Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(64)

Side by Side Diff: chrome/browser/crash_handler_host_linuxish.cc

Issue 10532178: Rename back _linuxish to linux. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Fixed a typo Created 8 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
(Empty)
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "chrome/browser/crash_handler_host_linuxish.h"
6
7 #include <stdint.h>
8 #include <stdlib.h>
9 #include <sys/socket.h>
10 #include <sys/syscall.h>
11 #include <unistd.h>
12
13 #include "base/bind.h"
14 #include "base/bind_helpers.h"
15 #include "base/eintr_wrapper.h"
16 #include "base/file_path.h"
17 #include "base/format_macros.h"
18 #include "base/linux_util.h"
19 #include "base/logging.h"
20 #include "base/memory/singleton.h"
21 #include "base/message_loop.h"
22 #include "base/path_service.h"
23 #include "base/rand_util.h"
24 #include "base/string_util.h"
25 #include "base/stringprintf.h"
26 #include "base/threading/thread.h"
27 #include "breakpad/src/client/linux/handler/exception_handler.h"
28 #include "breakpad/src/client/linux/minidump_writer/linux_dumper.h"
29 #include "breakpad/src/client/linux/minidump_writer/minidump_writer.h"
30 #include "chrome/app/breakpad_linuxish.h"
31 #include "chrome/common/chrome_paths.h"
32 #include "chrome/common/env_vars.h"
33 #include "content/public/browser/browser_thread.h"
34
35 #if defined(OS_ANDROID)
36 #include <sys/linux-syscalls.h>
37
38 #define SYS_read __NR_read
39 #endif
40
41 using content::BrowserThread;
42 using google_breakpad::ExceptionHandler;
43
44 namespace {
45
46 // The length of the control message:
47 const unsigned kControlMsgSize =
48 CMSG_SPACE(2*sizeof(int)) + CMSG_SPACE(sizeof(struct ucred));
49 // The length of the regular payload:
50 const unsigned kCrashContextSize = sizeof(ExceptionHandler::CrashContext);
51
52 // Handles the crash dump and frees the allocated BreakpadInfo struct.
53 void CrashDumpTask(CrashHandlerHostLinux* handler, BreakpadInfo* info) {
54 if (handler->IsShuttingDown())
55 return;
56
57 HandleCrashDump(*info);
58 delete[] info->filename;
59 delete[] info->process_type;
60 delete[] info->crash_url;
61 delete[] info->guid;
62 delete[] info->distro;
63 delete info;
64 }
65
66 } // namespace
67
68 // Since classes derived from CrashHandlerHostLinux are singletons, it's only
69 // destroyed at the end of the processes lifetime, which is greater in span than
70 // the lifetime of the IO message loop. Thus, all calls to base::Bind() use
71 // non-refcounted pointers.
72
73 CrashHandlerHostLinux::CrashHandlerHostLinux()
74 : shutting_down_(false) {
75 int fds[2];
76 // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from
77 // sending datagrams to other sockets on the system. The sandbox may prevent
78 // the process from calling socket() to create new sockets, but it'll still
79 // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
80 // a datagram to any (abstract) socket on the same system. With
81 // SOCK_SEQPACKET, this is prevented.
82 CHECK_EQ(socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds), 0);
83 static const int on = 1;
84
85 // Enable passcred on the server end of the socket
86 CHECK_EQ(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)), 0);
87
88 process_socket_ = fds[0];
89 browser_socket_ = fds[1];
90
91 BrowserThread::PostTask(
92 BrowserThread::IO, FROM_HERE,
93 base::Bind(&CrashHandlerHostLinux::Init, base::Unretained(this)));
94 }
95
96 CrashHandlerHostLinux::~CrashHandlerHostLinux() {
97 (void) HANDLE_EINTR(close(process_socket_));
98 (void) HANDLE_EINTR(close(browser_socket_));
99 }
100
101 void CrashHandlerHostLinux::Init() {
102 MessageLoopForIO* ml = MessageLoopForIO::current();
103 CHECK(ml->WatchFileDescriptor(
104 browser_socket_, true /* persistent */,
105 MessageLoopForIO::WATCH_READ,
106 &file_descriptor_watcher_, this));
107 ml->AddDestructionObserver(this);
108 }
109
110 void CrashHandlerHostLinux::InitCrashUploaderThread() {
111 SetProcessType();
112 uploader_thread_.reset(
113 new base::Thread(std::string(process_type_ + "_crash_uploader").c_str()));
114 uploader_thread_->Start();
115 }
116
117 void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
118 NOTREACHED();
119 }
120
121 void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
122 DCHECK_EQ(fd, browser_socket_);
123
124 // A process has crashed and has signaled us by writing a datagram
125 // to the death signal socket. The datagram contains the crash context needed
126 // for writing the minidump as well as a file descriptor and a credentials
127 // block so that they can't lie about their pid.
