram | |
125 // to the death signal socket. The datagram contains the crash context needed | |
126 // for writing the minidump as well as a file descriptor and a credentials | |
127 // block so that they can't lie about their pid. | |
128 // | |
129 // The message sender is in chrome/app/breakpad_linux.cc. | |
130 | |
131 const size_t kIovSize = 8; | |
132 struct msghdr msg = {0}; | |
133 struct iovec iov[kIovSize]; | |
134 | |
135 // Freed in WriteDumpFile(); | |
136 char* crash_context = new char[kCrashContextSize]; | |
137 // Freed in CrashDumpTask(); | |
138 char* guid = new char[kGuidSize + 1]; | |
139 char* crash_url = new char[kMaxActiveURLSize + 1]; | |
140 char* distro = new char[kDistroSize + 1]; | |
141 | |
142 char* tid_buf_addr = NULL; | |
143 int tid_fd = -1; | |
144 uint64_t uptime; | |
145 size_t oom_size; | |
146 char control[kControlMsgSize]; | |
147 const ssize_t expected_msg_size = | |
148 kCrashContextSize + | |
149 kGuidSize + 1 + | |
150 kMaxActiveURLSize + 1 + | |
151 kDistroSize + 1 + | |
152 sizeof(tid_buf_addr) + sizeof(tid_fd) + | |
153 sizeof(uptime) + | |
154 sizeof(oom_size); | |
155 | |
156 iov[0].iov_base = crash_context; | |
157 iov[0].iov_len = kCrashContextSize; | |
158 iov[1].iov_base = guid; | |
159 iov[1].iov_len = kGuidSize + 1; | |
160 iov[2].iov_base = crash_url; | |
161 iov[2].iov_len = kMaxActiveURLSize + 1; | |
162 iov[3].iov_base = distro; | |
163 iov[3].iov_len = kDistroSize + 1; | |
164 iov[4].iov_base = &tid_buf_addr; | |
165 iov[4].iov_len = sizeof(tid_buf_addr); | |
166 iov[5].iov_base = &tid_fd; | |
167 iov[5].iov_len = sizeof(tid_fd); | |
168 iov[6].iov_base = &uptime; | |
169 iov[6].iov_len = sizeof(uptime); | |
170 iov[7].iov_base = &oom_size; | |
171 iov[7].iov_len = sizeof(oom_size); | |
172 msg.msg_iov = iov; | |
173 msg.msg_iovlen = kIovSize; | |
174 msg.msg_control = control; | |
175 msg.msg_controllen = kControlMsgSize; | |
176 | |
177 const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0)); | |
178 if (msg_size != expected_msg_size) { | |
179 LOG(ERROR) << "Error reading from death signal socket. Crash dumping" | |
180 << " is disabled." | |
181 << " msg_size:" << msg_size | |
182 << " errno:" << errno; | |
183 file_descriptor_watcher_.StopWatchingFileDescriptor(); | |
184 return; | |
185 } | |
186 | |
187 if (msg.msg_controllen != kControlMsgSize || | |
188 msg.msg_flags & ~MSG_TRUNC) { | |
189 LOG(ERROR) << "Received death signal message with the wrong size;" | |
190 << " msg.msg_controllen:" << msg.msg_controllen | |
191 << " msg.msg_flags:" << msg.msg_flags | |
192 << " kCrashContextSize:" << kCrashContextSize | |
193 << " kControlMsgSize:" << kControlMsgSize; | |
194 return; | |
195 } | |
196 | |
197 // Walk the control payload an extract the file descriptor and validated pid. | |
198 pid_t crashing_pid = -1; | |
199 int partner_fd = -1; | |
200 int signal_fd = -1; | |
201 for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr; | |
202 hdr = CMSG_NXTHDR(&msg, hdr)) { | |
203 if (hdr->cmsg_level != SOL_SOCKET) | |
204 continue; | |
205 if (hdr->cmsg_type == SCM_RIGHTS) { | |
206 const unsigned len = hdr->cmsg_len - | |
207 (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr); | |
208 DCHECK_EQ(len % sizeof(int), 0u); | |
209 const unsigned num_fds = len / sizeof(int); | |
210 if (num_fds != 2) { | |
211 // A nasty process could try and send us too many descriptors and | |
212 // force a leak. | |
213 LOG(ERROR) << "Death signal contained wrong number of descriptors;" | |
214 << " num_fds:" << num_fds; | |
215 for (unsigned i = 0; i < num_fds; ++i) | |
216 (void) HANDLE_EINTR(close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i])); | |
217 return; | |
218 } else { | |
219 partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0]; | |
220 signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1]; | |
221 } | |
222 } else if (hdr->cmsg_type == SCM_CREDENTIALS) { | |
223 const struct ucred *cred = | |
224 reinterpret_cast<struct ucred*>(CMSG_DATA(hdr)); | |
225 crashing_pid = cred->pid; | |
226 } | |
227 } | |
228 | |
229 if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) { | |
230 LOG(ERROR) << "Death signal message didn't contain all expected control" | |
231 << " messages"; | |
232 if (partner_fd >= 0) | |
233 (void) HANDLE_EINTR(close(partner_fd)); | |
234 if (signal_fd >= 0) | |
235 (void) HANDLE_EINTR(close(signal_fd)); | |
236 return; | |
237 } | |
238 | |
239 // Kernel bug workaround (broken in 2.6.30 and 2.6.32, working in 2.6.38). | |
240 // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID | |
241 // namespaces. Thus |crashing_pid| might be garbage from our point of view. | |
242 // In the future we can remove this workaround, but we have to wait a couple | |
243 // of years to be sure that it's worked its way out into the world. | |
244 // TODO(thestig) Remove the workaround when Ubuntu Lucid is deprecated. | |
245 | |
246 // The crashing process closes its copy of the signal_fd immediately after | |
247 // calling sendmsg(). We can thus not reliably look for with with | |
248 // FindProcessHoldingSocket(). But by necessity, it has to keep the | |
249 // partner_fd open until the crashdump is complete. | |
250 uint64_t inode_number; | |
251 if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) { | |
252 LOG(WARNING) << "Failed to get inode number for passed socket"; | |
253 (void) HANDLE_EINTR(close(partner_fd)); | |
254 (void) HANDLE_EINTR(close(signal_fd)); | |
255 return; | |
256 } | |
257 (void) HANDLE_EINTR(close(partner_fd)); | |
258 | |
259 pid_t actual_crashing_pid = -1; | |
260 if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) { | |
261 LOG(WARNING) << "Failed to find process holding other end of crash reply " | |
262 "socket"; | |
263 (void) HANDLE_EINTR(close(signal_fd)); | |
264 return; | |
265 } | |
266 | |
267 crashing_pid = actual_crashing_pid; | |
268 | |
269 // The crashing TID set inside the compromised context via | |
270 // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if | |
271 // the kernel supports PID namespacing) and may need to be | |
272 // translated. | |
273 // | |
274 // We expect the crashing thread to be in sys_read(), waiting for us to | |
275 // write to |signal_fd|. Most newer kernels where we have the different pid | |
276 // namespaces also have /proc/[pid]/syscall, so we can look through | |
277 // |actual_crashing_pid|'s thread group and find the thread that's in the | |
278 // read syscall with the right arguments. | |
279 | |
280 std::string expected_syscall_data; | |
281 // /proc/[pid]/syscall is formatted as follows: | |
282 // syscall_number arg1 ... arg6 sp pc | |
283 // but we just check syscall_number through arg3. | |
284 base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ", | |
285 SYS_read, tid_fd, tid_buf_addr); | |
286 bool syscall_supported = false; | |
287 pid_t crashing_tid = | |
288 base::FindThreadIDWithSyscall(crashing_pid, | |
289 expected_syscall_data, | |
290 &syscall_supported); | |
291 if (crashing_tid == -1) { | |
292 // We didn't find the thread we want. Maybe it didn't reach | |
293 // sys_read() yet or the thread went away. We'll just take a | |