128 //
129 // The message sender is in chrome/app/breakpad_linux.cc.
130
131 const size_t kIovSize = 8;
132 struct msghdr msg = {0};
133 struct iovec iov[kIovSize];
134
135 // Freed in WriteDumpFile();
136 char* crash_context = new char[kCrashContextSize];
137 // Freed in CrashDumpTask();
138 char* guid = new char[kGuidSize + 1];
139 char* crash_url = new char[kMaxActiveURLSize + 1];
140 char* distro = new char[kDistroSize + 1];
141
142 char* tid_buf_addr = NULL;
143 int tid_fd = -1;
144 uint64_t uptime;
145 size_t oom_size;
146 char control[kControlMsgSize];
147 const ssize_t expected_msg_size =
148 kCrashContextSize +
149 kGuidSize + 1 +
150 kMaxActiveURLSize + 1 +
151 kDistroSize + 1 +
152 sizeof(tid_buf_addr) + sizeof(tid_fd) +
153 sizeof(uptime) +
154 sizeof(oom_size);
155
156 iov[0].iov_base = crash_context;
157 iov[0].iov_len = kCrashContextSize;
158 iov[1].iov_base = guid;
159 iov[1].iov_len = kGuidSize + 1;
160 iov[2].iov_base = crash_url;
161 iov[2].iov_len = kMaxActiveURLSize + 1;
162 iov[3].iov_base = distro;
163 iov[3].iov_len = kDistroSize + 1;
164 iov[4].iov_base = &tid_buf_addr;
165 iov[4].iov_len = sizeof(tid_buf_addr);
166 iov[5].iov_base = &tid_fd;
167 iov[5].iov_len = sizeof(tid_fd);
168 iov[6].iov_base = &uptime;
169 iov[6].iov_len = sizeof(uptime);
170 iov[7].iov_base = &oom_size;
171 iov[7].iov_len = sizeof(oom_size);
172 msg.msg_iov = iov;
173 msg.msg_iovlen = kIovSize;
174 msg.msg_control = control;
175 msg.msg_controllen = kControlMsgSize;
176
177 const ssize_t msg_size = HANDLE_EINTR(recvmsg(browser_socket_, &msg, 0));
178 if (msg_size != expected_msg_size) {
179 LOG(ERROR) << "Error reading from death signal socket. Crash dumping"
180 << " is disabled."
181 << " msg_size:" << msg_size
182 << " errno:" << errno;
183 file_descriptor_watcher_.StopWatchingFileDescriptor();
184 return;
185 }
186
187 if (msg.msg_controllen != kControlMsgSize ||
188 msg.msg_flags & ~MSG_TRUNC) {
189 LOG(ERROR) << "Received death signal message with the wrong size;"
190 << " msg.msg_controllen:" << msg.msg_controllen
191 << " msg.msg_flags:" << msg.msg_flags
192 << " kCrashContextSize:" << kCrashContextSize
193 << " kControlMsgSize:" << kControlMsgSize;
194 return;
195 }
196
197 // Walk the control payload an extract the file descriptor and validated pid.