294 // guess here and assume the crashing thread is the thread group | |
295 // leader. If procfs syscall is not supported by the kernel, then | |
296 // we assume the kernel also does not support TID namespacing and | |
297 // trust the TID passed by the crashing process. | |
298 LOG(WARNING) << "Could not translate tid - assuming crashing thread is " | |
299 "thread group leader; syscall_supported=" << syscall_supported; | |
300 crashing_tid = crashing_pid; | |
301 } | |
302 | |
303 ExceptionHandler::CrashContext* bad_context = | |
304 reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context); | |
305 bad_context->tid = crashing_tid; | |
306 | |
307 // Sanitize the string data a bit more | |
308 guid[kGuidSize] = crash_url[kMaxActiveURLSize] = distro[kDistroSize] = 0; | |
309 | |
310 // Freed in CrashDumpTask(); | |
311 BreakpadInfo* info = new BreakpadInfo; | |
312 | |
313 info->process_type_length = process_type_.length(); | |
314 char* process_type_str = new char[info->process_type_length + 1]; | |
315 process_type_.copy(process_type_str, info->process_type_length); | |
316 process_type_str[info->process_type_length] = '\0'; | |
317 info->process_type = process_type_str; | |
318 | |
319 info->crash_url_length = strlen(crash_url); | |
320 info->crash_url = crash_url; | |
321 | |
322 info->guid_length = strlen(guid); | |
323 info->guid = guid; | |
324 | |
325 info->distro_length = strlen(distro); | |
326 info->distro = distro; | |
327 #if defined(OS_ANDROID) | |
328 // Nothing gets uploaded in android. | |
329 info->upload = false; | |
330 #else | |
331 info->upload = (getenv(env_vars::kHeadless) == NULL); | |
332 #endif | |
333 info->process_start_time = uptime; | |
334 info->oom_size = oom_size; | |
335 | |
336 BrowserThread::PostTask( | |
337 BrowserThread::FILE, FROM_HERE, | |
338 base::Bind(&CrashHandlerHostLinux::WriteDumpFile, | |
339 base::Unretained(this), | |
340 info, | |
341 crashing_pid, | |
342 crash_context, | |
343 signal_fd)); | |
344 } | |
345 | |
346 void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info, | |
347 pid_t crashing_pid, | |
348 char* crash_context, | |
349 int signal_fd) { | |
350 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE)); | |
351 | |
352 FilePath dumps_path("/tmp"); | |
353 PathService::Get(base::DIR_TEMP, &dumps_path); | |
354 if (!info->upload) | |
355 PathService::Get(chrome::DIR_CRASH_DUMPS, &dumps_path); | |
356 const uint64 rand = base::RandUint64(); | |
357 const std::string minidump_filename = | |
358 base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp", | |
359 dumps_path.value().c_str(), | |
360 process_type_.c_str(), | |
361 rand); | |
362 if (!google_breakpad::WriteMinidump(minidump_filename.c_str(), | |
363 crashing_pid, crash_context, | |
364 kCrashContextSize)) { | |
365 LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid; | |
366 } | |
367 delete[] crash_context; | |
368 | |
369 // Freed in CrashDumpTask(); | |
370 char* minidump_filename_str = new char[minidump_filename.length() + 1]; | |
371 minidump_filename.copy(minidump_filename_str, minidump_filename.length()); | |
372 minidump_filename_str[minidump_filename.length()] = '\0'; | |
373 info->filename = minidump_filename_str; | |
374 info->pid = crashing_pid; | |
375 | |
376 BrowserThread::PostTask( | |
377 BrowserThread::IO, FROM_HERE, | |
378 base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask, | |
379 base::Unretained(this), | |
380 info, | |
381 signal_fd)); | |
382 } | |
383 | |
384 void CrashHandlerHostLinux::QueueCrashDumpTask(BreakpadInfo* info, | |
385 int signal_fd) { | |