198 pid_t crashing_pid = -1;
199 int partner_fd = -1;
200 int signal_fd = -1;
201 for (struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg); hdr;
202 hdr = CMSG_NXTHDR(&msg, hdr)) {
203 if (hdr->cmsg_level != SOL_SOCKET)
204 continue;
205 if (hdr->cmsg_type == SCM_RIGHTS) {
206 const unsigned len = hdr->cmsg_len -
207 (((uint8_t*)CMSG_DATA(hdr)) - (uint8_t*)hdr);
208 DCHECK_EQ(len % sizeof(int), 0u);
209 const unsigned num_fds = len / sizeof(int);
210 if (num_fds != 2) {
211 // A nasty process could try and send us too many descriptors and
212 // force a leak.
213 LOG(ERROR) << "Death signal contained wrong number of descriptors;"
214 << " num_fds:" << num_fds;
215 for (unsigned i = 0; i < num_fds; ++i)
216 (void) HANDLE_EINTR(close(reinterpret_cast<int*>(CMSG_DATA(hdr))[i]));
217 return;
218 } else {
219 partner_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[0];
220 signal_fd = reinterpret_cast<int*>(CMSG_DATA(hdr))[1];
221 }
222 } else if (hdr->cmsg_type == SCM_CREDENTIALS) {
223 const struct ucred *cred =
224 reinterpret_cast<struct ucred*>(CMSG_DATA(hdr));
225 crashing_pid = cred->pid;
226 }
227 }
228
229 if (crashing_pid == -1 || partner_fd == -1 || signal_fd == -1) {
230 LOG(ERROR) << "Death signal message didn't contain all expected control"
231 << " messages";
232 if (partner_fd >= 0)
233 (void) HANDLE_EINTR(close(partner_fd));
234 if (signal_fd >= 0)
235 (void) HANDLE_EINTR(close(signal_fd));
236 return;
237 }
238
239 // Kernel bug workaround (broken in 2.6.30 and 2.6.32, working in 2.6.38).
240 // The kernel doesn't translate PIDs in SCM_CREDENTIALS across PID
241 // namespaces. Thus |crashing_pid| might be garbage from our point of view.
242 // In the future we can remove this workaround, but we have to wait a couple
243 // of years to be sure that it's worked its way out into the world.
244 // TODO(thestig) Remove the workaround when Ubuntu Lucid is deprecated.
245
246 // The crashing process closes its copy of the signal_fd immediately after
247 // calling sendmsg(). We can thus not reliably look for with with
248 // FindProcessHoldingSocket(). But by necessity, it has to keep the
249 // partner_fd open until the crashdump is complete.
250 uint64_t inode_number;
251 if (!base::FileDescriptorGetInode(&inode_number, partner_fd)) {
252 LOG(WARNING) << "Failed to get inode number for passed socket";
253 (void) HANDLE_EINTR(close(partner_fd));
254 (void) HANDLE_EINTR(close(signal_fd));
255 return;
256 }
257 (void) HANDLE_EINTR(close(partner_fd));
258
259 pid_t actual_crashing_pid = -1;
260 if (!base::FindProcessHoldingSocket(&actual_crashing_pid, inode_number)) {
261 LOG(WARNING) << "Failed to find process holding other end of crash reply "
262 "socket";
263 (void) HANDLE_EINTR(close(signal_fd));
264 return;
265 }
266
267 crashing_pid = actual_crashing_pid;
268
269 // The crashing TID set inside the compromised context via
270 // sys_gettid() in ExceptionHandler::HandleSignal might be wrong (if
271 // the kernel supports PID namespacing) and may need to be
272 // translated.
273 //
274 // We expect the crashing thread to be in sys_read(), waiting for us to
275 // write to |signal_fd|. Most newer kernels where we have the different pid
276 // namespaces also have /proc/[pid]/syscall, so we can look through
277 // |actual_crashing_pid|'s thread group and find the thread that's in the
278 // read syscall with the right arguments.
279
280 std::string expected_syscall_data;
281 // /proc/[pid]/syscall is formatted as follows:
282 // syscall_number arg1 ... arg6 sp pc
283 // but we just check syscall_number through arg3.
284 base::StringAppendF(&expected_syscall_data, "%d 0x%x %p 0x1 ",
285 SYS_read, tid_fd, tid_buf_addr);
286 bool syscall_supported = false;
287 pid_t crashing_tid =
288 base::FindThreadIDWithSyscall(crashing_pid,
289 expected_syscall_data,
290 &syscall_supported);
291 if (crashing_tid == -1) {
292 // We didn't find the thread we want. Maybe it didn't reach
293 // sys_read() yet or the thread went away. We'll just take a
294 // guess here and assume the crashing thread is the thread group
295 // leader. If procfs syscall is not supported by the kernel, then
296 // we assume the kernel also does not support TID namespacing and
297 // trust the TID passed by the crashing process.
298 LOG(WARNING) << "Could not translate tid - assuming crashing thread is "
299 "thread group leader; syscall_supported=" << syscall_supported;
300 crashing_tid = crashing_pid;
301 }
302
303 ExceptionHandler::CrashContext* bad_context =
304 reinterpret_cast<ExceptionHandler::CrashContext*>(crash_context);
305 bad_context->tid = crashing_tid;
306
307 // Sanitize the string data a bit more
308 guid[kGuidSize] = crash_url[kMaxActiveURLSize] = distro[kDistroSize] = 0;
309
310 // Freed in CrashDumpTask();
311 BreakpadInfo* info = new BreakpadInfo;
312
313 info->process_type_length = process_type_.length();
314 char* process_type_str = new char[info->process_type_length + 1];
315 process_type_.copy(process_type_str, info->process_type_length);
316 process_type_str[info->process_type_length] = '\0';
317 info->process_type = process_type_str;
318
319 info->crash_url_length = strlen(crash_url);
320 info->crash_url = crash_url;
321
322 info->guid_length = strlen(guid);
323 info->guid = guid;
324
325 info->distro_length = strlen(distro);
326 info->distro = distro;
327 #if defined(OS_ANDROID)
328 // Nothing gets uploaded in android.
329 info->upload = false;
330 #else
331 info->upload = (getenv(env_vars::kHeadless) == NULL);
332 #endif
333 info->process_start_time = uptime;
334 info->oom_size = oom_size;
335
336 BrowserThread::PostTask(
337 BrowserThread::FILE, FROM_HERE,
338 base::Bind(&CrashHandlerHostLinux::WriteDumpFile,
339 base::Unretained(this),
340 info,
341 crashing_pid,
342 crash_context,
343 signal_fd));
344 }
345
346 void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info,
347 pid_t crashing_pid,
348 char* crash_context,
349 int signal_fd) {
350 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
351
352 FilePath dumps_path("/tmp");
353 PathService::Get(base::DIR_TEMP, &dumps_path);
354 if (!info->upload)
355 PathService::Get(chrome::DIR_CRASH_DUMPS, &dumps_path);
356 const uint64 rand = base::RandUint64();
357 const std::string minidump_filename =
358 base::StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp",
359 dumps_path.value().c_str(),
360 process_type_.c_str(),
361 rand);
362 if (!google_breakpad::WriteMinidump(minidump_filename.c_str(),
363 crashing_pid, crash_context,
364 kCrashContextSize)) {
365 LOG(ERROR) << "Failed to write crash dump for pid " << crashing_pid;
366 }
367 delete[] crash_context;
368
369 // Freed in CrashDumpTask();
370 char* minidump_filename_str = new char[minidump_filename.length() + 1];
371 minidump_filename.copy(minidump_filename_str, minidump_filename.length());
372 minidump_filename_str[minidump_filename.length()] = '\0';
373 info->filename = minidump_filename_str;
374 info->pid = crashing_pid;
375
376 BrowserThread::PostTask(
377 BrowserThread::IO, FROM_HERE,
378 base::Bind(&CrashHandlerHostLinux::QueueCrashDumpTask,
379 base::Unretained(this),
380 info,
381 signal_fd));
382 }
383
384 void CrashHandlerHostLinux::QueueCrashDumpTask(BreakpadInfo* info,
385 int signal_fd) {
386 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
387
388 // Send the done signal to the process: it can exit now.