386 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); | |
387 | |
388 // Send the done signal to the process: it can exit now. | |
389 struct msghdr msg = {0}; | |
390 struct iovec done_iov; | |
391 done_iov.iov_base = const_cast<char*>("\x42"); | |
392 done_iov.iov_len = 1; | |
393 msg.msg_iov = &done_iov; | |
394 msg.msg_iovlen = 1; | |
395 | |
396 (void) HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL)); | |
397 (void) HANDLE_EINTR(close(signal_fd)); | |
398 | |
399 uploader_thread_->message_loop()->PostTask( | |
400 FROM_HERE, | |
401 base::Bind(&CrashDumpTask, base::Unretained(this), info)); | |
402 } | |
403 | |
404 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() { | |
405 file_descriptor_watcher_.StopWatchingFileDescriptor(); | |
406 | |
407 // If we are quitting and there are crash dumps in the queue, turn them into | |
408 // no-ops. | |
409 shutting_down_ = true; | |
410 uploader_thread_->Stop(); | |
411 } | |
412 | |
413 bool CrashHandlerHostLinux::IsShuttingDown() const { | |
414 return shutting_down_; | |
415 } | |
416 | |
417 ExtensionCrashHandlerHostLinux::ExtensionCrashHandlerHostLinux() { | |
418 InitCrashUploaderThread(); | |
419 } | |
420 | |
421 ExtensionCrashHandlerHostLinux::~ExtensionCrashHandlerHostLinux() { | |
422 } | |
423 | |
424 void ExtensionCrashHandlerHostLinux::SetProcessType() { | |
425 process_type_ = "extension"; | |
426 } | |
427 | |
428 // static | |
429 ExtensionCrashHandlerHostLinux* ExtensionCrashHandlerHostLinux::GetInstance() { | |
430 return Singleton<ExtensionCrashHandlerHostLinux>::get(); | |
431 } | |
432 | |
433 GpuCrashHandlerHostLinux::GpuCrashHandlerHostLinux() { | |
434 InitCrashUploaderThread(); | |
435 } | |
436 | |
437 GpuCrashHandlerHostLinux::~GpuCrashHandlerHostLinux() { | |
438 } | |
439 | |
440 void GpuCrashHandlerHostLinux::SetProcessType() { | |
441 process_type_ = "gpu-process"; | |
442 } | |
443 | |
444 // static | |
445 GpuCrashHandlerHostLinux* GpuCrashHandlerHostLinux::GetInstance() { | |
446 return Singleton<GpuCrashHandlerHostLinux>::get(); | |
447 } | |
448 | |
449 PluginCrashHandlerHostLinux::PluginCrashHandlerHostLinux() { | |
450 InitCrashUploaderThread(); | |
451 } | |
452 | |
453 PluginCrashHandlerHostLinux::~PluginCrashHandlerHostLinux() { | |
454 } | |
455 | |
456 void PluginCrashHandlerHostLinux::SetProcessType() { | |
457 process_type_ = "plugin"; | |
458 } | |
459 | |
460 // static | |
461 PluginCrashHandlerHostLinux* PluginCrashHandlerHostLinux::GetInstance() { | |
462 return Singleton<PluginCrashHandlerHostLinux>::get(); | |
463 } | |
464 | |
465 PpapiCrashHandlerHostLinux::PpapiCrashHandlerHostLinux() { | |
466 InitCrashUploaderThread(); | |
467 } | |
468 | |
469 PpapiCrashHandlerHostLinux::~PpapiCrashHandlerHostLinux() { | |
470 } | |
471 | |
472 void PpapiCrashHandlerHostLinux::SetProcessType() { | |
473 process_type_ = "ppapi"; | |
474 } | |
475 | |
476 // static | |
477 PpapiCrashHandlerHostLinux* PpapiCrashHandlerHostLinux::GetInstance() { | |
478 return Singleton<PpapiCrashHandlerHostLinux>::get(); | |
479 } | |
480 | |
481 RendererCrashHandlerHostLinux::RendererCrashHandlerHostLinux() { | |
482 InitCrashUploaderThread(); | |
483 } | |
484 | |
485 RendererCrashHandlerHostLinux::~RendererCrashHandlerHostLinux() { | |
486 } | |
487 | |
488 void RendererCrashHandlerHostLinux::SetProcessType() { | |
489 process_type_ = "renderer"; | |
490 } | |
491 | |
492 // static | |
493 RendererCrashHandlerHostLinux* RendererCrashHandlerHostLinux::GetInstance() { | |
494 return Singleton<RendererCrashHandlerHostLinux>::get(); | |
495 } | |
OLD | NEW |