389 struct msghdr msg = {0};
390 struct iovec done_iov;
391 done_iov.iov_base = const_cast<char*>("\x42");
392 done_iov.iov_len = 1;
393 msg.msg_iov = &done_iov;
394 msg.msg_iovlen = 1;
395
396 (void) HANDLE_EINTR(sendmsg(signal_fd, &msg, MSG_DONTWAIT | MSG_NOSIGNAL));
397 (void) HANDLE_EINTR(close(signal_fd));
398
399 uploader_thread_->message_loop()->PostTask(
400 FROM_HERE,
401 base::Bind(&CrashDumpTask, base::Unretained(this), info));
402 }
403
404 void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
405 file_descriptor_watcher_.StopWatchingFileDescriptor();
406
407 // If we are quitting and there are crash dumps in the queue, turn them into
408 // no-ops.
409 shutting_down_ = true;
410 uploader_thread_->Stop();
411 }
412
413 bool CrashHandlerHostLinux::IsShuttingDown() const {
414 return shutting_down_;
415 }
416
417 ExtensionCrashHandlerHostLinux::ExtensionCrashHandlerHostLinux() {
418 InitCrashUploaderThread();
419 }
420
421 ExtensionCrashHandlerHostLinux::~ExtensionCrashHandlerHostLinux() {
422 }
423
424 void ExtensionCrashHandlerHostLinux::SetProcessType() {
425 process_type_ = "extension";
426 }
427
428 // static
429 ExtensionCrashHandlerHostLinux* ExtensionCrashHandlerHostLinux::GetInstance() {
430 return Singleton<ExtensionCrashHandlerHostLinux>::get();
431 }
432
433 GpuCrashHandlerHostLinux::GpuCrashHandlerHostLinux() {
434 InitCrashUploaderThread();
435 }
436
437 GpuCrashHandlerHostLinux::~GpuCrashHandlerHostLinux() {
438 }
439
440 void GpuCrashHandlerHostLinux::SetProcessType() {
441 process_type_ = "gpu-process";
442 }
443
444 // static
445 GpuCrashHandlerHostLinux* GpuCrashHandlerHostLinux::GetInstance() {
446 return Singleton<GpuCrashHandlerHostLinux>::get();
447 }
448
449 PluginCrashHandlerHostLinux::PluginCrashHandlerHostLinux() {
450 InitCrashUploaderThread();
451 }
452
453 PluginCrashHandlerHostLinux::~PluginCrashHandlerHostLinux() {
454 }
455
456 void PluginCrashHandlerHostLinux::SetProcessType() {
457 process_type_ = "plugin";
458 }
459
460 // static
461 PluginCrashHandlerHostLinux* PluginCrashHandlerHostLinux::GetInstance() {
462 return Singleton<PluginCrashHandlerHostLinux>::get();
463 }
464
465 PpapiCrashHandlerHostLinux::PpapiCrashHandlerHostLinux() {
466 InitCrashUploaderThread();
467 }
468
469 PpapiCrashHandlerHostLinux::~PpapiCrashHandlerHostLinux() {
470 }
471
472 void PpapiCrashHandlerHostLinux::SetProcessType() {
473 process_type_ = "ppapi";
474 }
475
476 // static
477 PpapiCrashHandlerHostLinux* PpapiCrashHandlerHostLinux::GetInstance() {
478 return Singleton<PpapiCrashHandlerHostLinux>::get();
479 }
480
481 RendererCrashHandlerHostLinux::RendererCrashHandlerHostLinux() {
482 InitCrashUploaderThread();
483 }
484
485 RendererCrashHandlerHostLinux::~RendererCrashHandlerHostLinux() {
486 }
487
488 void RendererCrashHandlerHostLinux::SetProcessType() {
489 process_type_ = "renderer";
490 }
491
492 // static
493 RendererCrashHandlerHostLinux* RendererCrashHandlerHostLinux::GetInstance() {
494 return Singleton<RendererCrashHandlerHostLinux>::get();
495 }
OLDNEW
« no previous file with comments | « chrome/browser/crash_handler_host_linuxish.h ('k') | chrome/browser/crash_handler_host_linuxish_stub.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698